Network attack and defense decision support method and system based on artificial intelligence

Abstract

The present invention provides a network attack and defense decision support method and system based on artificial intelligence, which relates to the field of network attack and defense technology, including obtaining network topology information and equipment configuration information, building a digital twin model of the network environment, collecting network traffic data and security logs, using a deep learning model to extract features, generating a network security situation assessment report, using a graph neural network to analyze the attack spectrum, identifying target nodes and generating an initial defense strategy set, based on the effectiveness evaluation results of the defense strategy, using a multi-objective optimization algorithm to generate multiple candidate defense schemes, performing security and feasibility analysis on the candidate defense schemes, selecting the optimal defense scheme, refining the optimal defense scheme into specific implementation steps, generating alternative schemes to deal with different attack situations, presenting the optimal defense scheme and the alternative schemes through a visual interface, and providing a decision-making basis and a risk assessment report.

Description

Technical Field

[0001] The present invention relates to network attack and defense technology, and in particular to an artificial intelligence-based network attack and defense decision support method and system. Background Art

[0002] With the rapid development of network information technology, network security issues are becoming increasingly serious. Traditional network security defense methods mainly rely on manual experience and rule settings. Facing complex and ever-changing network attacks, it is often difficult to formulate defense strategies in a timely and effective manner.

[0003] In the prior art, there are some network security decision support systems, such as those that generate risk scores and priority lists of remedial measures by evaluating factors such as asset importance and vulnerability severity. However, this method does not fully consider the attack path and network topology, and the generated defense strategy is not targeted enough. Therefore, the network security decision support methods in the prior art still have problems such as insufficient attack and defense strategy analysis, lack of effective strategy evaluation and dynamic optimization mechanism, and are difficult to cope with increasingly complex network security threats. Summary of the invention

[0004] The embodiments of the present invention provide a network attack and defense decision support method and system based on artificial intelligence, which can solve the problems in the prior art.

[0005] According to a first aspect of the embodiments of the present invention,

[0006] Provided is a network attack and defense decision support method based on artificial intelligence, including:

[0007] Obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, use deep learning models to extract features, generate a network security situation assessment report, and based on the network security situation assessment report and the preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map;

[0008] Analyze the attack graph using a graph neural network, identify target nodes and generate an initial defense strategy set, apply the initial defense strategy set to the network environment digital twin model, conduct multiple rounds of attack and defense drills through a generative adversarial network, and evaluate the effectiveness of each defense strategy;

[0009] Based on the effectiveness evaluation results of the defense strategy, a multi-objective optimization algorithm is used to generate multiple candidate defense plans, and the security and feasibility analysis of the candidate defense plans is performed to select the optimal defense plan. The optimal defense plan is broken down into specific implementation steps, including equipment configuration adjustment, network architecture optimization, and security policy update. At the same time, a scenario analysis is performed on the optimal defense plan to generate alternative plans to deal with different attack situations. The optimal defense plan and alternative plans are presented through a visual interface, and a decision-making basis and risk assessment report are provided.

[0010] In an optional embodiment,

[0011] Obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, use deep learning models to extract features, generate a network security situation assessment report, and based on the network security situation assessment report and the preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map including:

[0012] Collect network topology information and device configuration information, obtain device model, operating system version, and open port information through active detection protocols, obtain network traffic data through passive monitoring, extract account information and security policy information, and build a multi-level network environment digital twin model including physical layer, network layer, application layer, and data layer;

[0013] Based on the multi-level network environment digital twin model, network traffic data and security logs are continuously collected, traffic metadata features and log multi-dimensional features are extracted, time series anomaly detection algorithms are used to identify abnormal traffic patterns, multivariate correlation analysis methods are used to detect abnormal event associations, network topology structures are converted into low-dimensional vector representations through graph embedding algorithms, and global network security situation features are extracted using graph neural network models;

[0014] Calculate asset importance weights, threat frequency coefficients, vulnerability distribution density and attack intensity index, build a quantitative assessment matrix for network security situation, use the analytic hierarchy process to calculate subjective weights, and use the entropy weight method to calculate objective weights. Take the weighted average of subjective weights and objective weights to get the comprehensive weights. Calculate the network security situation score based on the comprehensive weights and generate a network security situation assessment report.

[0015] Based on the network security situation assessment report, a network attack and defense domain knowledge graph is constructed, system vulnerabilities, misconfigurations, weak passwords, and access control defects are represented as nodes and relationships in the network attack and defense domain knowledge graph, and ontology reasoning rules are used to expand the attack and defense knowledge;

[0016] The network attack process is modeled as a Markov decision process, and the state space, action space and transition probability are defined. A multi-objective reward function that includes attack success rate, resource consumption and concealment is designed. The attack and defense knowledge in the network attack and defense domain knowledge graph is used to initialize the strategy network. The attack decision is iteratively optimized through a deep reinforcement learning algorithm to generate the optimal attack path and attack graph.

[0017] In an optional embodiment,

[0018] The attack and defense knowledge in the network attack and defense domain knowledge graph is used to initialize the strategy network, and the attack decision is iteratively optimized through the deep reinforcement learning algorithm to generate the optimal attack path and attack graph, including:

[0019] Based on the network attack and defense domain knowledge graph, the causal dependency between attack and defense behaviors is extracted through causal discovery and causal reasoning techniques to construct a causal knowledge graph, where nodes represent attack and defense entities and directed edges represent causal effects.

[0020] Use graph neural networks to learn the network attack and defense domain knowledge graph and causal knowledge graph, obtain the feature representation of knowledge, including the embedded representation of nodes and the embedded representation of relationships, and build a hierarchical policy network, including a top-level policy network and a bottom-level policy network. The top-level policy network selects the target attack phase, and the bottom-level policy network selects the specific attack atomic action.

[0021] Initializing the policy network using the feature representation of the knowledge, aligning the input layer of the top policy network with the embedded representation of the attack phase node, and aligning the input layer of the bottom policy network with the embedded representation of the attack atomic action node;

[0022] When the policy network infers the attack decision, the current environment state is mapped to the corresponding node in the network attack and defense domain knowledge graph, a causal subgraph under the current environment state is constructed, and the causal subgraph is input into the initialized policy network to infer the optimal attack action. At the same time, combined with the knowledge graph correlation index, the policy network is optimized to obtain the optimized attack strategy, and the optimized attack strategy is updated to the network attack and defense domain knowledge graph and the causal knowledge graph. Based on the optimized policy network, the updated network attack and defense domain knowledge graph and the causal knowledge graph, the optimal attack path and attack graph are generated.

[0023] In an optional embodiment,

[0024] The initial defense strategy set is applied to the digital twin model of the network environment, and multiple rounds of attack and defense drills are conducted through the adversarial generative network to evaluate the effectiveness of each defense strategy, including:

[0025] In the digital twin model of the network environment, a defense game model is constructed, in which the game participants include the behaviors of the attacker and the defender, and the strategy space and profit function are defined, and the initial defense strategy set is applied to the defense game model;

[0026] Design a scheduling algorithm to monitor the computing resources, storage space, and network status of virtual nodes in the digital twin model of the network environment in real time, obtain monitoring data, and dynamically adjust the deployment and status of defense components in the initial defense strategy set based on the monitoring data to obtain an adjusted defense strategy set;

[0027] Use the adversarial generative network to conduct multiple rounds of attack and defense drills in the digital twin model of the network environment to simulate the attack and defense confrontation process. In the simulated attack and defense confrontation process, the defense nodes are set as distributed participants, and the distributed defense strategy is calculated by sharing intelligence and working together between the defense nodes.

[0028] A multi-stage game model is adopted to divide the simulated attack and defense confrontation process into multiple stages. The local optimal strategy is analyzed in each stage to obtain the stage-by-stage analysis results. According to the stage-by-stage analysis results, the attacker's next behavior is inferred, and the distributed defense strategy is adjusted accordingly to form an optimized defense strategy. The optimized defense strategy is quantitatively analyzed to evaluate the effectiveness of each defense strategy and finally obtain the evaluation results.

[0029] In an optional embodiment,

[0030] The adversarial generative network is used to conduct multiple rounds of attack and defense drills in the digital twin model of the network environment to simulate the attack and defense confrontation process. In the simulated attack and defense confrontation process, the defense nodes are set as distributed participants. Through the sharing of intelligence and collaborative work between defense nodes, the distributed defense strategy is calculated, including:

[0031] Establish a federated learning framework, which includes multiple defense nodes and a central server, wherein the defense nodes include firewalls and intrusion detection systems, and each defense node trains a local model based on its own collected local data, wherein the local model is a deep neural network, and local model parameters are obtained by minimizing the loss function, and the local model parameters are encrypted by a homomorphic encryption algorithm to obtain encrypted local model parameters;

[0032] Each defense node uploads the encrypted local model parameters to the central server through a secure communication protocol. The central server receives and verifies the integrity and authenticity of the encrypted local model parameters uploaded by each defense node, and performs weighted average of the encrypted local model parameters according to the amount of data of each defense node to generate global model parameters. The central server distributes the global model parameters to each defense node.

