Network security threat-oriented network topology structure labeling method, device and equipment

Abstract

The invention relates to a network topology structure labeling method, device and equipment oriented to network security threats. The method comprises the following steps: acquiring a network threat intelligence set, and determining a severity characterization value of each network threat intelligence in the network threat intelligence set; determining the weight of each network node in the network topology structure to be labeled; for a network node in the network topology structure, at least one associated network threat intelligence related to the network node is determined from the network threat intelligence set, and according to the weight of the network node and the respective severity characterization value of the at least one associated network threat intelligence, the severity characterization value of the at least one associated network threat intelligence is determined; determining a threat level of the network node; and marking the threat level and the weight of the network node in the network topology structure. By adopting the method, the network security protection effect can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network topology structure annotation method, device and equipment for network security threats. Background Art

[0002] With the rapid development of information technology and the widespread popularization of the Internet, network security issues have become increasingly severe, so network security protection methods have emerged.

[0003] Traditional network security protection methods mainly rely on static rules and attack feature libraries for detection and protection.

[0004] However, with the rapid changes in information systems and the increasing complexity and diversity of cyber attacks, traditional methods have gradually shown their shortcomings in efficiency and accuracy, and the effectiveness of network security protection needs to be improved. Summary of the invention

[0005] Based on this, it is necessary to provide a network topology structure labeling method, device and equipment for network security threats that can improve the effectiveness of network security protection in response to the above technical problems.

[0006] On the one hand, the present application provides a network topology structure labeling method, including: obtaining a network threat intelligence set, determining the severity representation value of each network threat intelligence in the network threat intelligence set; determining the respective weight of each network node in the network topology structure to be labeled; for a network node in the network topology structure, determining at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determining the threat level of the network node based on the weight of the network node and the respective severity representation value of the at least one associated network threat intelligence; labeling the threat level and weight of the network node in the network topology structure.

[0007] On the other hand, the present application also provides a network topology structure labeling device, including: an intelligence acquisition module, used to acquire a network threat intelligence set and determine the severity representation value of each network threat intelligence in the network threat intelligence set; a weight determination module, used to determine the respective weights of each network node in the network topology structure to be labeled; a level determination module, used to determine, for a network node in the network topology structure, at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determine the threat level of the network node based on the weight of the network node and the respective severity representation values ​​of the at least one associated network threat intelligence; a node labeling module, used to label the threat level and weight of the network node in the network topology structure.

[0008] In some embodiments, the weight determination module is also used to determine, for each network node in the network topology structure, the number of network nodes directly connected to the network node, and obtain the number of connected nodes corresponding to the network node; obtain a first evaluation value of the network node based on the number of connected nodes; and determine the weight of the network node based on the first evaluation value.

[0009] In some embodiments, the weight determination module is also used to determine each network node pair from the network topology structure, wherein the network node pair includes two different network nodes; for each of the network node pairs, determine at least one shortest path between two network nodes in the network node pair to constitute a shortest path set corresponding to the network node pair; for each of the network nodes, count the number of target shortest paths passing through the network node in the shortest path sets corresponding to each network node pair that does not include the network node, obtain the number of shortest paths corresponding to the network node, and determine a second evaluation value of the network node based on the number of shortest paths; and determine the weight of the network node based on the first evaluation value and the second evaluation value.

[0010] In some embodiments, the weight determination module is also used to determine, for each network node in the network topology structure, the shortest path length between the network node and each remaining network node in the network topology structure, and obtain a third evaluation value corresponding to the network node by comprehensively determining the shortest path lengths; and determine the weight of the network node based on the first evaluation value, the second evaluation value and the third evaluation value.

[0011] In some embodiments, the level determination module is also used to comprehensively calculate the severity representation value of each of the at least one associated network threat intelligence to obtain a total severity representation value; and determine the threat level of the network node based on the weight of the network node and the total severity representation value.

[0012] In some embodiments, the intelligence acquisition module is further used to determine the threat level of the threat intelligence for each network threat intelligence in the network threat intelligence set; and determine the severity representation value of the threat intelligence based on the threat level of the threat intelligence.

[0013] On the other hand, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above-mentioned network topology structure labeling method when executing the computer program.

