Network space anti-mapping method and device, computer equipment and storage medium

Abstract

The invention relates to a cyberspace anti-mapping method and device, computer equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: inputting real-time network flow data in a network space into a trained anomaly detection model, and determining an anomaly detection result of the network flow data; the anomaly detection model is obtained through training based on annotation data in a network security knowledge graph; if the abnormal detection result is abnormal, determining an abnormal mode corresponding to the abnormal request in the network flow data, analyzing the potential attack path according to the abnormal mode and a topological structure of a network space, and determining a predicted attack scheme; the exception request is an access request initiated by the network flow data whose exception detection result is exception to each piece of resource data in a network space; and updating the security policy based on the predicted attack scheme to obtain an updated security policy, and executing the security policy. By adopting the method, the surveying and mapping security of the network space can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a cyberspace anti-mapping method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] The Internet has become an essential part of our daily lives and work. However, cyber attackers use various vulnerabilities, abnormal software, and advanced persistent threats to continuously attack various network devices and systems, causing economic losses and information leaks.

[0003] Nowadays, cyber attackers can hide in the surveying and mapping activities of cyberspace, and carry out cyber attacks secretly in the name of cyberspace surveying and mapping. In related technologies, network security defense means are often limited to the detection and defense of static rules, which cannot effectively deal with the hidden cyber attacks in the surveying and mapping activities of cyberspace, resulting in insufficient security of network equipment and systems. Summary of the invention

[0004] Based on this, it is necessary to provide a cyberspace anti-mapping method, device, computer equipment, computer-readable storage medium and computer program product that can improve the security of network equipment and systems in response to the above-mentioned technical problems.

[0005] In a first aspect, the present application provides a cyberspace anti-mapping method. The method comprises:

[0006] Inputting the real-time network traffic data in the network space into a trained anomaly detection model to determine the anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph includes the abnormal resource data in the network space and the association relationship between the abnormal resource data;

[0007] If the anomaly detection result is abnormal, then determine the abnormal pattern corresponding to the abnormal request in the network traffic data, and analyze the potential attack path according to the abnormal pattern and the topological structure of the network space to determine the predicted attack plan; the abnormal request is an access request initiated by the network traffic data whose anomaly detection result is abnormal to each resource data in the network space;

[0008] The security policy is updated based on the predicted attack scenario to obtain an updated security policy, and the security policy is executed.

[0009] In one embodiment, before inputting the real-time network traffic data in the network space into the trained anomaly detection model and determining the anomaly detection result of the network traffic data, the method further includes:

[0010] Performing data preprocessing on the initial traffic data acquired in real time to obtain training traffic data, and marking the training traffic data based on the abnormal resource data in the network security knowledge graph and the association relationship between the abnormal resource data to obtain marked training traffic data;

[0011] Establishing a preset anomaly detection model, determining a loss value based on the training traffic data and the anomaly detection model, and determining gradient information of the anomaly detection model through a back propagation algorithm and the loss value;

[0012] The model parameters of the anomaly detection model are updated through the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to be executed until the model performance of the anomaly detection model meets the training end condition, thereby obtaining a trained anomaly detection model.

[0013] In one embodiment, before inputting the real-time network traffic data in the network space into the trained anomaly detection model and determining the anomaly detection result of the network traffic data, the method further includes:

[0014] Perform entity extraction and relationship extraction on the abnormal resource data obtained from the network security data source to obtain entities and relationships corresponding to the abnormal resource data, and determine the network security knowledge graph constituted by the abnormal resource data based on the entities and relationships;

[0015] Updating the network security knowledge graph based on the existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph;

[0016] According to the abnormal resource data in the network security knowledge graph, the marked normal and abnormal network traffic data are evaluated to determine the comprehensiveness evaluation result, completeness evaluation result and accuracy evaluation result of the network security knowledge graph on the marked normal and abnormal network traffic data; wherein the comprehensiveness evaluation result is used to represent the number of entities and relationships in the network security knowledge graph; the completeness evaluation result is used to represent whether the attributes of each entity in the network security knowledge graph are complete; the accuracy evaluation result is used to represent the evaluation index of the prediction model corresponding to the network security knowledge graph;

[0017] If at least one of the comprehensiveness assessment result, the integrity assessment result and the accuracy assessment result does not reach a preset standard value, the abnormal resource data in the network security knowledge graph is updated to obtain an updated network security knowledge graph.

[0018] In one embodiment, the method further comprises:

[0019] If the anomaly detection result is normal, determining fingerprint information of the system and application corresponding to the network traffic data;

[0020] Obfuscating the fingerprint information by at least one of adding random noise, deleting or modifying features, and encrypting features to obtain blurred fingerprint information;

[0021] Based on a random insertion or random position replacement strategy, the fuzzy fingerprint information is mixed with the network traffic data to obtain updated network traffic data.

[0022] In one embodiment, analyzing the potential attack path according to the abnormal pattern and the topological structure of the network space to determine the predicted attack plan includes:

[0023] According to the abnormal pattern, determining the invaded host in the topological structure of the network space or the external abnormal user as the attack starting point;

[0024] According to the UCT selection strategy, a subnode corresponding to the attack starting point is determined in the topological structure of the network space, and a new state corresponding to the subnode is generated;

[0025] Based on the new state, the child nodes are expanded until all child nodes are generated according to the new state, and a node tree consisting of the child nodes and the attack starting point is obtained;

[0026] According to a preset number of simulations, by randomly selecting actions, a process of each node in the node tree reaching a terminal state from a current state is simulated to obtain simulation statistical information corresponding to each node in the node tree;

[0027] According to the simulation statistical information and the topological structure of the node tree, an attack action with high expected benefits is determined as a predicted attack plan.

[0028] In one embodiment, the updating of the security policy based on the predicted attack scenario to obtain an updated security policy includes:

[0029] Determine the configured security policy as the current state in the simulated annealing policy, determine the cost function value of the current state, and determine the initial temperature and the termination temperature of the simulated annealing policy; the cost function value is determined based on the predicted attack scenario and the cost function of the security policy;

[0030] Based on the attack path and impact range in the predicted attack scheme, adjusting the parameters in the current state, mutating the current state, and determining the mutated candidate state and the cost function value corresponding to the candidate state;

[0031] Determine a difference between a cost function value of the current state and a cost function value of the candidate state, and if the difference satisfies a preset condition, determine the candidate state as the current state;

[0032] Returning to the step of adjusting the parameters in the current state based on the attack path and impact range in the predicted attack scheme, until the initial temperature drops to the termination temperature;

[0033] A state in which the cost function value is the minimum among the current states is determined, and the security policy is updated according to the state in which the cost function value is the minimum to obtain an updated security policy.