[0033] The defense node receives the global model parameters as initialization parameters, uses local data to fine-tune the model for the initialization parameters, obtains updated local model parameters, repeats iterations until a preset iteration termination condition is met, and obtains the final joint model parameters. At the same time, in the digital twin model of the network environment, multiple rounds of attack and defense drills are performed using the adversarial generative network, and the initial distributed defense strategy is calculated based on the final joint model parameters and the attack and defense drill results.

[0034] Each defense node updates the local defense model based on the final joint model parameters and the initial distributed defense strategy, and uses the updated local defense model to perform anomaly detection and attack identification on real-time network traffic to obtain detection results. The central server coordinates the formulation and implementation of a global defense strategy based on the detection results of each defense node and the attack and defense drill experience in the digital twin model of the network environment to achieve distributed network defense. The digital twin model of the network environment is updated according to the actual defense effect, and the process of using the generative adversarial network to conduct multiple rounds of attack and defense drills to update the digital twin model of the network environment is repeated to continuously optimize the generated distributed network defense strategy.

[0035] In an optional embodiment,

[0036] Based on the effectiveness evaluation results of the defense strategy, a multi-objective optimization algorithm is used to generate multiple candidate defense solutions, and the security and feasibility of the candidate defense solutions are analyzed. The optimal defense solution is selected, including:

[0037] Build a multi-source heterogeneous data fusion platform to collect and integrate firewall logs, intrusion detection system records, network traffic monitoring data, terminal behavior logs and threat intelligence data in real time, and synchronize the collected multi-source heterogeneous data through dynamic time warping algorithms to form a pre-processed multidimensional data set;

[0038] Using the preprocessed multidimensional data set, a hierarchical autoencoder network structure is designed to perform feature extraction and dimensionality reduction, and a high-dimensional feature vector is constructed. Based on the high-dimensional feature vector, a hybrid model of a long short-term memory network and a graph convolutional network is used to perform time series analysis and topological relationship modeling on the high-dimensional feature vector, learn network behavior patterns and attack characteristics, and generate a network behavior model;

[0039] Using the network behavior model, combined with a hybrid approach of case-based reasoning and expert system, a defense knowledge base is constructed, historical cases similar to the current network behavior pattern are retrieved from the pre-constructed defense knowledge base, and an initial set of candidate defense solutions is generated by applying expert-defined heuristic rules through a rule engine;

[0040] Construct a multi-objective optimization model, take defense effect, resource consumption, false alarm rate and system performance as optimization targets, apply the improved non-dominated sorting genetic algorithm to the initial candidate defense solution set for multi-objective optimization, obtain the target optimal solution set, and design a security assessment framework based on knowledge graph, integrate expert knowledge and historical cases, evaluate each candidate solution in the target optimal solution set, generate evaluation results, and calculate the comprehensive evaluation score of each candidate solution based on the evaluation results;

[0041] A multi-level indicator system is designed. For each candidate solution, based on the calculated comprehensive evaluation score, its membership in each indicator is calculated, and the fuzzy comprehensive evaluation method is used to obtain the final quantitative score. The solution with the highest final quantitative score is selected as the optimal defense solution.

[0042] In an optional embodiment,

[0043] The formula for calculating the comprehensive evaluation score of each candidate solution based on the evaluation results is as follows:

[0044]

[0045] Among them, Score(x) represents the comprehensive evaluation score of candidate solution x, λ represents the trade-off coefficient, n represents the number of evaluation indicators, and w i represents the weight of the i-th evaluation indicator, μ i (x) represents the membership value of candidate solution x on the i-th evaluation index, β represents the adjustment parameter, K(x) represents the similarity between candidate solution x and historical successful defense measures, m represents the number of objective functions, and α a represents the weight coefficient of the ath objective function, f a (x) represents the score of candidate solution x on the ath objective function, represents the maximum value of all candidate solutions on the ath objective function, y j It represents the jth solution among the candidate solutions, and p represents the nonlinear degree of controlling different objective combinations.

[0046] According to a second aspect of the embodiments of the present invention,

[0047] Provided is a network attack and defense decision support system based on artificial intelligence, including:

[0048] The first unit is used to obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, extract features using a deep learning model, generate a network security situation assessment report, and based on the network security situation assessment report and a preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map;

[0049] The second unit is used to analyze the attack graph using a graph neural network, identify target nodes and generate an initial defense strategy set, apply the initial defense strategy set to the network environment digital twin model, conduct multiple rounds of attack and defense drills through a generative adversarial network, and evaluate the effectiveness of each defense strategy;

[0050] The third unit is used to generate multiple candidate defense plans based on the effectiveness evaluation results of the defense strategy using a multi-objective optimization algorithm, conduct security and feasibility analysis on the candidate defense plans, select the optimal defense plan, and refine the optimal defense plan into specific implementation steps, including equipment configuration adjustment, network architecture optimization, and security policy update. At the same time, a scenario analysis is conducted on the optimal defense plan to generate alternative plans to deal with different attack situations, present the optimal defense plan and alternative plans through a visual interface, and provide decision-making basis and risk assessment report.

[0051] According to a third aspect of the embodiments of the present invention,

[0052] An electronic device is provided, comprising:

[0053] processor;

[0054] a memory for storing processor-executable instructions;

[0055] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0056] A fourth aspect of the embodiments of the present invention is:

[0057] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0058] In this embodiment, by constructing a digital twin model of the network environment, the network topology and device configuration are accurately depicted, providing a real and reliable environmental foundation for the attack and defense strategy analysis. Deep learning is used to extract network security situation features, and potential attack paths are simulated through reinforcement learning and attack graph analysis to achieve a comprehensive assessment of network security risks. The initial defense strategy set is generated by using a graph neural network, and attack and defense drills are conducted through an adversarial generation network in a digital twin environment to achieve a quantitative evaluation of the effectiveness of the defense strategy. A multi-objective optimization algorithm is introduced to dynamically optimize the defense plan, while ensuring security and taking into account the feasibility of strategy implementation, improving the comprehensive benefits of the defense strategy, generating specific executable implementation steps according to the optimal defense plan, and providing alternative plans for different attack situations to enhance the flexibility and adaptability of the defense system. The attack and defense decision analysis results are presented through a visual interface, and decision-making basis and risk assessment reports are provided to provide intuitive and explainable auxiliary decision support for network administrators. By making full use of artificial intelligence technology, intelligent analysis of network security situation, automatic generation and optimization of attack and defense strategies are realized. Compared with traditional methods, the intelligence level and real-time response capability of network security defense are greatly improved, providing an effective solution to cope with increasingly complex network security challenges. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A flowchart of a network attack and defense decision support method based on artificial intelligence according to an embodiment of the present invention;

[0060] Figure 2 Schematic diagram of the structure of the network attack and defense decision support system based on artificial intelligence according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0063] Figure 1 FIG. 1 is a flow chart of a network attack and defense decision support method based on artificial intelligence according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0064] S101. Obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, use deep learning models to extract features, generate a network security situation assessment report, and based on the network security situation assessment report and the preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map.

[0065] Among them, network topology discovery technology obtains the connection relationship and configuration information of devices in the network, including device type, IP address, open port, operating system, etc., by combining active detection and passive monitoring. Using the collected network topology and device configuration information, a digital twin model that is highly consistent with the physical network environment is built. This model not only reflects the static composition of the network, but also dynamically presents the operation status of the network by synchronizing network traffic and security events in real time.

[0066] Using deep learning algorithms, we extract multi-dimensional features from traffic and log data, such as the source and destination IP addresses, protocol types, packet length distribution, etc. of traffic, and the event type, occurrence time, source address, destination address, etc. of logs. We analyze multi-source heterogeneous data through correlation, characterize the security status of the network, and generate a global security situation assessment report.

[0067] Based on a comprehensive digital twin model of the network environment, starting from known vulnerabilities and attack surfaces, the reinforcement learning algorithm is used to simulate the attacker's intrusion path. The attacker constantly tries to exploit the system's vulnerabilities through trial and error to find possible breakthroughs. The reinforcement learning agent obtains environmental feedback, evaluates the benefits of the current attack action, adjusts the strategy, and finally finds one or more possible attack paths. The graph composed of attack paths is the attack map, which intuitively shows the connection between the vulnerabilities and the security risks faced by the network.