[0014] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the above-mentioned video file compression method are implemented.

[0015] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements the steps in the above-mentioned network topology structure labeling method when executed by a processor.

[0016] The above-mentioned network topology structure annotation method, device, computer equipment, computer-readable storage medium and computer program product obtain a network threat intelligence set, determine the severity representation value of each network threat intelligence in the network threat intelligence set, determine the weight of each network node in the network topology structure to be annotated, and for the network node in the network topology structure, determine at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determine the threat level of the network node according to the weight of the network node and the severity representation value of at least one associated network threat intelligence, and annotate the threat level and weight of the network node in the network topology structure. Thus, a direct association relationship is established between the network threat intelligence and the network topology structure, and the network threat intelligence is effectively applied to the network topology structure, which can intuitively reflect the various threats faced by the network topology structure, and can intuitively observe the impact and scope of network threats on the network topology structure, thereby improving the efficiency and accuracy of network security management, thereby improving the effect of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0018] FIG1 is an application environment diagram of a network topology structure annotation method according to an embodiment;

[0019] FIG2 is a schematic diagram of a flow chart of a network topology labeling method in one embodiment;

[0020] FIG3 is a schematic diagram of a network topology marking method in another embodiment;

[0021] FIG4 is a structural block diagram of a network topology labeling device in one embodiment;

[0022] FIG5 is a diagram showing the internal structure of a computer device in one embodiment;

[0023] FIG. 6 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0025] The network topology structure annotation method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1, which includes a network topology structure of multiple network nodes, such as network nodes 1 to network nodes 6, and the application environment also includes a computer device. Among them, the connection between the network nodes represents that the network nodes can communicate with each other. The data storage system can store data that the computer device needs to process. The data storage system can be integrated on the computer device, or it can be placed on the cloud or other network servers. Although the computer device is drawn outside the network in the figure, the location of the computer device is not limited in this scheme. The computing device can also be located in the network, that is, the computer device can also be a network node in the network. The computer device can obtain a network threat intelligence set, determine the severity representation value of each network threat intelligence in the network threat intelligence set, determine the weight of each network node in the network topology structure, and for the network node in the network topology structure, determine at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determine the threat level of the network node according to the weight of the network node and the severity representation value of at least one associated network threat intelligence, and mark the threat level and weight of the network node in the network topology structure.

[0026] The network node may be a terminal or a server. The computer device may be a terminal or a server, and the terminal may be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, etc. The server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0027] In some embodiments, as shown in FIG2 , a network topology structure annotation method is provided, which can be applied to a terminal or a server, and is described by taking the method applied to the computer device in FIG1 as an example, including the following steps 202 to 208. Among them:

[0028] Step 202: Obtain a network threat intelligence set and determine a severity representation value of each network threat intelligence in the network threat intelligence set.

[0029] Specifically, a computer device may form a network threat intelligence collection from part or all of the threat intelligence in the threat intelligence library. The threat intelligence in the threat intelligence library may be collected by the computer device or by other devices. The sources of network threat intelligence include but are not limited to open source or closed source threat intelligence. The data interface definition of threat intelligence may be pre-set. The threat intelligence in the threat intelligence library may be collected based on the data interface defined by the data interface definition. The threat intelligence library may be stored in a database.

[0030] Cyber ​​threat intelligence can be divided into many types, including but not limited to malware intelligence, vulnerability intelligence, attack behavior intelligence, or malicious domain name and IP (Internet Protocol Address) address intelligence. Malware intelligence includes but is not limited to basic information, analysis and detection methods of malware such as computer viruses, worms, Trojans, spyware, etc. Vulnerability intelligence includes but is not limited to vulnerability information in various software, systems and devices. Attack behavior intelligence includes but is not limited to information such as attack methods, targets, and attack tools. Malicious domain name and IP address intelligence includes but is not limited to information on malicious domain names and IP addresses.

[0031] Specifically, computer equipment or other equipment can clean, deduplicate, verify and classify the collected network threat intelligence to build a threat intelligence library.

[0032] Step 204: determine the weight of each network node in the network topology structure to be labeled.

