One-stop Threat Analysis and Supervision Command System

Abstract

The present invention relates to the field of network security technology, and discloses a one-stop threat analysis and supervision command system, comprising: a first data structuring module, which is used to sort the collected threat information to obtain a number one one-dimensional structured data; an abnormal event identification module, which is used to input the number one one-dimensional structured data into an abnormal identification model, and output a result indicating whether the event is abnormal; a second data structuring module, which is used to generate a number one two-dimensional structured data; a defense strategy module, which is used to input the number one two-dimensional structured data into a strategy generation model, and the strategy generation model outputs a result indicating the defense strategy; the present invention integrates a number of cutting-edge technologies such as multi-source heterogeneous data mining, high-dimensional attack pattern recognition, and intelligent decision-making, and can detect various types of network attack behaviors in real time, analyze potential threats, formulate defense countermeasures and command defense resources, thereby realizing active defense and greatly improving network security protection capabilities.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more particularly, to a one-stop threat analysis and supervision command system. Background Art

[0002] Cyberspace is becoming a new frontier for cyberattacks, with ever-evolving methods and increasingly sophisticated targets. Traditional passive defense systems like firewalls and intrusion detection systems are no longer able to fully guarantee the security of network systems. Summary of the Invention

[0003] The present invention provides a one-stop threat analysis and supervision command system to solve the technical problem in related technologies that traditional passive defense systems such as firewalls and intrusion detection systems are unable to fully ensure the security of network systems.

[0004] The present invention provides a one-stop threat analysis and supervision command system, including:

[0005] Threat information collection module, which is used to collect threat information, including original network data packets, traffic statistics, system logs, vulnerability databases, and honeypots;

[0006] A first data structuring module is configured to sort the collected threat information to obtain a first one-dimensional structured data; the first one-dimensional structured data includes n data items sorted by time, the tth data item represents the threat information collected for the tth time; threat information is collected once each time an event occurs;

[0007] An abnormal event recognition module is configured to input the one-dimensional structured data into an abnormality recognition model. The abnormality recognition model includes a first intermediate layer and a first output layer. The first intermediate layer inputs the one-dimensional structured data and outputs first intermediate representation data to the first output layer. The first output layer outputs a result indicating whether the event corresponding to each moment is abnormal.

[0008] A second data structuring module is used to extract user behavior data associated with abnormal events and then generate two-dimensional structured data. The two-dimensional structured data includes a data matrix and a relationship matrix. A cell in the data matrix represents one-dimensional structured data of an independent object. The independent object includes an abnormal event, user behavior, host, attack source IP, privileged account, and important service. A cell in the data matrix only contains data of the independent object it represents.

[0009] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit and the independent object represented by the j-th unit of the No. 1 data matrix. If there is an association, the value of this element in the No. 1 relationship matrix is 1, otherwise it is 0;

[0010] a defense strategy module, which is used to input the first two-dimensional structure data into a strategy generation model, the strategy generation model including a second intermediate layer, a third intermediate layer, a second output layer, and a third output layer, wherein the second intermediate layer and the third intermediate layer both input the first two-dimensional structure data, the second intermediate layer outputs second intermediate representation data to the second output layer, the third intermediate layer outputs third intermediate representation data to the second output layer and the third output layer, and the second output layer outputs a result representing the defense strategy;

[0011] The third output layer outputs the attack technology route, target system, and hazard assessment results of the attack in cyberspace.

[0012] Furthermore, features are extracted from heterogeneous data sources such as raw network packets, traffic statistical features, system logs, vulnerability libraries, honeypots, etc.

[0013] Furthermore, the existence of a correlation between abnormal events means that: the abnormal events occur at adjacent times;

[0014] The association between abnormal events and user behaviors means that user behaviors trigger abnormal events;

[0015] The association between user behavior and privileged accounts refers to: the user used the privileged account to perform operations;

[0016] The abnormal event is associated with the victim host, which means that the abnormal event damages the host;

[0017] The association between an abnormal event and an attack source IP means that the IP address of the user who triggered the abnormal event is the attack source IP.

[0018] Furthermore, defense strategies include firewall rules, intrusion prevention measures, and vulnerability remediation.

[0019] Furthermore, the abnormal event recognition model is used as a discriminator and connected to the first pre-trained output layer. The first pre-trained output layer outputs the judgment result of whether the input is threat information of a true abnormal event or threat information of a false abnormal event. The combined generator is used for adversarial training. The generator inputs random noise and then generates threat information of a false abnormal event.

