Network security threat tracing method and system based on correlation analysis

Abstract

The invention belongs to the technical field of network security, and provides a network security threat tracing method and system based on association analysis, and the technical scheme is as follows: constructing a network security situation map based on multi-source network security data, and performing association analysis on attack elements by adopting a graph mining algorithm based on the network security situation map to obtain an association analysis result, based on the correlation analysis result, the multi-path traceability strategy is used for tracing the attack and determining the attack source and the propagation path, potential threats can be automatically identified, risks can be evaluated, the optimal attack path can be found out, the accuracy and traceability efficiency of threat identification are improved, and a basis is provided for subsequent defense and countermeasures.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security threat tracing method and system based on association analysis. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of network technology, network security threats are becoming increasingly complex and diverse, and traditional security defense methods can no longer meet actual needs. As an important branch of network security, situational awareness technology helps users to discover and respond to security threats in a timely manner by real-time monitoring and analyzing security data in the network environment. Situational awareness technology collects massive amounts of information in the network, including log data, traffic information, and alarm information, and monitors the network status in real time. Then, data analysis and graph mining techniques are used to identify abnormal behaviors and potential security threats, such as intrusion attempts and malware propagation. These technologies are used to conduct in-depth analysis of the data to reveal the attacker's behavior patterns and attack strategies.

[0004] Existing situational awareness solutions often have difficulty in keeping up with the speed of change of real-time data in terms of data processing capabilities, and the algorithms used are inefficient when processing complex data. This may cause delays or lags when the system processes large-scale, high-speed network traffic, and cannot promptly reflect the latest situation of network security. In addition, when performing correlation analysis, it is too dependent on expert knowledge bases and predefined rule sets, resulting in the inability to accurately identify the correlation between attack behaviors when facing new or variant attacks. The traceability capability is generally weak, and most systems can only perceive the existence of an attack, but often cannot accurately trace the specific source of the attack, the attack path, the identity of the attacker, and other information. Summary of the invention

[0005] In order to solve at least one of the technical problems existing in the above-mentioned background technology, the present invention provides a network security threat tracing method and system based on association analysis, which integrates multiple data sources and uses graph mining algorithms to achieve efficient identification, association analysis and attack tracing of network security threats, thereby effectively improving network defense capabilities and security management levels.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A first aspect of the present invention provides a network security threat tracing method based on association analysis, comprising the following steps:

[0008] Obtain cybersecurity data from multiple sources;

[0009] Build a network security situation map based on multi-source network security data;

[0010] Based on the network security situation map, the graph mining algorithm is used to perform correlation analysis on the attack elements to obtain the correlation analysis results, including:

[0011] For the detection of known threats, network security data is matched with known threat patterns in the established threat pattern library to discover potential threats and attack behaviors. For the detection of unknown threats, the trained threat identification model is used to classify and identify nodes and edges in the network security situation diagram to discover potential threats and attack behaviors.

[0012] Conduct risk assessment on potential threats and attack behaviors to obtain risk assessment values;

[0013] Use depth-first search DFS to analyze the attack path and find the optimal attack path;

[0014] Based on the correlation analysis results, a multi-path tracing strategy is used to trace the attack and determine the attack source and propagation path.

[0015] Furthermore, the construction of a network security situation map based on multi-source network security data includes using a graph model to extract the relationship between entities in the network, and constructing a network security situation map based on the relationship between entities; in the network security situation map, the nodes in the graph represent hosts, servers and applications, the edges represent communications and access control, and the weights of the edges are set according to the communication frequency and access rights.

[0016] Furthermore, for the detection of known threats, a similarity calculation formula is used to calculate the similarity between the data to be evaluated and the threat pattern to match the network security data and the known threat patterns in the established threat pattern library. The threat pattern library includes IP address blacklists and whitelists, traffic anomaly detection rules and DDoS attack detection patterns.