[0033] The network topology structure includes a plurality of network nodes, and the network topology structure also includes edges. The edges are used to indicate that there is a connection relationship between two network nodes, and the two network nodes with a connection relationship can communicate with each other.

[0034] Specifically, the computer device may determine the weight of the network node according to the connection relationship between the network node and other network nodes in the network topology. For example, for a network node, the computer device may determine the number of network nodes connected to the network node from the network topology, and determine the weight of the network node according to the determined number, and the weight may be positively correlated with the number.

[0035] In some embodiments, for each network node, the computer device may obtain the functional description information of the network node, the functional description information is used to describe the role of the network node, and the weight of the network node is determined according to the functional description information. The weights of network nodes with different roles may be different, and the weights corresponding to different roles may be pre-set.

[0036] Step 206, for a network node in the network topology structure, determine at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determine the threat level of the network node based on the weight of the network node and the severity representation value of the at least one associated network threat intelligence.

[0037] Specifically, for each network node, at least one associated network threat intelligence related to the network node is searched from the network threat intelligence set. If not found, the threat level of the network node can be determined to be the lowest level. If found, the threat level of the network node can be determined based on the weight of the network node and the severity representation value of each of the at least one associated network threat intelligence related to the network node.

[0038] In some embodiments, the computer device may determine the severity representation value of the network threat intelligence based on the mapping relationship between the network threat intelligence and the severity representation value. For example, Y is used to represent the network threat intelligence, M is used to represent the severity representation value of the network threat intelligence, and s is used to represent the mapping relationship between the network threat intelligence and the severity representation value, then M=s(Y).

[0039] In some embodiments, when the at least one associated network threat intelligence is only one associated network threat intelligence, the computer device may determine the threat level of the network node according to the severity representation value and the weight of the network node. The computer device may multiply the severity representation value and the weight of the network node, use the multiplication result as the severity representation value corresponding to the network node, and determine the threat level of the network node according to the severity representation value of the network node. The severity representation value of the network node is positively correlated with the threat level of the network node.

[0040] In some embodiments, when the at least one associated network threat intelligence is at least two associated network threat intelligences, the computer device can comprehensively calculate the severity representation value of each of the at least one associated network threat intelligence to obtain a total severity representation value, and determine the threat level of the network node based on the weight of the network node and the total severity representation value.

[0041] In some embodiments, the computer device determines the network threat intelligence related to the network node in the following ways, including but not limited to: (1) IP address and domain name matching: matching the IP address and domain name in the network threat intelligence with the network node in the network topology structure. If the IP address or domain name in the network threat intelligence directly corresponds to a network node in the network topology structure, then it can be determined that the network threat intelligence is directly related to the network node. (2) Attack method and target system analysis: analyzing the attack method and target system described in the network threat intelligence. If the attack method may affect a network node in the network topology structure, or the target system is part of the network topology structure, then it can be considered that the network threat intelligence has a potential association with the relevant network node in the network topology structure. (3) Utilizing tools and platforms: utilizing network security analysis tools and platforms, such as SIEM (Security Information and Event Management), SOC (Security Operations Center), etc., to further analyze and associate the network threat intelligence. These tools usually have powerful data processing and correlation analysis capabilities, which can help security personnel quickly identify the correlation between network threat intelligence and network nodes in the network topology structure.

[0042] Step 208: marking the threat level and weight of the network node in the network topology.

[0043] Specifically, the computer device can directly or indirectly display the network topology structure, and for each network node in the network topology structure, display or mark the corresponding weight corresponding to the network node. For network nodes with threat levels, display or mark the corresponding threat levels corresponding to the network nodes with threat levels. From the marked network topology structure, the role and impact of threat intelligence on the network topology structure can be intuitively observed.

[0044] In some embodiments, when the computer device is a server, the computer device can send the network topology structure and the threat levels and weights of the network nodes in the network topology structure to the terminal, and the terminal displays the network topology structure and displays the threat levels and weights of the network nodes on the network topology structure.

[0045] In some embodiments, when the computer device is a terminal, the terminal may display a network topology structure, and display the threat levels and weights of network nodes on the network topology structure.