[0020] Furthermore, the calculation formula of the first intermediate layer is as follows:

[0021] h t =tanh(W hh h t -1+W xh X t +b h )

[0022] where h trepresents the t-th first intermediate representation data output by the first intermediate layer, h t-1 Indicates the t-1th first intermediate representation data, x t Represents the tth data item of the one-dimensional structure data, W hh and W xh are the first and second weight parameters, b h is the first bias parameter, and tanh is the hyperbolic tangent function.

[0023] Furthermore, the calculation formula of the first output layer is as follows:

[0024] G (t) =σ(W G H (t) +b G )

[0025] Among them G (t) Represents the first output vector. The two components of the first output vector represent whether the event corresponding to the t-th moment is abnormal or not. W G is the first output weight parameter, b G is the first output bias parameter, and σ represents the sigmoid function.

[0026] Furthermore, the calculation formula of the second intermediate layer is as follows:

[0027]

[0028] where k v The second intermediate representation data of the vth unit of the data matrix No. 1, M (v) is the set of cells associated with the vth cell of the data matrix No. 1, S u The data of the independent object represented by the u-th unit of the data matrix, c v is a normalization constant, σ is the sigmoid function, W k represents the third weight parameter;

[0029] The calculation formula for the third intermediate layer is as follows:

[0030]

[0031] Among them, P v The third intermediate representation data of the vth unit of the data matrix No. 1, W p represents the state weight parameter, S v and S u Respectively represent the data of the independent objects represented by the vth and uth cells of the data matrix, M (v) represents the set of cells of the data matrix that are associated with the vth cell of the data matrix, and M represents M (v)The total number of units in ;

[0032] R u，v =tanh(δ*S v T *S u +1)

[0033] Where tanh represents the hyperbolic tangent function, T represents the transpose, and δ represents an adjustable parameter; the default value of δ is 1 / M;

[0034] The calculation formula of the second output layer is as follows:

[0035]

[0036] Where y represents the second output vector, and its cth component value represents the probability value of the cth strategy. The strategy with the largest probability value is selected as the output. The strategy group contains all executable strategies. A strategy includes the parameters of each protection behavior in the network space. k u The second intermediate representation data of the u-th unit of the data matrix No. 1, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W y is the second output weight parameter, b y is the second output bias parameter, σ represents the sigmoid function;

[0037] The calculation formula of the third output layer is as follows:

[0038]

[0039] Where Y represents the third output vector, its A components represent the probability values of A attack technology routes, B components represent the probability values of B target systems, and C components represent the probability values of C hazard assessment levels. The attack technology route, target system, and hazard assessment with the largest probability value are output, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W Y is the third output weight parameter, b Y is the third output bias parameter, and σ represents the sigmoid function.

[0040] Furthermore, the parameters of the protection behavior include the ID of the firewall rule, the ID of the intrusion prevention measure, and whether the vulnerability repair is enabled.

[0041] The present invention provides a computer storage medium for storing computer-readable instructions, which can run the aforementioned one-stop threat analysis and supervision command system when the computer-readable instructions are read.

[0042] The beneficial effects of the present invention are:

[0043] This invention integrates a number of cutting-edge technologies such as multi-source heterogeneous data mining, high-dimensional attack pattern recognition, and intelligent decision-making. It can detect various types of network attack behaviors in real time, analyze potential threats, formulate defense countermeasures and command defense resources, thereby achieving active defense and greatly improving network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a module diagram of the one-stop threat analysis and supervision command system of the present invention;

[0045] Figure 2 It is a module schematic diagram of the computer storage medium of the present invention. DETAILED DESCRIPTION

[0046] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that these embodiments are discussed solely to enable those skilled in the art to better understand and implement the subject matter described herein, and that the functions and arrangements of the elements discussed may be varied without departing from the scope of this specification. Various examples may omit, substitute, or add various processes or components as needed. Furthermore, features described in some examples may be combined in other examples.

[0047] At least one embodiment of the present invention discloses a one-stop threat analysis and supervision command system, such as Figure 1 As shown, including:

[0048] Threat information collection module, which is used to collect threat information, including original network data packets, traffic statistics, system logs, vulnerability databases, and honeypots;

[0049] It is necessary to extract features from heterogeneous data sources such as raw network packets, traffic statistics, system logs, vulnerability libraries, honeypots, etc., including:

[0050] 1. Network traffic feature extraction;

[0051] Extract statistical features from network data packets, such as communication session duration, packet size, protocol type, etc.