[0068] In an optional embodiment,

[0069] Obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, use deep learning models to extract features, generate a network security situation assessment report, and based on the network security situation assessment report and the preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map including:

[0070] Collect network topology information and device configuration information, obtain device model, operating system version, and open port information through active detection protocols, obtain network traffic data through passive monitoring, extract account information and security policy information, and build a multi-level network environment digital twin model including physical layer, network layer, application layer, and data layer;

[0071] Based on the multi-level network environment digital twin model, network traffic data and security logs are continuously collected, traffic metadata features and log multi-dimensional features are extracted, time series anomaly detection algorithms are used to identify abnormal traffic patterns, multivariate correlation analysis methods are used to detect abnormal event associations, network topology structures are converted into low-dimensional vector representations through graph embedding algorithms, and global network security situation features are extracted using graph neural network models;

[0072] Calculate asset importance weights, threat frequency coefficients, vulnerability distribution density and attack intensity index, build a quantitative assessment matrix for network security situation, use the analytic hierarchy process to calculate subjective weights, and use the entropy weight method to calculate objective weights. Take the weighted average of subjective weights and objective weights to get the comprehensive weights. Calculate the network security situation score based on the comprehensive weights and generate a network security situation assessment report.

[0073] Based on the network security situation assessment report, a network attack and defense domain knowledge graph is constructed, system vulnerabilities, misconfigurations, weak passwords, and access control defects are represented as nodes and relationships in the network attack and defense domain knowledge graph, and ontology reasoning rules are used to expand the attack and defense knowledge;

[0074] The network attack process is modeled as a Markov decision process, and the state space, action space and transition probability are defined. A multi-objective reward function that includes attack success rate, resource consumption and concealment is designed. The attack and defense knowledge in the network attack and defense domain knowledge graph is used to initialize the strategy network. The attack decision is iteratively optimized through a deep reinforcement learning algorithm to generate the optimal attack path and attack graph.

[0075] Exemplarily, first of all, the core of this technical solution is to build a multi-level digital twin model of the network environment as the basis for subsequent network security situation analysis and attack and defense decision-making. In order to build this digital twin model, it is necessary to comprehensively collect network topology information and device configuration information. Among them, network topology information includes the connection relationship between devices, network hierarchy, etc., which can be automatically obtained through network discovery protocols such as LLDP and CDP. Device configuration information includes device model, operating system version, open ports, account information, security policy, etc., which can be obtained through active detection protocols such as SNMP, SSH, etc., or by passively monitoring network traffic data to extract relevant information.

[0076] After collecting enough network environment information, a multi-level digital twin model of the network environment can be constructed. The model contains four levels: physical layer, network layer, application layer, and data layer, which correspond to different perspectives and abstract levels of the network environment. The physical layer describes the physical connection relationship and geographical distribution of the device; the network layer describes the network logical structure such as IP address, subnet division, routing protocol, etc.; the application layer describes the end-to-end business application and service dependency; the data layer describes the data asset distribution and data flow in the network. Through this multi-level modeling, all aspects of the network environment can be fully reflected, providing a fine-grained environmental view for subsequent security analysis.

[0077] After building a digital twin model of the network environment, network traffic data and security logs can be continuously collected based on the model to monitor and evaluate the network security situation in real time. Specifically, traffic metadata features can be extracted from the original traffic data, such as the source and destination IP, destination IP, port number, protocol type, number of bytes, number of packets, duration, etc. These features can characterize the pattern and behavior of network traffic. At the same time, multi-dimensional features such as event type, severity, timestamp, source and destination IP, destination IP, etc. can be extracted from the logs generated by various security devices such as firewalls and intrusion detection systems. These features can reflect various security events that occur in the network.

[0078] After obtaining the traffic metadata features and log multi-dimensional features, machine learning algorithms can be applied to analyze the network security situation. For traffic data, time series anomaly detection algorithms can be used, such as autoencoder-based anomaly detection, LSTM-based anomaly detection, etc., to identify abnormal traffic by learning the pattern of normal traffic. For security event logs, multivariate correlation analysis methods can be used to explore the correlation between features of different dimensions, detect interrelated abnormal events, and reveal the attack chain behind security events.

[0079] In addition, the graph embedding algorithm can be used to convert the network topology into a low-dimensional vector representation, and the network nodes can be mapped into a low-dimensional space, so that the structural relationship between the nodes can be preserved. Based on the graph embedding representation, the graph neural network model can be further used to learn the feature representation of the nodes through the message passing mechanism, aggregate the local network structure and security situation information, and extract the global network security situation characteristics.

[0080] After obtaining the multi-dimensional quantitative indicators of the network security situation, we can further construct a network security situation assessment matrix. This matrix comprehensively considers multiple dimensions such as asset importance, threat frequency, vulnerability distribution, and attack intensity, and each dimension has a quantitative weight coefficient. Among them, asset importance reflects the importance of different network assets to the business, and different weights can be assigned according to factors such as asset type and business; threat frequency reflects the frequency of different types of security incidents, which can be obtained based on historical data statistics; vulnerability distribution reflects the density of vulnerabilities such as loopholes, weak passwords, and misconfigurations in the network, which can be measured through vulnerability scanning, configuration verification, etc.; attack intensity reflects the intensity of the attack on the network, which can be evaluated by combining threat intelligence, honeypot trapping, and other means.

[0081] When constructing the evaluation matrix, the hierarchical analysis method can be used to invite network security experts to compare the importance of each dimension in pairs and obtain the weight distribution of subjective judgment. At the same time, the entropy weight method can also be used to calculate the objective importance weight based on the discrete degree of each dimension indicator. By taking the weighted average of the subjective weight and the objective weight, a comprehensive weight distribution scheme can be obtained, and then the scores of each dimension are weighted and summarized to finally obtain the quantitative score of the network security situation and generate a network security situation assessment report.

[0082] Based on the results of network security situation assessment, we can further construct a knowledge graph in the field of network attack and defense, and formalize the attack and defense entities and relationships. The nodes in the knowledge graph can be attack and defense elements such as system vulnerabilities, device types, configuration items, password policies, access control, etc. The relationship between nodes can characterize the semantic connections such as dependency, causality, inheritance, etc. between elements. For example, the "CVE-2020-1234" node is used to represent a specific vulnerability, and the "JSF framework" node is used to represent a Web application framework. There is an "influence" relationship between the two; the "weak password" node is used to represent a vulnerability, and the "FTP service" node is used to represent an application service. There is a "threat" relationship between the two.

[0083] After constructing a preliminary network attack and defense knowledge graph, we can further use ontology reasoning rules to expand more attack and defense knowledge. For example, we can define the rule "If a web application has a remote code execution vulnerability and the web application is open to external access, it may lead to the server being taken over." Through such reasoning rules, we can dig out implicit attack paths. For another example, we can define the rule "If a host has multiple high-risk vulnerabilities at the same time and lacks effective patch management, the security risk of the host is extremely high." Through such reasoning rules, we can identify high-risk assets in the network.

[0084] After acquiring rich network attack and defense knowledge, the attack process can be modeled as a Markov decision process to simulate the attack behavior from the attacker's perspective. The Markov decision process consists of state space, action space, state transition probability and reward function. Among them, the state space corresponds to the various attack stages in the attack process, such as reconnaissance, scanning, obtaining access rights, escalating permissions, lateral penetration, etc.; the action space corresponds to the specific attack methods that the attacker can take at each stage, such as social engineering, vulnerability exploitation, password blasting, backdoor implantation, etc.; the state transition probability describes the probability of successfully entering the next stage after taking a certain action in the current attack stage; the reward function describes the benefits of taking different actions at different stages, and it is necessary to comprehensively consider factors such as attack success rate, attack resource consumption, and attack concealment.

[0085] Based on the Markov decision process, a deep reinforcement learning algorithm can be used to learn the optimal strategy for attack decisions through continuous trial and error and feedback. Specifically, the Deep Q-Learning algorithm can be used to approximate the action-value function through a neural network to evaluate the long-term benefits of taking a specific action under a given state. At the same time, the attack and defense knowledge in the network attack and defense knowledge graph can be used to initialize the parameters of the neural network, provide prior knowledge to the learning algorithm, and accelerate the strategy search process. In addition, technologies such as time difference learning, experience replay, and dual networks can be added to improve the stability and sample efficiency of the reinforcement learning algorithm.

[0086] Through multiple rounds of iterative training, the reinforcement learning agent can gradually master the optimal strategy for attack decision-making. In the testing phase, the agent can automatically plan the optimal attack path by simply inputting information about the target network environment.