[0034] In a second aspect, the present application also provides a cyberspace anti-mapping device. The device comprises:

[0035] An anomaly detection module, used to input the real-time network traffic data in the network space into a trained anomaly detection model to determine the anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph contains the abnormal resource data in the network space and the association relationship between the abnormal resource data;

[0036] An attack prediction module, for determining an abnormal pattern corresponding to an abnormal request in the network traffic data if the abnormal detection result is abnormal, and analyzing potential attack paths according to the abnormal pattern and the topological structure of the network space to determine a predicted attack plan; the abnormal request is an access request initiated by the network traffic data whose abnormal detection result is abnormal to each resource data in the network space;

[0037] The policy updating module is used to update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

[0038] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first aspect are implemented.

[0039] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0040] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0041] The above-mentioned cyberspace reverse mapping method, device, computer equipment, storage medium and computer program product can detect the real-time network traffic data in the cyberspace, and can use the trained anomaly detection model to determine the anomaly detection result of the real-time network traffic data, and determine whether the network traffic data is abnormal. Since the trained anomaly detection model is trained based on the annotated data of the pre-constructed network security knowledge graph, and the network security knowledge graph contains the entities and associations of the abnormal resource data, the anomaly detection model can accurately detect whether the network traffic data is abnormal by relying on the abnormal resource data contained in the network security knowledge graph. In the case where the anomaly detection result is abnormal, the server can determine the abnormal request initiated in the abnormal network traffic data, and determine the abnormal pattern corresponding to the abnormal request, and then predict the potential attack path through the topological structure and abnormal pattern of the cyberspace, and obtain the predicted attack plan, so as to update the existing security policy through the predicted attack plan, obtain the updated security policy, and execute the updated security policy. Since the network traffic data in cyberspace is monitored and detected in real time, and when there are anomalies in the network traffic data, the server can predict the network attacks of criminals through the abnormal patterns of abnormal requests and obtain the predicted attack plans, thereby updating the security policies in real time and improving the defense accuracy of cyberspace anti-mapping, thereby improving the security of the server in the face of network attacks when responding to cyberspace mapping activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] FIG1 is a diagram of an application environment of a cyberspace reverse mapping method in one embodiment;

[0044] FIG2 is a schematic diagram of a process flow of a cyberspace reverse mapping method in one embodiment;

[0045] FIG3 is a schematic diagram of a cyberspace reverse mapping system in one embodiment;

[0046] FIG4 is a structural block diagram of a network space anti-mapping device in one embodiment;

[0047] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] The cyberspace anti-mapping method provided in the embodiment of the present application can be applied in the application environment shown in FIG. 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 can initiate a mapping request or an access request to the server 104, and the requests of multiple terminals 102 can be transmitted from each terminal 102 to the server 104 in the form of network traffic data. The server 104 can input the network traffic data of each terminal 102 in the cyberspace into the trained anomaly detection model, detect whether the network traffic data is abnormal, and determine the abnormal request corresponding to the abnormal network traffic data. The server 104 analyzes the abnormal request and determines the abnormal pattern corresponding to the abnormal request. The server 104 analyzes the potential attack path of the criminals according to the topological structure and abnormal pattern of the cyberspace, and obtains a predicted attack plan. The server 104 updates the existing security policy according to the predicted attack plan to obtain an updated security policy, so that the server 104 uses the updated security policy to detect the network traffic data. The server 104 may use security policies to monitor various surveying and mapping requests and access requests in the cyberspace, thereby improving the security of the server and network equipment.

[0050] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be implemented using an independent server or a server cluster consisting of multiple servers.

[0051] In an exemplary embodiment, as shown in FIG2 , a cyberspace reverse mapping method is provided, which is described by taking the method applied to the server 104 in FIG1 as an example, and includes the following steps S202 to S206. Among them:

[0052] Step S202, input the real-time network traffic data in the network space into the trained anomaly detection model to determine the anomaly detection result of the network traffic data.

[0053] Among them, the anomaly detection model is trained based on the labeled data in the network security knowledge graph; the network security knowledge graph contains abnormal resource data in cyberspace and the correlation relationship between abnormal resource data.

[0054] Specifically, the server monitors the real-time network traffic data in the network space, and inputs the real-time network traffic data into the trained anomaly detection model according to the preset window size. The anomaly detection model processes the network traffic data and identifies the anomaly detection results corresponding to each access request in the network traffic data. The anomaly detection model is trained by pre-labeled triples in the network security knowledge graph, and the triples contain all the data with anomalies in the recorded network space. The network traffic data of the preset window size may contain multiple access requests, and the access object and access content of each access request may be different. For each access request, the anomaly detection model can identify the anomaly detection results of each access request. The access request can be an abnormal request or a normal request.

[0055] In one example, the anomaly detection model can perform text processing on each access request, obtain the word vectors corresponding to each field in the access request, and determine the vector value of the access request as a whole based on the association between the word vectors in the network security knowledge graph, and determine the probability value of the access request being an abnormal request based on the similarity between the vector value and the abnormal request vector value. If the probability value is greater than a preset value, the access request is determined to be an abnormal request.

[0056] Step S204, if the anomaly detection result is abnormal, determine the abnormal pattern corresponding to the abnormal request in the network traffic data, and analyze the potential attack path according to the abnormal pattern and the topological structure of the network space to determine the predicted attack plan.

[0057] Among them, abnormal requests are access requests initiated to various resource data in cyberspace by network traffic data with abnormal detection results; abnormal patterns are behavioral patterns corresponding to multiple abnormal requests of the same execution subject in a continuous time period, and abnormal patterns are usually determined by statistical analysis and summary of multiple continuous abnormal requests of multiple same execution subjects. The topological structure includes a network structure with nodes as entities in cyberspace and multiple terminals, servers and other devices connected by edges. Potential attack paths are used to represent network paths that criminals may use to attack nodes in the topological structure. Predicted attack plans are used to represent specific attack plans initiated by criminals according to potential attack paths.

