One-stop threat analysis and supervision command system

Abstract

The invention relates to the technical field of network security, and discloses a one-stop threat analysis and supervision command system, which comprises a first data structuring module used for sorting collected threat information to obtain first one-dimensional structure data; the abnormal event recognition module is used for inputting the first one-dimensional structure data into an abnormal recognition model and outputting a result representing whether the event is abnormal or not; the second data structuring module is used for generating first two-dimensional structure data; the defense strategy module is used for inputting the first two-dimensional structure data into a strategy generation model, and the strategy generation model outputs a result representing a defense strategy; according to the method, multiple advanced technologies such as multi-source heterogeneous data mining, high-dimensional attack pattern recognition and intelligent decision making are fused, various network attack behaviors can be detected in real time, potential threats can be analyzed, defense countermeasures can be made, and defense resources can be commanded, so that active defense is realized, and the network security protection capability is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a one-stop threat analysis and supervision command system. Background Art

[0002] Cyberspace is becoming a new attack front, with cyber attack methods constantly being updated and attack targets becoming increasingly covert and precise. Traditional passive defense systems such as firewalls and intrusion detection can no longer fully ensure the security of network systems. Summary of the invention

[0003] The present invention provides a one-stop threat analysis and supervision command system to solve the technical problem that traditional passive defense systems such as firewalls and intrusion detection in related technologies are difficult to fully ensure the security of network systems.

[0004] The present invention provides a one-stop threat analysis and supervision command system, including:

[0005] Threat information collection module, which is used to collect threat information, including original network data packets, traffic statistics, system logs, vulnerability libraries, and honeypots;

[0006] A first data structuring module is used to sort the collected threat information to obtain a number one one-dimensional structured data; the number one one-dimensional structured data includes n data items sorted by time, the tth data item represents the threat information collected for the tth time; each time an event occurs, threat information is collected once;

[0007] An abnormal event recognition module is used to input the number one one-dimensional structure data into an abnormal recognition model, the abnormal recognition model includes a first intermediate layer and a first output layer, the first intermediate layer inputs the number one one-dimensional structure data and outputs the first intermediate representation data to the first output layer, and the first output layer outputs a result indicating whether the event corresponding to each moment is abnormal;

[0008] The second data structuring module is used to extract the user behavior data associated with the abnormal event, and then generate a No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes a No. 1 data matrix and a No. 1 relationship matrix, a unit of the No. 1 data matrix represents a No. 1 one-dimensional structure data of an independent object, the independent object includes an abnormal event, user behavior, host, attack source IP, privileged account, important service, indicating that a unit of the No. 1 data matrix only contains the data of the independent object it represents;

[0009] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0;

[0010] A defense strategy module, which is used to input the first two-dimensional structure data into a strategy generation model, the strategy generation model includes a second intermediate layer, a third intermediate layer, a second output layer and a third output layer, wherein the second intermediate layer and the third intermediate layer both input the first two-dimensional structure data, the second intermediate layer outputs the second intermediate representation data to the second output layer, the third intermediate layer outputs the third intermediate representation data to the second output layer and the third output layer, and the second output layer outputs the result representing the defense strategy;

[0011] The output of the third output layer represents the attack technology route, target system, and hazard assessment results of the attack suffered by cyberspace.

[0012] Furthermore, features are extracted from heterogeneous data sources such as raw network packets, traffic statistical features, system logs, vulnerability libraries, honeypots, etc.

[0013] Furthermore, the existence of a correlation between abnormal events means that: the abnormal events occur at adjacent times;

[0014] The association between abnormal events and user behaviors means that: user behaviors trigger abnormal events;

[0015] The association between user behavior and privileged accounts means: the user used the privileged account to perform operations;

[0016] The abnormal event is associated with the victim host, which means: the abnormal event damages the host;

[0017] The association between the abnormal event and the attack source IP means that the IP address of the user who triggered the abnormal event is the attack source IP.

[0018] Further, the defense strategy includes firewall rules, intrusion prevention measures, and vulnerability remediation.

[0019] Furthermore, the abnormal event recognition model is used as a discriminator and connected to the first pre-trained output layer. The first pre-trained output layer outputs a judgment result of whether the input is threat information of a true abnormal event or threat information of a false abnormal event. The generator is combined for adversarial training. The generator inputs random noise and then generates threat information of false abnormal events.

