Power monitoring system network security attack scene intelligent identification method based on traceability graph

Abstract

The invention provides an intelligent identification method for a network security attack scene of a power monitoring system based on a traceability graph. The intelligent identification method comprises the following steps: step 1, performing arrangement and standardization processing on an original data set of the collected power monitoring system; 2, dividing a traceability graph by using timestamp attributes of edges, and positioning abnormal events into specific time slots; 3, carrying out the full-graph embedding of the sub-graphs, and completing the clue correlation tracing through a node similarity algorithm and a relation extraction algorithm; 4, an automatic encoder is used for completing attack scene intelligent recognition, and alarm sorting and alarm noise reduction based on alarm clue scores are achieved. According to the power monitoring system network security attack scene intelligent identification method based on the traceability graph provided by the invention, clue association traceability of historical alarms and transverse space jump behaviors is realized, the identification accuracy and efficiency of the model are improved, and the attack scene of the power monitoring system is identified more effectively.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to an intelligent identification method for network security attack scenarios of an electric power monitoring system based on a traceability graph. Background Art

[0002] Logs are recorded information generated by computer systems, applications or services, recording various activities, events and states of the system. Log analysis technology refers to the collection, storage, parsing and query of system logs to obtain information about system operation status, performance monitoring and security analysis. There are many business systems and middleware in the operation of the power monitoring system. Attackers may exploit vulnerabilities in the operating system to invade, or exploit vulnerabilities in middleware such as Apache, Tomcat, Nginx, etc. to attack the system. In order to fully restore the real attack scenario, in addition to the log data, it is also necessary to obtain massive log data from the information system based on real and complete operating system logs and middleware logs for necessary processing and analysis.

[0003] The traceability diagram is an effective information expression method used to track the source, propagation path and change process of data, information or events, so as to conduct effective traceability analysis and credibility assessment. By constructing an attack traceability diagram, the purpose of attack detection and traceability can be achieved. At the same time, graphical display technology can present complex traceability relationships in an intuitive and easy-to-understand way, helping users better understand the process of attack events and the behavior patterns of attackers, and then identify alarm information and network security attack scenarios.

[0004] In order to identify the attack scenarios in the power monitoring network security system, the existing methods use rule-based and feature-based machine learning for detection, but these methods rely on detailed rules and feature formulation methods, which are difficult to cover all the complex attack scenarios that appear in the power monitoring system. At the same time, the current mainstream detection technology still stays in the intrusion detection system (IDS), intrusion prevention system (IPS), endpoint detection and response (EDR), network traffic analysis and other methods. These methods can only detect short-term, immediate attacks, and cannot break through the alarm time window limit, and the effect of identifying network security attack scenarios is not good. Summary of the invention

[0005] In order to solve the above problems, the present invention provides an intelligent identification method for network security attack scenarios of electric power monitoring systems based on tracing graphs, which realizes the clue correlation tracing of historical alarms and lateral space jumping behaviors, improves the recognition accuracy and efficiency of the model, and more effectively identifies attack scenarios of electric power monitoring systems.

[0006] The present invention specifically provides a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph. The method is divided into four parts: traceability graph collection, subgraph division, graph embedding, and anomaly detection, and includes the following steps:

[0007] Step 1: sort and standardize the original data set collected from the power monitoring system;

[0008] Step 2: Use the timestamp attribute of the edge to divide the traceability graph and locate the abnormal event to a specific time slot;

[0009] Step 3: embed the subgraph into the whole graph, use the node similarity algorithm and relationship extraction algorithm to complete the clue association tracing;

[0010] Step 4: Use the automatic encoder to complete intelligent identification of attack scenarios and implement alarm sorting and alarm noise reduction based on alarm clue scoring.

