Cyberspace counter-mapping method, device, computer equipment and storage medium

Abstract

The present application relates to a cyberspace reverse mapping method, device, computer equipment and storage medium, and relates to the field of network security technology. The method includes: inputting real-time network traffic data in the cyberspace into a trained anomaly detection model to determine the anomaly detection result of the network traffic data; the anomaly detection model is trained based on the labeled data in the network security knowledge graph; if the anomaly detection result is abnormal, then the abnormal pattern corresponding to the abnormal request in the network traffic data is determined, and according to the abnormal pattern and the topological structure of the cyberspace, the potential attack path is analyzed to determine the predicted attack plan; the abnormal request is the access request initiated by the network traffic data with an abnormal anomaly detection result to each resource data in the cyberspace; based on the predicted attack plan, the security policy is updated to obtain the updated security policy, and the security policy is executed. The use of this method can improve the security of the cyberspace during mapping.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a cyberspace anti-mapping method, apparatus, computer equipment, storage medium, and computer program product. Background Art

[0002] The Internet has become an essential part of our daily lives and work. However, cyber attackers exploit various vulnerabilities, abnormal software, and advanced persistent threats to continuously launch attacks on various network devices and systems, causing economic losses and information leaks.

[0003] Today, cyber attackers can hide within cyberspace mapping activities, lurking under the guise of cyberspace mapping and covertly launching cyberattacks. Related technologies often limit network security defenses to static rule-based detection and defense, failing to effectively counter hidden cyberattacks within cyberspace mapping activities. This leads to inadequate security for network devices and systems. Summary of the Invention

[0004] Based on this, it is necessary to provide a cyberspace anti-mapping method, device, computer equipment, computer-readable storage medium and computer program product that can improve the security of network equipment and systems in response to the above technical problems.

[0005] In a first aspect, the present application provides a cyberspace anti-mapping method. The method comprises:

[0006] Inputting real-time network traffic data in the cyberspace into a trained anomaly detection model to determine an anomaly detection result of the network traffic data; the anomaly detection model is trained based on annotated data in a network security knowledge graph; the network security knowledge graph includes anomaly resource data in the cyberspace and associations between the anomaly resource data;

[0007] If the anomaly detection result is abnormal, determining an abnormal pattern corresponding to the abnormal request in the network traffic data, and analyzing potential attack paths based on the abnormal pattern and the topological structure of the network space to determine a predicted attack plan; the abnormal request is an access request initiated by the network traffic data with the abnormal detection result to various resource data in the network space;

[0008] The security policy is updated based on the predicted attack scenario to obtain an updated security policy, and the security policy is executed.

[0009] In one embodiment, before inputting the real-time network traffic data in the cyberspace into the trained anomaly detection model and determining the anomaly detection result of the network traffic data, the method further includes:

[0010] Performing data preprocessing on the initial traffic data acquired in real time to obtain training traffic data, and marking the training traffic data based on the abnormal resource data in the network security knowledge graph and the association relationship between the abnormal resource data to obtain marked training traffic data;

[0011] Establishing a preset anomaly detection model, determining a loss value based on the training traffic data and the anomaly detection model, and determining gradient information of the anomaly detection model through a backpropagation algorithm and the loss value;

[0012] The model parameters of the anomaly detection model are updated using the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to execute until the model performance of the anomaly detection model meets the training end condition, thereby obtaining a trained anomaly detection model.

[0013] In one embodiment, before inputting the real-time network traffic data in the cyberspace into the trained anomaly detection model and determining the anomaly detection result of the network traffic data, the method further includes:

[0014] Perform entity extraction and relationship extraction on abnormal resource data obtained from a network security data source to obtain entities and relationships corresponding to the abnormal resource data, and determine a network security knowledge graph constituted by the abnormal resource data based on the entities and relationships;

[0015] Updating the network security knowledge graph based on an existing graph structure in a network security knowledge base to obtain an updated network security knowledge graph;

[0016] Based on the abnormal resource data in the network security knowledge graph, the marked normal and abnormal network traffic data are evaluated to determine the comprehensiveness evaluation results, completeness evaluation results, and accuracy evaluation results of the network security knowledge graph on the marked normal and abnormal network traffic data; wherein the comprehensiveness evaluation result is used to represent the number of entities and relationships in the network security knowledge graph; the completeness evaluation result is used to indicate whether the attributes of each entity in the network security knowledge graph are complete; and the accuracy evaluation result is used to represent the evaluation index of the prediction model corresponding to the network security knowledge graph;

[0017] If at least one of the comprehensiveness assessment result, the integrity assessment result and the accuracy assessment result does not reach a preset standard value, the abnormal resource data in the network security knowledge graph is updated to obtain an updated network security knowledge graph.

[0018] In one embodiment, the method further comprises:

[0019] If the anomaly detection result is normal, determining fingerprint information of the system and application corresponding to the network traffic data;

[0020] Obfuscating the fingerprint information by at least one of adding random noise, deleting or modifying features, and encrypting features to obtain obfuscated fingerprint information;

[0021] Based on a random insertion or random position replacement strategy, the blurred fingerprint information is mixed with the network traffic data to obtain updated network traffic data.

[0022] In one embodiment, analyzing potential attack paths based on the abnormal pattern and the topological structure of the network space to determine a predicted attack scenario includes:

[0023] According to the abnormal pattern, determining an invaded host in the topology of the network space or an external abnormal user as an attack starting point;

[0024] Determine, in accordance with the UCT selection strategy, a child node corresponding to the attack starting point in the topological structure of the network space, and generate a new state corresponding to the child node;

[0025] Based on the new state, the child nodes are expanded until all child nodes are generated according to the new state, thereby obtaining a node tree consisting of the child nodes and the attack starting point;

[0026] According to a preset number of simulations, by randomly selecting actions, a process of each node in the node tree reaching a terminal state from a current state is simulated to obtain simulation statistical information corresponding to each node in the node tree;

[0027] According to the simulation statistical information and the topological structure of the node tree, an attack action with a high expected return is determined as a predicted attack plan.

[0028] In one embodiment, updating the security policy based on the predicted attack scenario to obtain an updated security policy includes:

[0029] Determining the configured security policy as the current state in the simulated annealing policy, determining a cost function value of the current state, and determining an initial temperature and an end temperature of the simulated annealing policy; the cost function value is determined based on the predicted attack scenario and the cost function of the security policy;

[0030] Based on the attack path and impact range in the predicted attack scenario, adjusting parameters in the current state, mutating the current state, and determining a candidate state after the mutation and a cost function value corresponding to the candidate state;

[0031] Determine a difference between a cost function value of the current state and a cost function value of the candidate state, and if the difference satisfies a preset condition, determine the candidate state as the current state;

[0032] Returning to the step of adjusting the parameters in the current state based on the attack path and impact range in the predicted attack scenario, until the initial temperature drops to the termination temperature;

[0033] A state in which the cost function value is minimum among the current states is determined, and the security policy is updated according to the state in which the cost function value is minimum to obtain an updated security policy.