[0058] Specifically, the server monitors the real-time network traffic data according to the preset windows and determines the abnormal detection results of the access requests in each window. If the abnormal detection result is abnormal, the access request is determined to be an abnormal request, and the server obtains all access requests of the same execution subject in the access request in the adjacent windows in the preset window, and determines whether it is an abnormal access request. The server can match multiple abnormal requests corresponding to the same execution subject with the preset abnormal pattern to determine the abnormal pattern corresponding to the abnormal request in the network traffic data.

[0059] Based on this, the server establishes the actual attack path of the abnormal request in the topological structure of the network space according to the execution subject of the abnormal request, the request object and other information. The server predicts the potential attack path that may exist in the future through the actual attack path, topological structure and the movement trajectory of the abnormal pattern, and generates the predicted attack plan that the execution subject corresponding to the criminals may generate in the subsequent network traffic data under the potential attack path.

[0060] Step S206, updating the security policy based on the predicted attack scenario, obtaining an updated security policy, and executing the security policy.

[0061] Among them, the security policy is a real-time network protection strategy deployed in cyberspace. The security policy is used to monitor and securely process access requests issued by various execution entities in cyberspace. When criminals hide network attacks in access requests through cyberspace mapping, the security policy can identify the corresponding access requests and securely process the access requests, such as isolation or blocking.

[0062] Specifically, the server can analyze the execution subject, request object, potential attack path, actual attack path and other information in the predicted attack plan, adjust the parameters in the existing security policy, and obtain the updated security policy. At the same time, the server will synchronously deploy the updated security policy to the entire network space and execute the security policy in real time.

[0063] In the above-mentioned cyberspace reverse mapping method, by detecting the real-time network traffic data in the cyberspace, the trained anomaly detection model can be used to determine the anomaly detection result of the real-time network traffic data and determine whether the network traffic data is abnormal. Since the trained anomaly detection model is trained based on the annotated data of the pre-constructed network security knowledge graph, and the network security knowledge graph contains the entities and associations of the abnormal resource data, the anomaly detection model can accurately detect whether the network traffic data is abnormal by relying on the abnormal resource data contained in the network security knowledge graph. In the case where the anomaly detection result is abnormal, the server can determine the abnormal request initiated in the abnormal network traffic data, and determine the abnormal pattern corresponding to the abnormal request, and then predict the potential attack path through the topological structure and abnormal pattern of the cyberspace, and obtain the predicted attack plan, so as to update the existing security policy through the predicted attack plan, obtain the updated security policy, and execute the updated security policy. Since the network traffic data in cyberspace is monitored and detected in real time, and when there are anomalies in the network traffic data, the server can predict the network attacks of criminals through the abnormal patterns of abnormal requests and obtain the predicted attack plans, thereby updating the security policies in real time and improving the defense accuracy of cyberspace anti-mapping, thereby improving the security of the server in the face of network attacks when responding to cyberspace mapping activities.

[0064] In an exemplary embodiment, before the step of “inputting the real-time network traffic data in the network space into the trained anomaly detection model to determine the anomaly detection result of the network traffic data”, the method further includes:

[0065] The initial traffic data acquired in real time is preprocessed to obtain training traffic data, and the training traffic data is labeled based on the abnormal resource data and the association relationship between the abnormal resource data in the network security knowledge graph to obtain the labeled training traffic data; a preset anomaly detection model is established, and a loss value is determined based on the training traffic data and the anomaly detection model, and the gradient information of the anomaly detection model is determined through the back propagation algorithm and the loss value; the model parameters of the anomaly detection model are updated through the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to execute until the model performance of the anomaly detection model meets the training end conditions to obtain a trained anomaly detection model.

[0066] The initial traffic data is the traffic data obtained in multiple continuous preset windows when training the anomaly detection model. The training traffic data is the traffic data obtained after data preprocessing of the missing data in the initial traffic data on the basis of the initial traffic data. The anomaly detection model is a classification model based on machine learning, which can be a neural network model of different algorithms or a natural language processing model for text, and the embodiments of the present application do not make specific limitations.

[0067] Specifically, the server can select traffic data in multiple continuous preset windows in the historical time period as the initial traffic data, and determine the initial traffic data with abnormal requests and normal requests in multiple historical time periods. The server performs data preprocessing on the initial traffic data to ensure the uniform format of the initial traffic data, and deletes missing data and abnormal data to obtain preprocessed training traffic data. Based on this, the server marks the training traffic data of each historical time period through the abnormal resource data and the association relationship between the abnormal resource data recorded in the network security knowledge graph, and determines the label value corresponding to each group of access requests in the training traffic data.

[0068] The server can select a preset anomaly detection model according to the demand, and determine the loss value corresponding to the preset loss function in the anomaly detection model by controlling the hyperparameters of the anomaly detection model and the input labeled training traffic data. The server calculates the gradient information of the anomaly detection model in this round of training according to the back propagation algorithm and the loss value, and adjusts the model parameters corresponding to the internal structure in the anomaly detection model based on the gradient information and the hyperparameters, thereby completing a round of updates of the anomaly detection model and obtaining an updated anomaly detection model. The server can determine the model performance of the updated anomaly detection model. If the model performance meets the preset training end condition, the updated anomaly detection model is a trained anomaly detection model. If the model performance does not meet the preset training end condition, the step of determining the loss value of the loss function based on the training traffic data and the anomaly detection model is returned to execute, thereby adjusting the model parameters of the anomaly detection model multiple times until the updated anomaly detection model meets the training end condition and obtains a trained anomaly detection model.

[0069] In this embodiment, by preprocessing the initial traffic data and marking the training traffic data, the data quality of the training traffic data can be improved, and the effect of training the anomaly detection model can be improved. The server can improve the application effect of the anomaly detection model after training by repeatedly updating the model parameters inside the anomaly detection model and using the model performance as the training end condition, thereby obtaining an anomaly detection model that meets the training end condition and improving the detection accuracy of the anomaly detection model.

[0070] In an exemplary embodiment, before the step of “inputting the real-time network traffic data in the network space into the trained anomaly detection model to determine the anomaly detection result of the network traffic data”, the method further includes:

[0071] Entity extraction and relationship extraction are performed on the abnormal resource data obtained from the network security data source to obtain the entities and relationships corresponding to the abnormal resource data, and based on the entities and relationships, the network security knowledge graph composed of the abnormal resource data is determined.

[0072] The network security knowledge graph is updated based on the existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph.