[0020] Furthermore, the calculation formula of the first intermediate layer is as follows:

[0021] h t =tanh(W hh h t -1+W xh X t +b h )

[0022] where h trepresents the tth first intermediate representation data output by the first intermediate layer, h t-1 represents the t-1th first intermediate representation data, x t represents the tth data item of the one-dimensional structure data, W hh and W xh are the first and second weight parameters, b h is the first bias parameter and tanh is the hyperbolic tangent function.

[0023] Furthermore, the calculation formula of the first output layer is as follows:

[0024] G (t) =σ(W G H (t) +b G )

[0025] Among them G (t) represents the first output vector. The two components of the first output vector represent whether the event corresponding to the tth moment is abnormal. G is the first output weight parameter, b G is the first output bias parameter, and σ represents the sigmoid function.

[0026] Furthermore, the calculation formula of the second intermediate layer is as follows:

[0027]

[0028] where k v The second intermediate representation data of the vth unit of the data matrix No. 1, M (v) is the set of cells associated with the vth cell of the data matrix No. 1, S u represents the data of the independent object represented by the u-th unit of the data matrix, c v is a normalization constant, σ is the sigmoid function, W k represents the third weight parameter;

[0029] The calculation formula for the third intermediate layer is as follows:

[0030]

[0031] Where P v The third intermediate representation data of the vth unit of the data matrix No. 1, W p represents the state weight parameter, S v and S u Respectively represent the data of the independent objects represented by the vth and uth cells of the data matrix, M (v) represents the set of cells of the data matrix that are associated with the vth cell of the data matrix, and M represents M (v)The total number of cells in ;

[0032] R u，v =tanh(δ*S v T *S u +1)

[0033] Where tanh represents the hyperbolic tangent function, T represents the transpose, and δ represents an adjustable parameter; the default value of δ is 1 / M;

[0034] The calculation formula of the second output layer is as follows:

[0035]

[0036] Where y represents the second output vector, and its cth component value represents the probability value of the cth strategy. The strategy with the largest probability value is selected as the output. The strategy group contains all executable strategies. A strategy includes the parameters of each protection behavior in the network space. u represents the second intermediate representation data of the u-th unit of the data matrix No. 1, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W y is the second output weight parameter, b y is the second output bias parameter, σ represents the sigmoid function;

[0037] The calculation formula of the third output layer is as follows:

[0038]

[0039] Where Y represents the third output vector, its A components represent the probability values ​​of A attack technology routes, B components represent the probability values ​​of B target systems, and C components represent the probability values ​​of C hazard assessment levels. The attack technology route, target system, and hazard assessment with the largest probability value are output, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W Y is the third output weight parameter, b Y is the third output bias parameter, and σ represents the sigmoid function.

[0040] Furthermore, the parameters of the protection behavior include the ID of the firewall rule, the ID of the intrusion prevention measure, and whether the vulnerability repair is started.

[0041] The present invention provides a computer storage medium for storing computer-readable instructions, which can run the aforementioned one-stop threat analysis and supervision command system when the computer-readable instructions are read.

[0042] The beneficial effects of the present invention are:

[0043] The present invention integrates a number of cutting-edge technologies such as multi-source heterogeneous data mining, high-dimensional attack pattern recognition, and intelligent decision-making. It can detect various types of network attack behaviors in real time, analyze potential threats, formulate defense countermeasures and command defense resources, thereby achieving active defense and greatly improving network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a module schematic diagram of the one-stop threat analysis and supervision command system of the present invention;

[0045] Figure 2 It is a module schematic diagram of the computer storage medium of the present invention. DETAILED DESCRIPTION

[0046] The subject matter described herein will now be discussed with reference to example implementations. It should be understood that the discussion of these implementations is only to enable those skilled in the art to better understand and implement the subject matter described herein, and the functions and arrangements of the elements discussed may be changed without departing from the scope of protection of the present specification. Various examples may omit, replace, or add various processes or components as needed. In addition, the features described in some examples may also be combined in other examples.

[0047] At least one embodiment of the present invention discloses a one-stop threat analysis and supervision command system, such as Figure 1 As shown, including:

[0048] Threat information collection module, which is used to collect threat information, including original network data packets, traffic statistics, system logs, vulnerability libraries, and honeypots;

[0049] It is necessary to extract features from heterogeneous data sources such as original network packets, traffic statistics, system logs, vulnerability libraries, honeypots, etc., including:

[0050] 1. Network traffic feature extraction;

[0051] Extract statistical features from network data packets, such as communication session duration, packet size, protocol type, etc.