[0046] In the above network topology structure annotation method, a network threat intelligence set is obtained, the severity representation value of each network threat intelligence in the network threat intelligence set is determined, and the weight of each network node in the network topology structure to be annotated is determined. For the network node in the network topology structure, at least one associated network threat intelligence related to the network node is determined from the network threat intelligence set, and the threat level of the network node is determined according to the weight of the network node and the severity representation value of at least one associated network threat intelligence, and the threat level and weight of the network node are annotated in the network topology structure. Thus, a direct association relationship is established between the network threat intelligence and the network topology structure, and the network threat intelligence is effectively applied to the network topology structure, which can intuitively reflect the various threats faced by the network topology structure, and can intuitively observe the impact and scope of network threats on the network topology structure, thereby improving the efficiency and accuracy of network security management, thereby improving the effect of network security protection.

[0047] In some embodiments, as shown in FIG. 3 , determining the weight of each network node in the network topology structure to be labeled includes: step 302, for each network node in the network topology structure, determining the number of network nodes directly connected to the network node from the network topology structure, and obtaining the number of connected nodes corresponding to the network node; step 304, obtaining a first evaluation value of the network node according to the number of connected nodes; and determining the weight of the network node based on the first evaluation value.

[0048] The edge in the network topology structure refers to a line connecting two nodes in the network topology structure. The first evaluation value is positively correlated with the number of connected nodes.

[0049] Specifically, the computer device may use the number of connected nodes as the first evaluation value. Alternatively, the computer device may normalize the number of connected nodes to obtain the first evaluation value.

[0050] In some embodiments, the computer device may determine the number of network nodes included in the network topology node to obtain the total number of network nodes. The computer device may calculate the ratio of the number of connected nodes to the total number of network nodes to obtain a first evaluation value. Alternatively, the computing device may calculate the ratio of the number of connected nodes to the total number of network nodes-1 to obtain a first evaluation value, for example, the first evaluation value=the number of connected nodes / (the total number of network nodes-1).

[0051] In some embodiments, the weight of the network node is positively correlated with the first evaluation value. For example, the computer device may use the first evaluation value as the weight of the network node.

[0052] In this embodiment, the weight of the network node is determined according to the amount of connected node data, thereby improving the accuracy of the weight.

[0053] In some embodiments, the method also includes: determining each network node pair from the network topology structure, the network node pair including two different network nodes; for each network node pair, determining at least one shortest path between two network nodes in the network node pair to form a shortest path set corresponding to the network node pair; for each network node, counting the number of target shortest paths passing through the network node in the shortest path sets corresponding to each network node pair that does not include the network node, to obtain the number of shortest paths corresponding to the network node, and determining a second evaluation value of the network node based on the number of shortest paths; determining the weight of the network node based on the first evaluation value, including: determining the weight of the network node based on the first evaluation value and the second evaluation value.

[0054] Among them, the weight of the network node is positively correlated with the second evaluation value. Taking the network topology structure in Figure 1 as an example, the process of obtaining the shortest path set is illustrated. The network node pairs are: (network node 1, network node 2), (network node 1, network node 3), (network node 1, network node 4), (network node 1, network node 5), (network node 1, network node 6), (network node 2, network node 3), (network node 2, network node 4), (network node 2, network node 5), (network node 2, network node 6), (network node 3, network node 4), (network node 3, network node 5), (network node 4, network node 6), (network node 5, network node 6).

[0055] Taking (network node 1, network node 6) as an example, the paths from network node 1 to network node 6 are: Path 1: network node 1 → network node 3 → network node 5 → network node 6, Path 2: network node 1 → network node 3 → network node 4 → network node 6, Path 3: network node 1 → network node 2 → network node 3 → network node 4 → network node 6, Path 4: network node 1 → network node 2 → network node 3 → network node 4 → network node 6. Since the lengths of Path 1 to Path 4 (the number of edges included) are 3, 3, 4, and 4 respectively, it can be seen that Path 1 and Path 2 are both the shortest paths between network node 1 and network node 6, so Path 1 and Path 2 are the shortest paths. Path 1 and Path 2 constitute the shortest path set corresponding to the network node pair (network node 1, network node 6). In the same way, the shortest path sets corresponding to the remaining network node pairs can be obtained.