[0087] In this embodiment, through multi-level network environment modeling, the physical connection, logical topology, business dependency, data flow and other perspectives in the network are comprehensively portrayed, providing a full range of environmental perception capabilities for security analysis. By introducing cutting-edge machine learning technologies such as time series anomaly detection, multivariate association, and graph neural networks, security situation features are automatically extracted from massive, heterogeneous network data, overcoming the inefficiency and omissions of manual analysis. A combination of hierarchical analysis method and entropy weight method is adopted to reasonably allocate the importance weights of each security indicator, and finally obtain a quantitative security score for specific business scenario needs, helping enterprises to accurately control their own security levels. Construct a knowledge graph in the field of network attack and defense, and expand implicit knowledge through ontology reasoning, empower intelligent decision-making with knowledge, so that the attack path generated by the system is closer to the behavior pattern of real APT groups. Through the concept of data-driven and knowledge-driven, it can flexibly adapt to different network environments and security needs, with good versatility and scalability.

[0088] In an optional embodiment,

[0089] The attack and defense knowledge in the network attack and defense domain knowledge graph is used to initialize the strategy network, and the attack decision is iteratively optimized through the deep reinforcement learning algorithm to generate the optimal attack path and attack graph, including:

[0090] Based on the network attack and defense domain knowledge graph, the causal dependency between attack and defense behaviors is extracted through causal discovery and causal reasoning techniques to construct a causal knowledge graph, where nodes represent attack and defense entities and directed edges represent causal effects.

[0091] Use graph neural networks to learn the network attack and defense domain knowledge graph and causal knowledge graph, obtain the feature representation of knowledge, including the embedded representation of nodes and the embedded representation of relationships, and build a hierarchical policy network, including a top-level policy network and a bottom-level policy network. The top-level policy network selects the target attack phase, and the bottom-level policy network selects the specific attack atomic action.

[0092] Initializing the policy network using the feature representation of the knowledge, aligning the input layer of the top policy network with the embedded representation of the attack phase node, and aligning the input layer of the bottom policy network with the embedded representation of the attack atomic action node;

[0093] When the policy network infers the attack decision, the current environment state is mapped to the corresponding node in the network attack and defense domain knowledge graph, a causal subgraph under the current environment state is constructed, and the causal subgraph is input into the initialized policy network to infer the optimal attack action. At the same time, combined with the knowledge graph correlation index, the policy network is optimized to obtain the optimized attack strategy, and the optimized attack strategy is updated to the network attack and defense domain knowledge graph and the causal knowledge graph. Based on the optimized policy network, the updated network attack and defense domain knowledge graph and the causal knowledge graph, the optimal attack path and attack graph are generated.

[0094] For example, first, we need to build a comprehensive and accurate network attack and defense knowledge graph. This knowledge graph uses nodes to represent various attack and defense entities, such as vulnerabilities, attack methods, defense measures, attack targets, etc., and uses directed edges to represent semantic relationships between entities, such as "exploit", "defense", "belong to", etc. Through natural language processing technology, these entities and relationships can be automatically extracted from massive unstructured data such as security knowledge bases, vulnerability databases, attack and defense blogs, and the results of manual combing can be integrated to finally obtain a high-quality attack and defense knowledge graph.

[0095] On the basis of the attack and defense knowledge graph, causal discovery and causal reasoning techniques are further used to explore the causal dependency between attack and defense behaviors. Causal relationships are different from general correlations. They describe the decisive influence between things. For example, the existence of vulnerabilities is the reason why attack behaviors occur, and patching is a means to eliminate vulnerabilities and block the attack chain. Through causal analysis, a causal knowledge graph can be constructed, in which nodes still represent attack and defense entities, but directed edges represent causal effects. This causal knowledge can help understand the internal mechanism of attack and defense behaviors and predict the development trend of attack events.

[0096] After obtaining the attack and defense knowledge represented by the knowledge graph, it is necessary to empower it into the intelligent attack decision algorithm. Here, a hierarchical deep reinforcement learning framework is adopted to realize knowledge-driven strategy optimization through graph neural network. Specifically, the attack and defense knowledge graph and the causal knowledge graph are represented and learned using graph neural network. The graph neural network can aggregate the attribute features of the nodes and the relationship semantics on the edges, update the hidden state of the nodes through the message passing mechanism, and finally obtain the embedded representation of the nodes and the embedded representation of the relationships.

[0097] These knowledge embedded representations can be used to initialize a hierarchical policy network. The policy network consists of two levels. The top-level policy network is responsible for selecting the current attack stage, such as reconnaissance, scanning, obtaining access rights, escalating privileges, and lateral penetration. The bottom-level policy network is responsible for selecting specific attack atomic actions under a given attack stage, such as social engineering, vulnerability exploitation, password cracking, and backdoor implantation. The connection between the knowledge graph and the policy network is established by aligning the input layer of the top-level policy network with the embedding vector of the attack stage node and the input layer of the bottom-level policy network with the embedding vector of the attack atomic action node. This is equivalent to each decision node in the policy network corresponding to an entity node in the knowledge graph, and the decision-making process can utilize the knowledge carried by the node.

[0098] In the process of inferring attack decisions by the policy network, the current state of the environment is first mapped to the corresponding node in the attack and defense knowledge graph. This step can be achieved by matching the substructure of the graph. Then, with the node as the center, a local causal subgraph is extracted to depict the causal context in the current environment. By inputting the causal subgraph into the policy network that has been initialized by knowledge embedding, the optimal attack action can be inferred. The optimal action here is not only conducive to achieving the current attack goal, but also tries to avoid triggering alarms and being discovered by the defense system.

[0099] At the same time, in the process of training the policy network through reinforcement learning, not only the reward signal of environmental feedback is used, but also the knowledge graph relevance index is used to optimize the policy. For example, the importance and centrality of the candidate attack action node in the knowledge graph can be calculated as a reference for judging the quality of the action. The semantic relevance and coherence between the candidate action and the executed action sequence can also be examined to avoid generating unreasonable attack paths. By integrating environmental rewards and knowledge indicators, more comprehensive evaluation feedback can be obtained to guide the optimization of the policy network.

[0100] When the policy network learns an optimized attack strategy, it can also feed back to the knowledge graph to form a closed loop. Specifically, the optimized strategy execution trajectory and the new knowledge obtained from the evaluation process can be updated to the original network attack and defense knowledge graph and causal knowledge graph. For example, new attack path instances can be added, the importance weights of existing attack and defense entities can be adjusted, and even hidden attack surfaces can be mined based on new causal dependencies. These updated knowledge graphs can be used to support subsequent attack decisions.

[0101] Finally, based on the optimized policy network and updated knowledge graph, the attack path and attack graph can be automatically generated to intuitively present the entire attack process. The attack path depicts the evolution of the attack action over time, reflecting the penetration trajectory from the initial foothold to the final target. The attack graph uses nodes to represent target assets, access rights, and attack actions, and edges to represent attack path fragments, visually showing the distribution of attacks in the network topology.

[0102] In this embodiment, the knowledge graph is enabled to the deep reinforcement learning policy network using a graph neural network, so that the attack decision is no longer a black box exploration, but incorporates prior attack and defense knowledge, and the policy learning becomes more efficient and explainable. Through the hierarchical policy network, the attack decision is planned and refined from top to bottom, so that the autonomous attack system can flexibly choose actions at the strategic and tactical levels to cope with complex and changing network environments. The causal knowledge graph is combined with the policy network, the effect of the attack action is predicted through causal reasoning, and the policy network is guided to make causally consistent action selections to avoid generating unreasonable attack paths. In the process of knowledge-driven policy learning, the knowledge graph is dynamically expanded and optimized, and new attack and defense knowledge is continuously accumulated, so that the knowledge base can keep pace with the times and adapt to the ever-changing network security situation. Formalizing the network attack process into a time-series attack path and mapping it to the attack graph not only helps to trace the source and analyze the security incidents that have occurred, but also intuitively presents the full picture of complex attacks.

[0103] S102. Analyze the attack graph using a graph neural network, identify target nodes and generate an initial defense strategy set, apply the initial defense strategy set to the digital twin model of the network environment, conduct multiple rounds of attack and defense drills through a generative adversarial network, and evaluate the effectiveness of each defense strategy.

[0104] In response to the problems revealed by the aforementioned attack graph, the graph neural network algorithm identified key weak links such as terminal protection, border protection, and identity authentication. Generate an initial defense strategy, including deploying the EDR (Endpoint Detection and Response) terminal detection and response platform, improving firewall strategies, and upgrading bastion hosts. After multiple rounds of attack and defense drills, the EDR platform can intercept malicious email attachments, the firewall can block C&C communications, and the bastion host can strengthen auditing. Ultimately, a set of defense solutions that take into account both practicality and effectiveness is formed: deploy lightweight EDR Agents on terminals across the entire network to detect suspicious behaviors in a timely manner; add high-performance threat intelligence firewalls at the Internet border, link with cloud intelligence libraries, and accurately block malicious traffic; sort out and optimize remote operation and maintenance channels, unify management and control strategies, and enhance identity authentication strength. This solution can avoid the security threats of botnets to the greatest extent.

