Big data network attack portraying method based on knowledge graph

Abstract

The invention discloses a big data network attack portraying method based on a knowledge graph, and the method comprises the steps: obtaining the real-time flow of each network node in a network, marking the network node with the real-time flow exceeding the first preset real-time flow, and obtaining a first node; acquiring upstream and downstream direct connection network nodes of the first node, and marking the direct connection network nodes with real-time traffic exceeding second preset real-time traffic to obtain a second node; acquiring an attack link of a network attack based on the connection relationship between the first node and the second node and the data flow direction; based on the attack link, obtaining an influence range and environment information of the network attack, and respectively obtaining a subjective intention and an objective intention in the network attack; and obtaining network attack portrait information based on the subjective intention and the objective intention. The problem of insufficient precision and timeliness in a current network attack portrait confirmation method is solved, and a network attack portrait with higher precision and higher timeliness is obtained.

Description

Technical Field

[0001] The present application belongs to the field of Internet technology, and specifically, relates to a big data network attack profiling method based on knowledge graph. Background Art

[0002] The prevention of network attacks and the identification of the purpose of network attacks have always been the research focus and emphasis in the Internet field. In current research, virus library technology, data link analysis technology, firewall technology, etc. have been developed. Such technologies can only be used by technical experts to build and analyze network attack portraits after the network attack is successful. This makes the creation of network attack portraits less accurate and timely, and it is difficult to analyze and prevent network attacks in real time based on high-quality network attack portraits.

[0003] Therefore, how to create a high-precision and more effective network attack portrait is a key technical problem that technical personnel in this field need to solve. Summary of the invention

[0004] In order to solve the main problems of insufficient accuracy and timeliness in creating network attack portraits in current technical solutions, this application discloses the following technical contents to improve the accuracy and timeliness of creating network attack portraits, thereby improving the ability to prevent network attacks, specifically: A big data network attack profiling method based on knowledge graph, including: Acquire the real-time traffic of each network node in the network, mark the network node whose real-time traffic exceeds the first preset real-time traffic, and obtain the first node; Acquire upstream and downstream directly connected network nodes of the first node, mark the directly connected network nodes whose real-time traffic exceeds a second preset real-time traffic, and obtain a second node; Based on the connection relationship and data flow direction between the first node and the second node, acquiring an attack link of the network attack; Based on the attack link, obtaining the subjective intention and objective intention of the network attack; Based on the subjective intention and the objective intention, network attack portrait information is obtained.

[0005] Optionally, the acquiring of the real-time traffic of each network node in the network, marking the network node whose real-time traffic exceeds a first preset real-time traffic, and obtaining the first node includes: Based on the network operation characteristics, adjusting the first preset real-time flow corresponding to each network node; Monitor the real-time traffic of each network node in the network; The real-time traffic of the network node is compared with a first preset real-time traffic corresponding to the network node. If the real-time traffic of the network node exceeds the first preset real-time traffic, the network node is marked as the first node.

[0006] Optionally, acquiring upstream and downstream directly connected network nodes of the first node, marking the directly connected network nodes whose real-time traffic exceeds a second preset real-time traffic, and obtaining the second node includes: Acquire a network node directly connected to the first node to obtain a directly connected network node; Determining the first preset real-time traffic corresponding to the directly connected network node as the second preset real-time traffic; The real-time traffic of the directly connected network node is compared with a second preset real-time traffic corresponding to the directly connected network node. If the real-time traffic of the directly connected network node exceeds the second preset real-time traffic, the directly connected network node is marked as a second node.

[0007] Optionally, also include: When the second node has other network nodes directly connected to the second node in addition to the direct connection relationship with the first node, marking the other network nodes as temporary second nodes; Determining the first preset real-time traffic corresponding to the temporary second node as the temporary second preset real-time traffic; Compare the real-time traffic of the temporary second node with the corresponding temporary second preset real-time traffic, and if the real-time traffic of the temporary second node exceeds the temporary second preset real-time traffic, mark the temporary second node as the second node, and adjust the second node directly connected to the temporary second node to the first node; Traverse all network nodes until the real-time traffic of the temporary second node does not exceed the corresponding temporary second preset real-time traffic, and obtain all the first nodes and the second nodes.

[0008] Optionally, acquiring an attack link of a network attack based on a connection relationship and a data flow direction between the first node and the second node includes: Based on the connection relationship between the first node and the second node, construct a network attack topology map; Based on the data flow between the first node and the second node, an attack link of the network attack is obtained from the network attack topology map.

[0009] Optionally, constructing a network attack topology graph based on a connection relationship between the first node and the second node includes: Setting the first node as an intermediate node of the attack link of the network attack, and setting the second node as an end node of the attack link of the network attack; Connecting the intermediate nodes with a direct connection relationship until the terminal node is connected to the intermediate node with a direct connection relationship, thereby obtaining a temporary network attack topology diagram; Obtaining the importance of the first node and the second node in the temporary network attack topology graph includes: The importance of the first node and the second node is obtained by using the following equation:

[0010] in, Indicates the importance of the first and second nodes in the network attack topology graph. Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first node or the second node, Indicates the first i The probability of selecting the first node or the second node, i Represents the index of the first node and the second node in the network attack topology graph, j Indicates the first i The number of directly connected nodes of the first node or the second node; The selection probabilities of the first node and the second node are obtained using the following equation:

[0011] in, Indicates the first i The probability of selecting the first node or the second node, Indicates the first i The weight parameter of the first node or the second node in-degree and out-degree on the node selection probability, Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first node or the second node, Indicates the first i The adjacency between the first node or the second node and the directly connected node, Indicates the first i an adjacency between a directly connected node of a first node or a second node and the corresponding first node or second node; The adjacency value is obtained using the following equation:

[0012] in, Indicates the first i The adjacency between a directly connected node of a first node or a second node and the corresponding first node or second node, represents the weight parameter of node in-degree and out-degree on node selection probability, Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first node or the second node, i Represents the index of the first node and the second node in the network attack topology graph, j Indicates the first i The number of directly connected nodes of the first node or the second node; When the selection probability values ​​of the first node and the second node and the importance of the nodes both exceed preset values, the first node or the second node is a necessary node; The necessary nodes are connected in the temporary network attack topology map to obtain a network attack topology map.