[0073] According to the abnormal resource data in the network security knowledge graph, the marked normal and abnormal network traffic data are evaluated to determine the comprehensive evaluation results, integrity evaluation results and accuracy evaluation results of the network security knowledge graph on the marked normal and abnormal network traffic data. If at least one of the comprehensive evaluation results, integrity evaluation results and accuracy evaluation results does not reach the preset standard value, the abnormal resource data in the network security knowledge graph is updated to obtain an updated network security knowledge graph.

[0074] Among them, the comprehensiveness evaluation result is used to indicate the number of entities and relationships in the network security knowledge graph; the integrity evaluation result is used to indicate whether the attributes of each entity in the network security knowledge graph are complete; the accuracy evaluation result is used to indicate the evaluation index of the prediction model corresponding to the network security knowledge graph; the network security data source is the real abnormal requests and normal requests recorded in the cyberspace, the abnormal requests correspond to the abnormal resource data, and the normal requests correspond to the normal resource data. The network security data source contains the request subject (i.e., the execution subject) in the abnormal request, the request object (such as a server, URL, etc.) and the request content (for example, files, pictures, videos, etc.). The data in the network security data source is usually unstructured data.

[0075] Specifically, the server can perform entity extraction and relationship extraction on the unstructured data in the network security data source to determine the entities and relationships corresponding to the abnormal requests and normal requests in the network security data source. The server can only add the entities and relationships corresponding to the abnormal requests as triples to the network security knowledge graph. Among them, the triples in the network security knowledge graph are obtained by taking the above-mentioned request subject, request object and request content as entities, and the association relationship between the request subject, request object and request content as relationships.

[0076] The server can also obtain triples in the network security knowledge base and merge the triples with the network security knowledge graph to obtain an updated network security knowledge graph. The network security knowledge base is a multiple access request in the network space constructed by artificially using historical data. Since the data in the network security knowledge base is structured data, the server does not need to extract entities from the network security knowledge base. It can directly merge the existing graph structure with the network security knowledge graph according to the association relationship defined in the network security knowledge graph to obtain an updated network security knowledge graph.

[0077] The server can evaluate the comprehensiveness, integrity, and accuracy of the network security knowledge graph. The server can determine the estimated threshold of the number of entities and relationships through the network security data source and the data contained in the network security knowledge base. If the number of entities and relationships in the network security knowledge graph obtained by the server does not meet the threshold, the comprehensiveness evaluation result of the network security knowledge graph is determined to be unqualified. In addition, the server can select keywords from the network security data source and the network security knowledge base to traverse the network security knowledge graph by traversing, and determine whether the keywords are stored in the network security knowledge graph as entities, thereby determining the integrity evaluation result of the network security knowledge graph. Finally, the server can predict and determine the normal network traffic data (normal request) and abnormal network traffic data (abnormal request) marked by itself according to the updated network security knowledge graph, determine the prediction accuracy of the network security knowledge graph, and use it as the accuracy evaluation result. For example, the server determines whether the network traffic data is normal network traffic data or abnormal network traffic data through the abnormal resource data stored in the network security knowledge graph, that is, the performance of the network security knowledge graph is tested by the self-marked network traffic data.

[0078] In this embodiment, a network security knowledge graph is constructed by performing entity extraction and relationship extraction on the network security data source, and the network security knowledge graph is updated through the existing graph structure in the network security knowledge base. The quality of the network security knowledge graph is evaluated through the comprehensiveness evaluation results, the integrity evaluation results, and the accuracy evaluation results. When all comprehensiveness evaluation results reach the preset standard values, the network security knowledge graph is updated, which can improve the quality of the network security knowledge graph.

[0079] In an exemplary embodiment, the method also includes: if the anomaly detection result is normal, determining the fingerprint information of the system and application corresponding to the network traffic data; blurring the fingerprint information by adding random noise, deleting or modifying features, and encrypting features to obtain blurred fingerprint information; based on a random insertion or random position replacement strategy, mixing the blurred fingerprint information with the network traffic data to obtain updated network traffic data.

[0080] Specifically, the server detects the access request in the network traffic data and obtains the anomaly detection result, and the anomaly detection result in the network traffic data is normal. The server can obtain the system and application corresponding to the network traffic data and determine the fingerprint information of the system and application. The server can add random noise, delete features, modify features, and encrypt features to the fingerprint information, thereby blurring the fingerprint information and obtaining blurred fingerprint information. The server can mix the blurred fingerprint information with the network traffic data through a preset random insertion or random position replacement strategy to obtain updated network traffic data, thereby completing the hiding of the system and application corresponding to the network traffic data.

[0081] In this embodiment, by fuzzifying the fingerprint information corresponding to the system and application corresponding to the network traffic data, and mixing the fuzzified fingerprint information with the network traffic data, the security of the network traffic data during transmission in the cyberspace can be improved.

[0082] In an exemplary embodiment, the specific implementation process of the step of "analyzing potential attack paths according to abnormal patterns and the topological structure of the network space to determine the predicted attack plan" includes:

[0083] According to the abnormal pattern, the invaded host or external abnormal user in the topological structure of the network space is determined as the starting point of the attack; according to the UCT selection strategy, the child node corresponding to the attack starting point is determined in the topological structure of the network space, and the new state corresponding to the child node is generated; based on the new state, the child node is expanded until all the child nodes are generated according to the new state, and a node tree consisting of child nodes and attack starting points is obtained; according to the preset number of simulations, by randomly selecting actions, the process of each node in the node tree reaching the terminal state from the current state is simulated, and the simulation statistical information corresponding to each node in the node tree is obtained; according to the simulation statistical information and the topological structure of the node tree, the attack action with high expected return is determined as the predicted attack plan.

[0084] Among them, the UCT (Upper Confidence bounds for Trees) selection strategy is used for decision tree search and to make better decisions in uncertain environments. The compromised host can be the request subject, request content, or request object in an abnormal request, and the compromised host can be the request subject, request content, or request object in other abnormal requests in the same abnormal mode as the abnormal request.

[0085] Specifically, the server can obtain multiple abnormal requests contained in the abnormal pattern corresponding to the abnormal request, and project the request content, request subject and request object involved in the abnormal request into the topological structure of the network space to obtain at least one invaded host (abnormal request object). The server can obtain external abnormal users (abnormal request subjects) in multiple abnormal requests. The server can use the invaded host and external abnormal users as attack starting points respectively.