[0011] Furthermore, the step 1 specifically includes the following sub-steps:

[0012] Step 1.1, read and store system logs. Use the audit log tools provided by different systems to record various events in the power monitoring system (such as user login and logout, file access, system calls, network activities, system startup and shutdown, etc.), and capture various system calls and kernel events by calling kernel modules, record them and write them into corresponding log files;

[0013] Step 1.2, Generation and storage of traceability graph. First, receive and process the event stream in the system audit log, and build the vertices and edges of the traceability graph by parsing and extracting key information (for example, event type, timestamp, and resource identifier); then, select, filter, and transform the event stream to meet pre-set rules and conditions. According to conditions such as event type, attribute constraints, or time window, filter out events that meet specific requirements and generate accurate traceability graph data; finally, convert the records into a traceability graph for storage;

[0014] Furthermore, the step 2 specifically includes the following sub-steps:

[0015] Step 2.1, taking the first event as the time reference, obtain the relative time of all events in the traceability graph;

[0016] Step 2.2: Divide the subgraph based on the timestamp and locate the abnormal event in a specific time slot;

[0017] Step 2.3: Output is the csv file sequence corresponding to the sub-graph division.

[0018] Furthermore, the step 3 specifically includes the following sub-steps:

[0019] Step 3.1, graph structure generation, for the n subgraphs generated by subgraph partitioning, use a loop to read the start and end node numbers, node attributes and edge attributes of each edge in turn;

[0020] Step 3.2, subgraph embedding, using graph embedding algorithm, its input is subgraph sequence, and output is feature vector corresponding to subgraph. Subgraph embedding includes three parts, namely graph traversal serialization, sequence embedding learning and graph embedding aggregation. Graph traversal serialization is to traverse the input graph, and use node similarity algorithm and relationship extraction algorithm to generate node traversal sequence, and record the order of nodes passed when traversing the graph; sequence embedding learning is to use word embedding model to learn the embedding representation of node sequence, and obtain the embedding vector of each node; graph embedding aggregation is to use an aggregation function to merge the vector representation of these nodes into the vector representation of the entire graph, and complete the association tracing of alarm clues.

[0021] Furthermore, the step 4 specifically includes the following sub-steps:

[0022] Step 4.1: Encode the subgraph embedding vector using an autoencoder;

[0023] Step 4.2, determine the attack scenarios existing in the power monitoring system based on the anomaly score. The anomaly score describes the degree to which a subgraph deviates from the subgraph in the training data. After the subgraph of the benign provenance graph is detected by the autoencoder, the outliers of the anomaly score should be discretely distributed and the number is small. After the subgraph of the malicious provenance graph is detected by the autoencoder, the outliers of the anomaly score are distributed in large numbers and continuously. By detecting the number of outliers exceeding a certain threshold, the attack scenario can be identified. Define the alarm clue score ASI as the basis for determining the alarm level, and perform attack scenario identification and alarm sorting based on the number of outliers exceeding the anomaly score threshold, and the set anomaly threshold and sensitivity.

[0024] Compared with the prior art, the beneficial effects are:

[0025] 1. The time slice division technology is used to realize the automatic mining method of cross-temporal and spatial alarm evidence clues that breaks through the alarm time window limitation;

[0026] 2. It uses unsupervised learning and has a certain ability to recognize attack scenarios that have never been seen before;

[0027] 3. The detection capability is strong. Based on time slices, it balances the forgetting rate and sensitivity, realizes the clue correlation tracing of historical alarms and lateral space jumping behaviors, improves the recognition accuracy and efficiency of the model, and more effectively identifies the attack scenarios of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a structural schematic diagram of a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph according to the present invention;

[0029] Figure 2 A schematic diagram of a case study on identifying attack scenarios based on anomaly scores. DETAILED DESCRIPTION

[0030] The following is a detailed description of a specific implementation method of an intelligent identification method for network security attack scenarios of an electric power monitoring system based on a traceability graph of the present invention in conjunction with the accompanying drawings.

[0031] This paper proposes an intelligent identification method for network security attack scenarios of power monitoring system based on traceability graph. Figure 1 As shown in the figure, it is divided into four parts: traceability graph collection, subgraph partitioning, graph embedding, and anomaly detection. First, the original data set collected from the power monitoring system is sorted and standardized; then, the traceability graph is partitioned using the timestamp attribute of the edge. The timestamp attribute records the time when the event occurred. By partitioning the subgraph based on the timestamp, the abnormal event is located in a specific time slot; after obtaining the subgraph sequence, the full graph of the subgraph is embedded to convert the high-dimensional graph structure into a low-dimensional feature vector that is easier to understand and process; finally, after completing the subgraph embedding, the automatic encoder is used to complete the intelligent identification of the attack scenario.