[0013] Optionally, acquiring the attack link of the network attack from the network attack topology map based on the data flow direction between the first node and the second node includes: Based on the data flow direction of the first node and the second node, acquiring the first node or the second node at the most upstream of the data flow direction as the function initial node; Based on the functional initial node, all preset network attack links in the network attack topology graph are obtained; Based on the data flow direction, the preset network attack link is verified, and the attack link of the network attack is obtained.

[0014] Optionally, obtaining the subjective intention and objective intention of the network attack based on the attack link includes: Based on the attack link, confirming the attack function of the attack link; Based on the attack function, confirm the scope of the network attack; Based on the attack function and the network attack scope, obtaining the subjective intention; Based on the attack link, the IP address of the network attack is reversed to obtain the objective intention.

[0015] Optionally, obtaining the subjective intention based on the attack function and the network attack scope includes: Based on the subjective intention matching equation, a subjective intention matching value is obtained, and the subjective intention matching equation is:

[0016] in, represents the subjective intention matching value, k a node index representing the first node or the second node in the expected attack link, l represents the number of the first node and the second node in the expected attack link, a represents the functional importance weights of the first node and the second node, Indicates the importance of the first node and the second node in the expected attack link; m The node index representing the network node in the functional link, n represents the number of network nodes in the functional link, b represents the functional importance weight in the functional link, Indicates the importance of network nodes in the functional link, c Indicates the scope of the network attack; The subjective intention matching value is amplified to obtain an amplified subjective intention matching value, and the equation of the amplified subjective intention matching value is:

[0017] in, Indicates the amplified subjective intention matching value, which is a numerical range; f represents the weight of subjective intention matching value; represents the subjective intention matching value; The subjective intent keyword has a unique assignment. When the unique assignment falls into the expanded subjective intent matching value, the subjective intent keyword corresponding to the unique assignment is obtained to obtain the subjective intent.

[0018] Optionally, the acquiring network attack profile information based on the subjective intention and the objective intention includes: Based on the subjective intention, obtaining a network attack portrait template from a network attack portrait database; Based on the objective intention, the network attack portrait template is verified to obtain a network attack portrait, including: Assigning importance to the attack information in the network attack portrait template; Assigning weights to the objective intention to obtain an objective value; The scoring value of the network attack portrait template is obtained based on the evaluation equation, and the network attack portrait template whose scoring value is higher than the scoring value threshold is obtained. The evaluation equation is:

[0019] in, Indicates the score value of the network attack portrait template, d represents the objective value, h Indicates the importance weight of attack information in the network attack template. Indicates the importance of attack information in the network attack template; When the score value of the network attack portrait template is not lower than the score value threshold of the network attack portrait template, the objective intention is added to the network attack portrait template to obtain the network attack portrait.

[0020] The beneficial effects of this application are: 1. Realized the early determination of network attack portraits. When confirming network attack portraits, it is no longer necessary to obtain network attack portraits based on attack links only after the network attack has been completed. Instead, after the network attack is detected in real time, the functions that the attacker wants to attack are determined or inferred through the network attack behaviors that have already occurred, thereby confirming the network attack portrait, and achieving the acquisition of network attack portraits when the attack fails.

[0021] 2. Improve the accuracy of network attack analysis. When acquiring network attack portraits, the current network attack form and path are not confirmed based on a single attack chain, but the attack behavior is analyzed based on all network attack paths and attacked network nodes. Such analysis results are used as information sources for network attack portraits to improve the accuracy of network attack analysis.

[0022] 3. Collect more network attack profile information. It is possible to obtain information about network attacks that have not been successfully completed, and comprehensively analyze the overall network attack behavior based on network nodes, so as to jointly analyze network attack profile information based on all network attack information, so as to realize the collection and prediction of current network attack behavior information. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments of the present application or the prior art. Obviously, the following description is only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. The drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific implementation methods, they are used to explain the present disclosure, but do not constitute a limitation to the present disclosure. In the drawings: Figure 1 A flow chart of a big data network attack profiling method based on knowledge graph provided in an embodiment of the present application; Figure 2 A schematic diagram of a network node topology in a network provided in an embodiment of the present application; Figure 3 A schematic diagram of a temporary network attack topology in a big data network attack based on a network graph provided in an embodiment of the present application; Figure 4 A topological diagram of a network attack link in a big data network attack based on a network graph provided in an embodiment of the present application; Figure 5 A schematic diagram of a big data network attack profiling result based on a knowledge graph provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In addition, in the embodiments of the present application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0025] While the Internet brings convenience to people's lives and helps research, it may also cause significant property losses due to network attacks. At present, the prevention and counter-investigation of network attacks have become the focus and key points in the field of network applications. In the current network attack prevention work, the network attack identification method based on knowledge graph has begun to be adopted, but the effect is not satisfactory. The main problems are: (1) The generation of network attack portraits is delayed, which is manifested as: only after the network attack has been suffered and losses have been caused, the network attack can be analyzed based on knowledge graphs and other related technologies, and it is difficult to achieve effective pre-prevention and control effects. That is, when a certain network node is attacked but the attack effect on the entire function has not yet been achieved, it is difficult to obtain a network attack portrait; (2) The accuracy of network attack target analysis is insufficient, which is manifested as: the identification of network attacks can only be accurately identified after the entire network function has been attacked, and the accuracy of the analysis of the purpose and object of the network attack is insufficient; (3) The information source of the network attack portrait is not complete, which is manifested as: the network portrait is often determined based on specific attack targets and attack intentions, and it is difficult to achieve the identification of the entire network attack situation. Due to the single information source of the network attack portrait, it is naturally difficult to obtain a complete network attack portrait.

[0026] Therefore, in the technical solution of the present application, full consideration is given to analyzing and confirming the possible network attack links based on the network nodes that have been attacked when the network attack is not successfully completed, so as to accurately confirm the attack targets and further achieve a comprehensive analysis of the attack behavior. After that, the attack intention is judged based on the attack behavior, and the network attack portrait is obtained based on the attack intention, thereby achieving accurate prediction of network attack behavior, with more information sources, and improving the accuracy of drawing network attack portraits.

[0027] The embodiment of the present application discloses a big data network attack profiling method based on knowledge graph, which improves the accuracy and pre-prediction performance of network attack profiling. Specifically: like Figure 1 As shown, a flow chart of a big data network attack profiling method based on knowledge graph provided in an embodiment of the present application includes: S110, obtaining the real-time traffic of each network node in the network, marking the network node whose real-time traffic exceeds a first preset real-time traffic, and obtaining a first node.