[0086] The server can use the UCT selection strategy to obtain the node corresponding to the attack starting point in the topology structure, obtain the child nodes around the node, and generate a new state for the child node. The new state is used to mark the child node, and the new state can represent the state change of the child node when it is attacked or not attacked on the potential attack path. The server can expand the child node according to the value of each new state, and further determine the next layer of child nodes to the neighboring nodes in the topology structure, and generate a new state corresponding to the next layer of child nodes. It should be understood that the value of the new state can show a step-like change according to the propagation mode of the abnormal pattern and the number of layers of the child node. According to the preset iteration rules, the server can obtain a node tree generated by multiple layers of child nodes. The node tree contains each child node and the attack starting point. Based on this, the server can generate multiple node trees.

[0087] Afterwards, for each node tree, the server can simulate in the node tree according to the preset number of simulations. Starting from the attack starting point, by randomly selecting actions for each node in the node tree, the state value of each child node is randomly changed, thereby simulating the process of each node from the current state to the terminal state. When the preset number of simulations is reached, each child node reaches the terminal state. At this time, the statistical information of all nodes between the attack node and the current child node in the node tree is recorded. The server can reset the state value of the node tree and repeat the simulation in the node tree. Since the simulation process randomly selects actions, the path of each simulation is different, and the statistical information of all nodes obtained is also different. After multiple rounds of simulation, the server can determine the expected return of each node tree based on the statistical information of each node in each round, and determine the simulated action corresponding to the node tree with the highest expected return as the best action, and determine the best action as the predicted attack plan.

[0088] In this embodiment, the attack starting point is determined by the abnormal pattern, and a node tree consisting of new states of multiple child nodes is generated by the UCT selection strategy and the attack starting point. Afterwards, the state of each node in the node tree is simulated according to the random selection action, so as to obtain the simulated statistical information of each node in each node tree, and finally, the node tree with high expected return is determined through the simulated statistical information, and the attack action corresponding to the node tree is obtained as the predicted attack plan, which can improve the completeness and accuracy of determining the predicted attack plan.

[0089] In an exemplary embodiment, the specific implementation process of the step of “updating the security policy based on the predicted attack scenario to obtain an updated security policy” includes:

[0090] The configured security strategy is determined as the current state in the simulated annealing strategy, and the cost function value of the current state is determined, as well as the initial temperature and the termination temperature of the simulated annealing strategy.

[0091] Based on the attack path and impact range in the predicted attack plan, the parameters in the current state are adjusted, the current state is mutated, and the candidate state after the mutation and the cost function value corresponding to the candidate state are determined.

[0092] The difference between the cost function value of the current state and the cost function value of the candidate state is determined, and if the difference meets a preset condition, the candidate state is determined to be the current state.

[0093] Return to execute the step of adjusting the parameters in the current state based on the attack path and impact range in the predicted attack scenario until the initial temperature is reduced to the termination temperature.

[0094] The state with the minimum cost function value among the current states is determined, and the security policy is updated according to the state with the minimum cost function value to obtain an updated security policy.

[0095] The cost function value is determined based on the cost function of the predicted attack scenario and the security policy. The cost function is a preset function within the security policy.

[0096] Specifically, the server initializes the current security policy to the current state in the simulated annealing strategy, and determines the cost function value corresponding to the current state according to the simulated annealing strategy. Based on this, the server can obtain the attack path and impact range in the predicted attack plan, and use the attack path and impact range as two impact parameters, respectively, to adjust the parameters in the current state to obtain the adjusted current state. The server mutates the adjusted current state through the simulated annealing strategy, that is, randomly updates the security policy, obtains the mutated candidate state, and determines the cost function value corresponding to the candidate state. The candidate state can be understood as the state corresponding to the updated security policy.

[0097] The server can determine the error value between the cost function value of the current state and the cost function value of the candidate state, and determine the candidate state as the current state when the error value meets the preset conditions. It should be understood that each time a mutation is performed, the initial temperature in the simulated annealing strategy will change until the initial temperature becomes the termination temperature after multiple changes and the mutation cannot be performed. Based on this, the server can perform multiple mutations before reaching the termination temperature, and the current state can be adjusted after each mutation to generate a candidate state, and the cost function values ​​of the current state and the candidate state are compared, so as to determine the candidate state as the current state, or retain the current state. Finally, the server can obtain multiple current states during the annealing process, and the server can select the state with the smallest cost function value from multiple current states as the final state, and update the security policy according to the mutation process of the final state to obtain an updated security policy.

[0098] In this embodiment, the security policy is mutated multiple times through the simulated annealing strategy to obtain multiple current states, and the current state with the smallest cost function value is selected as the final state. The server finally updates the security policy according to the final state to obtain an updated security policy, which can improve the protection scope and accuracy of the security policy, thereby improving the security of the security policy.

[0099] As shown in Figure 3, the specific execution process of the above-mentioned cyberspace anti-mapping method in the cyberspace anti-mapping system is described in detail below in combination with a specific embodiment. The server can be configured with a cyberspace anti-mapping system, which includes an intelligence integration module, a knowledge graph library (cyberspace knowledge graph), an anomaly detection module, a request identification module, a fingerprint obfuscation module, a path analysis module, a strategy optimization module, a defense response module, and a display operation platform.

[0100] Among them, the intelligence integration module is mainly used to collect, integrate and analyze threat information from various security intelligence sources to obtain real-time threat intelligence support; the knowledge graph library is mainly used to establish a cyberspace knowledge base, and regularly update and maintain the knowledge base, as well as associate the pre-processed network traffic data with the pre-built network security knowledge base, extract key features, and annotate potential threat information in the traffic; the anomaly detection module is mainly used to monitor and analyze abnormal requests and behavior patterns, and the anomaly detection model in the anomaly detection module is trained using the data annotated by the knowledge graph library, and then the trained model is used to monitor network traffic in real time; the request identification module is mainly used to analyze abnormal patterns in network traffic, and receive the detection results of the anomaly detection module, The abnormal requests are recorded and classified, and the identified abnormal patterns are fed back to the knowledge graph module to update the knowledge graph library; the fingerprint obfuscation module is used to perform fingerprint obfuscation processing on the system and application; the path analysis module is used to evaluate different network attack paths and analyze the propagation path and impact range of network attacks based on the source information provided by the request identification module, combined with the system topology and security policy; the policy optimization module is used to optimize the system's security policy and parameter configuration based on the attack path analysis results provided by the path analysis module, and adjust the defense policy in real time; the defense response module is used to automatically trigger the corresponding defense measures and emergency response mechanisms based on the threats detected by the system; the display operation platform is used to display the system analysis results to the management user in a visual form. The defense response module automatically triggers the corresponding defense measures and emergency response mechanisms based on the data transmitted by the path analysis module and the request identification module; the display operation platform summarizes the operation data of each module and displays it visually.