[0034] In a second aspect, the present application also provides a cyberspace anti-mapping device. The device includes:

[0035] An anomaly detection module is configured to input real-time network traffic data in a cyberspace into a trained anomaly detection model to determine anomaly detection results for the network traffic data; the anomaly detection model is trained based on annotated data in a network security knowledge graph; the network security knowledge graph includes anomaly resource data in the cyberspace and associations between the anomaly resource data;

[0036] an attack prediction module configured to, if the anomaly detection result is abnormal, determine an abnormal pattern corresponding to an abnormal request in the network traffic data, and analyze potential attack paths based on the abnormal pattern and the topological structure of the network space to determine a predicted attack scenario; the abnormal request is an access request initiated by the network traffic data with the abnormal detection result to various resource data in the network space;

[0037] The policy updating module is used to update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

[0038] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0039] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0040] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0041] The above-mentioned cyberspace reverse mapping method, apparatus, computer equipment, storage medium, and computer program product can detect real-time network traffic data in cyberspace and use a trained anomaly detection model to determine the anomaly detection results of the real-time network traffic data and determine whether the network traffic data is abnormal. Because the trained anomaly detection model is trained based on the annotated data of a pre-constructed network security knowledge graph, and the network security knowledge graph contains entities and associations of abnormal resource data, the anomaly detection model can accurately detect whether the network traffic data is abnormal based on the abnormal resource data contained in the network security knowledge graph. If the anomaly detection result is abnormal, the server can determine the abnormal request initiated in the abnormal network traffic data and the abnormal pattern corresponding to the abnormal request. Then, based on the topological structure of the cyberspace and the abnormal pattern, the server can predict the potential attack path and obtain a predicted attack plan. The server can then update the existing security policy based on the predicted attack plan, obtain an updated security policy, and execute the updated security policy. Since the network traffic data in the cyberspace is monitored and detected in real time, and when there are anomalies in the network traffic data, the server can predict the network attacks of criminals through the abnormal patterns of abnormal requests and obtain the predicted attack plans, thereby updating the security policies in real time and improving the defense accuracy of cyberspace anti-mapping, thereby improving the security of the server in the face of network attacks when responding to cyberspace mapping activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 A diagram of an application environment of a cyberspace reverse mapping method in one embodiment;

[0044] Figure 2 1 is a flow chart of a cyberspace reverse mapping method according to an embodiment;

[0045] Figure 3 is a schematic diagram of a cyberspace counter-mapping system in one embodiment;

[0046] Figure 4is a structural block diagram of a cyberspace anti-mapping device in one embodiment;

[0047] Figure 5 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] The cyberspace reverse mapping method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store data that server 104 needs to process. The data storage system can be integrated with server 104, or placed in the cloud or on other network servers. Terminal 102 can initiate mapping requests or access requests to server 104. Requests from multiple terminals 102 can be transmitted from each terminal 102 to server 104 in the form of network traffic data. Server 104 can input the network traffic data of each terminal 102 in the network space into a trained anomaly detection model to detect whether there are anomalies in the network traffic data and determine the abnormal requests corresponding to the abnormal network traffic data. Server 104 analyzes the abnormal requests and determines the abnormal patterns corresponding to the abnormal requests. Based on the topological structure and abnormal patterns of the network space, server 104 analyzes the potential attack paths of criminals and obtains predicted attack scenarios. Server 104 updates the existing security policy based on the predicted attack scenarios to obtain an updated security policy, which server 104 then uses to detect network traffic data. The server 104 may use security policies to monitor various surveying and mapping requests and access requests in the cyberspace, thereby improving the security of the server and network devices.

[0050] Terminal 102 may include, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, and smart car devices. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Head-mounted devices may include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, and the like. Server 104 may be implemented as a standalone server or a server cluster consisting of multiple servers.

[0051] In an exemplary embodiment, Figure 2As shown, a cyberspace reverse mapping method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the process, including the following steps S202 to S206.

[0052] Step S202: input the real-time network traffic data in the cyberspace into the trained anomaly detection model to determine anomaly detection results of the network traffic data.

[0053] Among them, the anomaly detection model is trained based on the labeled data in the network security knowledge graph; the network security knowledge graph contains abnormal resource data in the cyberspace and the correlation relationship between abnormal resource data.

[0054] Specifically, the server monitors real-time network traffic data in the cyberspace and inputs it into a trained anomaly detection model according to a preset window size. The anomaly detection model processes the network traffic data and identifies anomaly detection results corresponding to each access request in the network traffic data. The anomaly detection model is trained using pre-labeled triples from the network security knowledge graph. These triples contain all recorded data indicating anomalies in the cyberspace. The network traffic data within the preset window size can contain multiple access requests, each with different access objects and content. For each access request, the anomaly detection model identifies the anomaly detection result for each access request. Access requests can be either abnormal or normal.

[0055] In one example, the anomaly detection model can perform text processing on each access request, obtain the word vector corresponding to each field in the access request, and determine the vector value of the access request as a whole based on the association relationship between the word vectors in the network security knowledge graph. Based on the similarity between the vector value and the abnormal request vector value, the probability value of the access request being an abnormal request is determined. If the probability value is greater than a preset value, the access request is determined to be an abnormal request.

[0056] Step S204: If the anomaly detection result is abnormal, determine the abnormal pattern corresponding to the abnormal request in the network traffic data, and analyze the potential attack path based on the abnormal pattern and the topological structure of the network space to determine the predicted attack plan.

[0057] Among them, abnormal requests are access requests initiated to various resource data in the cyberspace by network traffic data with abnormal detection results; abnormal patterns are behavioral patterns corresponding to multiple abnormal requests from the same execution subject within a continuous time period. Abnormal patterns are usually determined by statistical analysis and summary of multiple consecutive abnormal requests from multiple identical execution subjects. The topology structure includes a network structure with nodes as entities in the cyberspace and multiple terminals, servers and other devices connected by edges. Potential attack paths are used to represent the network paths that criminals may use to attack nodes in the topology structure. Predicted attack plans are used to represent the specific attack plans launched by criminals according to potential attack paths.

[0058] Specifically, the server monitors real-time network traffic data according to preset windows and determines the anomaly detection results for access requests within each window. If the anomaly detection result indicates an anomaly, the access request is determined to be an abnormal request. The server then obtains all access requests from the same execution entity within adjacent windows within the preset window and determines whether the request is an abnormal access request. The server can match multiple abnormal requests corresponding to the same execution entity with preset anomaly patterns to determine the anomaly pattern corresponding to the abnormal request in the network traffic data.