[0105] In an optional embodiment,

[0106] The initial defense strategy set is applied to the digital twin model of the network environment, and multiple rounds of attack and defense drills are conducted through the adversarial generative network to evaluate the effectiveness of each defense strategy, including:

[0107] In the digital twin model of the network environment, a defense game model is constructed, in which the game participants include the behaviors of the attacker and the defender, and the strategy space and profit function are defined, and the initial defense strategy set is applied to the defense game model;

[0108] Design a scheduling algorithm to monitor the computing resources, storage space, and network status of virtual nodes in the digital twin model of the network environment in real time, obtain monitoring data, and dynamically adjust the deployment and status of defense components in the initial defense strategy set based on the monitoring data to obtain an adjusted defense strategy set;

[0109] Use the adversarial generative network to conduct multiple rounds of attack and defense drills in the digital twin model of the network environment to simulate the attack and defense confrontation process. In the simulated attack and defense confrontation process, the defense nodes are set as distributed participants, and the distributed defense strategy is calculated by sharing intelligence and working together between the defense nodes.

[0110] A multi-stage game model is adopted to divide the simulated attack and defense confrontation process into multiple stages. The local optimal strategy is analyzed in each stage to obtain the stage-by-stage analysis results. According to the stage-by-stage analysis results, the attacker's next behavior is inferred, and the distributed defense strategy is adjusted accordingly to form an optimized defense strategy. The optimized defense strategy is quantitatively analyzed to evaluate the effectiveness of each defense strategy and finally obtain the evaluation results.

[0111] For example, first, it is necessary to build an accurate and real-time digital twin model of the network environment. A digital twin is a virtual copy of a physical system that synchronizes the state changes of physical entities in real time through sensor data. In the field of network security, digital twins can be used to reproduce network topology, host nodes, security devices and other elements, and reflect their configuration, performance and security status in real time. Through this mapping, the real network attack and defense process can be simulated in a digital twin environment without touching the physical system.

[0112] Based on the digital twin environment, a defense game model is constructed. The game model consists of three key elements: participants, strategy space, and profit function. The participants here include defenders, i.e., security devices and monitoring tools in the network, and attackers, i.e., malicious programs and hackers. The strategy space of each participant defines a series of optional actions, such as the filtering rules of the firewall and the feature library of the intrusion detection system. The profit function measures the benefits that the participants can obtain under a given combination of attack and defense strategies, such as improved system security and attack costs. The defense game model takes a set of initial defense strategies as input, and the optimal combination of defense strategies can be obtained by solving the game equilibrium.

[0113] However, the network environment is dynamically changing, and fixed defense strategies are difficult to cope with complex and changing attacks. Therefore, it is also necessary to design an online scheduling optimization algorithm to monitor the various indicators of digital twin nodes in real time and dynamically adjust the defense strategy. Specifically, by deploying monitoring probes on virtual nodes, performance indicators such as the node's CPU, memory usage, storage space occupancy, network delay, packet loss rate, and security indicators such as security events and threat intelligence can be collected. The scheduling algorithm analyzes the aggregated monitoring data and adaptively adjusts the deployment location and working parameters of each defense component. For example, when it is detected that some nodes become performance bottlenecks, the defense task can be offloaded to nodes with sufficient resources; when it is detected that some attack features appear frequently, the IDS feature library, that is, the intrusion detection system (IDS), can be dynamically updated to improve detection accuracy. After scheduling optimization, a set of dynamically updated defense strategies can be obtained.

[0114] In order to verify the effectiveness of dynamic defense strategies in real attack and defense confrontation, the adversarial generative network technology is introduced to automatically generate a large number of attack and defense adversarial samples in the digital twin environment. The adversarial generative network consists of two neural networks that compete with each other. One acts as a generator, responsible for generating attack traffic, and the other acts as a discriminator, responsible for identifying whether the generated traffic is an attack. Through repeated confrontation between the generator and the discriminator, the fidelity of the attack traffic can be continuously enhanced, while the discrimination ability of the defense model can be improved. The adversarially generated attack and defense samples are input into the digital twin environment to simulate a network attack and defense process that is close to reality.

[0115] In the process of simulating attack and defense, a distributed defense architecture is further adopted. Each defense node in the digital twin environment is set as a distributed participant, and trusted intelligence sharing and collaborative operations are realized through blockchain technology. For example, when a node detects a new threat feature, the intelligence can be written into the blockchain so that other nodes can perceive it in real time; multiple nodes can reach a consensus on suspected threats based on smart contracts and jointly deploy joint defense measures. Under the distributed architecture, defense nodes protect privacy data while exchanging intelligence; while exerting their respective expertise, they achieve the global optimal collaborative defense and improve the overall defense effectiveness.

[0116] Considering that network attack and defense in reality is often a multi-stage process, this solution adopts a multi-stage game model to divide and analyze the attack and defense confrontation process in time. For example, an APT (Advanced Persistent Threat) attack can be divided into reconnaissance, initial access, privilege escalation, lateral penetration and other stages, each of which corresponds to different attack methods and defense measures. The simulated attack and defense confrontation data is divided into stages and put into the multi-stage game model to analyze the local optimal defense strategy for each stage. Then, based on the analysis results of the current stage and considering the evolution trend of attack technology, the attack behavior in the next stage can be predicted and the defense strategy can be actively adjusted. After cross-stage dynamic game analysis, a set of systematic progressive optimization defense strategies can be obtained.

[0117] Finally, the optimized defense strategy is quantitatively evaluated. By designing a series of security indicators, such as the number of vulnerabilities that can be reduced, the types of attacks that can be detected, and the average time to block attacks, the effectiveness of each defense sub-strategy is scored. The real attack and defense data set is replayed in the digital twin environment, and various quantitative indicators are counted. The evaluation results are visualized to intuitively show the pros and cons of different defense strategies. On the one hand, quantitative evaluation provides an objective basis for the selection and deployment of defense strategies, and on the other hand, it also provides improvement directions for the continuous optimization of strategies.

[0118] In this embodiment, through a highly simulated digital twin environment, the network security status is synchronized in real time, and massive multi-source security data is analyzed based on intelligent algorithms to gain insight into the network security situation from a global perspective, supporting accurate tracing and early warning. Integrating cutting-edge theories such as game theory, adversarial learning, and multi-agent reinforcement learning, using real and simulated attack and defense knowledge, continuously optimizing defense strategies, and realizing active adaptation and dynamic defense against unknown threats. Blockchain networking is adopted to give decentralized security components the ability to collaborate with trust, and on the premise of ensuring data privacy, real-time threat intelligence sharing, linkage disposal, tracing and evidence collection are realized, thereby improving the overall defense effectiveness. A multi-stage game model is introduced to decompose the attack and defense confrontation in time sequence, focusing on the key control points of each stage, forming a systematic in-depth defense idea from perception, analysis to disposal, and globally coordinating security resources. Constructing strategy evaluation indicators covering multiple dimensions such as attack and defense effects, costs, and performance, using a combination of simulation verification and actual measurement methods to quantitatively analyze strategy configurations, and provide visual decision support to promote the refinement of security management.

[0119] In an optional embodiment,

[0120] The adversarial generative network is used to conduct multiple rounds of attack and defense drills in the digital twin model of the network environment to simulate the attack and defense confrontation process. In the simulated attack and defense confrontation process, the defense nodes are set as distributed participants. Through the sharing of intelligence and collaborative work between defense nodes, the distributed defense strategy is calculated, including:

[0121] Establish a federated learning framework, which includes multiple defense nodes and a central server, wherein the defense nodes include firewalls and intrusion detection systems, and each defense node trains a local model based on its own collected local data, wherein the local model is a deep neural network, and local model parameters are obtained by minimizing the loss function, and the local model parameters are encrypted by a homomorphic encryption algorithm to obtain encrypted local model parameters;

[0122] Each defense node uploads the encrypted local model parameters to the central server through a secure communication protocol. The central server receives and verifies the integrity and authenticity of the encrypted local model parameters uploaded by each defense node, and performs weighted average of the encrypted local model parameters according to the amount of data of each defense node to generate global model parameters. The central server distributes the global model parameters to each defense node.

[0123] The defense node receives the global model parameters as initialization parameters, uses local data to fine-tune the model for the initialization parameters, obtains updated local model parameters, repeats iterations until a preset iteration termination condition is met, and obtains the final joint model parameters. At the same time, in the digital twin model of the network environment, multiple rounds of attack and defense drills are performed using the adversarial generative network, and the initial distributed defense strategy is calculated based on the final joint model parameters and the attack and defense drill results.