[0101] In an exemplary embodiment, the specific steps for constructing the knowledge graph library network space knowledge base are as follows:

[0102] Step 1.1: Clean and preprocess the raw data collected from various security intelligence sources, vulnerability databases, and malicious IP lists, and classify the processed data according to data type and source. Then, use NLP technology and entity extraction algorithms to identify entities from the text data in each data and extract the attributes corresponding to each group of entities.

[0103] Step 1.2: Analyze the association relationships in the data, and determine and extract the relationships between entities through rule matching methods. The identified entities are used as nodes of the graph, and the relationships between entities are used as edges of the graph to form a set of directed or undirected graph structures.

[0104] Step 1.3: Use professional dictionaries, security threat intelligence, malware signature libraries, security vulnerability databases, expert knowledge, and industry standards to expand and supplement the constructed knowledge graph, then store the constructed knowledge graph in a graph database or graph storage system, and establish a corresponding index structure to build the corresponding cyberspace knowledge base.

[0105] Step 1.4: Conduct a quality assessment on the constructed knowledge base, and optimize and modify each set of data stored in the base based on the assessment results. Then, regularly collect new data from each set of data sources to update and expand the knowledge base.

[0106] In an exemplary embodiment, the specific steps of monitoring and analyzing by the anomaly detection module are as follows:

[0107] Step 2.1: Capture the network traffic data flowing through the system from the network in real time, perform data cleaning, noise removal and feature extraction on the collected raw network traffic data, unify the data format of each network traffic data after processing, and mark each group of processed network traffic data.

[0108] Step 2.2: Establish a monitoring model based on the PyTorch deep learning framework, define the structure of the input layer, hidden layer, and output layer of the monitoring model, compile and initialize the monitoring model, and then divide the network traffic data into training set, test set, and training set.

[0109] Step 2.3: Use the data from the training set to train the monitoring model. Send the input data into the model for forward propagation to obtain the corresponding predicted value. Calculate the loss value between the predicted value and the actual value through the loss function, and obtain the gradient of the loss value to the model parameters through the back propagation algorithm. Then, the Adam optimizer updates the model parameters according to the calculated gradient information.

[0110] Step 2.4: After each training session, use the validation set data to evaluate the model performance during the training process. If the model performance no longer improves, stop training. Otherwise, continue training and adjust the model's hyperparameters or structure based on the validation information until the preset number of training times is reached.

[0111] Step 2.5: Use the data from the test set to evaluate the performance of the trained model and tune the model based on the test results. Input the real-time captured network traffic data into the trained monitoring model for real-time monitoring. Through continuous observation and analysis of network traffic data, abnormal requests and behavior patterns can be identified.

[0112] Step 2.6: Based on the constructed knowledge graph, further detect and analyze the identified abnormal requests, compare the features in the network traffic data with known attack patterns and threat intelligence, determine whether there are potential security threats, analyze the behavior patterns of abnormal requests, and infer possible attack types and targets through analysis of abnormal behavior patterns.

[0113] In an exemplary embodiment, the fingerprint obfuscation module performs the following specific steps for fingerprint obfuscation:

[0114] Step 3.1: Extract fingerprint information from the system and application using the Masscan fingerprint extraction tool, and perform fuzzy processing on the extracted fingerprint information by adding random noise, deleting or modifying some features, and encrypting the features;

[0115] Step 3.2: Use random insertion or random position replacement methods to mix the obfuscated fingerprint information with normal traffic data, and process the obfuscated data according to the system's external response rules and policies. Then, adjust and update the fingerprint obfuscation strategy regularly based on the latest attack techniques and security threats.

[0116] In an exemplary embodiment, the specific steps of network attack path evaluation of the path analysis module are as follows:

[0117] Step 4.1: Collect information about the network topology, build a network topology map based on the collected information, determine the attack target in the network, and select one or more groups of invaded hosts or external malicious users as the attack starting point;

[0118] Step 4.2: Set the attack starting point as the root node and initialize the statistical information of the root node. Starting from the root node, select the node to be expanded in the network topology according to the UCT selection strategy, expand the selected node, and generate a new state after taking different actions from the current state. Generate all possible child nodes based on the generated new state;

[0119] Step 4.3: Simulate a series of actions of the expanded node from the current state to the terminal state by randomly selecting actions. Update the statistical information of all nodes on the path from the root node to the current node according to the results of the simulated game.

[0120] Step 4.4: Repeat the process of node selection, expansion, simulated game and statistical information update until the preset number of searches is reached. According to the statistical information of the nodes, the action with the highest expected benefit is selected as the best action, and the selected best action is returned as the final attack plan;

[0121] Step 4.5: Based on the best attack plan, analyze the attack propagation path and impact range, and then optimize and improve network security defense measures based on the analysis results.

[0122] In an exemplary embodiment, the specific steps of policy optimization module parameter configuration and policy adjustment optimization are as follows:

[0123] Step 5.1: Take the current parameter configuration or strategy setting of the system as the starting state, set an initial temperature and an end temperature, and use the initial temperature to control the start state of the simulated annealing, and use the end temperature to control the stop state of the simulated annealing;

[0124] Step 5.2: mutate the current system state by randomly selecting parameters for fine-tuning, generate a set of new candidate states, and calculate the value of the cost function or objective function corresponding to the newly generated candidate states;

[0125] Step 5.3: Calculate the difference in the cost function between the current state and the new state. If the energy difference is negative or meets the preset probability, the new state is accepted. According to the judgment result of the acceptance of the new state, the state of the system is updated. If the new state is accepted, the current state is updated to the new state.

[0126] Step 5.4: Reduce the temperature by exponential decay, and check whether the current temperature has dropped below the termination temperature. If it has dropped below the termination temperature, stop simulated annealing, otherwise, repeatedly generate a new solution for replacement;

[0127] Step 5.5: After the simulated annealing is terminated, the system state of the minimum cost function value is returned. According to the system state, the system parameter configuration and strategy settings are adjusted, and the system is further optimized and adjusted according to the specific application scenario and optimization goal.