[0059] Based on this, the server constructs the actual attack path of the abnormal request within the topology of the network space, taking into account information such as the execution subject and the request object. Using the actual attack path, topology, and the movement trajectory of the abnormal pattern, the server predicts potential subsequent attack paths and generates predicted attack scenarios based on the corresponding execution subject of the criminal under the potential attack path, as seen in subsequent network traffic data.

[0060] Step S206: update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

[0061] Among them, the security policy is a real-time network protection policy deployed in cyberspace. The security policy is used to monitor and securely process access requests issued by various execution entities in cyberspace. When criminals hide network attacks in access requests through cyberspace mapping, the security policy can identify the corresponding access requests and securely process the access requests, such as isolation or blocking.

[0062] Specifically, the server analyzes information such as the execution subject, request target, potential attack path, and actual attack path in the predicted attack scenario, adjusts the parameters in the existing security policy, and generates an updated security policy. Simultaneously, the server deploys the updated security policy to the entire network space and enforces it in real time.

[0063] In the above-mentioned cyberspace reverse mapping method, by detecting real-time network traffic data in the cyberspace, a trained anomaly detection model can be used to determine the anomaly detection results of the real-time network traffic data and determine whether the network traffic data is abnormal. Since the trained anomaly detection model is trained based on the annotated data of a pre-constructed network security knowledge graph, and the network security knowledge graph contains entities and associations of abnormal resource data, the anomaly detection model can accurately detect whether the network traffic data is abnormal based on the abnormal resource data contained in the network security knowledge graph. In the case where the anomaly detection result is abnormal, the server can determine the abnormal request initiated in the abnormal network traffic data and determine the abnormal pattern corresponding to the abnormal request. Then, based on the topological structure and abnormal pattern of the cyberspace, the potential attack path is predicted to obtain a predicted attack plan, thereby updating the existing security policy through the predicted attack plan, obtaining an updated security policy, and executing the updated security policy. Since the network traffic data in the cyberspace is monitored and detected in real time, and when there are anomalies in the network traffic data, the server can predict the network attacks of criminals through the abnormal patterns of abnormal requests and obtain the predicted attack plans, thereby updating the security policies in real time and improving the defense accuracy of cyberspace anti-mapping, thereby improving the security of the server in the face of network attacks when responding to cyberspace mapping activities.

[0064] In an exemplary embodiment, before the step of “inputting real-time network traffic data in the cyberspace into the trained anomaly detection model to determine anomaly detection results of the network traffic data”, the method further includes:

[0065] The initial traffic data acquired in real time is preprocessed to obtain training traffic data, and the training traffic data is labeled based on the abnormal resource data and the correlation relationship between the abnormal resource data in the network security knowledge graph to obtain labeled training traffic data; a preset anomaly detection model is established, and the loss value is determined based on the training traffic data and the anomaly detection model, and the gradient information of the anomaly detection model is determined through the back propagation algorithm and the loss value; the model parameters of the anomaly detection model are updated through the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to execute until the model performance of the anomaly detection model meets the training end conditions to obtain a trained anomaly detection model.

[0066] The initial traffic data refers to traffic data acquired within multiple consecutive preset windows during the training of the anomaly detection model. The training traffic data is traffic data obtained by preprocessing the initial traffic data for missing data. The anomaly detection model is a machine learning-based classification model, which can be a neural network model using different algorithms or a natural language processing model for text, and is not specifically limited in the present embodiments.

[0067] Specifically, the server can select traffic data from multiple consecutive preset windows within a historical time period as initial traffic data, and determine the initial traffic data containing abnormal requests and normal requests within multiple historical time periods. The server preprocesses the initial traffic data to ensure a uniform format, removes missing data and abnormal data, and obtains preprocessed training traffic data. Based on this, the server labels the training traffic data for each historical time period using the associations between abnormal resource data and abnormal resource data recorded in the network security knowledge graph, and determines the label value corresponding to each set of access requests in the training traffic data.

[0068] The server can select a preset anomaly detection model based on demand and determine the loss value corresponding to a preset loss function within the anomaly detection model by controlling the anomaly detection model's hyperparameters and inputting labeled training traffic data. The server calculates the gradient information of the anomaly detection model during the current round of training based on the backpropagation algorithm and the loss value. Based on the gradient information and the hyperparameters, the server adjusts the model parameters corresponding to the internal structure of the anomaly detection model, thereby completing a round of updating the anomaly detection model and obtaining an updated anomaly detection model. The server can determine the model performance of the updated anomaly detection model. If the model performance meets the preset training end criteria, the updated anomaly detection model is considered the trained anomaly detection model. If the model performance does not meet the preset training end criteria, the server returns to the step of determining the loss value of the loss function based on the training traffic data and the anomaly detection model, thereby adjusting the model parameters of the anomaly detection model multiple times until the updated anomaly detection model meets the training end criteria, resulting in a trained anomaly detection model.

[0069] In this embodiment, by preprocessing the initial traffic data and labeling the training traffic data, the data quality of the training traffic data can be improved, thereby enhancing the effectiveness of anomaly detection model training. The server can improve the application effectiveness of the trained anomaly detection model by repeatedly updating the model parameters within the anomaly detection model and using model performance as the training termination condition. This results in an anomaly detection model that meets the training termination condition and improves the detection accuracy of the anomaly detection model.

[0070] In an exemplary embodiment, before the step of “inputting real-time network traffic data in the cyberspace into the trained anomaly detection model to determine anomaly detection results of the network traffic data”, the method further includes:

[0071] Entity extraction and relationship extraction are performed on the abnormal resource data obtained from the network security data source to obtain the entities and relationships corresponding to the abnormal resource data, and based on the entities and relationships, the network security knowledge graph composed of the abnormal resource data is determined.

[0072] The network security knowledge graph is updated based on the existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph.

[0073] Based on the abnormal resource data in the cybersecurity knowledge graph, the labeled normal and abnormal network traffic data is evaluated to determine the comprehensiveness, completeness, and accuracy assessment results of the cybersecurity knowledge graph on the labeled normal and abnormal network traffic data. If at least one of the comprehensiveness, completeness, and accuracy assessment results does not meet the preset standard value, the abnormal resource data in the cybersecurity knowledge graph is updated to obtain an updated cybersecurity knowledge graph.