[0017] Furthermore, for the detection of unknown threats, the training process of the threat identification model includes:

[0018] Construct a training data set D, D = {(x1,y1),(x2,y2),...,(x n ,y n )}, where x i The feature vector representing the node or edge, y i Indicates the corresponding label;

[0019] By training the machine learning model, a classification function f(x) is obtained to classify and identify newly input nodes or edges. When f(x)>0, it is judged as abnormal and may pose a threat; when f(x)≤0, it is judged as normal and there is no threat.

[0020] Furthermore, the calculation formula of the risk assessment value is:

[0021]

[0022] Among them, R(t i ) for each threat t i The risk value, w j is the weight of the jth indicator, that is, the influence of each indicator on the final risk assessment, A ij represents the score of the i-th threat on the j-th factor.

[0023] Furthermore, the use of depth-first search DFS to analyze the attack path and find the optimal attack path includes:

[0024] Traverse the network situation graph to obtain a set of all possible attack paths;

[0025] Compare the weights and attribute labels of different attack paths, and find the optimal attack path from the attack path set according to the set goals, including the shortest path and the minimum weight path.

[0026] Furthermore, based on the correlation analysis result, the attack is traced using a multi-path tracing strategy to determine the attack source and propagation path, including:

[0027] Construct timeline analysis, arrange network security data in chronological order to form a timeline, and analyze key events in the timeline;

[0028] According to the attack behavior in the timeline, a behavior chain is constructed, the patterns in the behavior chain are analyzed, and a heuristic function is designed to evaluate the possible distance or cost from the current node to the attack source;

[0029] Starting from the target node, the heuristic search algorithm is used to traverse the graph in reverse. During the traversal process, the optimal next node is selected for access based on the value of the heuristic function. When a branch node is encountered, the most likely attack path is selected for backtracking based on a comprehensive judgment of the heuristic function, timeline, and behavior chain information, and the path information is recorded until the attack source is traced back or no feasible path can be found, thereby determining the source.

[0030] A second aspect of the present invention provides a network security threat tracing system based on association analysis, comprising:

[0031] A data acquisition module, which is used to acquire multi-source network security data;

[0032] A graph construction module, which is used to construct a network security situation graph based on multi-source network security data;

[0033] The association analysis module is used to perform association analysis on attack elements based on the network security situation map using a graph mining algorithm to obtain association analysis results, including:

[0034] For the detection of known threats, network security data is matched with known threat patterns in the established threat pattern library to discover potential threats and attack behaviors; for the detection of unknown threats, the trained threat identification model is used to classify and identify nodes and edges in the network security situation diagram to discover potential threats and attack behaviors; risk assessment is performed on potential threats and attack behaviors to obtain risk assessment values; depth-first search DFS is used to analyze attack paths to find the optimal attack path;

[0035] The tracing module is used to trace the attack based on the correlation analysis results and use the multi-path tracing strategy to determine the attack source and propagation path.

[0036] A third aspect of the present invention provides a computer-readable storage medium.

[0037] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the network security threat tracing method based on association analysis as described above.

[0038] A fourth aspect of the present invention provides a computer device.

[0039] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the network security threat tracing method based on association analysis as described above are implemented.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. The present invention proposes an association analysis algorithm based on machine learning and graph theory evaluation methods, and constructs a network security situation map based on multi-source network security data; based on the network security situation map, a graph mining algorithm is used to perform association analysis on attack elements to obtain association analysis results, which can automatically identify potential threats, assess risks and find the optimal attack path, significantly improving the accuracy of threat identification and tracing efficiency.

[0042] 2. The present invention introduces graph mining technology into the field of network security situation awareness and attack tracing. By constructing a network situation map and applying efficient graph mining technology, it realizes comprehensive monitoring and in-depth analysis of network security threats.

[0043] 3. The present invention proposes a tracing mathematical model for the multi-path tracing strategy determination algorithm, which can accurately determine the source and propagation path of the attack. This innovation provides strong support for the tracing and defense of network attacks.

[0044] 4. The present invention uses visualization technology to present complex analysis results in an intuitive and easy-to-understand form. This innovation improves users' perception of network security situation and understanding of attack tracing, thereby improving user experience and decision-making efficiency.