[0056] When calculating the second evaluation value of any network node from network node 1 to network node 6, for example, network node 3, the network node pairs excluding network node 3 may be determined first, namely (network node 1, network node 2), (network node 1, network node 4), (network node 1, network node 5), (network node 1, network node 6), (network node 2, network node 4), (network node 2, network node 5), (network node 2, network node 6), (network node 4, network node 6), (network node 5, network node 6). Then, from the shortest path sets corresponding to the network nodes excluding network node 3, the target shortest paths passing through network node 3 are determined. In this example, the target shortest path refers to the shortest path passing through network node 3, and the number of target shortest paths is taken as the number of shortest paths corresponding to network node 3.

[0057] Specifically, for each network node, the computer device can count the number of shortest paths in the shortest path sets corresponding to each network node pair excluding the network node, and obtain the total number of paths corresponding to the network node. For example, for network node 3, the shortest path sets corresponding to the network node pairs excluding network node 3 are sets A and B, and the number of shortest paths included in set A and the number of shortest paths included in set B are summed to obtain the total number of paths corresponding to network node 3. The computer device can determine the second evaluation value of the network node based on the number of shortest paths corresponding to the network node and the total number of paths corresponding to the network node. The second evaluation value is negatively correlated with the total number of paths. The second evaluation value is positively correlated with the number of shortest paths.

[0058] In some embodiments, for each network node i, the computer device may determine a network node pair that does not include the network node i as a target network node pair corresponding to the network node i, determine the number of shortest paths in the shortest path set corresponding to the target network node pair that do not pass through the network node i, and obtain a first number corresponding to the target network node pair, and determine the number of all shortest paths included in the shortest path set corresponding to the target network node pair, and obtain a second number corresponding to the target network node pair, calculate the ratio of the first number to the second number, and obtain the number ratio corresponding to the target network node, and sum the number ratios corresponding to each target network node corresponding to the network node i to obtain a second evaluation value of the network node i.

[0059] In this embodiment, the second evaluation value is determined in combination with the shortest path, and the weight of the network node is determined in combination with the first evaluation value and the second evaluation value, thereby improving the accuracy of the weight.

[0060] In some embodiments, the method also includes: for each network node in the network topology structure, determining the shortest path length between the network node and each remaining network node in the network topology structure, and comprehensively determining the shortest path lengths to obtain a third evaluation value corresponding to the network node; based on the first evaluation value and the second evaluation value, determining the weight of the network node, including: determining the weight of the network node based on the first evaluation value, the second evaluation value and the third evaluation value.

[0061] The weight of the network node is positively correlated with the third evaluation value. The shortest path length between two network nodes refers to the length of the shortest path between the two network nodes (ie, the number of edges included in the shortest path).

[0062] Specifically, for network node i, the computer device can determine the shortest path length between network node i and network node j, where network node j is any network node that is the same as network node i, i.e., i≠j. When there are multiple network nodes that are different from network node i (i.e., the remaining network nodes), the shortest path lengths between network node i and each of the remaining network nodes are summed to obtain the total length. The computer device can determine the third evaluation value corresponding to the network node based on the total length, and the third evaluation value is negatively correlated with the total length. The computer device can determine the third evaluation value corresponding to the network node based on the total number and total length of network nodes included in the network topology. For example, if the total number of network nodes is N, the ratio of N to the total length can be used as the third evaluation value corresponding to the network node, or the ratio of N-1 to the total length can be used as the third evaluation value corresponding to the network node. In some embodiments, the first evaluation value is the value of the network node on the degree centrality (DC) indicator, the second evaluation value is the value of the network node on the betweenness centrality (BC) indicator, and the third evaluation value is the value of the network node on the closeness centrality (CC) indicator. The computer device can use a weight calculation function to calculate the weight, with X representing the weight and w representing the weight calculation function, then X=w (first evaluation value, second evaluation value, third evaluation value). The weight calculation function can be, but is not limited to, a function that calculates the mean or sum.