[0074] The comprehensiveness assessment results represent the number of entities and relationships in the cybersecurity knowledge graph; the completeness assessment results indicate whether the attributes of each entity in the cybersecurity knowledge graph are complete; and the accuracy assessment results represent the evaluation metrics of the predictive model corresponding to the cybersecurity knowledge graph. The cybersecurity data source is the actual abnormal and normal requests recorded in cyberspace, with abnormal requests corresponding to abnormal resource data, and normal requests corresponding to normal resource data. The cybersecurity data source contains the request subject (i.e., the execution subject) in abnormal requests, the request object (e.g., a server, URL, etc.), and the request content (e.g., files, images, videos, etc.). The data in the cybersecurity data source is typically unstructured.

[0075] Specifically, the server can perform entity and relationship extraction on the unstructured data in the network security data source to determine the entities and relationships corresponding to abnormal and normal requests in the network security data source. The server can then add only the entities and relationships corresponding to abnormal requests as triples to the network security knowledge graph. The triples in the network security knowledge graph are derived by treating the aforementioned request subject, request object, and request content as entities, and the associations between the request subject, request object, and request content as relationships.

[0076] The server can also retrieve triples from the cybersecurity knowledge base and merge them with the cybersecurity knowledge graph to obtain an updated cybersecurity knowledge graph. The cybersecurity knowledge base is a collection of multiple access requests in a cyberspace manually constructed from historical data. Because the data in the cybersecurity knowledge base is structured, the server does not need to extract entities from the cybersecurity knowledge base. Instead, it can directly merge the existing graph structure with the cybersecurity knowledge graph based on the associations defined in the cybersecurity knowledge graph to obtain an updated cybersecurity knowledge graph.

[0077] The server can evaluate the comprehensiveness, completeness, and accuracy of the cybersecurity knowledge graph. The server can determine a threshold for the number of estimated entities and relationships based on data from the cybersecurity data source and the cybersecurity knowledge base. If the number of entities and relationships in the cybersecurity knowledge graph obtained by the server does not meet the threshold, the server determines that the comprehensiveness of the cybersecurity knowledge graph is unsatisfactory. Furthermore, the server can traverse the cybersecurity knowledge graph by selecting keywords from the cybersecurity data source and the cybersecurity knowledge base to determine whether the keywords are stored as entities in the cybersecurity knowledge graph, thereby determining the integrity of the cybersecurity knowledge graph. Finally, based on the updated cybersecurity knowledge graph, the server can perform predictions on self-annotated normal network traffic data (normal requests) and abnormal network traffic data (abnormal requests), determine the prediction accuracy of the cybersecurity knowledge graph, and use this as the accuracy evaluation result. For example, the server can determine whether network traffic data is normal or abnormal based on abnormal resource data stored in the cybersecurity knowledge graph, thereby testing the performance of the cybersecurity knowledge graph using self-annotated network traffic data.

[0078] In this embodiment, a network security knowledge graph is constructed by performing entity extraction and relationship extraction on the network security data source, and the network security knowledge graph is updated through the existing graph structure in the network security knowledge base. The quality of the network security knowledge graph is evaluated through the comprehensiveness evaluation results, the integrity evaluation results, and the accuracy evaluation results. When all comprehensiveness evaluation results reach the preset standard values, the network security knowledge graph is updated, which can improve the quality of the network security knowledge graph.

[0079] In an exemplary embodiment, the method also includes: if the anomaly detection result is normal, determining the fingerprint information of the system and application corresponding to the network traffic data; blurring the fingerprint information by adding random noise, deleting or modifying features, and encrypting features to obtain blurred fingerprint information; based on a random insertion or random position replacement strategy, mixing the blurred fingerprint information with the network traffic data to obtain updated network traffic data.

[0080] Specifically, the server detects access requests in the network traffic data and obtains anomaly detection results, and the anomaly detection results in the network traffic data are normal. The server can obtain the system and application corresponding to the network traffic data and determine the fingerprint information of the system and application. The server can add random noise, delete features, modify features, and encrypt features to the fingerprint information, thereby blurring the fingerprint information and obtaining blurred fingerprint information. The server can mix the blurred fingerprint information with the network traffic data through a preset random insertion or random position replacement strategy to obtain updated network traffic data, thereby completing the hiding of the system and application corresponding to the network traffic data.

[0081] In this embodiment, by fuzzifying the fingerprint information corresponding to the system and application corresponding to the network traffic data, and mixing the fuzzified fingerprint information with the network traffic data, the security of the network traffic data during transmission in the cyberspace can be improved.

[0082] In an exemplary embodiment, the specific implementation process of the step of "analyzing potential attack paths based on abnormal patterns and the topology of the network space to determine a predicted attack plan" includes:

[0083] According to the abnormal pattern, the host that has been invaded in the topological structure of the network space, or the external abnormal user is determined as the starting point of the attack; according to the UCT selection strategy, the child node corresponding to the attack starting point is determined in the topological structure of the network space, and the new state corresponding to the child node is generated; based on the new state, the child node is expanded until all the child nodes are generated according to the new state, and a node tree consisting of the child nodes and the attack starting point is obtained; according to the preset number of simulations, by randomly selecting actions, the process of each node in the node tree from the current state to the terminal state is simulated, and the simulation statistical information corresponding to each node in the node tree is obtained; according to the simulation statistical information and the topological structure of the node tree, the attack action with high expected return is determined as the predicted attack plan.

[0084] The UCT (Upper Confidence Bounds for Trees) selection strategy is used for decision tree search and to make better decisions in uncertain environments. A compromised host can be the request subject, request content, or request object in an abnormal request. A compromised host can also be the request subject, request content, or request object in other abnormal requests that fall under the same abnormal pattern as the abnormal request.

[0085] Specifically, the server can obtain multiple abnormal requests contained in the abnormal pattern corresponding to the abnormal request and project the request content, request subject, and request object involved in the abnormal request into the topology of the network space to obtain at least one compromised host (abnormal request object). The server can also obtain external abnormal users (abnormal request subjects) in the multiple abnormal requests. The server can use the compromised host and external abnormal user as the starting point of the attack.

[0086] The server can use the UCT selection strategy to obtain the node corresponding to the attack starting point in the topology structure, obtain the child nodes around the node, and generate a new state for the child node. The new state is used to mark the child node, and the new state can represent the state change of the child node when it is attacked or not attacked on the potential attack path. The server can expand the child node based on the value of each new state, and further determine the next layer of child nodes towards the neighboring nodes in the topology structure, and generate a new state corresponding to the next layer of child nodes. It should be understood that the value of the new state can show a step-by-step change based on the propagation method of the abnormal pattern and the number of layers of child nodes. According to the preset iteration rules, the server can obtain a node tree generated by multiple layers of child nodes. The node tree contains each child node and the attack starting point. Based on this, the server can generate multiple node trees.