[0028] S120: Acquire upstream and downstream directly connected network nodes of the first node, mark the directly connected network nodes whose real-time traffic exceeds a second preset real-time traffic, and obtain a second node.

[0029] S130: Based on the connection relationship and data flow direction between the first node and the second node, obtain an attack link of the network attack.

[0030] S140: Based on the attack link, obtain the subjective intention and objective intention of the network attack.

[0031] S150: Based on the subjective intention and the objective intention, obtain network attack portrait information.

[0032] Below, the above steps will be explained separately. Specifically: In step S110, based on the flow monitoring system set in the network system, the running flow of the current node is obtained in real time, and its purpose is to analyze whether the network node is abnormal by comparing the real-time flow and the preset flow. If an abnormality occurs, the node is considered to be under attack. Its purpose is to quickly determine and locate the network node under attack by monitoring the flow of the global network nodes, so as to accurately determine the network node under attack.

[0033] Wherein, step S110 includes: S111. Based on network operation characteristics, adjust the first preset real-time traffic corresponding to each network node.

[0034] Among them, based on the current operating status of the entire network system and the specific network node links based on the functions to be achieved by the current entire network, the theoretical traffic of each network node in the network system is analyzed, namely: the first preset real-time traffic.

[0035] The real-time traffic is judged and summarized for all network nodes in the entire network, so as to confirm the first preset real-time traffic parameter corresponding to each time point in the operation of the network.

[0036] In some embodiments, based on the function implementation method, function implementation requirements and network node links that jointly implement the functions of the current network system, the network node links in the current related function implementation process are confirmed.

[0037] In some embodiments, there is a coupling phenomenon of network nodes among different network functions in the network system. The first preset real-time traffic of different nodes is analyzed in the scenarios where independent functions are realized and multiple functions are realized together to realize the specific analysis of the parameter.

[0038] In some embodiments, based on the function completion instruction in the network system, the first preset real-time traffic of all network nodes in the network node link in the network function implementation is analyzed.

[0039] S112. Monitor the real-time traffic of each network node in the network.

[0040] The purpose of this step is to monitor the global network nodes of the network system, so as to monitor the abnormal traffic conditions of network nodes from the perspective of the global network. When a single network node is monitored, there is no need to analyze the entire attack link, which improves the effectiveness of judging network attack behaviors.

[0041] Among them, a traffic comparator is set to monitor the real-time traffic of network nodes in real time.

[0042] Among them, the traffic of a single node is monitored in real time, and the actual traffic of the network node is obtained.

[0043] In some embodiments, a specific number of network nodes is used as a node set, and the real-time traffic of the node set is monitored and compared with the first preset real-time traffic to reduce the number of traffic comparators to be set and achieve higher accuracy.

[0044] S113: Compare the real-time traffic of the network node with a first preset real-time traffic corresponding to the network node. If the real-time traffic of the network node exceeds the first preset real-time traffic, mark the network node as the first node.

[0045] The purpose of this step is to quickly and accurately determine whether the current network node is under attack based on the deviation between the real-time traffic and the first preset real-time traffic, and after confirming that it is under attack, mark the network node as the first node.

[0046] Among them, the monitored real-time traffic of the network node is compared with the corresponding first preset real-time traffic. If it is found that the real-time traffic of the network node exceeds the first preset real-time traffic, it means that other network traffic has appeared in the network node. In the case of a network attack, this traffic anomaly obviously means that the attacker has injected other instructions or messages. Therefore, it can be determined that the network node is under attack and it will be marked as the first node.

[0047] In some embodiments, when it is found that the real-time traffic is higher or much lower than the first preset real-time traffic, it is confirmed that the network node is under attack. The reason why the network node is determined to be under attack when the real-time traffic is much lower than the first preset real-time traffic is that the attacker may use a message that is difficult to identify by the traffic comparator, or the upstream node of the network node is attacked, resulting in a traffic hijacking problem. At this time, the network node can be determined as a node under network attack.

[0048] Among them, in step S110, based on the acquisition of the first node, the current network attack link information and the target function of the network attack cannot be determined, nor can the coverage of the network attack behavior be determined. Therefore, in the specific network attack behavior analysis, it is also necessary to analyze the attack link based on other nodes directly connected to the first node. Therefore, it is necessary to determine the entire attack link based on S120, the purpose of which is to achieve the impact range analysis of the entire attack link and obtain all network attack links.

[0049] Wherein, step S120 includes: S121. Acquire a network node directly connected to the first node to obtain a directly connected network node.

[0050] The purpose of this step is that when a network attack is to achieve an attack on a certain network function, it does not just attack one node in the entire network system, but all network nodes on the functional link during the implementation of the network function. Therefore, only obtaining one abnormal node cannot determine the current attack target. Considering that there is a logical relationship between network nodes, by determining the network node directly connected to the first node, it can be used to analyze the current network attack path, and based on this path, determine the entire attack path.

[0051] In the confirmation of the directly connected network node of the first node, the direct connection relationship of the network nodes is determined based on the functional connection relationship between the network nodes, specifically, Figure 2As shown, it is a schematic diagram of the network node topology in a network provided in an embodiment of the present application, wherein when there is a functional connection relationship between each network node, it is determined to be a direct connection, wherein A1-A2, B1-B2, C1-C5, D1-D4 are network nodes in the network system, and E1-E5 are network function nodes, wherein, in the implementation of some functions, there is a coupling relationship of functional links, such as A1-B1-C1-C4-D3-E2 and A1-B1-C1-C4-D1-E4.

[0052] In some embodiments, based on the distribution position of the first node, the Euler distance between it and other surrounding nodes is calculated, and an Euler distance threshold is set. Only when the distance is within the threshold range, it can be considered that there is a direct connection between other nodes and the first node.

[0053] S122: Determine the first preset real-time traffic corresponding to the directly connected network node as the second preset real-time traffic.

[0054] The purpose of this step is to set a preset real-time traffic for each network node in the global traffic monitoring of the network system. Relying on this parameter, there is no need to repeatedly calculate the real-time traffic of the directly connected nodes under normal circumstances, thereby fully reducing the computing resources of the entire system during operation.

[0055] When it is determined that the first node exists and is marked, the first preset real-time traffic of the network node directly connected to the first node is retrieved in real time, and the first preset real-time traffic is directly determined as the second preset real-time traffic.