[0063] In some embodiments, the computer device may determine the fourth evaluation value of the network node according to the role of the network node, and the more important the role, the greater the fourth evaluation value. The computer device may determine the weight of the network device according to at least one of the first evaluation value, the second evaluation value, the third evaluation value, or the fourth evaluation value.

[0064] In this embodiment, the shortest path lengths determined are comprehensively determined to obtain a third evaluation value corresponding to the network node, and the weight of the network node is determined based on the first evaluation value, the second evaluation value and the third evaluation value, thereby improving the accuracy of the weight.

[0065] In some embodiments, the threat level of a network node is determined based on the weight of the network node and the severity representation value of at least one associated network threat intelligence, including: comprehensively calculating the severity representation value of at least one associated network threat intelligence to obtain a total severity representation value; and determining the threat level of the network node based on the weight of the network node and the total severity representation value.

[0066] Specifically, the comprehensive calculation may be a sum calculation, and the computer device may sum the severity representation values ​​of the at least one associated network threat intelligence to obtain a total severity representation value.

[0067] In some embodiments, the computer device may determine the threat level of the network node using a function for determining the threat level of the network node. For example, Z represents the threat level of the network node, then Z= f(X,M). f may be, but is not limited to, a function for calculating a product.

[0068] In this embodiment, the threat level of the network node is determined based on the weight and the total severity representation value of the network node, thereby improving the accuracy of the threat level.

[0069] In some embodiments, determining the severity representation value of each network threat intelligence in the network threat intelligence set includes: determining the threat level of the threat intelligence for each network threat intelligence in the network threat intelligence set; and determining the severity representation value of the threat intelligence based on the threat level of the threat intelligence.

[0070] Among them, the threat level can be divided into high, medium and low, etc. Different threat levels can correspond to different severity representation values.

[0071] Specifically, the computer device may determine a severity representation value corresponding to the threat level of the threat intelligence as the severity representation value of the threat intelligence.

[0072] In this embodiment, the severity characterization value of the threat intelligence is determined according to the threat level of the threat intelligence, thereby improving the accuracy of the severity characterization value.

[0073] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0074] Based on the same inventive concept, the embodiment of the present application also provides a network topology structure annotation device for implementing the network topology structure annotation method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more network topology structure annotation device embodiments provided below can refer to the limitations of the network topology structure annotation method above, and will not be repeated here.

[0075] In some embodiments, as shown in FIG. 4 , a network topology structure annotation device is provided, including: an intelligence acquisition module 402 , a weight determination module 404 , a level determination module 406 , and a node annotation module 408 , wherein:

[0076] The intelligence acquisition module 402 is used to acquire a network threat intelligence set and determine a severity representation value of each network threat intelligence in the network threat intelligence set.

[0077] The weight determination module 404 is used to determine the weight of each network node in the network topology structure to be marked.

[0078] The level determination module 406 is used to determine, for a network node in the network topology structure, at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determine the threat level of the network node based on the weight of the network node and the severity representation value of the at least one associated network threat intelligence.

[0079] The node marking module 408 is used to mark the threat level and weight of the network node in the network topology.

[0080] In some embodiments, the weight determination module 404 is also used to determine, for each network node in the network topology structure, the number of network nodes directly connected to the network node, and obtain the number of connected nodes corresponding to the network node; obtain a first evaluation value of the network node according to the number of connected nodes; and determine the weight of the network node based on the first evaluation value.

[0081] In some embodiments, the weight determination module 404 is also used to determine each network node pair from the network topology structure, where the network node pair includes two different network nodes; for each network node pair, determine at least one shortest path between the two network nodes in the network node pair to form a shortest path set corresponding to the network node pair; for each network node, count the number of target shortest paths passing through the network node in the shortest path sets corresponding to each network node pair that does not include the network node, obtain the number of shortest paths corresponding to the network node, and determine a second evaluation value of the network node based on the number of shortest paths; based on the first evaluation value and the second evaluation value, determine the weight of the network node.

[0082] In some embodiments, the weight determination module 404 is also used to determine, for each network node in the network topology structure, the shortest path length between the network node and each remaining network node in the network topology structure, and comprehensively determine the shortest path lengths to obtain a third evaluation value corresponding to the network node; based on the first evaluation value, the second evaluation value and the third evaluation value, determine the weight of the network node.