[0124] Each defense node updates the local defense model based on the final joint model parameters and the initial distributed defense strategy, and uses the updated local defense model to perform anomaly detection and attack identification on real-time network traffic to obtain detection results. The central server coordinates the formulation and implementation of a global defense strategy based on the detection results of each defense node and the attack and defense drill experience in the digital twin model of the network environment to achieve distributed network defense. The digital twin model of the network environment is updated according to the actual defense effect, and the process of using the generative adversarial network to conduct multiple rounds of attack and defense drills to update the digital twin model of the network environment is repeated to continuously optimize the generated distributed network defense strategy.

[0125] For example, in the process of establishing a federated learning framework, it is first necessary to design and implement a system architecture that includes multiple defense nodes and a central server. Defense nodes include security devices such as firewalls and intrusion detection systems, which perform their own local model training by collecting and processing local data. The local model adopts a deep neural network structure and adjusts the model parameters by continuously minimizing the loss function, so that it can effectively identify and detect abnormal behaviors and potential attacks in the network.

[0126] During the training process, each defense node will calculate local model parameters based on its own data volume and model performance, and encrypt these parameters using a homomorphic encryption algorithm. This encryption process prevents the leakage of sensitive information during data transmission, while ensuring the integrity and authenticity of the data. The encrypted local model parameters are uploaded to the central server through a secure communication protocol.

[0127] After receiving the encrypted local model parameters uploaded by each defense node, the central server needs to verify the integrity and authenticity of these parameters to ensure the reliability of the uploaded data. After verification, the central server performs a weighted average of the encrypted local model parameters based on the amount of data from each node to generate global model parameters. This global model parameter is then distributed to all defense nodes as the initialization parameter for a new round of local model training.

[0128] After receiving the global model parameters, the defense node combines them with local data to fine-tune the model. This process further optimizes the local model parameters by re-training with local data. This process is repeated until the preset iteration termination condition is reached, thus forming the final joint model parameters. In this process, the defense node can effectively integrate knowledge from different nodes and improve the generalization ability and accuracy of the model.

[0129] In the digital twin model of the network environment, multiple rounds of attack and defense drills are conducted in combination with the adversarial generative network to simulate actual attack scenarios. This drill aims to verify the effectiveness of the model and calculate the initial distributed defense strategy based on the drill results and the final joint model parameters. Based on this strategy, each defense node will update its own local defense model to detect anomalies and identify attacks on network traffic in real time. The detection results will be fed back to the central server, which will coordinate the formulation and implementation of a global defense strategy based on the attack and defense drill experience in the digital twin model of the network environment.

[0130] According to the actual defense effect, the central server will update the digital twin model of the network environment and repeat the process of attack and defense drills through the adversarial generation network to continuously optimize the generated distributed network defense strategy. This dynamic update mechanism ensures that the system can maintain efficient defense capabilities in the face of ever-changing network threats.

[0131] In this embodiment, the accuracy and robustness of the defense model are improved, and false positives and missed positives are reduced; secondly, data privacy protection is achieved by using federated learning, so that each defense node can jointly improve its defense capabilities without sharing sensitive data; in addition, the attack and defense drill mechanism based on the adversarial generative network enables the defense system to more effectively respond to complex attacks in the real world and quickly adapt to new threats; finally, through dynamic updates and continuous optimization, the flexibility and adaptability of the system in changes in the network environment are ensured.

[0132] S103. Based on the effectiveness evaluation results of the defense strategy, a multi-objective optimization algorithm is used to generate multiple candidate defense plans, and the security and feasibility analysis of the candidate defense plans is performed to select the optimal defense plan. The optimal defense plan is refined into specific implementation steps, including equipment configuration adjustment, network architecture optimization and security policy update. At the same time, a scenario analysis is performed on the optimal defense plan to generate alternative plans to deal with different attack situations. The optimal defense plan and alternative plans are presented through a visual interface, and a decision-making basis and a risk assessment report are provided.

[0133] In an optional embodiment,

[0134] Based on the effectiveness evaluation results of the defense strategy, a multi-objective optimization algorithm is used to generate multiple candidate defense solutions, and the security and feasibility of the candidate defense solutions are analyzed. The optimal defense solution is selected, including:

[0135] Build a multi-source heterogeneous data fusion platform to collect and integrate firewall logs, intrusion detection system records, network traffic monitoring data, terminal behavior logs and threat intelligence data in real time, and synchronize the collected multi-source heterogeneous data through dynamic time warping algorithms to form a pre-processed multidimensional data set;

[0136] Using the preprocessed multidimensional data set, a hierarchical autoencoder network structure is designed to perform feature extraction and dimensionality reduction, and a high-dimensional feature vector is constructed. Based on the high-dimensional feature vector, a hybrid model of a long short-term memory network and a graph convolutional network is used to perform time series analysis and topological relationship modeling on the high-dimensional feature vector, learn network behavior patterns and attack characteristics, and generate a network behavior model;

[0137] Using the network behavior model, combined with a hybrid approach of case-based reasoning and expert system, a defense knowledge base is constructed, historical cases similar to the current network behavior pattern are retrieved from the pre-constructed defense knowledge base, and an initial set of candidate defense solutions is generated by applying expert-defined heuristic rules through a rule engine;

[0138] Construct a multi-objective optimization model, take defense effect, resource consumption, false alarm rate and system performance as optimization targets, apply the improved non-dominated sorting genetic algorithm to the initial candidate defense solution set for multi-objective optimization, obtain the target optimal solution set, and design a security assessment framework based on knowledge graph, integrate expert knowledge and historical cases, evaluate each candidate solution in the target optimal solution set, generate evaluation results, and calculate the comprehensive evaluation score of each candidate solution based on the evaluation results;

[0139] A multi-level indicator system is designed. For each candidate solution, based on the calculated comprehensive evaluation score, its membership in each indicator is calculated, and the fuzzy comprehensive evaluation method is used to obtain the final quantitative score. The solution with the highest final quantitative score is selected as the optimal defense solution.

[0140] First, it is necessary to build a multi-source heterogeneous data fusion platform to realize the collection, cleaning and integration of network security big data. The platform brings together log data scattered in various security devices and systems, such as firewall logs, intrusion detection alarms, network traffic metadata, terminal operation records, etc. At the same time, the platform also needs to continuously collect external threat intelligence, such as malicious domain names, malicious IPs, malware features, etc. Since these heterogeneous data have different sources and formats, especially the difference in timestamps, it will affect the subsequent correlation analysis. Therefore, the platform needs to design a set of dynamic time warping algorithms to adaptively calibrate the timestamps of various data sources to a unified time axis. The calibrated data is integrated into a unified multidimensional data set, providing a data foundation for intelligent analysis.

[0141] Then, we use the preprocessed multidimensional data set to build a deep neural network model to extract high-dimensional feature representations of network behavior. Specifically, we use a layered autoencoder network structure to automatically extract abstract features from raw data through unsupervised learning and achieve dimensionality reduction compression. For example, for raw network traffic data, the autoencoder can learn to extract high-level features such as communication frequency and traffic surges. For the administrator's operation log, the autoencoder can characterize the statistical characteristics of operation time and operation objects. By stacking autoencoders layer by layer, heterogeneous data is eventually mapped to a high-dimensional semantic feature space.

[0142] Based on the extracted high-dimensional features, a composite neural network model is designed, integrating the characteristics of long short-term memory network (LSTM) and graph convolution network (GCN), to model the temporal characteristics and topological relationships of network behavior respectively. Among them, LSTM is good at mining the long-term dependencies of multi-dimensional time series data, which can characterize the evolution law of network behavior in the time dimension and capture the phased characteristics of various continuous attacks. GCN is good at processing graph-structured data, which can model the complex interaction relationship between network entities and discover coordinated anomalies and group attacks. The composite model takes high-dimensional features as input and forms a digital representation of network behavior, namely the network behavior vector, through end-to-end training. When new data arrives, the model can be used to judge its abnormality and attack type in real time.

[0143] On this basis, a set of composite defense knowledge reasoning mechanisms is constructed. First, the case-based reasoning (CBR) method is used to mine massive historical data, extract key information from successful attack and defense confrontation cases, such as attack characteristics, defense measures, effect evaluation, etc., and form a structured case library. After the current network behavior vector is input, the CBR system searches the case library to find the historical cases most similar to the current behavior, and extracts candidate defense measures from them. At the same time, a rule-based expert system is introduced to summarize the experience of security experts into a set of heuristic rules, such as detection thresholds for DDoS attacks and best practices for cross-domain identity authentication. The expert system uses the candidate solutions extracted by CBR as input, performs logical reasoning and constraint solving through the rule engine, further screens and optimizes the defense measures, and forms a set of candidate defense solutions that meet specific constraints.