[0056] In some embodiments, a specific number of network nodes is taken as a node set. When the traffic of a certain node set is found to be abnormal, the node set is regarded as a first node set. Other node sets directly connected to the first node set are determined, and the first preset real-time traffic of the directly connected node set is directly determined as the second preset real-time traffic.

[0057] S123: Compare the real-time traffic of the directly connected network node with a second preset real-time traffic corresponding to the directly connected network node; if the real-time traffic of the directly connected network node exceeds the second preset real-time traffic, mark the directly connected network node as a second node.

[0058] The purpose of this step is to quickly and accurately determine whether the directly connected network node of the first node is under attack based on the deviation between the real-time traffic of the directly connected node and the second preset real-time traffic, and mark the network node as the second node after confirming that it is under attack.

[0059] Among them, the monitored real-time traffic of the directly connected network node is compared with the corresponding second preset real-time traffic. If it is found that the real-time traffic of the directly connected network node exceeds the second preset real-time traffic, it means that other network traffic has appeared in the network node. During a network attack, this traffic anomaly obviously means that the attacker has injected other instructions or messages. Therefore, it can be determined that the network node is under attack and it will be marked as the second node.

[0060] In some embodiments, when it is found that the real-time traffic of the directly connected network node is higher or much lower than the second preset real-time traffic, it is confirmed that the network node is under attack. The reason why the network node is determined to be under attack when the real-time traffic is much lower than the second preset real-time traffic is that the attacker may use a message that is difficult to identify by the traffic comparator, or the upstream node of the network node is attacked, resulting in a traffic hijacking problem. At this time, the network node can be determined as a node under network attack.

[0061] In fact, for steps S122 and S123, only a first node and a second node can be obtained. In this case, it is obviously difficult to determine the entire network attack link. Therefore, it is necessary to determine the possible attack links. For this purpose, the following steps are set, including: S124: When the second node has other network nodes directly connected to the second node in addition to the direct connection relationship with the first node, mark the other network nodes as temporary second nodes.

[0062] The purpose of this step is that for the first node and the second node that have been obtained, the two are already directly connected, and the second node is obviously the external end of the network attack. Therefore, when directly judging that the network node is directly connected to the second node and is not the first node, all network nodes in the entire network attack chain can be identified.

[0063] Herein, all network nodes that are directly connected to the second node are obtained, and the first node is removed, and all other nodes are marked as temporary second nodes.

[0064] In some embodiments, a specific number of network nodes is used as a node set. When a traffic abnormality is found in a second node set, all node sets directly connected to it are obtained, and the first node set among them is extracted, and all other node sets are marked as temporary second node sets.

[0065] S125. Determine the first preset real-time traffic corresponding to the temporary second node as temporary second preset real-time traffic.

[0066] The purpose of this step is to set a preset real-time traffic for each network node in the global traffic monitoring of the network system. Relying on this parameter, there is no need to repeatedly calculate the preset real-time traffic of the directly connected nodes, thereby fully reducing the computing resources of the entire system during operation.

[0067] Among them, the first preset real-time traffic corresponding to the temporary second node is retrieved in real time, and the first preset real-time traffic is directly determined as the temporary second preset real-time traffic.

[0068] In some embodiments, a specific number of network nodes is taken as a node set. When it is found that the traffic of the second node set is abnormal, the node set is the second node set, other node sets directly connected to the second node set are determined, and the first preset real-time traffic of the directly connected node set is directly determined as a temporary second preset real-time traffic.

[0069] S126. Compare the real-time traffic of the temporary second node with the corresponding temporary second preset real-time traffic. If the real-time traffic of the temporary second node exceeds the temporary second preset real-time traffic, mark the temporary second node as the second node, and adjust the second node directly connected to the temporary second node to the first node.

[0070] The purpose of this step is to quickly and accurately determine whether the temporary second node is under attack based on the deviation between the real-time traffic of the temporary second node and the temporary second preset real-time traffic. After confirming that it is under attack, the network node is marked as the second node. At the same time, the second node directly connected to it is adjusted to the first node. The reason why it is not marked according to the sequence number is that in some cases, there is a situation where the downstream network node is reversely inferred from the upstream node whether it is under attack, such as: the node that detects abnormal traffic is Figure 2 For the C3 node in the network, it is also necessary to re-detect the upstream node B3 to confirm whether the B3 node has also suffered a network attack. When the labeling scheme is adopted, it is easy to cause logical errors in the subsequent attack chain judgment. For example, if C3 is considered to be the initial node in the network attack and it is impossible to identify whether the B3 node has been attacked, it is easy to fail to identify the network attack.

[0071] Wherein, the real-time traffic of the temporary second node is compared with the temporary second preset real-time traffic. When it is found that the real-time traffic of the temporary second node exceeds the temporary second preset real-time traffic, it is confirmed that the temporary second node is under network attack, and it is marked as the second node, and the second node connected to it is marked as the second network node. Figure 3As shown, a schematic diagram of a temporary network attack topology in a big data network attack based on a network graph is provided in an embodiment of the present application, which includes multiple first nodes and one second node, wherein the nodes with serial numbers 1 and 2 in the network nodes are the first node and the second node, respectively, and for the nodes that have been attacked, that is, the nodes with abnormal traffic are determined, they are directly adjusted to the first node and the second node, and the second node is the final node in the current network attack behavior, and the first node is the intermediate attack node.

[0072] In some embodiments, when it is found that the real-time traffic of the temporary second node is much lower than the temporary second preset real-time traffic, it is confirmed that the network node is under attack. The reason why the network node is determined to be under attack when the real-time traffic is much lower than the second preset real-time traffic is that the attacker may use a message that is difficult to identify by the traffic comparator, or the upstream node of the network node is attacked, resulting in a traffic hijacking problem. At this time, the network node can be determined as a node under network attack.

[0073] S127. Traverse all network nodes until the real-time traffic of the temporary second node does not exceed the corresponding temporary second preset real-time traffic, and obtain all the first nodes and the second nodes.

[0074] The purpose of this step is to determine the attack status of all network nodes, so that the current attack link can be found during attack detection.

[0075] Among them, all temporary second nodes are determined by second nodes that have a direct connection relationship with the currently acquired second node, and based on the comparison between the real-time traffic and the preset real-time traffic, it is determined whether the current temporary second node is under attack.