[0052] Use deep packet inspection (DPI) technology to extract application layer features, such as HTTP requests, file transfers, etc.

[0053] 2. Log feature extraction;

[0054] Parse system logs and security device logs to extract various event information;

[0055] Use regular expressions, structured queries, and other methods to identify key fields;

[0056] 3. Vulnerability feature extraction;

[0057] Extract information such as attack vectors, exploitation methods, and degree of harm of each known vulnerability from the vulnerability database;

[0058] 4. Honeypot feature extraction;

[0059] Analyze attacker behaviors captured by honeypots, such as attack payloads, malicious code samples, etc.

[0060] A first data structuring module is used to sort the collected threat information to obtain a number one one-dimensional structured data; the number one one-dimensional structured data includes n data items sorted by time, the tth data item represents the threat information collected for the tth time; each time an event occurs, threat information is collected once;

[0061] The abnormal event recognition module is used to input the numbered one-dimensional structure data into the abnormal recognition model. The abnormal recognition model includes a first intermediate layer and a first output layer. The first intermediate layer inputs the numbered one-dimensional structure data and outputs the first intermediate representation data to the first output layer. The first output layer outputs the result indicating whether the event corresponding to each moment is abnormal.

[0062] The second data structuring module is used to extract the user behavior data associated with the abnormal event, and then generate a No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes a No. 1 data matrix and a No. 1 relationship matrix, a unit of the No. 1 data matrix represents a No. 1 one-dimensional structure data of an independent object, the independent object includes an abnormal event, user behavior, host, attack source IP, privileged account, important service, indicating that a unit of the No. 1 data matrix only contains the data of the independent object it represents;

[0063] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0;

[0064] There is a correlation between abnormal events if: the abnormal events occur at adjacent times;

[0065] The association between abnormal events and user behaviors means that: user behaviors trigger abnormal events;

[0066] The association between user behavior and privileged accounts means: the user used the privileged account to perform operations;

[0067] The abnormal event is associated with the victim host, which means: the abnormal event damages the host;

[0068] The association between an abnormal event and the attack source IP means that the IP address of the user who triggered the abnormal event is the attack source IP;

[0069] The defense strategy module is used to input the No. 1 two-dimensional structure data into the strategy generation model, and the strategy generation model includes a second intermediate layer, a third intermediate layer, a second output layer, and a third output layer, wherein the second intermediate layer and the third intermediate layer both input the No. 1 two-dimensional structure data, the second intermediate layer outputs the second intermediate representation data to the second output layer, the third intermediate layer outputs the third intermediate representation data to the second output layer and the third output layer, and the second output layer outputs the result of the defense strategy. The defense strategy includes firewall rules, intrusion prevention measures, vulnerability repairs and other protection behaviors.

[0070] The output of the third output layer represents the attack technology route, target system, and hazard assessment results of the attack suffered by cyberspace.

[0071] like Figure 2 As shown, at least one embodiment of the present invention discloses a computer storage medium for storing computer-readable instructions, which can run the aforementioned one-stop threat analysis and supervision command system when the computer-readable instructions are read.

[0072] In one embodiment of the present invention, the abnormal event recognition model is used as a discriminator and is connected to the first pre-trained output layer, which outputs the judgment result of whether the input is threat information of a true abnormal event or threat information of a false abnormal event. The generator is combined for adversarial training, the generator inputs random noise, and then generates threat information of false abnormal events.

[0073] Through adversarial training, the discriminator can learn the distribution of threat information of abnormal events, so that the abnormal event recognition model can recognize abnormal events that do not appear in the training data.

[0074] In one embodiment of the present invention, the calculation formula of the first intermediate layer is as follows:

[0075] h t =tanh(W hh h t-1 +W xh X t +b h )

[0076] where h t represents the tth first intermediate representation data output by the first intermediate layer, h t-1 represents the t-1th first intermediate representation data, x t represents the tth data item of the one-dimensional structure data, W hh and W xh are the first and second weight parameters, b h is the first bias parameter and tanh is the hyperbolic tangent function.