[0144] Considering the multi-objective characteristics of network security management, a multi-objective optimization model is constructed for the above candidate defense solution set. Maximizing the attack detection rate, minimizing resource consumption, and minimizing the false alarm rate are taken as optimization objectives to form a multi-objective combinatorial optimization problem. Conventional multi-objective evolutionary algorithms such as NSGAII have slow convergence speed in high-dimensional search space. Therefore, on the basis of NSGAII, heuristic initialization, adaptive mutation and other mechanisms are introduced, and an improved non-dominated sorting genetic algorithm is proposed, which improves the optimization efficiency while ensuring the diversity of solutions. Through multi-objective optimization, a set of non-dominated solutions with balanced performance is searched from the candidate set, that is, the target optimal solution set.

[0145] Finally, the optimal solution set is quantitatively evaluated. Traditional security assessments rely on expert experience and are highly subjective. This solution designs an evaluation framework based on knowledge graphs, which formalizes multi-dimensional indicators such as defense effect, implementation cost, ease of use, and the logical relationship between indicators into a security assessment ontology. In the knowledge graph, concept nodes represent various indicators, relationship edges characterize the influence dependence between indicators, and weights reflect the expert's judgment on the importance of indicators. For each scheme to be evaluated, its attribute values ​​such as defense effect prediction value and resource consumption budget are linked to the knowledge graph to form a subgraph of a specific scheme. Through ontology reasoning, the attribute values ​​are aggregated, and the expert judgment is calibrated to finally form a comprehensive evaluation score for the scheme. On this basis, the hierarchical analysis method is further introduced to construct a multi-level comprehensive evaluation index system, and combined with fuzzy set theory, the satisfaction degree of each candidate scheme for each evaluation indicator is quantitatively described by membership function, and finally the final score of each scheme is obtained through fuzzy weighted summation. The scheme with the highest score is the global optimal defense scheme.

[0146] In an optional embodiment,

[0147] The formula for calculating the comprehensive evaluation score of each candidate solution based on the evaluation results is as follows:

[0148]

[0149] Among them, Score(x) represents the comprehensive evaluation score of candidate solution x, λ represents the trade-off coefficient, n represents the number of evaluation indicators, and w i represents the weight of the i-th evaluation indicator, μ i (x) represents the membership value of candidate solution x on the i-th evaluation index, β represents the adjustment parameter, K(x) represents the similarity between candidate solution x and historical successful defense measures, m represents the number of objective functions, and α a represents the weight coefficient of the ath objective function, f a (x) represents the score of candidate solution x on the ath objective function, represents the maximum value of all candidate solutions on the ath objective function, y j It represents the jth solution among the candidate solutions, and p represents the nonlinear degree of controlling different objective combinations.

[0150] In this embodiment, multi-source heterogeneous data is deeply mined through machine learning algorithms, key features in attack and defense confrontation are automatically extracted, behavioral models for specific attack types are constructed, knowledge is formed with data, reliance on expert experience is reduced, and the efficiency of knowledge base construction is improved. And through knowledge reasoning technology, the extracted knowledge is matched with online data streams in real time, and knowledge is used to guide security decisions, realizing the automated process from data to knowledge and then to decision-making. Through graph neural network and other technologies, multi-source heterogeneous information of the entire network is associated, the context of attack events is deeply portrayed, more hidden attack behaviors are captured, and rule blind spots are reduced. Multi-objective intelligent optimization technology is introduced, and the defense strategy selection is modeled as a multi-objective combination optimization problem. Through the improved evolutionary algorithm search and solution, the optimal defense combination that meets multiple security and performance constraints is adaptively found, and dynamically adjusted according to environmental changes, so as to achieve the continuous evolution of defense strategies. Based on the security assessment framework of knowledge graph, a multi-dimensional quantitative indicator system is established, expert experience is integrated, security status is visually displayed, qualitative judgment is combined with quantitative calculation, and the rigor of the assessment process and the credibility of the assessment results are enhanced. On the basis of automated analysis, we focus on the introduction of security experts' experience and interactive feedback. Through an explainable reasoning mechanism and a visual interface, we help security personnel quickly understand the system output and provide decision correction and optimization suggestions. The feedback from security experts can flow back to continuously optimize the system model. Through this human-machine collaborative and closed-loop optimization operation model, the intelligence level of threat discovery, response, and defense can be significantly improved.

[0151] Figure 2 FIG. 1 is a schematic diagram of the structure of a network attack and defense decision support system based on artificial intelligence according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0152] The first unit is used to obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, extract features using a deep learning model, generate a network security situation assessment report, and based on the network security situation assessment report and a preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map;

[0153] The second unit is used to analyze the attack graph using a graph neural network, identify target nodes and generate an initial defense strategy set, apply the initial defense strategy set to the network environment digital twin model, conduct multiple rounds of attack and defense drills through a generative adversarial network, and evaluate the effectiveness of each defense strategy;

[0154] The third unit is used to generate multiple candidate defense plans based on the effectiveness evaluation results of the defense strategy using a multi-objective optimization algorithm, conduct security and feasibility analysis on the candidate defense plans, select the optimal defense plan, and refine the optimal defense plan into specific implementation steps, including equipment configuration adjustment, network architecture optimization, and security policy update. At the same time, a scenario analysis is conducted on the optimal defense plan to generate alternative plans to deal with different attack situations, present the optimal defense plan and alternative plans through a visual interface, and provide decision-making basis and risk assessment report.

[0155] According to a third aspect of the embodiments of the present invention,

[0156] An electronic device is provided, comprising:

[0157] processor;

[0158] a memory for storing processor-executable instructions;

[0159] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0160] A fourth aspect of the embodiments of the present invention is:

[0161] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0162] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0163] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network attack and defense decision support method based on artificial intelligence, characterized in that: include: Obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, use deep learning models to extract features, generate a network security situation assessment report, and based on the network security situation assessment report and the preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map; Analyze the attack graph using a graph neural network, identify target nodes and generate an initial defense strategy set, apply the initial defense strategy set to the network environment digital twin model, conduct multiple rounds of attack and defense drills through a generative adversarial network, and evaluate the effectiveness of each defense strategy; Based on the effectiveness evaluation results of the defense strategy, a multi-objective optimization algorithm is used to generate multiple candidate defense plans, and the security and feasibility of the candidate defense plans are analyzed to select the optimal defense plan. The optimal defense plan is refined into specific implementation steps, including device configuration adjustment, network architecture optimization, and security policy update. At the same time, a scenario analysis is performed on the optimal defense plan to generate alternative plans to deal with different attack situations. The optimal defense plan and alternative plans are presented through a visual interface, and a decision-making basis and risk assessment report are provided; Obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, use deep learning models to extract features, generate a network security situation assessment report, and based on the network security situation assessment report and the preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map including: Collect network topology information and device configuration information, obtain device model, operating system version, and open port information through active detection protocols, obtain network traffic data through passive monitoring, extract account information and security policy information, and build a multi-level network environment digital twin model including physical layer, network layer, application layer, and data layer; Based on the multi-level network environment digital twin model, network traffic data and security logs are continuously collected, traffic metadata features and log multi-dimensional features are extracted, time series anomaly detection algorithms are used to identify abnormal traffic patterns, multivariate correlation analysis methods are used to detect abnormal event associations, network topology structures are converted into low-dimensional vector representations through graph embedding algorithms, and global network security situation features are extracted using graph neural network models; Calculate asset importance weights, threat frequency coefficients, vulnerability distribution density and attack intensity index, build a quantitative assessment matrix for network security situation, use the analytic hierarchy process to calculate subjective weights, and use the entropy weight method to calculate objective weights. Take the weighted average of subjective weights and objective weights to get the comprehensive weights. Calculate the network security situation score based on the comprehensive weights and generate a network security situation assessment report. Based on the network security situation assessment report, a network attack and defense domain knowledge graph is constructed, system vulnerabilities, misconfigurations, weak passwords, and access control defects are represented as nodes and relationships in the network attack and defense domain knowledge graph, and ontology reasoning rules are used to expand the attack and defense knowledge; The network attack process is modeled as a Markov decision process, the state space, action space and transition probability are defined, and a multi-objective reward function including attack success rate, resource consumption and concealment is designed. The attack and defense knowledge in the network attack and defense domain knowledge graph is used to initialize the strategy network, and the attack decision is iteratively optimized through the deep reinforcement learning algorithm to generate the optimal attack path and attack graph; The initial defense strategy set is applied to the digital twin model of the network environment, and multiple rounds of attack and defense drills are conducted through the adversarial generative network to evaluate the effectiveness of each defense strategy, including: In the digital twin model of the network environment, a defense game model is constructed, in which the game participants include the behaviors of the attacker and the defender, and the strategy space and profit function are defined, and the initial defense strategy set is applied to the defense game model; Design a scheduling algorithm to monitor the computing resources, storage space, and network status of virtual nodes in the digital twin model of the network environment in real time, obtain monitoring data, and dynamically adjust the deployment and status of defense components in the initial defense strategy set based on the monitoring data to obtain an adjusted defense strategy set; Use the adversarial generative network to conduct multiple rounds of attack and defense drills in the digital twin model of the network environment to simulate the attack and defense confrontation process. In the simulated attack and defense confrontation process, the defense nodes are set as distributed participants, and the distributed defense strategy is calculated by sharing intelligence and working together between the defense nodes. A multi-stage game model is adopted to divide the simulated attack and defense confrontation process into multiple stages. The local optimal strategy is analyzed in each stage to obtain the stage-by-stage analysis results. According to the stage-by-stage analysis results, the attacker's next behavior is inferred, and the distributed defense strategy is adjusted accordingly to form an optimized defense strategy. The optimized defense strategy is quantitatively analyzed to evaluate the effectiveness of each defense strategy and finally obtain the evaluation results.