[0076] Based on the above steps S110 and S120, it is possible to determine all network nodes that have been attacked in the current network system. However, considering that in a network attack, one or more specific functions must be attacked, simply determining the connection relationship cannot determine the correct attack link, because there may be situations such as Figure 3 It is obviously difficult to determine the current status of the entire attack chain in the form of the second node - the first node - ... - the first node - the second node. Therefore, it is necessary to determine the attack chain of the network attack based on the data flow information. At the same time, even if there are nodes that have not been attacked, they are still included in the network attack chain. Specifically, as shown in S130, it includes: S131. Construct a network attack topology map based on the connection relationship between the first node and the second node.

[0077] The purpose of this step is that in a network system, there is often a coupling phenomenon of network nodes between multiple network functions. Therefore, in the specific attack link judgment, based on the network attack topology diagram, all network nodes currently suffering from network attacks and the analysis of attack links can be realized.

[0078] Among them, based on the direct connection relationship between all the first nodes and the second nodes, they are directly connected. At the same time, for the network nodes with a coupling relationship, they also need to be directly created according to the connection relationship of the network nodes.

[0079] In some embodiments, the coupling strength between different network functions and the importance of network nodes are judged, and then the direct connection strength in the network nodes is analyzed, so as to obtain a simplified network attack topology diagram that can ensure high accuracy. Including: S1311. Set the first node as an intermediate node of the attack link of the network attack, and set the second node as an end node of the attack link of the network attack.

[0080] In the technical solution of the present application, the second node is the end node in the attack link of the network attack, and the attack scope and attack result of the network attack can be directly determined.

[0081] Wherein, based on the direct connection relationship between network nodes, all first nodes and second nodes therein are directly connected according to the direct connection relationship to obtain an attack link of the connected network attack.

[0082] S1312: Connect the intermediate nodes with a direct connection relationship until the terminal node is connected to the intermediate node with a direct connection relationship, thereby obtaining a temporary network attack topology diagram.

[0083] S1313, obtaining the importance of the first node and the second node in the temporary network attack topology graph, including: The importance of the first node and the second node is obtained by using the following equation:

[0084] in, Indicates the importance of the first and second nodes in the network attack topology graph. Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first node or the second node, Indicates the first iThe probability of selecting the first node or the second node, i Represents the index of the first node and the second node in the network attack topology graph, j Indicates the first i The number of nodes directly connected to the first node or the second node.

[0085] S1314: The selection probabilities of the first node and the second node are obtained by using the following equation:

[0086] in, Indicates the first i The probability of selecting the first node or the second node, Indicates the first i The weight parameter of the first node or the second node in-degree and out-degree on the node selection probability, Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first node or the second node, Indicates the first i The adjacency between the first node or the second node and the directly connected node, Indicates the first i The adjacency between a directly connected node of a first node or a second node and the corresponding first node or second node.

[0087] S1315, the adjacency value is obtained using the following equation:

[0088] in, Indicates the first i The adjacency between a directly connected node of a first node or a second node and the corresponding first node or second node, represents the weight parameter of node in-degree and out-degree on node selection probability, Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first node or the second node, i Represents the index of the first node and the second node in the network attack topology graph, j Indicates the first i The number of nodes directly connected to the first node or the second node.

[0089] Among them, for the parameters in step S1314 A j , its calculation equation is the same as the adjacency degree numerical calculation equation in equation S1315, that is, both need to determine the weight parameters of the node selection probability, the number of edges of directly connected nodes, and the number of directly connected nodes based on the node in-degree and out-degree.

[0090] S1316: When the selection probability values ​​of the first node and the second node and the importance of the nodes both exceed preset values, the first node or the second node is a necessary node.

[0091] The purpose of this step is to quantitatively describe the importance of the first node or the second node being analyzed in the entire network system by simultaneously screening the selection probability value and the node importance. When both parameters exceed the preset values, it means that the node meets the indicators in terms of both selection probability and importance.

[0092] S1317. Connect the necessary nodes in the temporary network attack topology map to obtain a network attack topology map.

[0093] The purpose of this step is to prune the temporary network attack topology graph by connecting only necessary nodes, which can substantially reduce the number of nodes in all attack links in the network attack topology graph and ensure that the obtained network attack topology graph meets the accuracy requirements.

[0094] Among them, for the temporary network attack topology diagram, if a node in the entire network link is a necessary node, the network downstream node directly connected to it is a non-essential node, and the downstream node of the non-essential node is a necessary node, then the two necessary nodes are directly connected and the non-essential node is removed, such as Figure 4 As shown, a topological diagram of a network attack link in a big data network attack based on a network graph is provided in an embodiment of the present application.

[0095] In some embodiments, the Euler distances of all necessary nodes adjacent to each other are calculated, and the two necessary nodes with the smallest Euler distance are connected.

[0096] After obtaining the network attack topology map, in fact, although the topology map realizes the connection of necessary nodes, since the network node information in the network attack topology map does not have a direction, it is obviously impossible to directly confirm the attack link based on the network attack topology map. Therefore, other verification methods need to be introduced to confirm the attack link of the network attack. Specifically, the steps are as follows: S132. Based on the data flow between the first node and the second node, obtain an attack link of the network attack from the network attack topology map.

[0097] The purpose of this step is to further confirm, based on the data flow direction, whether there is a link interruption or data flow error in the network node link obtained after the first node and the second node are connected, after obtaining the network attack topology diagram, so as to obtain the network attack link.

[0098] Among them, based on the data flow direction of the first node and the second node, the first node or the second node at the most upstream of the data flow is obtained as the function initial node.

[0099] Among them, the upstream and downstream relationship between the first node and the second node is determined based on the data transmission method in the functional link during the implementation of the relevant functions in the network system. Figure 4 It can be clearly seen that in the functional link, the initial node is A2, so at this time, the second node upstream is the functional initial node.

[0100] Wherein, based on the functional initial node, all preset network attack links in the network attack topology graph are obtained.

[0101] Among them, in some network systems, network attacks may target multiple functions in the network system at the same time. In this case, there are multiple network attack links. By confirming the initial node in each attack link, the preset network attack link can be obtained.

[0102] Among them, in some networks, some network nodes are coupling nodes in multiple functional links, so it is necessary to search all network nodes with connections based on the functional initial node to obtain the preset network attack link.

[0103] Wherein, based on the data flow direction, the preset network attack link is verified, and the attack link of the network attack is obtained.