[0045] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0047] Figure 1 This is a flow chart of a network security threat identification method based on correlation analysis and tracing provided by an embodiment of the present invention;

[0048] Figure 2 is a flowchart of association analysis provided by an embodiment of the present invention;

[0049] Figure 3 It is a flow chart of tracing the source of an attack using a multi-path tracing strategy provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0051] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0052] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0053] Embodiment 1

[0054] like Figure 1 As shown, this embodiment provides a network security threat identification method based on correlation analysis and tracing, comprising the following steps:

[0055] Step 1: Obtain cybersecurity data from multiple sources;

[0056] In this embodiment, the multi-source network data includes network flow data, system logs, application logs, security event logs, etc. Specifically, the network flow data is collected using a packet capture tool, the logs generated by the server, operating system, application, etc. are collected through a system log collector, and security event logs are obtained from security devices and software.

[0057] Step 2: Preprocess the acquired multi-source network security data;

[0058] The collected data is preprocessed, cleaned, and normalized to improve the accuracy and usability of the data. The data cleaning process includes removing duplicate, invalid, and erroneous data entries; data normalization involves the standardization of information such as timestamps, IP addresses, and port numbers.

[0059] Step 3: Construct a network security situation map based on the preprocessed multi-source network data;

[0060] In this embodiment, in the network security situation diagram, the nodes in the diagram represent entities (such as hosts, servers, applications, etc.), the edges represent the relationships between entities (such as communication, access control, etc.), and the weights of the edges can be set according to factors such as communication frequency and access rights. In order to more intuitively represent the security status of the network, attribute labels such as security level, vulnerability information, etc. can also be added to the nodes and edges.

[0061] In this embodiment, a graph model is used to extract the relationship between entities in the network, and a network security situation map is constructed based on the relationship between entities. The subgraph mining algorithm in the graph mining technology is used to mine potential attack paths and patterns, and the constructed graph reflects the actual structure and security status of the network.

[0062] In this embodiment, the graph model adopted is the Graph Convolutional Networks (GCN) model, which is a deep learning model for processing graph data. It can effectively capture local and global features in the graph structure and extend the convolution operation to the graph structure. Traditional convolutional neural networks (CNN) are mainly used to process regular data (such as pixel grids in images), while GCN can process irregular graph data (such as entities and their relationships in the network).

[0063] In GCN, the feature vector of a node is combined with the features of its neighbor nodes through the adjacency matrix of the graph to update the node representation. This process is performed through multiple layers of convolution operations, allowing each node to gradually aggregate the feature information of its neighbors to form a richer representation.

[0064] The forward propagation formula of the GCN model is as follows:

[0065]

[0066] Among them, H (l) is the node feature matrix of the lth layer, is the adjacency matrix of the graph, plus the identity matrix I to represent self-connection, yes The degree matrix, W (l) The weight matrix of the layer, σ is the activation function, ReLU;

[0067] GCN uses convolution operations layer by layer to enable each node to learn information from the entire graph.

[0068] Step 4: Use graph mining algorithms to conduct in-depth analysis of the situation graph and analyze the correlation between hidden security threats and attack behavior elements, such as Figure 2 As shown, the specific steps include:

[0069] Step 401: By establishing a threat pattern library, the collected data is matched with known threat patterns in the library to discover potential threats and attack behaviors;

[0070] Among them, the threat pattern library includes IP address blacklists and whitelists, traffic anomaly detection rules, DDoS attack detection patterns, etc. During the matching process, similarity calculation algorithms (such as cosine similarity, Euclidean distance, etc.) are used to evaluate the similarity between data and threat patterns.

[0071] Threat assessment analysis uses machine learning algorithms, such as support vector machines (SVM) and random forests, to classify and identify nodes and edges in the network situation diagram.

[0072] Assume that the training data set is: D = {(x1, y1), (x2, y2), ..., (x n ,y n )},

[0073] where x i The feature vector representing the node or edge, y i Indicates the corresponding label (normal or abnormal). By training the machine learning model, a classification function f(x) can be obtained to classify and identify the newly input nodes or edges. When f(x)>0, it is judged as abnormal and there may be a threat; when f(x)≤0, it is judged as normal and there is no threat.