2. The method according to claim 1, characterized in that The attack and defense knowledge in the network attack and defense domain knowledge graph is used to initialize the strategy network, and the attack decision is iteratively optimized through the deep reinforcement learning algorithm to generate the optimal attack path and attack graph, including: Based on the network attack and defense domain knowledge graph, the causal dependency between attack and defense behaviors is extracted through causal discovery and causal reasoning techniques to construct a causal knowledge graph, where nodes represent attack and defense entities and directed edges represent causal effects. Use graph neural networks to learn the network attack and defense domain knowledge graph and causal knowledge graph, obtain the feature representation of knowledge, including the embedded representation of nodes and the embedded representation of relationships, and build a hierarchical policy network, including a top-level policy network and a bottom-level policy network. The top-level policy network selects the target attack phase, and the bottom-level policy network selects the specific attack atomic action. Initializing the policy network using the feature representation of the knowledge, aligning the input layer of the top policy network with the embedded representation of the attack phase node, and aligning the input layer of the bottom policy network with the embedded representation of the attack atomic action node; When the policy network infers the attack decision, the current environment state is mapped to the corresponding node in the network attack and defense domain knowledge graph, a causal subgraph under the current environment state is constructed, and the causal subgraph is input into the initialized policy network to infer the optimal attack action. At the same time, combined with the knowledge graph correlation index, the policy network is optimized to obtain the optimized attack strategy, and the optimized attack strategy is updated to the network attack and defense domain knowledge graph and the causal knowledge graph. Based on the optimized policy network, the updated network attack and defense domain knowledge graph and the causal knowledge graph, the optimal attack path and attack graph are generated.

3. The method according to claim 1, characterized in that The adversarial generative network is used to conduct multiple rounds of attack and defense drills in the digital twin model of the network environment to simulate the attack and defense confrontation process. In the simulated attack and defense confrontation process, the defense nodes are set as distributed participants. Through the sharing of intelligence and collaborative work between defense nodes, the distributed defense strategy is calculated, including: Establish a federated learning framework, which includes multiple defense nodes and a central server, wherein the defense nodes include firewalls and intrusion detection systems, and each defense node trains a local model based on its own collected local data, wherein the local model is a deep neural network, and local model parameters are obtained by minimizing the loss function, and the local model parameters are encrypted by a homomorphic encryption algorithm to obtain encrypted local model parameters; Each defense node uploads the encrypted local model parameters to the central server through a secure communication protocol. The central server receives and verifies the integrity and authenticity of the encrypted local model parameters uploaded by each defense node, and performs weighted average of the encrypted local model parameters according to the amount of data of each defense node to generate global model parameters. The central server distributes the global model parameters to each defense node. The defense node receives the global model parameters as initialization parameters, uses local data to fine-tune the model for the initialization parameters, obtains updated local model parameters, repeats iterations until a preset iteration termination condition is met, and obtains the final joint model parameters. At the same time, in the digital twin model of the network environment, multiple rounds of attack and defense drills are performed using the adversarial generative network, and the initial distributed defense strategy is calculated based on the final joint model parameters and the attack and defense drill results. Each defense node updates the local defense model based on the final joint model parameters and the initial distributed defense strategy, and uses the updated local defense model to perform anomaly detection and attack identification on real-time network traffic to obtain detection results. The central server coordinates the formulation and implementation of a global defense strategy based on the detection results of each defense node and the attack and defense drill experience in the digital twin model of the network environment to achieve distributed defense. The digital twin model of the network environment is updated according to the actual defense effect, and the process of using the generative adversarial network to conduct multiple rounds of attack and defense drills to update the digital twin model of the network environment is repeated to continuously optimize the generated distributed defense strategy.

4. The method according to claim 1, characterized in that: Based on the effectiveness evaluation results of the defense strategy, a multi-objective optimization algorithm is used to generate multiple candidate defense solutions, and the security and feasibility of the candidate defense solutions are analyzed. The optimal defense solution is selected, including: Build a multi-source heterogeneous data fusion platform to collect and integrate firewall logs, intrusion detection system records, network traffic monitoring data, terminal behavior logs and threat intelligence data in real time, and synchronize the collected multi-source heterogeneous data through dynamic time warping algorithms to form a pre-processed multidimensional data set; Using the preprocessed multidimensional data set, a hierarchical autoencoder network structure is designed to perform feature extraction and dimensionality reduction, and a high-dimensional feature vector is constructed. Based on the high-dimensional feature vector, a hybrid model of a long short-term memory network and a graph convolutional network is used to perform time series analysis and topological relationship modeling on the high-dimensional feature vector, learn network behavior patterns and attack characteristics, and generate a network behavior model; Using the network behavior model, combined with a hybrid approach of case-based reasoning and expert system, a defense knowledge base is constructed, historical cases similar to the current network behavior pattern are retrieved from the pre-constructed defense knowledge base, and an initial set of candidate defense solutions is generated by applying expert-defined heuristic rules through a rule engine; Construct a multi-objective optimization model, take defense effect, resource consumption, false alarm rate and system performance as optimization targets, apply the improved non-dominated sorting genetic algorithm to the initial candidate defense solution set for multi-objective optimization, obtain the target optimal solution set, and design a security assessment framework based on knowledge graph, integrate expert knowledge and historical cases, evaluate each candidate solution in the target optimal solution set, generate evaluation results, and calculate the comprehensive evaluation score of each candidate solution based on the evaluation results; A multi-level indicator system is designed. For each candidate solution, based on the calculated comprehensive evaluation score, its membership in each indicator is calculated, and the fuzzy comprehensive evaluation method is used to obtain the final quantitative score. The solution with the highest final quantitative score is selected as the optimal defense solution.

5. The method according to claim 4, characterized in that The formula for calculating the comprehensive evaluation score of each candidate solution based on the evaluation results is as follows: Among them, Score(x) represents the comprehensive evaluation score of candidate solution x, λ represents the trade-off coefficient, n represents the number of evaluation indicators, and w i represents the weight of the i-th evaluation indicator, μ i (x) represents the membership value of candidate solution x on the i-th evaluation index, β represents the adjustment parameter, K(x) represents the similarity between candidate solution x and historical successful defense measures, m represents the number of objective functions, and α a represents the weight coefficient of the ath objective function, f a (x) represents the score of candidate solution x on the ath objective function, represents the maximum value of all candidate solutions on the ath objective function, y j It represents the jth solution among the candidate solutions, and p represents the nonlinear degree of controlling different objective combinations.

6. A network attack and defense decision support system based on artificial intelligence, used to implement the method described in any one of claims 1 to 5, characterized in that: include: The first unit is used to obtain network topology information and device configuration information, build a digital twin model of the network environment, collect network traffic data and security logs, extract features using a deep learning model, generate a network security situation assessment report, and based on the network security situation assessment report and a preset attack pattern library, use a reinforcement learning algorithm to simulate the attack path and generate an attack map; The second unit is used to analyze the attack graph using a graph neural network, identify target nodes and generate an initial defense strategy set, apply the initial defense strategy set to the network environment digital twin model, conduct multiple rounds of attack and defense drills through a generative adversarial network, and evaluate the effectiveness of each defense strategy; The third unit is used to generate multiple candidate defense plans based on the effectiveness evaluation results of the defense strategy using a multi-objective optimization algorithm, conduct security and feasibility analysis on the candidate defense plans, select the optimal defense plan, and refine the optimal defense plan into specific implementation steps, including equipment configuration adjustment, network architecture optimization, and security policy update. At the same time, a scenario analysis is conducted on the optimal defense plan to generate alternative plans to deal with different attack situations, present the optimal defense plan and alternative plans through a visual interface, and provide decision-making basis and risk assessment report.

7. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 5.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images