[0087] Afterwards, for each node tree, the server can perform simulations in the node tree according to the preset number of simulations. Starting from the attack starting point, by randomly selecting actions for each node in the node tree, the state value of each child node is randomly changed, thereby simulating the process of each node from the current state to the terminal state. When the preset number of simulations is reached, each child node reaches the terminal state. At this time, the statistical information of all nodes between the attack node and the current child node in the node tree is recorded. The server can reset the state value of the node tree and repeat the simulation in the node tree. Since the simulation process randomly selects actions, the path of each simulation is different, and the statistical information of all nodes obtained is also different. After multiple rounds of simulation, the server can determine the expected benefit of each node tree based on the statistical information of each node in each round, and determine the simulated action corresponding to the node tree with the highest expected benefit as the best action, and determine the best action as the predicted attack plan.

[0088] In this embodiment, an attack starting point is determined through anomaly patterns. A node tree consisting of multiple new states of child nodes is generated using the UCT selection strategy and the attack starting point. Subsequently, the state of each node in the node tree is simulated based on randomly selected actions, thereby obtaining simulated statistical information for each node in each node tree. Finally, based on this simulated statistical information, a node tree with a high expected return is identified, and the attack action corresponding to the node tree is obtained as a predicted attack plan. This improves the completeness and accuracy of the predicted attack plan.

[0089] In an exemplary embodiment, the specific implementation process of the step of “updating the security policy based on the predicted attack scenario to obtain the updated security policy” includes:

[0090] The configured security policy is determined as the current state in the simulated annealing policy, and the cost function value of the current state is determined, as well as the initial temperature and the termination temperature of the simulated annealing policy.

[0091] Based on the attack path and impact range in the predicted attack scenario, the parameters in the current state are adjusted, the current state is mutated, and the candidate state after mutation and the cost function value corresponding to the candidate state are determined.

[0092] The difference between the cost function value of the current state and the cost function value of the candidate state is determined. If the difference meets a preset condition, the candidate state is determined to be the current state.

[0093] Return to the step of adjusting the parameters in the current state based on the attack path and impact range in the predicted attack scenario until the initial temperature is reduced to the termination temperature.

[0094] The state with the minimum cost function value among the current states is determined, and the security policy is updated according to the state with the minimum cost function value to obtain an updated security policy.

[0095] The cost function value is determined based on the cost function of the predicted attack scenario and the security policy. The cost function is a preset function within the security policy.

[0096] Specifically, the server initializes the current security policy to the current state in a simulated annealing strategy and determines the cost function value corresponding to the current state based on the simulated annealing strategy. Based on this, the server obtains the attack path and impact range from the predicted attack scenario, uses the attack path and impact range as two influencing parameters, and adjusts the parameters in the current state to obtain the adjusted current state. The server mutates the adjusted current state using the simulated annealing strategy, randomly updating the security policy to obtain a mutated candidate state and determine the cost function value corresponding to the candidate state. The candidate state can be understood as the state corresponding to the updated security policy.

[0097] The server can determine the error value between the cost function value of the current state and the cost function value of the candidate state, and determine the candidate state as the current state when the error value meets the preset conditions. It should be understood that each time a mutation is performed, the initial temperature in the simulated annealing strategy will change until the initial temperature becomes the termination temperature after multiple changes and no mutation can be performed. Based on this, the server can perform multiple mutations before reaching the termination temperature. After each mutation, the current state can be adjusted to generate a candidate state, and the cost function values ​​of the current state and the candidate state can be compared to determine the candidate state as the current state, or retain the current state. Ultimately, the server can obtain multiple current states during the annealing process. The server can select the state with the smallest cost function value from the multiple current states as the final state, and update the security policy according to the mutation process of the final state to obtain an updated security policy.

[0098] In this embodiment, the security policy is mutated multiple times through the simulated annealing strategy to obtain multiple current states, and the current state with the smallest cost function value is selected as the final state. The server finally updates the security policy according to the final state to obtain an updated security policy, which can improve the protection scope and protection accuracy of the security policy, thereby improving the security of the security policy.

[0099] like Figure 3 As shown, the following describes in detail the specific implementation process of the above-mentioned cyberspace anti-mapping method in a cyberspace anti-mapping system, combined with a specific embodiment. The server can be configured with a cyberspace anti-mapping system, which includes an intelligence integration module, a knowledge graph library (cyberspace knowledge graph), an anomaly detection module, a request identification module, a fingerprint obfuscation module, a path analysis module, a policy optimization module, a defense response module, and a display and operation platform.

[0100] Among them, the intelligence integration module is mainly used to collect, integrate and analyze threat information from various security intelligence sources to obtain real-time threat intelligence support; the knowledge graph library is mainly used to establish a cyberspace knowledge base, and regularly update and maintain the knowledge base, as well as associate the pre-processed network traffic data with the pre-built network security knowledge base, extract key features, and mark potential threat information in the traffic; the anomaly detection module is mainly used to monitor and analyze abnormal requests and behavior patterns, and the anomaly detection model in the anomaly detection module is trained using the data annotated by the knowledge graph library, and then the trained model is used to monitor network traffic in real time; the request identification module is mainly used to analyze abnormal patterns in network traffic and receive the detection results of the anomaly detection module. It also records and classifies abnormal requests, and feeds back the identified abnormal patterns to the knowledge graph module, thereby updating the knowledge graph library. The fingerprint obfuscation module is used to perform fingerprint obfuscation processing on systems and applications. The path analysis module is used to evaluate different network attack paths based on the source information provided by the request identification module, combined with the system topology and security policy, and analyze the propagation path and impact range of network attacks. The policy optimization module is used to optimize the system's security policy and parameter configuration based on the attack path analysis results provided by the path analysis module, and adjust the defense policy in real time. The defense response module is used to automatically trigger corresponding defense measures and emergency response mechanisms based on the threats detected by the system. The display operation platform is used to display the system analysis results to management users in a visual form. The defense response module automatically triggers corresponding defense measures and emergency response mechanisms based on the data transmitted by the path analysis module and the request identification module. The display operation platform summarizes the operating data of each module and displays it visually.

[0101] In an exemplary embodiment, the specific steps for constructing the knowledge graph network space knowledge base are as follows:

[0102] Step 1.1: Clean and preprocess the raw data collected from various security intelligence sources, vulnerability databases, and malicious IP lists, and classify the processed data according to data type and source. Then, use NLP technology and entity extraction algorithms to identify entities from the text data in each data and extract the corresponding attributes of each group of entities.

[0103] Step 1.2: Analyze the association relationships in the data, and determine and extract the relationships between entities through rule matching methods. The identified entities are used as nodes of the graph, and the relationships between entities are used as edges of the graph to form a set of directed or undirected graph structures.