[0074] By combining similarity calculation and machine learning classification, the threat assessment algorithm can comprehensively utilize the detection capabilities of known threat patterns and unknown threats, using the threat pattern library and similarity calculation to quickly identify known threat patterns, and for the detection of unknown threats, it uses machine learning models (such as SVM or random forests) to automatically learn and identify new threat patterns. This combination can significantly improve the comprehensiveness and accuracy of network security situation analysis and achieve more efficient and automated threat detection and response.

[0075] Step 402: Conduct risk assessment on potential threats and attack behaviors;

[0076] After a threat is discovered, its potential impact on users is evaluated. Risk assessment takes into account multiple factors such as the severity of the threat, the success rate of the attack, and the possibility of being attacked. Multi-attribute decision analysis is used to calculate the risk value of each threat, and a corresponding response plan is generated based on the risk value of the threat.

[0077] In this embodiment, the risk assessment analysis uses methods such as fuzzy comprehensive evaluation or hierarchical analysis to conduct risk assessment on the identified threats.

[0078] Assume that the threat set is T = {t1, t2, ..., t m}, each threat t i The risk value is R(t i ), each threat may be a different type of attack behavior, such as DDoS attack, malware infection, data leakage, etc. By comprehensively considering multiple factors such as the severity, probability of occurrence and impact range of the threat, a risk assessment matrix A can be obtained, where A ij represents the score of the ith threat on the jth factor. Then, by calculating the comprehensive score of each threat, the risk value R(t i ), thus providing a scientific basis for network security defense. The risk value of each threat R(t i ) is calculated as:

[0079] where w j is the weight of the jth indicator, that is, the influence of each indicator on the final risk assessment, A ij It is a threat i score on this indicator;

[0080] According to the calculated risk value R(t i ), threats can be ranked and graded. The higher the risk value, the greater the potential impact of the threat on network security and needs to be dealt with first.

[0081] Generate corresponding response plans based on the risk value of the danger, including:

[0082] When the risk value R(t i ) is greater than the set first threshold, which is a high-risk threat. The corresponding defense plan is to isolate the infected system, close the suspicious port, etc.

[0083] When the risk value R(t i ) is greater than the set second threshold, indicating a medium-risk threat, which requires further monitoring and analysis, and the preparation of emergency plans;

[0084] When the risk value R(t i ) is greater than the set third threshold, which is a low-risk threat. Regular checks are required to ensure that it does not evolve into a high-risk threat.

[0085] Among them, in this embodiment, the first threshold value> the second threshold value> the third threshold value, and the specific value can be selected according to the actual situation.

[0086] Step 403: Based on the graph traversal algorithm, the attack path is analyzed using the depth-first search DFS.

[0087] By analyzing system logs, application logs, security event logs and other data, we can find out the ways and means by which attackers enter the network. Attack path analysis helps users understand the full picture of the attack and take more effective defense measures.

[0088] The specific analysis process is as follows: Let the starting node be s and the target node be t. The goal of the attack path analysis algorithm is to find the shortest path from s to t. By traversing the network security situation graph, all possible path sets P = {p1, p2, ..., p k Then, by comparing the weights and attribute labels of different paths, the optimal attack path is found, providing a basis for the formulation of defense strategies.

[0089] The process of finding the optimal attack path by comparing the weights and attribute labels of different paths is as follows:

[0090] First, calculate the path weight and attributes. For each path p i ∈P, calculate the total weight and other properties of the path (such as path length, node types passed, etc.). The path weight can be calculated by accumulating the weights of all edges in the path:

[0091]

[0092] Secondly, select the optimal path. According to the set goal (such as the shortest path, the path with the minimum weight, or the path that satisfies certain specific attributes), select the optimal path from the path set P. The optimal path p * It can be selected by the following formula:

[0093]

[0094] For the selected optimal attack path p * Conduct analysis to understand the specific steps and behaviors that an attacker may take, and formulate corresponding defense strategies based on the results of the attack path analysis. For example, you can strengthen the defense of key nodes, increase monitoring efforts, or fix potential vulnerabilities.