[0104] Among them, based on the data flow, analyze whether there is a connection interruption phenomenon between the first node and the second node in a direct connection relationship. For example, although two directly connected nodes are in a direct connection state in the network attack topology diagram, it is found in the data flow that the two network nodes obviously do not have a data interaction relationship. In this case, it can be confirmed that the attack link has failed to pass the verification, and the preset network attack link is not the attack link of the network attack.

[0105] Among them, only when it is determined that there is no discontinuous area of ​​data flow in the preset network attack link, can the preset network attack link be confirmed as a network attack link.

[0106] After confirming the network attack link, it is necessary to obtain information that can be used for attack profiling based on the network attack link. In this application, it is divided into subjective intent and objective intent. The subjective intent is used to identify the target of the network attack, the network system function to be attacked, the scope of the network attack, etc. The objective intent is mainly the IP address, so as to obtain a more accurate portrait. Specifically, as described in step S140, based on the attack link, the subjective intent and objective intent in the network attack are obtained.

[0107] Among them, the confirmation of objective intention includes: Based on the attack link, an attack function of the attack link is confirmed.

[0108] Based on the attack function, confirm the scope of the network attack; Based on the attack function and the network attack scope, obtaining the subjective intention; Based on the attack link, the IP address of the network attack is checked to obtain the objective intention Among them, if the second node is the terminal of a certain functional link, it can be considered that the current network function has been attacked, and the current attack function is recorded; if the second node is not the terminal of a certain functional link, it is necessary to analyze the functional link where the second node is located, and confirm the function corresponding to the functional link as the attack function of the attack link.

[0109] In some embodiments, the second node is a coupling node in multiple network function links, and all network functions that the node can correspond to are confirmed as attack functions of the attack link.

[0110] After the attack function of the attack link is confirmed, the network attack scope is confirmed based on all the attack functions.

[0111] Among them, based on the information such as the messages obtained in the abnormal traffic and the source of the abnormal traffic, IP reverse query is performed to analyze the current source IP of the abnormal traffic, and objective intention analysis is performed based on the IP information.

[0112] Among them, the ratio of all attack functions to the total number of functions is confirmed, and indicators such as "small attack range", "medium attack range", "large attack range" and "extremely large attack range" are set. The obtained ratio is used to quantitatively describe the attack range.

[0113] In some embodiments, importance levels are set for various functions in the network system, such as "highly important", "secondary important", "important" and "unimportant", and such importance levels can be set based on the importance of the function itself.

[0114] Wherein, based on the attack function and the network attack scope, obtaining the subjective intention includes: Based on the subjective intention matching equation, a subjective intention matching value is obtained, and the subjective intention matching equation is:

[0115] in, represents the subjective intention matching value, k a node index representing the first node or the second node in the expected attack link, l represents the number of the first node and the second node in the expected attack link, a represents the functional importance weights of the first node and the second node, Indicates the importance of the first node and the second node in the expected attack link; m The node index representing the network node in the functional link, n represents the number of network nodes in the functional link, b represents the functional importance weight in the functional link, Indicates the importance of network nodes in the functional link, c Indicates the scope of the network attack.

[0116] The purpose of this step is to analyze the attack scope of the network attack, the importance of each node in the attack link, and the current attack progress, and evaluate the degree of subjective malice, where, in this application, subjective malice and subjective intention are treated equally. More specifically, the numerator in the subjective intention matching equation actually represents the total importance of the network nodes that have completed the attack action in the current network attack, and the denominator is the total importance of the network nodes in the entire functional link. The ratio of the two can determine the attack tasks that have been completed by the current network attack behavior on the entire functional link, and thus the rate of the network attack can be determined. The greater the attack rate, the more significant the subjective malice and the more obvious the subjective intention.

[0117] However, for the calculation result, only a specific value can be obtained, and it is difficult to ensure that the value can correspond to a subjective intention keyword in the subjective intention evaluation database. Therefore, further processing is required, specifically: The subjective intention matching value is amplified to obtain an amplified subjective intention matching value, and the equation of the amplified subjective intention matching value is:

[0118] in, Indicates the amplified subjective intention matching value, which is a numerical range; f represents the weight of subjective intention matching value; Indicates the subjective intent matching value.

[0119] The purpose of this step is to obtain an expanded subjective intent matching value interval by calculating an equation. Since it is a numerical interval, it meets the basic requirement of obtaining multiple subjective intent keywords.

[0120] After obtaining the expanded subjective intent matching value, the subjective intent needs to be determined, specifically: The subjective intent keyword has a unique assignment. When the unique assignment falls into the expanded subjective intent matching value, the subjective intent keyword corresponding to the unique assignment is obtained to obtain the subjective intent.

[0121] In some embodiments, there are multiple subjective intent evaluation databases, each database represents a type of subjective intent keyword type, and all keywords therein are set with unique assignments. The amplified subjective intent matching values ​​are compared with each assignment in multiple databases respectively, so as to obtain subjective intent keywords from different databases respectively.

[0122] In some embodiments, after obtaining the subjective intent keywords, the keywords are further screened, and keywords that are obviously contradictory or too similar are checked or deleted to improve the conciseness of the subjective intent keywords.

[0123] Among them, the subjective intention of the network attack obviously represents the subjective malice of the initiator of this network attack. However, it is necessary to analyze the degree of subjective malice and determine the function of the attack in order to determine the subjective intention. After determining the candidate of the subjective intention, it is obviously necessary to analyze the subjective intention accurately. At this time, it is necessary to bring in the objective intention for analysis, specifically: After obtaining the subjective intention and objective intention of the network attack, the attack portrait is obtained. For the subjective intention, based on the obtained subjective intention keywords, the corresponding attack portrait is obtained from the network attack portrait template. Then, based on the objective intention, the obtained attack portrait is further screened to obtain a more accurate attack portrait. Specifically, as described in step S150, it includes: S151. Based on the subjective intention, obtain a network attack portrait template from a network attack portrait database.

[0124] Among them, based on the confirmed subjective intent keywords, all network attack portrait templates containing subjective intent keywords are obtained from the network attack portrait database based on keyword retrieval.

[0125] In some embodiments, retrieval weights are set for subjective intent keywords. For example, the subjective intent keyword is "obtain database information" and its weight is 0.9. At the same time, another keyword is "display function feedback error result" and its weight is 0.2. Since the weight of the former is much higher than the weight of the latter, all network attack portrait templates containing the keyword "obtain database information" are obtained. Even if the network attack portrait does not contain the network attack portrait template "display function feedback error result", it will still be called.