[0104] Step 1.3: Use professional dictionaries, security threat intelligence, malware signature libraries, security vulnerability databases, expert knowledge, and industry standards to expand and supplement the constructed knowledge graph. Then, store the constructed knowledge graph in a graph database or graph storage system, and establish a corresponding index structure to build the corresponding cyberspace knowledge base.

[0105] Step 1.4: Conduct a quality assessment on the constructed knowledge base, and optimize and modify each set of data stored in the base based on the assessment results. Then, regularly collect new data from each set of data sources to update and expand the knowledge base.

[0106] In an exemplary embodiment, the anomaly detection module monitors and analyzes the following specific steps:

[0107] Step 2.1: Capture network traffic data flowing through the system from the network in real time, perform data cleaning, noise removal, and feature extraction on the collected raw network traffic data, then unify the data format of each processed network traffic data and label each group of processed network traffic data.

[0108] Step 2.2: Build a monitoring model based on the PyTorch deep learning framework, define the structure of the input layer, hidden layer, and output layer of the monitoring model, compile and initialize the monitoring model, and then divide the network traffic data into a training set, a test set, and a training set.

[0109] Step 2.3: Use the data from the training set to train the monitoring model. Send the input data into the model for forward propagation to obtain the corresponding predicted value. Calculate the loss value between the predicted value and the actual value through the loss function, and obtain the gradient of the loss value to the model parameters through the backpropagation algorithm. Then, the Adam optimizer updates the model parameters based on the calculated gradient information.

[0110] Step 2.4: After each training session, use the validation set data to evaluate the model performance during training. If the model performance no longer improves, stop training. Otherwise, continue training and adjust the model's hyperparameters or structure based on the validation information until the preset number of training times is reached.

[0111] Step 2.5: Use the test set data to evaluate the performance of the trained model and fine-tune the model based on the test results. Input the real-time captured network traffic data into the trained monitoring model for real-time monitoring. Through continuous observation and analysis of network traffic data, abnormal requests and behavior patterns can be identified.

[0112] Step 2.6: Based on the constructed knowledge graph, further detect and analyze the identified abnormal requests, compare the characteristics in the network traffic data with known attack patterns and threat intelligence, determine whether there are potential security threats, analyze the behavior patterns of abnormal requests, and infer the possible attack type and attack target through analysis of abnormal behavior patterns.

[0113] In an exemplary embodiment, the fingerprint obfuscation module performs fingerprint obfuscation processing in the following specific steps:

[0114] Step 3.1: Use the Masscan fingerprint extraction tool to extract fingerprint information from the system and application, and then perform obfuscation processing on the extracted fingerprint information by adding random noise, deleting or modifying some features, and encrypting the features;

[0115] Step 3.2: Use random insertion or random position replacement methods to mix the obfuscated fingerprint information with normal traffic data, and process the obfuscated data according to the system's external response rules and policies. Then, regularly adjust and update the fingerprint obfuscation strategy based on the latest attack techniques and security threats.

[0116] In an exemplary embodiment, the path analysis module performs the following steps to evaluate the network attack path:

[0117] Step 4.1: Collect network topology information, build a network topology map based on the collected information, identify attack targets in the network, and select one or more groups of compromised hosts or external malicious users as attack starting points;

[0118] Step 4.2: Set the attack starting point as the root node and initialize the root node statistics. Starting from the root node, select the node to be expanded in the network topology according to the UCT selection strategy. Expand the selected node and generate a new state after taking different actions from the current state. Based on the generated new state, generate all possible child nodes.

[0119] Step 4.3: Simulate a series of actions of the expanded node from the current state to the terminal state by randomly selecting actions. Based on the results of the simulated game, update the statistics of all nodes on the path from the root node to the current node;

[0120] Step 4.4: Repeat the process of node selection, expansion, simulated games, and statistics update until the preset number of searches is reached. Based on the node statistics, the action with the highest expected payoff is selected as the best action, and the selected best action is returned as the final attack plan.

[0121] Step 4.5: Based on the optimal attack plan, analyze the attack propagation path and impact range, and then optimize and improve network security defense measures based on the analysis results.

[0122] In an exemplary embodiment, the specific steps of policy optimization module parameter configuration and policy adjustment optimization are as follows:

[0123] Step 5.1: Use the current system parameter configuration or strategy setting as the starting state, set an initial temperature and an end temperature, and use the initial temperature to control the start state of simulated annealing, and use the end temperature to control the stop state of simulated annealing;

[0124] Step 5.2: Mutate the current system state by randomly selecting parameters and fine-tuning them to generate a set of new candidate states. Calculate the cost function or objective function corresponding to the newly generated candidate states.

[0125] Step 5.3: Calculate the difference in the cost function between the current state and the new state. If the energy difference is negative or meets the preset probability, accept the new state. Update the state of the system based on the judgment result of accepting the new state. If the new state is accepted, update the current state to the new state.

[0126] Step 5.4: Reduce the temperature by exponential decay and check whether the current temperature has dropped below the termination temperature. If so, stop simulated annealing. Otherwise, repeat the process of generating a new solution for replacement.

[0127] Step 5.5: After the simulated annealing is terminated, the system state with the minimum cost function value is returned. According to the system state, the system parameter configuration and strategy settings are adjusted, and the system is further optimized and adjusted according to the specific application scenario and optimization goal.

[0128] In this embodiment, network traffic data flowing through the system is captured and processed from the network in real time, a monitoring model is established based on the PyTorch deep learning framework, the monitoring model is compiled and initialized, and then the network traffic data is divided into a training set, a test set, and a training set to train and adjust the constructed monitoring model. The real-time captured network traffic data is input into the trained monitoring model for real-time monitoring. By continuously observing and analyzing the network traffic data, abnormal requests and behavior patterns are identified. Based on the constructed knowledge graph, the identified abnormal requests are further detected and analyzed. The features in the network traffic data are compared with known attack patterns and threat intelligence to determine whether there are potential security threats. The behavior patterns of abnormal requests are analyzed, and the possible attack types and attack targets are inferred through the analysis of abnormal behavior patterns. This can achieve a more comprehensive and comprehensive security defense, provide rich security knowledge and rules, and realize intelligent security defense. It has strong scalability and can adapt to the ever-changing network security threats and environment.

[0129] Furthermore, in this embodiment, a network topology is constructed to identify attack targets in the network. One or more groups of compromised hosts or external malicious users are selected as attack starting points, with the attack starting point being the root node. Statistical information for the root node is initialized. Starting from the root node, nodes in the network topology are selected for expansion, and new states are generated after different actions are taken from the current state. All possible child nodes are generated based on the generated new states. Randomly selecting actions simulates a series of actions taken by the expanded node from the current state to the final state. Based on the results of the simulated game, statistical information for all nodes on the path from the root node to the current node is updated. The process of node selection, expansion, simulated game, and statistical information update is repeated until a preset number of searches is reached. Based on the node statistics, the action with the highest expected benefit is selected as the optimal action, and the selected optimal action is returned as the final attack plan. Based on the optimal attack plan, the attack propagation path and impact range are analyzed. Network security defense measures are then optimized and improved based on the analysis results. This improves the ability to identify and respond to attacks, reduces the likelihood of the system being attacked, enables timely response to emerging network attack threats, and maintains the timeliness and effectiveness of network security defenses.