[0032] Specifically, the present invention comprises the following steps:

[0033] Step 1: Sort and standardize the original data set collected from the power monitoring system. The specific process is as follows:

[0034] Step 1.1, read and store system logs. Use the audit log tools provided by different systems to record various events in the power monitoring system (such as user login and logout, file access, system calls, network activities, system startup and shutdown, etc.), and capture various system calls and kernel events by calling kernel modules, record them and write them into corresponding log files;

[0035] Step 1.2, Generation and storage of provenance graph. First, receive and process the event stream in the system audit log, and build the vertices and edges of the provenance graph by parsing and extracting key information (e.g., event type, timestamp, and resource identifier); for example, use the Audit tool in the Linux system for logging; then, select, filter, and transform the event stream to meet the pre-set rules and conditions. According to conditions such as event type, attribute constraints, or time windows, use the SPADE tool to filter out events that meet specific requirements and generate accurate provenance graph data; finally, use the graph database Neo4j for storage, convert the LinuxAudit record into a Provenance Graph represented by the Open Provenance Model, generate it in real time in the / tmp / provenance.json file, and store the final result in spade.graph to generate a provenance graph that can be used for subsequent analysis. For example, the Audit audit log filtering rules for the Linux system are shown in Table 1.

[0036] Table 1

[0037]

[0038]

[0039] Step 2: Use the timestamp attribute of the edge to divide the traceability graph and locate the abnormal event to a specific time slot. The specific process is as follows:

[0040] Step 2.1, taking the first event as the time reference, obtain the relative time of all events in the traceability graph;

[0041] Step 2.2: The timestamp attribute records the time when the event occurs. The subgraph is divided based on the timestamp to locate the abnormal event in a specific time slot.

[0042] Step 2.3: Output is a csv file sequence corresponding to the subgraphs. Whenever an event occurs in a corresponding time slot, it is added to the corresponding subgraph.

[0043] Step 3: embed the subgraph into the whole graph, and use the node similarity algorithm and relationship extraction algorithm to complete the clue association tracing. The specific process is as follows:

[0044] Step 3.1, graph structure generation, for the n subgraphs generated by subgraph partitioning, use a loop to read the start and end node numbers, node attributes and edge attributes of each edge in turn;

[0045] Step 3.2, subgraph embedding, using graph embedding algorithm, its input is subgraph sequence, and the output is the feature vector corresponding to the subgraph. Subgraph embedding includes three parts, namely graph traversal serialization, sequence embedding learning and graph embedding aggregation. Graph traversal serialization is to traverse the input graph, and use the node similarity algorithm and relationship extraction algorithm to generate the node traversal sequence, and record the order of nodes passed when traversing the graph; sequence embedding learning is to use the word embedding model to learn the embedding representation of the node sequence and obtain the embedding vector of each node; graph embedding aggregation is to use an aggregation function to merge the vector representations of these nodes into the vector representation of the entire graph to complete the association tracing of the alarm clues. The model parameters obtained by training are shown in Table 2.

[0046] Table 2

[0047]

[0048] Step 4: Use the automatic encoder to complete the intelligent identification of attack scenarios and implement alarm sorting and alarm noise reduction based on alarm clue scoring. The specific process is as follows:

[0049] Step 4.1: Encode the subgraph embedding vector using an autoencoder;

[0050] Step 4.2: Determine the attack scenarios existing in the power monitoring system based on the anomaly score. The anomaly score describes the degree to which a subgraph deviates from the subgraph in the training data. After the subgraph of the benign provenance graph is detected by the autoencoder, the outliers of the anomaly score should be discretely distributed and the number is small. After the subgraph of the malicious provenance graph is detected by the autoencoder, the outliers of the anomaly score are distributed in large numbers and continuously. By detecting the number of outliers exceeding a certain threshold, the attack scenario can be identified. Define the alarm clue score ASI as the basis for determining the alarm level, and perform attack scenario identification and alarm sorting based on the number of outliers exceeding the anomaly score threshold, and the set anomaly threshold and sensitivity. For example, the diagram of identifying attack scenarios based on anomaly scores Figure 2 shown.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit the present invention. A person skilled in the art should understand that the specific implementation of the present invention can be modified or replaced by equivalents, but these modifications or changes are within the scope of protection of the pending claims.