[0126] In some embodiments, the network attack portrait template is called only with a single subjective intent keyword, all network attack portrait templates are merged to obtain a new network attack portrait template, and the network attack portrait template can be stored again in the network attack portrait template database to become a new network attack portrait template.

[0127] S152. Based on the objective intention, verify the network attack portrait template to obtain a network attack portrait, including: Assigning importance to the attack information in the network attack portrait template; Assigning weights to the objective intention to obtain an objective value; The scoring value of the network attack portrait template is obtained based on the evaluation equation, and the network attack portrait template whose scoring value is higher than the scoring value threshold is obtained. The evaluation equation is:

[0128] in, Indicates the score value of the network attack portrait template, d represents the objective value, h Indicates the importance weight of attack information in the network attack template. Indicates the importance of attack information in the network attack template.

[0129] The purpose of this step is to consider that there may be multiple network attack portrait templates called based on subjective intent keywords. If they are used directly, it will obviously cause inconvenience to the network attack behavior analysis work. Therefore, it is necessary to screen out the network attack portrait that can best show the network attack behavior. Since the objective intent is locked based on the IP address, the screening of network attack portrait templates based on the objective intent can effectively improve the screening efficiency and screening accuracy of network attack portraits.

[0130] Among them, assigning a value to the importance of the attack information in the network attack portrait template can achieve a quantitative description of the attack information presented in different attack portraits. Specifically, it is determined based on the relevant functions of the entire network system.

[0131] Among them, the objective intention is assigned a weight, which is set based on the geographical information or other information corresponding to the IP address. For example, the IP address can be associated with other information. If the IP address is actually abroad, the objective intention is determined to be "foreign attack" and the weight is set to [0.7, 1.0]. If the IP address is domestic, the weight is set to [0.1, 0.7]. As for the specific weight value to be selected, it can be set by yourself.

[0132] In some embodiments, if it is found that the reverse lookup of the IP address fails, the weight is set to 1.0, because this represents that the attacker has higher network technology capabilities and usually has greater subjective malice, so the weight assignment for objective intent needs to be increased to the upper limit.

[0133] In some embodiments, a domestic IP address may be analyzed simultaneously with the enterprise or personal network address corresponding to the IP address, and a weight assignment may be determined based on the analysis results.

[0134] Among them, the result is obtained based on the evaluation equation, that is, the score value of the attack portrait template. At the same time, in this application, a score value threshold is also set. Only when the score value is higher than the set score value threshold, can the network attack portrait template be considered to meet the application standards and can subsequent application be carried out.

[0135] In some embodiments, if there are still multiple network attack portrait templates after comparing the score value and the score value threshold, the information in all network attack portrait templates is integrated into the same network attack portrait template to obtain a new network attack portrait template that meets the requirements.

[0136] S153: When the score value of the network attack portrait template is not lower than the score value threshold of the network attack portrait template, the objective intention is added to the network attack portrait template to obtain the network attack portrait.

[0137] Among them, after obtaining the network attack portrait template that meets the application requirements, the objective information corresponding to the IP address is also integrated into the network attack portrait template. Then, the network attack portrait template carries both the subjective intention and objective intention information of the network attack, thus forming a network attack portrait. Figure 5 As shown, a schematic diagram of a big data network attack portrait result based on a knowledge graph provided for an embodiment of the present application is provided, which includes all network attack information.

[0138] The embodiment of the present application discloses a big data network attack profiling method based on knowledge graph, and its beneficial effects are: 1. Realized the pre-determination of network attack portraits. When confirming network attack portraits, it is no longer necessary to obtain network attack portraits only after the network attack has achieved the confirmation of the entire network node link in the process of implementing the function. Instead, after the network attack is detected, the function that the attacker wants to attack is determined through the network attack behavior that has already occurred, thereby confirming the network attack portrait, and achieving the acquisition of network attack portraits when the attack fails.

[0139] 2. Improve the accuracy of network attack analysis. When obtaining network attack portraits, the current network attack form and path are not confirmed based on a single attack chain, but the attack behavior is analyzed based on all network attack paths and network nodes. By setting more network attack behavior information to obtain network attack portraits, the analysis accuracy of network attacks can be improved.

[0140] 3. Collect more network attack profile information. It is possible to obtain information about network attacks that have not been successfully completed, and comprehensively analyze the overall network attack behavior based on network nodes, so as to jointly analyze network attack profile information based on all network attack information, so as to realize the collection and prediction of current network attack behavior information.

[0141] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to computer program instructions, and the aforementioned computer program can be stored in a non-volatile storage medium. When the computer program is executed, it executes the steps of the above method embodiments. Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the embodiment of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a non-volatile storage medium and includes a number of instructions for an electronic device (which can be a personal computer, a server, a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention.

[0142] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A big data network attack profiling method based on knowledge graph, characterized in that: include: Acquire the real-time traffic of each network node in the network, mark the network node whose real-time traffic exceeds the first preset real-time traffic, and obtain the first node; Acquire upstream and downstream directly connected network nodes of the first node, mark the directly connected network nodes whose real-time traffic exceeds a second preset real-time traffic, and obtain a second node; Based on the connection relationship and data flow direction between the first node and the second node, acquiring an attack link of the network attack; Based on the attack link, obtaining the subjective intention and objective intention of the network attack; Based on the subjective intention and the objective intention, network attack portrait information is obtained.

2. The big data network attack profiling method based on knowledge graph according to claim 1 is characterized in that: The step of acquiring the real-time traffic of each network node in the network, marking the network node whose real-time traffic exceeds the first preset real-time traffic, and obtaining the first node includes: Based on the network operation characteristics, adjusting the first preset real-time flow corresponding to each network node; Monitor the real-time traffic of each network node in the network; The real-time traffic of the network node is compared with a first preset real-time traffic corresponding to the network node. If the real-time traffic of the network node exceeds the first preset real-time traffic, the network node is marked as the first node.