[0128] In this embodiment, by capturing and processing network traffic data flowing through the system from the network in real time, a monitoring model is established based on the PyTorch deep learning framework, the monitoring model is compiled and initialized, and then the network traffic data is divided into a training set, a test set, and a training set to train and adjust the constructed monitoring model, and the real-time captured network traffic data is input into the trained monitoring model for real-time monitoring, and abnormal requests and behavior patterns are identified through continuous observation and analysis of network traffic data. According to the constructed knowledge graph, the identified abnormal requests are further detected and analyzed, and the features in the network traffic data are compared with known attack patterns and threat intelligence to determine whether there is a potential security threat, and the behavior patterns of abnormal requests are analyzed. Through the analysis of abnormal behavior patterns, possible attack types and attack targets are inferred, which can achieve more comprehensive and comprehensive security defense, provide rich security knowledge and rules, and realize intelligent security defense. It has strong scalability and can adapt to the ever-changing network security threats and environment.

[0129] In addition, in this embodiment, by constructing a network topology map, the attack target in the network is determined, one or more groups of invaded hosts or external malicious users are selected as the attack starting point, the attack starting point is used as the root node, and the statistical information of the root node is initialized. Starting from the root node, nodes in the network topology map are selected for expansion, and new states after taking different actions from the current state are generated. All possible child nodes are generated based on the generated new states. A series of actions of the expanded node starting from the current state to the terminal state are simulated by randomly selecting actions. According to the results of the simulated game, the statistical information of all nodes on the path from the root node to the current node is updated, and the process of node selection, expansion, simulated game and statistical information update is repeated until a preset number of searches is reached. According to the statistical information of the node, the action with the highest expected benefit is selected as the best action, and the selected best action is returned as the final attack plan. According to the best attack plan, the propagation path and impact range of the attack are analyzed, and then according to the analysis results, the network security defense measures are optimized and improved, which can improve the ability to identify and respond to attacks, reduce the possibility of the system being attacked, and be able to respond to new network attack threats at any time to maintain the timeliness and effectiveness of network security defense.

[0130] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0131] Based on the same inventive concept, the embodiment of the present application also provides a cyberspace anti-mapping device for implementing the cyberspace anti-mapping method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more cyberspace anti-mapping devices provided below can refer to the limitations of the cyberspace anti-mapping method above, and will not be repeated here.

[0132] In an exemplary embodiment, as shown in FIG4 , a cyberspace anti-mapping device 400 is provided, comprising: an anomaly detection module 401 , an attack prediction module 402 and a strategy update module 403 , wherein:

[0133] The anomaly detection module 401 is used to input the real-time network traffic data in the network space into the trained anomaly detection model to determine the anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph includes the abnormal resource data in the network space and the association relationship between the abnormal resource data;

[0134] The attack prediction module 402 is used to determine the abnormal pattern corresponding to the abnormal request in the network traffic data if the abnormal detection result is abnormal, and analyze the potential attack path according to the abnormal pattern and the topological structure of the network space to determine the predicted attack plan; the abnormal request is the access request initiated by the network traffic data with abnormal detection result to each resource data in the network space;

[0135] The policy updating module 403 is used to update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

[0136] Furthermore, the device also includes a model training module, which is specifically used to: perform data preprocessing on the initial traffic data acquired in real time to obtain training traffic data, and mark the training traffic data based on the abnormal resource data and the association relationship between the abnormal resource data in the network security knowledge graph to obtain the marked training traffic data; establish a preset anomaly detection model, and determine the loss value based on the training traffic data and the anomaly detection model, and determine the gradient information of the anomaly detection model through the back propagation algorithm and the loss value; update the model parameters of the anomaly detection model through the gradient information to obtain an updated anomaly detection model, and return to execute the step of determining the loss value based on the training traffic data and the anomaly detection model until the model performance of the anomaly detection model meets the training end conditions to obtain a trained anomaly detection model.

[0137] Furthermore, the device also includes a graph determination module, which is specifically used to: perform entity extraction and relationship extraction on the abnormal resource data obtained from the network security data source to obtain the entities and relationships corresponding to the abnormal resource data, and determine the network security knowledge graph composed of the abnormal resource data based on the entities and relationships; update the network security knowledge graph based on the existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph; evaluate the normal and abnormal network traffic data marked according to the abnormal resource data in the network security knowledge graph to determine the comprehensiveness evaluation result, completeness evaluation result and accuracy evaluation result of the network security knowledge graph for the normal and abnormal network traffic data marked; wherein the comprehensiveness evaluation result is used to indicate the number of entities and relationships in the network security knowledge graph; the completeness evaluation result is used to indicate whether the attributes of each entity in the network security knowledge graph are complete; the accuracy evaluation result is used to indicate the evaluation index of the prediction model corresponding to the network security knowledge graph; if at least one of the comprehensiveness evaluation result, the completeness evaluation result and the accuracy evaluation result does not reach the preset standard value, the abnormal resource data in the network security knowledge graph is updated to obtain an updated network security knowledge graph.

[0138] Furthermore, the device also includes a fingerprint fuzzification module, which is specifically used to: if the anomaly detection result is normal, determine the fingerprint information of the system and application corresponding to the network traffic data; fuzzify the fingerprint information by adding random noise, deleting or modifying features, and encrypting features to obtain blurred fingerprint information; based on a random insertion or random position replacement strategy, mix the blurred fingerprint information with the network traffic data to obtain updated network traffic data.

[0139] Furthermore, the attack prediction module 402 is specifically used to: determine the invaded host in the topological structure of the network space or the external abnormal user as the attack starting point according to the abnormal pattern; determine the child node corresponding to the attack starting point in the topological structure of the network space according to the UCT selection strategy, and generate the new state corresponding to the child node; based on the new state, expand the child node until all the child nodes are generated according to the new state, and obtain a node tree consisting of the child nodes and the attack starting point; according to the preset number of simulations, by randomly selecting actions, simulate the process of each node in the node tree reaching the terminal state from the current state, and obtain the simulation statistical information corresponding to each node in the node tree; according to the simulation statistical information and the topological structure of the node tree, determine the attack action with high expected return as the predicted attack plan.