Claims

1. A method for intelligently identifying network security attack scenarios in a power monitoring system based on a traceability graph, characterized in that: The intelligent identification method of network security attack scenarios of power monitoring system includes the following steps: Step 1: sorting and standardizing the original data set collected from the power monitoring system; Step 2: Use the timestamp attribute of the edge to divide the traceability graph and locate the abnormal event to a specific time slot; Step 3: embed the subgraph into the whole graph, use the node similarity algorithm and relationship extraction algorithm to complete the clue association tracing; Step 4: Use the automatic encoder to complete intelligent identification of attack scenarios and implement alarm sorting and alarm noise reduction based on alarm clue scoring.

2. According to claim 1, a method for intelligently identifying network security attack scenarios of power monitoring systems based on traceability graphs is characterized in that: The step 1 specifically includes the following sub-steps: Step 1.1, read and store system logs; use the audit log tools provided by different systems to record various events in the power monitoring system, and capture various system calls and kernel events by calling kernel modules, record them and write them into corresponding log files; Step 1.2, Generation and storage of traceability graphs; First, receive and process the event stream in the system audit log, and construct the vertices and edges of the traceability graph by parsing and extracting key information; then, select, filter and transform the event stream to meet pre-set rules and conditions; based on event type, attribute constraints or time window conditions, filter out events that meet specific requirements and generate accurate traceability graph data; finally, convert the records into a traceability graph for storage.

3. According to claim 2, a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph is characterized in that: The step 2 specifically includes the following sub-steps: Step 2.1, taking the first event as the time reference, obtain the relative time of all events in the traceability graph; Step 2.2: Divide the subgraph based on the timestamp and locate the abnormal event in a specific time slot; Step 2.3: Output is the csv file sequence corresponding to the sub-graph division.

4. According to claim 3, a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph is characterized in that: The step 3 specifically includes the following sub-steps: Step 3.1, graph structure generation, for the n subgraphs generated by subgraph partitioning, use a loop to read the start and end node numbers, node attributes and edge attributes of each edge in turn; Step 3.2: Subgraph embedding, using graph embedding algorithm, whose input is subgraph sequence and output is feature vector corresponding to subgraph.

5. According to claim 4, a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph is characterized in that: The subgraph embedding in step 3.2 includes three parts, namely graph traversal serialization, sequence embedding learning and graph embedding aggregation, wherein graph traversal serialization is to traverse the input graph, and generate a node traversal sequence using a node similarity algorithm and a relationship extraction algorithm, recording the order of nodes passed when traversing the graph; sequence embedding learning is to use a word embedding model to learn the embedding representation of the node sequence to obtain the embedding vector of each node; graph embedding aggregation is to use an aggregation function to merge the vector representations of these nodes into the vector representation of the entire graph to complete the association tracing of the alarm clues.

6. According to claim 4 or 5, a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph is characterized in that: The step 4 specifically includes the following sub-steps: Step 4.1: Encode the subgraph embedding vector using an autoencoder; Step 4.2: Determine the attack scenarios existing in the power monitoring system based on the anomaly score.

7. According to claim 6, a method for intelligently identifying network security attack scenarios of a power monitoring system based on a traceability graph is characterized in that: In step 4.2, the anomaly score describes the degree to which a subgraph deviates from the subgraph in the training data; after the subgraph of the benign provenance graph is detected by the autoencoder, the outliers of the anomaly score should be discretely distributed and the number is small, while after the subgraph of the malicious provenance graph is detected by the autoencoder, the outliers of the anomaly score are distributed in large numbers and continuously. By detecting the number of outliers exceeding a certain threshold, the attack scenario can be identified; The alarm clue score ASI is defined as the basis for determining the alarm level. The attack scenario is identified and the alarm is sorted according to the number of outliers exceeding the anomaly score threshold, the set anomaly threshold and sensitivity.

Images