[0052] Use deep packet inspection (DPI) technology to extract application layer features, such as HTTP requests and file transfers;

[0053] 2. Log feature extraction;

[0054] Parse system logs and security device logs to extract various event information;

[0055] Use regular expressions, structured queries, and other methods to identify key fields;

[0056] 3. Vulnerability feature extraction;

[0057] Extract information such as attack vectors, exploitation methods, and degree of harm of each known vulnerability from the vulnerability database;

[0058] 4. Honeypot feature extraction;

[0059] Analyze attacker behaviors captured by honeypots, such as attack payloads and malicious code samples;

[0060] A first data structuring module is configured to sort the collected threat information to obtain a first one-dimensional structured data; the first one-dimensional structured data includes n data items sorted by time, the tth data item represents the threat information collected for the tth time; threat information is collected once each time an event occurs;

[0061] The abnormal event recognition module is used to input the one-dimensional structure data No. 1 into the abnormal recognition model. The abnormal recognition model includes a first intermediate layer and a first output layer. The first intermediate layer inputs the one-dimensional structure data No. 1 and outputs the first intermediate representation data to the first output layer. The first output layer outputs the result indicating whether the event corresponding to each moment is abnormal.

[0062] A second data structuring module is used to extract user behavior data associated with abnormal events and then generate two-dimensional structured data. The two-dimensional structured data includes a data matrix and a relationship matrix. A cell in the data matrix represents one-dimensional structured data of an independent object. The independent object includes an abnormal event, user behavior, host, attack source IP, privileged account, and important service. A cell in the data matrix only contains data of the independent object it represents.

[0063] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit and the independent object represented by the j-th unit of the No. 1 data matrix. If there is an association, the value of this element in the No. 1 relationship matrix is 1, otherwise it is 0;

[0064] There is a correlation between abnormal events if: the abnormal events occur at adjacent times;

[0065] The association between abnormal events and user behaviors means that user behaviors trigger abnormal events;

[0066] The association between user behavior and privileged accounts refers to: the user used the privileged account to perform operations;

[0067] The abnormal event is associated with the victim host, which means that the abnormal event damages the host;

[0068] The association between an abnormal event and the attack source IP means that the IP address of the user who triggered the abnormal event is the attack source IP;

[0069] The defense strategy module is configured to input the first two-dimensional structure data into a strategy generation model. The strategy generation model comprises a second intermediate layer, a third intermediate layer, a second output layer, and a third output layer. The second intermediate layer and the third intermediate layer both input the first two-dimensional structure data, the second intermediate layer outputs second intermediate representation data to the second output layer, the third intermediate layer outputs third intermediate representation data to the second and third output layers, and the second output layer outputs the result representing the defense strategy. The defense strategy includes protective actions such as firewall rules, intrusion prevention measures, and vulnerability remediation.

[0070] The third output layer outputs the attack technology route, target system, and hazard assessment results of the attack in cyberspace.

[0071] like Figure 2 As shown, at least one embodiment of the present invention discloses a computer storage medium for storing computer-readable instructions, which can run the aforementioned one-stop threat analysis and monitoring command system when the computer-readable instructions are read.

[0072] In one embodiment of the present invention, the abnormal event recognition model is used as a discriminator and is connected to the first pre-trained output layer. The first pre-trained output layer outputs the judgment result of whether the input is threat information of a true abnormal event or threat information of a false abnormal event. The combined generator is used for adversarial training. The generator inputs random noise and then generates threat information of a false abnormal event.

[0073] Through adversarial training, the discriminator can learn the distribution of threat information of abnormal events, and the abnormal event recognition model can identify abnormal events that do not appear in the training data.

[0074] In one embodiment of the present invention, the calculation formula of the first intermediate layer is as follows:

[0075] h t =tanh(W hh h t-1 +W xh X t +b h )

[0076] where h t represents the t-th first intermediate representation data output by the first intermediate layer, h t-1 Indicates the t-1th first intermediate representation data, x t Represents the tth data item of the one-dimensional structure data, W hh and W xh are the first and second weight parameters, b h is the first bias parameter, and tanh is the hyperbolic tangent function.