[0130] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0131] Based on the same inventive concept, embodiments of the present application also provide a cyberspace de-mapping device for implementing the aforementioned cyberspace de-mapping method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more cyberspace de-mapping device embodiments provided below can be found in the above-mentioned limitations of the cyberspace de-mapping method and will not be further elaborated here.

[0132] In an exemplary embodiment, Figure 4 As shown, a cyberspace anti-mapping device 400 is provided, comprising: an anomaly detection module 401, an attack prediction module 402 and a policy update module 403, wherein:

[0133] Anomaly detection module 401 is configured to input real-time network traffic data in a cyberspace into a trained anomaly detection model to determine anomaly detection results for the network traffic data; the anomaly detection model is trained based on annotated data in a network security knowledge graph; the network security knowledge graph includes anomaly resource data in a cyberspace and the relationships between the anomaly resource data;

[0134] Attack prediction module 402 is configured to, if the anomaly detection result is abnormal, determine an abnormal pattern corresponding to an abnormal request in the network traffic data, analyze potential attack paths based on the abnormal pattern and the topological structure of the network space, and determine a predicted attack plan; an abnormal request is an access request initiated by the network traffic data with an abnormal detection result to various resource data in the network space;

[0135] The policy updating module 403 is configured to update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

[0136] Furthermore, the device also includes a model training module, which is specifically used to: perform data preprocessing on the initial traffic data obtained in real time to obtain training traffic data, and mark the training traffic data based on the abnormal resource data and the correlation relationship between the abnormal resource data in the network security knowledge graph to obtain marked training traffic data; establish a preset anomaly detection model, and determine the loss value based on the training traffic data and the anomaly detection model, and determine the gradient information of the anomaly detection model through the back propagation algorithm and the loss value; update the model parameters of the anomaly detection model through the gradient information to obtain an updated anomaly detection model, and return to execute the step of determining the loss value based on the training traffic data and the anomaly detection model until the model performance of the anomaly detection model meets the training end conditions to obtain a trained anomaly detection model.

[0137] Furthermore, the device also includes a graph determination module, which is specifically used to: perform entity extraction and relationship extraction on the abnormal resource data obtained from the network security data source to obtain entities and relationships corresponding to the abnormal resource data, and determine the network security knowledge graph composed of the abnormal resource data based on the entities and relationships; update the network security knowledge graph based on the existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph; evaluate the normal and abnormal network traffic data marked according to the abnormal resource data in the network security knowledge graph to determine the comprehensiveness evaluation result, integrity evaluation result and accuracy evaluation result of the network security knowledge graph for the normal and abnormal network traffic data marked; wherein the comprehensiveness evaluation result is used to represent the number of entities and relationships in the network security knowledge graph; the integrity evaluation result is used to indicate whether the attributes of each entity in the network security knowledge graph are complete; the accuracy evaluation result is used to represent the evaluation index of the prediction model corresponding to the network security knowledge graph; if at least one of the comprehensiveness evaluation result, integrity evaluation result and accuracy evaluation result does not reach the preset standard value, the abnormal resource data in the network security knowledge graph is updated to obtain an updated network security knowledge graph.

[0138] Furthermore, the device also includes a fingerprint fuzzy module, which is specifically used to: if the anomaly detection result is normal, determine the fingerprint information of the system and application corresponding to the network traffic data; fuzzify the fingerprint information by adding random noise, deleting or modifying features, and encrypting features to obtain blurred fingerprint information; based on a random insertion or random position replacement strategy, mix the blurred fingerprint information with the network traffic data to obtain updated network traffic data.

[0139] Furthermore, the attack prediction module 402 is specifically used to: determine the invaded host in the topological structure of the network space or the external abnormal user as the attack starting point based on the abnormal pattern; determine the child node corresponding to the attack starting point in the topological structure of the network space according to the UCT selection strategy, and generate a new state corresponding to the child node; based on the new state, expand the child node until all child nodes are generated according to the new state, and obtain a node tree consisting of child nodes and attack starting points; according to the preset number of simulations, simulate the process of each node in the node tree reaching the terminal state from the current state by randomly selecting actions, and obtain the simulation statistical information corresponding to each node in the node tree; according to the simulation statistical information and the topological structure of the node tree, determine the attack action with high expected benefits as the predicted attack plan.

[0140] Furthermore, the policy update module 403 is specifically used to: determine the configured security policy as the current state in the simulated annealing policy, and determine the cost function value of the current state, as well as determine the initial temperature and termination temperature of the simulated annealing policy; the cost function value is determined based on the cost function of the predicted attack plan and the security policy; based on the attack path and influence range in the predicted attack plan, adjust the parameters in the current state, mutate the current state, determine the candidate state after the mutation and the cost function value corresponding to the candidate state; determine the difference between the cost function value of the current state and the cost function value of the candidate state, and if the difference meets the preset conditions, determine the candidate state as the current state; return to execute the step of adjusting the parameters in the current state based on the attack path and influence range in the predicted attack plan until the initial temperature drops to the termination temperature; determine the state with the smallest cost function value in each current state, and update the security policy according to the state with the smallest cost function value to obtain an updated security policy.

[0141] Each module in the aforementioned cyberspace counter-mapping device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a computer device's memory in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0142] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, memory and input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data such as security policies and network security knowledge graphs. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for anti-mapping of cyberspace is implemented.