[0095] Step 5: Based on the correlation analysis results, use the multi-path tracing strategy to trace the attack source and determine the attack source and propagation path;

[0096] In order to achieve a comprehensive traceback of the attack path and improve the traceability speed and accuracy, a multi-path traceability strategy is designed. This strategy combines timeline and behavior chain information and uses a heuristic search algorithm to optimize the traceability process. Figure 3 As shown, the specific steps are as follows:

[0097] Step 501: construct a timeline analysis, arrange the collected logs, traffic data, etc. in chronological order to form a timeline, analyze key events in the timeline, such as abnormal login, data leakage, malware installation, etc., and determine the time nodes and sequence of attack behaviors;

[0098] Step 502: Construct a behavior chain. According to the attack behavior in the timeline, construct a behavior chain to show a series of orderly operations taken by the attacker. Analyze the patterns in the behavior chain to identify the attacker's common methods and tools, as well as possible attack pattern variants. Design a heuristic function to evaluate the possible distance or cost from the current node to the attack source, taking into account factors such as the node degree, edge weight, and attack behavior frequency.

[0099] Step 503, multi-path backtracking, starting from the attack target node, using the heuristic search algorithm to reversely traverse the graph, during the traversal process, select the optimal next node to visit according to the value of the heuristic function, when encountering a branch node, based on the comprehensive judgment of the heuristic function, timeline and behavior chain information, select the most likely attack path for backtracking, and record the path information, repeat the above process until the attack source is traced back or no feasible path can be found. Analyze the multiple paths obtained by backtracking, combine the timeline and behavior chain information, determine the most likely attack path, and thus determine the source.

[0100] Step 6: Display the analysis results to the user end in the form of charts, images, etc.;

[0101] The analysis results are presented to users in the form of charts, images, etc., to help users intuitively understand the security situation and attack situation of the network. The visualization content includes real-time monitoring of network traffic, system status, application status, security events and other information, as well as historical data analysis results and attack path diagrams. Through visualization, users can more comprehensively understand the security status of the network and make correct security decisions in a timely manner.

[0102] Embodiment 2

[0103] This embodiment provides a network security threat tracing system based on correlation analysis, including:

[0104] A data acquisition module, which is used to acquire multi-source network security data;

[0105] A graph construction module, which is used to construct a network security situation graph based on multi-source network security data;

[0106] The association analysis module is used to perform association analysis on attack elements based on the network security situation map using a graph mining algorithm to obtain association analysis results, including:

[0107] For the detection of known threats, network security data is matched with known threat patterns in the established threat pattern library to discover potential threats and attack behaviors; for the detection of unknown threats, the trained threat identification model is used to classify and identify nodes and edges in the network security situation diagram to discover potential threats and attack behaviors; risk assessment is performed on potential threats and attack behaviors to obtain risk assessment values; depth-first search DFS is used to analyze attack paths to find the optimal attack path;

[0108] The tracing module is used to trace the attack based on the correlation analysis results and use the multi-path tracing strategy to determine the attack source and propagation path.

[0109] Embodiment 3

[0110] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the network security threat tracing method based on association analysis as described above are implemented.

[0111] Embodiment 4

[0112] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the network security threat tracing method based on association analysis as described above are implemented.

[0113] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0114] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0115] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0116] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0117] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0118] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security threat tracing method based on association analysis, characterized in that: The steps include: Obtain cybersecurity data from multiple sources; Build a network security situation map based on multi-source network security data; Based on the network security situation map, the graph mining algorithm is used to perform correlation analysis on the attack elements to obtain the correlation analysis results, including: For the detection of known threats, network security data is matched with known threat patterns in the established threat pattern library to discover potential threats and attack behaviors; for the detection of unknown threats, the trained threat identification model is used to classify and identify nodes and edges in the network security situation diagram to discover potential threats and attack behaviors; Conduct risk assessment on potential threats and attack behaviors to obtain risk assessment values; Use depth-first search DFS to analyze the attack path and find the optimal attack path; Based on the correlation analysis results, a multi-path tracing strategy is used to trace the attack and determine the attack source and propagation path.