3. The big data network attack profiling method based on knowledge graph according to claim 1 is characterized in that: Acquiring upstream and downstream directly connected network nodes of the first node, marking the directly connected network nodes whose real-time traffic exceeds a second preset real-time traffic, and obtaining a second node, comprises: Acquire a network node directly connected to the first node to obtain a directly connected network node; Determining the first preset real-time traffic corresponding to the directly connected network node as the second preset real-time traffic; The real-time traffic of the directly connected network node is compared with a second preset real-time traffic corresponding to the directly connected network node. If the real-time traffic of the directly connected network node exceeds the second preset real-time traffic, the directly connected network node is marked as a second node.

4. The big data network attack profiling method based on knowledge graph according to claim 2 or 3 is characterized in that: Also includes: When the second node has other network nodes directly connected to the second node in addition to the direct connection relationship with the first node, marking the other network nodes as temporary second nodes; Determining the first preset real-time traffic corresponding to the temporary second node as the temporary second preset real-time traffic; Compare the real-time traffic of the temporary second node with the corresponding temporary second preset real-time traffic, and if the real-time traffic of the temporary second node exceeds the temporary second preset real-time traffic, mark the temporary second node as the second node, and adjust the second node directly connected to the temporary second node to the first node; Traverse all network nodes until the real-time traffic of the temporary second node does not exceed the corresponding temporary second preset real-time traffic, and obtain all the first nodes and the second nodes.

5. The big data network attack profiling method based on knowledge graph according to claim 1 is characterized in that: The acquiring the attack link of the network attack based on the connection relationship and data flow direction between the first node and the second node includes: Based on the connection relationship between the first node and the second node, construct a network attack topology map; Based on the data flow between the first node and the second node, an attack link of the network attack is obtained from the network attack topology map.

6. The big data network attack profiling method based on knowledge graph according to claim 5 is characterized in that: The constructing a network attack topology graph based on the connection relationship between the first node and the second node includes: Setting the first node as an intermediate node of the attack link of the network attack, and setting the second node as an end node of the attack link of the network attack; Connecting the intermediate nodes with a direct connection relationship until the terminal node is connected to the intermediate node with a direct connection relationship, thereby obtaining a temporary network attack topology diagram; Obtaining the importance of the first node and the second node in the temporary network attack topology graph includes: The importance of the first node and the second node is obtained by using the following equation: ； in, Indicates the importance of the first and second nodes in the network attack topology graph. Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first or second node, Indicates the first i The probability of selecting the first node or the second node, i Represents the index of the first node and the second node in the network attack topology graph, j Indicates the first i The number of directly connected nodes of the first node or the second node; The selection probabilities of the first node and the second node are obtained using the following equation: ； in, Indicates the first i The probability of selecting the first node or the second node, Indicates the first i The weight parameter of the first node or the second node in-degree and out-degree on the node selection probability, Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first or second node, Indicates the first i The adjacency between the first node or the second node and the directly connected node, Indicates the first i an adjacency between a directly connected node of a first node or a second node and the corresponding first node or second node; The adjacency value is obtained using the following equation: ； in, Indicates the first i The adjacency between a directly connected node of a first node or a second node and the corresponding first node or second node, represents the weight parameter of node in-degree and out-degree on node selection probability, Indicates the first i The number of edges from the first node or the second node to the directly connected node, Indicates that the directly connected node points to the first i The number of edges from the first or second node, i Represents the index of the first node and the second node in the network attack topology graph, j Indicates the first i The number of directly connected nodes of the first node or the second node; When the selection probability values ​​of the first node and the second node and the importance of the nodes both exceed preset values, the first node or the second node is a necessary node; The necessary nodes are connected in the temporary network attack topology map to obtain a network attack topology map.

7. The big data network attack profiling method based on knowledge graph according to claim 5 is characterized in that: The acquiring the attack link of the network attack from the network attack topology map based on the data flow between the first node and the second node includes: Based on the data flow direction of the first node and the second node, acquiring the first node or the second node at the most upstream of the data flow direction as the function initial node; Based on the functional initial node, all preset network attack links in the network attack topology graph are obtained; Based on the data flow direction, the preset network attack link is verified, and the attack link of the network attack is obtained.

8. The big data network attack profiling method based on knowledge graph according to claim 1 is characterized in that: The obtaining of subjective intention and objective intention of the network attack based on the attack link includes: Based on the attack link, confirming the attack function of the attack link; Based on the attack function, confirm the scope of the network attack; Based on the attack function and the network attack scope, obtaining the subjective intention; Based on the attack link, the IP address of the network attack is reversed to obtain the objective intention.

9. The big data network attack profiling method based on knowledge graph according to claim 8 is characterized in that: The obtaining of the subjective intention based on the attack function and the network attack scope includes: Based on the subjective intention matching equation, a subjective intention matching value is obtained, and the subjective intention matching equation is: ； in, represents the subjective intention matching value, k a node index representing the first node or the second node in the expected attack link, l represents the number of the first node and the second node in the expected attack link, a represents the functional importance weights of the first node and the second node, Indicates the importance of the first node and the second node in the expected attack link; m The node index representing the network node in the functional link, n represents the number of network nodes in the functional link, b represents the functional importance weight in the functional link, Indicates the importance of network nodes in the functional link, c Indicates the scope of the network attack; The subjective intention matching value is amplified to obtain an amplified subjective intention matching value, and the equation of the amplified subjective intention matching value is: ； in, Indicates the amplified subjective intention matching value, which is a numerical range; f represents the weight of subjective intention matching value; represents the subjective intention matching value; The subjective intent keyword has a unique assignment. When the unique assignment falls into the expanded subjective intent matching value, the subjective intent keyword corresponding to the unique assignment is obtained to obtain the subjective intent.

10. The big data network attack profiling method based on knowledge graph according to claim 1 is characterized in that: The obtaining of network attack profile information based on the subjective intention and the objective intention includes: Based on the subjective intention, obtaining a network attack portrait template from a network attack portrait database; Based on the objective intention, the network attack portrait template is verified to obtain a network attack portrait, including: Assigning importance to the attack information in the network attack portrait template; Assigning weights to the objective intention to obtain an objective value; The scoring value of the network attack portrait template is obtained based on the evaluation equation, and the network attack portrait template whose scoring value is higher than the scoring value threshold is obtained. The evaluation equation is: ； in, Indicates the score value of the network attack portrait template, d represents the objective value, h Indicates the importance weight of attack information in the network attack template. Indicates the importance of attack information in the network attack template; When the score value of the network attack portrait template is not lower than the score value threshold of the network attack portrait template, the objective intention is added to the network attack portrait template to obtain the network attack portrait.

Images