[0143] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0144] In an exemplary embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0145] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0146] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0148] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0149] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A cyberspace reverse mapping method, characterized in that: The method comprises: Perform entity extraction and relationship extraction on abnormal resource data obtained from a network security data source to obtain entities and relationships corresponding to the abnormal resource data, and determine a network security knowledge graph constituted by the abnormal resource data based on the entities and relationships; Updating the network security knowledge graph based on an existing graph structure in a network security knowledge base to obtain an updated network security knowledge graph; Based on the abnormal resource data in the network security knowledge graph, the marked normal and abnormal network traffic data are evaluated to determine the comprehensiveness evaluation results, completeness evaluation results, and accuracy evaluation results of the network security knowledge graph on the marked normal and abnormal network traffic data; wherein the comprehensiveness evaluation result is used to represent the number of entities and relationships in the network security knowledge graph; the completeness evaluation result is used to indicate whether the attributes of each entity in the network security knowledge graph are complete; and the accuracy evaluation result is used to represent the evaluation index of the prediction model corresponding to the network security knowledge graph; If at least one of the comprehensiveness assessment result, the integrity assessment result, and the accuracy assessment result does not reach a preset standard value, updating the abnormal resource data in the network security knowledge graph to obtain an updated network security knowledge graph; Inputting the real-time network traffic data in the cyberspace into a trained anomaly detection model to determine an anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph includes anomaly resource data in the cyberspace and the association relationship between the anomaly resource data; If the anomaly detection result is abnormal, determining an abnormal pattern corresponding to the abnormal request in the network traffic data, and analyzing potential attack paths based on the abnormal pattern and the topological structure of the network space to determine a predicted attack plan; the abnormal request is an access request initiated by the network traffic data with the abnormal detection result to various resource data in the network space; The security policy is updated based on the predicted attack scenario to obtain an updated security policy, and the security policy is executed.

2. The method according to claim 1, characterized in that Before inputting the real-time network traffic data in the cyberspace into the trained anomaly detection model and determining an anomaly detection result of the network traffic data, the method further includes: Performing data preprocessing on the initial traffic data acquired in real time to obtain training traffic data, and marking the training traffic data based on the abnormal resource data in the network security knowledge graph and the association relationship between the abnormal resource data to obtain marked training traffic data; Establishing a preset anomaly detection model, determining a loss value based on the training traffic data and the anomaly detection model, and determining gradient information of the anomaly detection model through a backpropagation algorithm and the loss value; The model parameters of the anomaly detection model are updated using the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to execute until the model performance of the anomaly detection model meets the training end condition, thereby obtaining a trained anomaly detection model.

3. The method according to claim 1, characterized in that The method further comprises: If the anomaly detection result is normal, determining fingerprint information of the system and application corresponding to the network traffic data; Obfuscating the fingerprint information by at least one of adding random noise, deleting or modifying features, and encrypting features to obtain obfuscated fingerprint information; Based on a random insertion or random position replacement strategy, the blurred fingerprint information is mixed with the network traffic data to obtain updated network traffic data.

4. The method according to claim 1, wherein Analyzing potential attack paths based on the abnormal pattern and the topological structure of the network space to determine a predicted attack plan includes: According to the abnormal pattern, determining an invaded host in the topology of the network space or an external abnormal user as an attack starting point; Determine, in accordance with the UCT selection strategy, a child node corresponding to the attack starting point in the topological structure of the network space, and generate a new state corresponding to the child node; Based on the new state, the child nodes are expanded until all child nodes are generated according to the new state, thereby obtaining a node tree consisting of the child nodes and the attack starting point; According to a preset number of simulations, by randomly selecting actions, a process of each node in the node tree reaching a terminal state from a current state is simulated to obtain simulation statistical information corresponding to each node in the node tree; According to the simulation statistical information and the topological structure of the node tree, an attack action with a high expected return is determined as a predicted attack plan.

5. The method according to claim 1, wherein The updating of the security policy based on the predicted attack scenario to obtain an updated security policy includes: Determining the configured security policy as the current state in the simulated annealing policy, determining a cost function value of the current state, and determining an initial temperature and an end temperature of the simulated annealing policy; the cost function value is determined based on the predicted attack scenario and the cost function of the security policy; Based on the attack path and impact range in the predicted attack scenario, adjusting parameters in the current state, mutating the current state, and determining a candidate state after the mutation and a cost function value corresponding to the candidate state; Determine a difference between a cost function value of the current state and a cost function value of the candidate state, and if the difference satisfies a preset condition, determine the candidate state as the current state; Returning to the step of adjusting the parameters in the current state based on the attack path and impact range in the predicted attack scenario, until the initial temperature drops to the termination temperature; A state in which the cost function value is minimum among the current states is determined, and the security policy is updated according to the state in which the cost function value is minimum to obtain an updated security policy.

6. A cyberspace anti-mapping device, characterized in that: The device comprises: A graph determination module is configured to perform entity extraction and relationship extraction on abnormal resource data obtained from a network security data source, obtain entities and relationships corresponding to the abnormal resource data, and determine a network security knowledge graph constituted by the abnormal resource data based on the entities and relationships; A graph updating module, configured to update the network security knowledge graph based on an existing graph structure in the network security knowledge base to obtain an updated network security knowledge graph; A data evaluation module is configured to evaluate the labeled normal and abnormal network traffic data based on the abnormal resource data in the network security knowledge graph, and determine the comprehensiveness evaluation results, completeness evaluation results, and accuracy evaluation results of the network security knowledge graph on the labeled normal and abnormal network traffic data; wherein the comprehensiveness evaluation results are used to indicate the number of entities and relationships in the network security knowledge graph; the completeness evaluation results are used to indicate whether the attributes of each entity in the network security knowledge graph are complete; and the accuracy evaluation results are used to indicate the evaluation indicators of the prediction model corresponding to the network security knowledge graph; The graph updating module is further configured to update the abnormal resource data in the network security knowledge graph to obtain an updated network security knowledge graph if at least one of the comprehensiveness assessment result, the integrity assessment result, and the accuracy assessment result does not meet a preset standard value; An anomaly detection module, configured to input the real-time network traffic data in the cyberspace into a trained anomaly detection model to determine an anomaly detection result of the network traffic data; the anomaly detection model is trained based on the annotated data in the network security knowledge graph; the network security knowledge graph includes anomaly resource data in the cyberspace and the associations between the anomaly resource data; an attack prediction module configured to, if the anomaly detection result is abnormal, determine an abnormal pattern corresponding to an abnormal request in the network traffic data, and analyze potential attack paths based on the abnormal pattern and the topological structure of the network space to determine a predicted attack scenario; the abnormal request is an access request initiated by the network traffic data with the abnormal detection result to various resource data in the network space; The policy updating module is used to update the security policy based on the predicted attack scenario, obtain the updated security policy, and execute the security policy.

7. The device according to claim 6, characterized in that The device further comprises a processing module, wherein the processing module is configured to: Performing data preprocessing on the initial traffic data acquired in real time to obtain training traffic data, and marking the training traffic data based on the abnormal resource data in the network security knowledge graph and the association relationship between the abnormal resource data to obtain marked training traffic data; Establishing a preset anomaly detection model, determining a loss value based on the training traffic data and the anomaly detection model, and determining gradient information of the anomaly detection model through a backpropagation algorithm and the loss value; The model parameters of the anomaly detection model are updated using the gradient information to obtain an updated anomaly detection model, and the step of determining the loss value based on the training traffic data and the anomaly detection model is returned to execute until the model performance of the anomaly detection model meets the training end condition, thereby obtaining a trained anomaly detection model.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images