2. A network security threat tracing method based on association analysis as claimed in claim 1, characterized in that: The method of constructing a network security situation map based on multi-source network security data includes using a graph model to extract the relationship between entities in the network, and constructing a network security situation map based on the relationship between entities; in the network security situation map, the nodes in the graph represent hosts, servers and applications, the edges represent communication and access control, and the weights of the edges are set according to the communication frequency and access rights.

3. A network security threat tracing method based on association analysis as claimed in claim 1, characterized in that: For the detection of known threats, a similarity calculation formula is used to calculate the similarity between the data to be evaluated and the threat pattern to match the network security data and the known threat patterns in the established threat pattern library. The threat pattern library includes IP address blacklists and whitelists, traffic anomaly detection rules and DDoS attack detection patterns.

4. A network security threat tracing method based on association analysis as claimed in claim 1, characterized in that: For the detection of unknown threats, the training process of the threat identification model includes: Construct a training data set D, D = {(x1,y1),(x2,y2),...,(x n ,y n )}, where x i The feature vector representing the node or edge, y i Indicates the corresponding label; By training the machine learning model, a classification function f(x) is obtained to classify and identify newly input nodes or edges. When f(x)>0, it is judged as abnormal and may pose a threat; when f(x)≤0, it is judged as normal and there is no threat.

5. The network security threat tracing method based on association analysis according to claim 1, characterized in that: The formula for calculating the risk assessment value is: Among them, R(t i ) for each threat t i The risk value, w j is the weight of the jth indicator, that is, the influence of each indicator on the final risk assessment, A ij represents the score of the i-th threat on the j-th factor.

6. A network security threat tracing method based on association analysis as claimed in claim 1, characterized in that: The depth-first search DFS is used to analyze the attack path and find the optimal attack path, including: Traverse the network situation graph to obtain a set of all possible attack paths; Compare the weights and attribute labels of different attack paths, and find the optimal attack path from the attack path set according to the set goals, including the shortest path and the minimum weight path.

7. A network security threat tracing method based on association analysis as claimed in claim 1, characterized in that: Based on the correlation analysis results, the multi-path tracing strategy is used to trace the attack source and determine the attack source and propagation path, including: Construct timeline analysis, arrange network security data in chronological order to form a timeline, and analyze key events in the timeline; According to the attack behavior in the timeline, a behavior chain is constructed, the patterns in the behavior chain are analyzed, and a heuristic function is designed to evaluate the possible distance or cost from the current node to the attack source; Starting from the target node, the heuristic search algorithm is used to traverse the graph in reverse. During the traversal process, the optimal next node is selected for access based on the value of the heuristic function. When a branch node is encountered, the most likely attack path is selected for backtracking based on a comprehensive judgment of the heuristic function, timeline, and behavior chain information, and the path information is recorded until the attack source is traced back or no feasible path can be found, thereby determining the source.

8. A network security threat tracing system based on correlation analysis, characterized in that: include: A data acquisition module, which is used to acquire multi-source network security data; A graph construction module, which is used to construct a network security situation graph based on multi-source network security data; The association analysis module is used to perform association analysis on attack elements based on the network security situation map using a graph mining algorithm to obtain association analysis results, including: For the detection of known threats, network security data is matched with known threat patterns in the established threat pattern library to discover potential threats and attack behaviors; for the detection of unknown threats, the trained threat identification model is used to classify and identify nodes and edges in the network security situation diagram to discover potential threats and attack behaviors; risk assessment is performed on potential threats and attack behaviors to obtain risk assessment values; depth-first search DFS is used to analyze attack paths to find the optimal attack path; The tracing module is used to trace the attack based on the correlation analysis results and use the multi-path tracing strategy to determine the attack source and propagation path.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in a network security threat tracing method based on association analysis as described in any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the network security threat tracing method based on association analysis as described in any one of claims 1 to 7 are implemented.

Images