[0083] In some embodiments, the level determination module 406 is also used to comprehensively calculate the severity representation value of each of at least one associated network threat intelligence to obtain a total severity representation value; and determine the threat level of the network node based on the weight of the network node and the total severity representation value.

[0084] In some embodiments, the intelligence acquisition module 402 is further used to determine the threat level of the threat intelligence for each network threat intelligence in the network threat intelligence set; and determine the severity representation value of the threat intelligence according to the threat level of the threat intelligence.

[0085] Each module in the above network topology annotation device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0086] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data involved in the network topology structure annotation method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network topology structure annotation method is implemented.

[0087] In some embodiments, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a network topology structure annotation method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0088] Those skilled in the art will understand that the structures shown in FIGS. 5 and 6 are merely block diagrams of partial structures related to the scheme of the present application, and do not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than those shown in the figures, or combine certain components, or have a different arrangement of components.

[0089] In some embodiments, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0090] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above embodiments are implemented.

[0091] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above embodiments when executed by a processor.

[0092] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0093] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0094] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0095] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network topology labeling method, characterized in that: The method comprises: Obtain a network threat intelligence set, and determine a severity representation value of each network threat intelligence in the network threat intelligence set; Determine the weight of each network node in the network topology to be labeled; For a network node in the network topology structure, determining at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determining a threat level of the network node according to a weight of the network node and a severity representation value of each of the at least one associated network threat intelligence; The threat level and weight of the network node are marked in the network topology.

2. The method according to claim 1, characterized in that The determining of the weight of each network node in the network topology structure to be marked includes: For each network node in the network topology structure, determine the number of network nodes directly connected to the network node from the network topology structure to obtain the number of connected nodes corresponding to the network node; Obtaining a first evaluation value of the network node according to the number of connected nodes; A weight of the network node is determined based on the first evaluation value.

3. The method according to claim 2, characterized in that The method further comprises: Determining each network node pair from the network topology, the network node pair comprising two different network nodes; For each of the network node pairs, determining at least one shortest path between two network nodes in the network node pair to form a shortest path set corresponding to the network node pair; For each of the network nodes, count the number of target shortest paths passing through the network node in the shortest path sets respectively corresponding to each pair of network nodes excluding the network node, obtain the number of shortest paths corresponding to the network node, and determine the second evaluation value of the network node according to the number of shortest paths; The determining the weight of the network node based on the first evaluation value includes: Based on the first evaluation value and the second evaluation value, a weight of the network node is determined.

4. The method according to claim 3, characterized in that The method further comprises: For each network node in the network topology structure, determine the shortest path length between the network node and each remaining network node in the network topology structure, and obtain a third evaluation value corresponding to the network node by combining the determined shortest path lengths; The determining the weight of the network node based on the first evaluation value and the second evaluation value includes: A weight of the network node is determined based on the first evaluation value, the second evaluation value, and the third evaluation value.

5. The method according to any one of claims 1 to 4, characterized in that: The determining the threat level of the network node according to the weight of the network node and the severity representation value of each of the at least one associated network threat intelligence includes: Comprehensively calculating the severity representation value of each of the at least one associated network threat intelligence to obtain a total severity representation value; The threat level of the network node is determined based on the weight of the network node and the total severity representation value.

6. The method according to any one of claims 1 to 4, characterized in that: The determining of the severity representation value of each network threat intelligence in the network threat intelligence set includes: Determining the threat level of each piece of network threat intelligence in the network threat intelligence set; Determine a severity representation value of the threat intelligence based on the threat level of the threat intelligence.

7. A network topology annotation device, characterized in that: The device comprises: An intelligence acquisition module is used to acquire a network threat intelligence set and determine a severity representation value of each network threat intelligence in the network threat intelligence set; A weight determination module is used to determine the weight of each network node in the network topology structure to be marked; A level determination module is used to determine, for a network node in the network topology structure, at least one associated network threat intelligence related to the network node from the network threat intelligence set, and determine the threat level of the network node according to the weight of the network node and the severity representation value of each of the at least one associated network threat intelligence; The node marking module is used to mark the threat level and weight of the network node in the network topology.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images