[0077] The calculation formula of the first output layer is as follows:

[0078] G (t) =σ(W G H (t) +b G )

[0079] Among them G (t) represents the first output vector. The two components of the first output vector represent whether the event corresponding to the tth moment is abnormal. G is the first output weight parameter, b G is the first output bias parameter, and σ represents the sigmoid function.

[0080] In one embodiment of the present invention, the calculation formula of the second intermediate layer is as follows:

[0081] The calculation formula for the second intermediate layer is as follows:

[0082]

[0083] where k v The second intermediate representation data of the vth unit of the data matrix No. 1, M (v) is the set of cells associated with the vth cell of the data matrix No. 1, S u represents the data of the independent object represented by the u-th unit of the data matrix, c v is a normalization constant, σ is the sigmoid function, W k Represents the third weight parameter.

[0084] The calculation formula for the third intermediate layer is as follows:

[0085]

[0086] Where P v The third intermediate representation data of the vth unit of the data matrix No. 1, W P represents the state weight parameter, S v and S u Respectively represent the data of the independent objects represented by the vth and uth cells of the data matrix, M (v) represents the set of cells of the data matrix that are associated with the vth cell of the data matrix, and M represents M (v) The total number of cells in ;

[0087] R u，v =tanh(δ*S v T *S u +1)

[0088] Where tanh represents the hyperbolic tangent function, T represents the transpose, and δ represents an adjustable parameter; the default value of δ is 1 / M.

[0089] The calculation formula of the second output layer is as follows:

[0090]

[0091] Where y represents the second output vector, and its cth component value represents the probability value of the cth strategy. The strategy with the largest probability value is selected as the output. The strategy group contains all executable strategies. A strategy includes the parameters of each protection behavior in the network space. u represents the second intermediate representation data of the u-th unit of the data matrix No. 1, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W y is the second output weight parameter, b y is the second output bias parameter, and σ represents the sigmoid function.

[0092] The calculation formula of the third output layer is as follows:

[0093]

[0094] Where Y represents the third output vector, its A components represent the probability values ​​of A attack technology routes, B components represent the probability values ​​of B target systems, and C components represent the probability values ​​of C hazard assessment levels. The attack technology route, target system, and hazard assessment with the largest probability value are output, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W Y is the third output weight parameter, b Y is the third output bias parameter, and σ represents the sigmoid function.

[0095] In one embodiment of the present invention, the parameters of the protection behavior include the ID of the firewall rule, the ID of the intrusion prevention measure, and whether the vulnerability repair is started.

[0096] The above describes an embodiment of the present invention, but this embodiment is not limited to the above-mentioned specific implementation mode. The above-mentioned specific implementation mode is merely illustrative and not restrictive. Under the guidance of this embodiment, ordinary technicians in this field can also make more forms of equivalent embodiments, all of which are within the protection of this embodiment.

Claims

1. One-stop threat analysis and supervision command system, characterized by: include: Threat information collection module, which is used to collect threat information, including original network data packets, traffic statistics, system logs, vulnerability libraries, and honeypots; A first data structuring module, which is used to sort the collected threat information to obtain a number one one-dimensional structure data; The one-dimensional structure data includes n data items sorted by time, and the tth data item represents the threat information collected for the tth time; Every time an event occurs, threat information is collected; An abnormal event recognition module is used to input the number one one-dimensional structure data into an abnormal recognition model, the abnormal recognition model includes a first intermediate layer and a first output layer, the first intermediate layer inputs the number one one-dimensional structure data and outputs the first intermediate representation data to the first output layer, and the first output layer outputs a result indicating whether the event corresponding to each moment is abnormal; The second data structuring module is used to extract the user behavior data associated with the abnormal event, and then generate a No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes a No. 1 data matrix and a No. 1 relationship matrix, a unit of the No. 1 data matrix represents a No. 1 one-dimensional structure data of an independent object, the independent object includes an abnormal event, user behavior, host, attack source IP, privileged account, important service, indicating that a unit of the No. 1 data matrix only contains the data of the independent object it represents; The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0; A defense strategy module, which is used to input the first two-dimensional structure data into a strategy generation model, the strategy generation model includes a second intermediate layer, a third intermediate layer, a second output layer and a third output layer, wherein the second intermediate layer and the third intermediate layer both input the first two-dimensional structure data, the second intermediate layer outputs the second intermediate representation data to the second output layer, the third intermediate layer outputs the third intermediate representation data to the second output layer and the third output layer, and the second output layer outputs the result representing the defense strategy; The output of the third output layer represents the attack technology route, target system, and hazard assessment results of the attack suffered by cyberspace.

2. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: Extract features from raw network packets, traffic statistics, system logs, vulnerability libraries, and honeypots.

3. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: There is a correlation between abnormal events if: the abnormal events occur at adjacent times; The association between abnormal events and user behaviors means that: user behaviors trigger abnormal events; The association between user behavior and privileged accounts means: the user used the privileged account to perform operations; The abnormal event is associated with the victim host, which means: the abnormal event damages the host; The association between the abnormal event and the attack source IP means that the IP address of the user who triggered the abnormal event is the attack source IP.

4. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: Defense strategies include firewall rules, intrusion prevention measures, and vulnerability remediation.

5. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: The abnormal event recognition model is used as a discriminator and connected to the first pre-trained output layer. The first pre-trained output layer outputs the judgment result of whether the input is the threat information of a true abnormal event or the threat information of a false abnormal event. The generator is combined for adversarial training. The generator inputs random noise and then generates threat information of false abnormal events.

6. The one-stop threat analysis and monitoring command system according to claim 1, characterized in that: The calculation formula for the first intermediate layer is as follows: h t =tanh (W hh h t-1 +W xh x t +b h ) where h t represents the tth first intermediate representation data output by the first intermediate layer, h t-1 represents the t-1th first intermediate representation data, x t represents the tth data item of the one-dimensional structure data, W hh and W xh are the first and second weight parameters, b h is the first bias parameter and tanh is the hyperbolic tangent function.

7. The one-stop threat analysis and monitoring command system according to claim 6, characterized in that: The calculation formula of the first output layer is as follows: G (t) =σ(W G H (t) +b G ) Among them G (t) represents the first output vector. The two components of the first output vector represent whether the event corresponding to the tth moment is abnormal. G is the first output weight parameter, b G is the first output bias parameter, and σ represents the sigmoid function.

8. The one-stop threat analysis and monitoring command system according to claim 1 or 7, characterized in that: The calculation formula for the second intermediate layer is as follows: where k v The second intermediate representation data of the vth unit of the data matrix No. 1, M (v) is the set of cells associated with the vth cell of the data matrix No. 1, S u represents the data of the independent object represented by the u-th unit of the data matrix, c v is a normalization constant, σ is the sigmoid function, W k represents the third weight parameter; The calculation formula for the third intermediate layer is as follows: Where P v The third intermediate representation data of the vth unit of the data matrix No. 1, W P represents the state weight parameter, S v and S u Respectively represent the data of the independent objects represented by the vth and uth cells of the data matrix, M (v) represents the set of cells of the data matrix that are associated with the vth cell of the data matrix, and M represents M (v) The total number of cells in ; R u,v =tanh(δ*S v T *S u +1) Where tanh represents the hyperbolic tangent function, T represents the transpose, and δ represents an adjustable parameter; the default value of δ is 1 / M; The calculation formula of the second output layer is as follows: Where y represents the second output vector, and its cth component value represents the probability value of the cth strategy. The strategy with the largest probability value is selected as the output. The strategy group contains all executable strategies. A strategy includes the parameters of each protection behavior in the network space. u represents the second intermediate representation data of the u-th unit of the data matrix No. 1, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W y is the second output weight parameter, b y is the second output bias parameter, σ represents the sigmoid function; The calculation formula of the third output layer is as follows: Where Y represents the third output vector, its A components represent the probability values ​​of A attack technology routes, B components represent the probability values ​​of B target systems, and C components represent the probability values ​​of C hazard assessment levels. The attack technology route, target system, and hazard assessment with the largest probability value are output, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W Y is the third output weight parameter, b Y is the third output bias parameter, and σ represents the sigmoid function.

9. The one-stop threat analysis and monitoring command system according to claim 8, characterized in that: The parameters of the protection behavior include the ID of the firewall rule, the ID of the intrusion prevention measure, and whether the vulnerability repair is enabled.

10. A computer storage medium, characterized in that: It is used to store computer-readable instructions, which, when read, can run the one-stop threat analysis and supervision command system as described in any one of claims 1-9.

Images