[0140] Furthermore, the policy update module 403 is specifically used to: determine the configured security policy as the current state in the simulated annealing policy, determine the cost function value of the current state, and determine the initial temperature and termination temperature of the simulated annealing policy; the cost function value is determined based on the cost function of the predicted attack plan and the security policy; based on the attack path and influence range in the predicted attack plan, adjust the parameters in the current state, mutate the current state, determine the mutated candidate state and the cost function value corresponding to the candidate state; determine the difference between the cost function value of the current state and the cost function value of the candidate state, and if the difference meets the preset conditions, determine the candidate state as the current state; return to execute the step of adjusting the parameters in the current state based on the attack path and influence range in the predicted attack plan until the initial temperature is reduced to the termination temperature; determine the state with the smallest cost function value in each current state, and update the security policy according to the state with the smallest cost function value to obtain an updated security policy.

[0141] Each module in the above-mentioned cyberspace anti-mapping device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0142] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as security policies and network security knowledge graphs. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for anti-mapping of cyberspace is implemented.

[0143] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0145] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0146] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0148] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cyberspace reverse mapping method, characterized in that: The method comprises: Inputting the real-time network traffic data in the network space into a trained anomaly detection model to determine the anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph includes the abnormal resource data in the network space and the association relationship between the abnormal resource data; If the anomaly detection result is abnormal, then determine the abnormal pattern corresponding to the abnormal request in the network traffic data, and analyze the potential attack path according to the abnormal pattern and the topological structure of the network space to determine the predicted attack plan; the abnormal request is an access request initiated by the network traffic data whose anomaly detection result is abnormal to each resource data in the network space; The security policy is updated based on the predicted attack scenario to obtain an updated security policy, and the security policy is executed.

2. The method according to claim 1, characterized in that Before inputting the real-time network traffic data in the network space into the trained anomaly detection model and determining the anomaly detection result of the network traffic data, the method further includes: Performing data preprocessing on the initial traffic data acquired in real time to obtain training traffic data, and marking the training traffic data based on the abnormal resource data in the network security knowledge graph and the association relationship between the abnormal resource data to obtain marked training traffic data; Establishing a preset anomaly detection model, determining a loss value based on the training traffic data and the anomaly detection model, and determining gradient information of the anomaly detection model through a back propagation algorithm and the loss value; The model parameters of the anomaly detection model are updated through the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to be executed until the model performance of the anomaly detection model meets the training end condition, thereby obtaining a trained anomaly detection model.

3. The method according to claim 1, characterized in that: Before inputting the real-time network traffic data in the network space into the trained anomaly detection model and determining the anomaly detection result of the network traffic data, the method further includes: Perform entity extraction and relationship extraction on the abnormal resource data obtained from the network security data source to obtain entities and relationships corresponding to the abnormal resource data, and determine the network security knowledge graph constituted by the abnormal resource data based on the entities and relationships; Updating the network security knowledge graph based on the existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph; According to the abnormal resource data in the network security knowledge graph, the marked normal and abnormal network traffic data are evaluated to determine the comprehensiveness evaluation result, completeness evaluation result and accuracy evaluation result of the network security knowledge graph on the marked normal and abnormal network traffic data; wherein the comprehensiveness evaluation result is used to represent the number of entities and relationships in the network security knowledge graph; the completeness evaluation result is used to represent whether the attributes of each entity in the network security knowledge graph are complete; the accuracy evaluation result is used to represent the evaluation index of the prediction model corresponding to the network security knowledge graph; If at least one of the comprehensiveness assessment result, the integrity assessment result and the accuracy assessment result does not reach a preset standard value, the abnormal resource data in the network security knowledge graph is updated to obtain an updated network security knowledge graph.

4. The method according to claim 1, characterized in that The method further comprises: If the anomaly detection result is normal, determining fingerprint information of the system and application corresponding to the network traffic data; Obfuscating the fingerprint information by at least one of adding random noise, deleting or modifying features, and encrypting features to obtain blurred fingerprint information; Based on a random insertion or random position replacement strategy, the fuzzy fingerprint information is mixed with the network traffic data to obtain updated network traffic data.

5. The method according to claim 1, characterized in that The step of analyzing potential attack paths according to the abnormal pattern and the topological structure of the network space and determining a predicted attack plan includes: According to the abnormal pattern, determining the invaded host in the topological structure of the network space or the external abnormal user as the attack starting point; According to the UCT selection strategy, a subnode corresponding to the attack starting point is determined in the topological structure of the network space, and a new state corresponding to the subnode is generated; Based on the new state, the child nodes are expanded until all child nodes are generated according to the new state, and a node tree consisting of the child nodes and the attack starting point is obtained; According to a preset number of simulations, by randomly selecting actions, a process of each node in the node tree reaching a terminal state from a current state is simulated to obtain simulation statistical information corresponding to each node in the node tree; According to the simulation statistical information and the topological structure of the node tree, an attack action with high expected benefits is determined as a predicted attack plan.

6. The method according to claim 1, characterized in that The updating of the security policy based on the predicted attack scenario to obtain an updated security policy includes: Determine the configured security policy as the current state in the simulated annealing policy, determine the cost function value of the current state, and determine the initial temperature and the termination temperature of the simulated annealing policy; the cost function value is determined based on the predicted attack scenario and the cost function of the security policy; Based on the attack path and impact range in the predicted attack scheme, adjusting the parameters in the current state, mutating the current state, and determining the mutated candidate state and the cost function value corresponding to the candidate state; Determine a difference between a cost function value of the current state and a cost function value of the candidate state, and if the difference satisfies a preset condition, determine the candidate state as the current state; Returning to the step of adjusting the parameters in the current state based on the attack path and impact range in the predicted attack scheme, until the initial temperature decreases to the termination temperature; A state in which the cost function value is the minimum among the current states is determined, and the security policy is updated according to the state in which the cost function value is the minimum to obtain an updated security policy.

7. A cyberspace anti-mapping device, characterized in that: The device comprises: An anomaly detection module, used to input the real-time network traffic data in the network space into a trained anomaly detection model to determine the anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph contains the abnormal resource data in the network space and the association relationship between the abnormal resource data; An attack prediction module, for determining an abnormal pattern corresponding to an abnormal request in the network traffic data if the abnormal detection result is abnormal, and analyzing potential attack paths according to the abnormal pattern and the topological structure of the network space to determine a predicted attack plan; the abnormal request is an access request initiated by the network traffic data whose abnormal detection result is abnormal to each resource data in the network space; The policy updating module is used to update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images