[0077] The calculation formula of the first output layer is as follows:

[0078] G (t) =σ(W G H (t) +b G )

[0079] Among them G (t) Represents the first output vector. The two components of the first output vector represent whether the event corresponding to the t-th moment is abnormal or not. W G is the first output weight parameter, b G is the first output bias parameter, and σ represents the sigmoid function.

[0080] In one embodiment of the present invention, the calculation formula of the second intermediate layer is as follows:

[0081] The calculation formula for the second intermediate layer is as follows:

[0082]

[0083] where k v The second intermediate representation data of the vth unit of the data matrix No. 1, M (v) is the set of cells associated with the vth cell of the data matrix No. 1, S u The data of the independent object represented by the u-th unit of the data matrix, c v is a normalization constant, σ is the sigmoid function, W k Represents the third weight parameter.

[0084] The calculation formula for the third intermediate layer is as follows:

[0085]

[0086] Among them, P v The third intermediate representation data of the vth unit of the data matrix No. 1, W P represents the state weight parameter, S v and S u Respectively represent the data of the independent objects represented by the vth and uth cells of the data matrix, M (v) represents the set of cells of the data matrix that are associated with the vth cell of the data matrix, and M represents M (v) The total number of units in ;

[0087] R u，v =tanh(δ*S v T *S u +1)

[0088] Where tanh represents the hyperbolic tangent function, T represents the transpose, and δ represents an adjustable parameter; the default value of δ is 1 / M.

[0089] The calculation formula of the second output layer is as follows:

[0090]

[0091] Where y represents the second output vector, and its cth component value represents the probability value of the cth strategy. The strategy with the largest probability value is selected as the output. The strategy group contains all executable strategies. A strategy includes the parameters of each protection behavior in the network space. k u The second intermediate representation data of the u-th unit of the data matrix No. 1, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W y is the second output weight parameter, b y is the second output bias parameter, and σ represents the sigmoid function.

[0092] The calculation formula of the third output layer is as follows:

[0093]

[0094] Where Y represents the third output vector, its A components represent the probability values of A attack technology routes, B components represent the probability values of B target systems, and C components represent the probability values of C hazard assessment levels. The attack technology route, target system, and hazard assessment with the largest probability value are output, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W Y is the third output weight parameter, b Y is the third output bias parameter, and σ represents the sigmoid function.

[0095] In one embodiment of the present invention, the parameters of the protection behavior include the ID of the firewall rule, the ID of the intrusion prevention measure, and whether the vulnerability repair is started.

[0096] The above describes an embodiment of the present invention, but this embodiment is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Ordinary technicians in this field can also make more forms of equivalent embodiments based on the inspiration of this embodiment, all of which are protected by this embodiment.

Claims

1. One-stop threat analysis and supervision command system, characterized by: include: Threat information collection module, which is used to collect threat information, including original network data packets, traffic statistics, system logs, vulnerability databases, and honeypots; A first data structuring module, which is used to sort the collected threat information to obtain a number one one-dimensional structured data; The one-dimensional structure data No. 1 includes n data items sorted by time, and the t-th data item represents the threat information collected for the t-th time; Every time an event occurs, threat information is collected; An abnormal event recognition module is configured to input the one-dimensional structured data into an abnormality recognition model. The abnormality recognition model includes a first intermediate layer and a first output layer. The first intermediate layer inputs the one-dimensional structured data and outputs first intermediate representation data to the first output layer. The first output layer outputs a result indicating whether the event corresponding to each moment is abnormal. A second data structuring module is used to extract user behavior data associated with abnormal events and then generate two-dimensional structured data. The two-dimensional structured data includes a data matrix and a relationship matrix. A cell in the data matrix represents one-dimensional structured data of an independent object. The independent object includes an abnormal event, user behavior, host, attack source IP, privileged account, and important service. A cell in the data matrix only contains data of the independent object it represents. The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit and the independent object represented by the j-th unit of the No. 1 data matrix. If there is an association, the value of this element in the No. 1 relationship matrix is 1, otherwise it is 0; a defense strategy module, which is used to input the first two-dimensional structure data into a strategy generation model, the strategy generation model including a second intermediate layer, a third intermediate layer, a second output layer, and a third output layer, wherein the second intermediate layer and the third intermediate layer both input the first two-dimensional structure data, the second intermediate layer outputs second intermediate representation data to the second output layer, the third intermediate layer outputs third intermediate representation data to the second output layer and the third output layer, and the second output layer outputs a result representing the defense strategy; The third output layer outputs the attack technology route, target system, and hazard assessment results of the attack in cyberspace.

2. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: Extract features from raw network packets, traffic statistics, system logs, vulnerability databases, and honeypots.

3. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: There is a correlation between abnormal events if: the abnormal events occur at adjacent times; The association between abnormal events and user behaviors means that user behaviors trigger abnormal events; The association between user behavior and privileged accounts refers to: the user used the privileged account to perform operations; The abnormal event is associated with the victim host, which means that the abnormal event damages the host; The association between an abnormal event and an attack source IP means that the IP address of the user who triggered the abnormal event is the attack source IP.

4. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: Defense strategies include firewall rules, intrusion prevention measures, and vulnerability remediation.

5. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: The abnormal event recognition model is used as the discriminator and connected to the first pre-trained output layer. The first pre-trained output layer outputs the judgment result of whether the input is the threat information of a real abnormal event or the threat information of a false abnormal event. The combined generator is used for adversarial training. The generator inputs random noise and then generates threat information of false abnormal events.

6. The one-stop threat analysis and monitoring command system according to claim 1 is characterized in that: The calculation formula for the first intermediate layer is as follows: h t =tanh (W hh h t-1 +W xh x t +b h ) where h t represents the t-th first intermediate representation data output by the first intermediate layer, h t-1 Indicates the t-1th first intermediate representation data, x t Represents the tth data item of the one-dimensional structure data, W hh and W xh are the first and second weight parameters, b h is the first bias parameter, and tanh is the hyperbolic tangent function.

7. The one-stop threat analysis and monitoring command system according to claim 6, characterized in that: The calculation formula of the first output layer is as follows: G (t) =σ(W G H (t) +b G ) Among them G (t) Represents the first output vector. The two components of the first output vector represent whether the event corresponding to the t-th moment is abnormal or not. W G is the first output weight parameter, b G is the first output bias parameter, and σ represents the sigmoid function.

8. The one-stop threat analysis and monitoring command system according to claim 1 or 7, characterized in that: The calculation formula for the second intermediate layer is as follows: where k v The second intermediate representation data of the vth unit of the data matrix No. 1, M (v) is the set of cells associated with the vth cell of the data matrix No. 1, S u The data of the independent object represented by the u-th unit of the data matrix, c v is a normalization constant, σ is the sigmoid function, W k represents the third weight parameter; The calculation formula for the third intermediate layer is as follows: Among them, P v The third intermediate representation data of the vth unit of the data matrix No. 1, W P represents the state weight parameter, S v and S u Respectively represent the data of the independent objects represented by the vth and uth cells of the data matrix, M (v) represents the set of cells of the data matrix that are associated with the vth cell of the data matrix, and M represents M (v) The total number of units in ; R u,v =tanh(δ*S v T *S u +1) Where tanh represents the hyperbolic tangent function, T represents the transpose, and δ represents an adjustable parameter; the default value of δ is 1 / M; The calculation formula of the second output layer is as follows: Where y represents the second output vector, and its cth component value represents the probability value of the cth strategy. The strategy with the largest probability value is selected as the output. The strategy group contains all executable strategies. A strategy includes the parameters of each protection behavior in the network space. k u The second intermediate representation data of the u-th unit of the data matrix No. 1, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W y is the second output weight parameter, b y is the second output bias parameter, σ represents the sigmoid function; The calculation formula of the third output layer is as follows: Where Y represents the third output vector, its A components represent the probability values of A attack technology routes, B components represent the probability values of B target systems, and C components represent the probability values of C hazard assessment levels. The attack technology route, target system, and hazard assessment with the largest probability value are output, P u The third intermediate representation data of the u-th unit of the data matrix No. 1, W Y is the third output weight parameter, b Y is the third output bias parameter, and σ represents the sigmoid function.

9. The one-stop threat analysis and monitoring command system according to claim 8, characterized in that: The parameters of the protection behavior include the ID of the firewall rule, the ID of the intrusion prevention measure, and whether the vulnerability repair is enabled.

10. A computer storage medium, characterized in that It is used to store computer-readable instructions, which, when read, can run the one-stop threat analysis and monitoring command system as described in any one of claims 1-9.

Images