Network threat deduction system and method based on Transform and graph attention network model

Abstract

The invention discloses a network threat deduction system and method based on Transform and a graph attention network model. The system mainly comprises four modules including a threat intelligence extraction module, a network threat entity construction module, a network threat deduction module and a deduction result application module. The method comprises the following steps: preprocessing and mining network security threat intelligence data by utilizing a graph attention network (GAT) model, constructing a complete network threat intelligence knowledge graph based on a data association relationship, and determining a vulnerability utilization weight in the graph; modeling is carried out on a reasoned path sequence based on a Transform model, a next reasoning sequence is predicted in a generative mode, and rapid and efficient network threat intelligence reasoning is achieved. According to the method, the complexity of attack deduction calculation is reduced, the deduction efficiency is improved, and security risk investigation and early warning can be carried out for a large-scale network environment.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular to a network threat deduction system and method based on Transformer and graph attention network models. Background Art

[0002] The increasingly complex network environment and a wide variety of unknown threats have made many organizations and institutions realize that it is unrealistic to build an absolutely secure and robust business network, and that they need to continuously conduct objective and comprehensive security evaluations on the business network. However, there are two problems with directly conducting network security testing and evaluation. First, the tools used in the testing process are not completely damage-free and may cause irreversible or potential damage to the tested network. On the other hand, the test evaluation cycle is uncertain, and the test itself will occupy the resources of the business network and even affect the normal operation of the business network. Therefore, there is an urgent need for an auxiliary testing method to simultaneously solve the destructiveness of the testing method and the uncertainty of the testing cycle.

[0003] As a network testing technology that assists testers in determining network attack paths and discovering security risks, network threat simulation can better overcome the above two problems by constructing network entities (attackers, defenders, security equipment, network equipment, etc.) and their relationships (attacks, paths, defenses, importance) of the tested network on a virtualized platform or desktop exercise, analyzing the attacker's attack path, and exploring potential risk points. A rigorous and reliable simulation system must have the ability to handle complex network entity relationships and be able to calculate and evaluate the evolution of network threats in a time series. Summary of the invention

[0004] In response to the problems existing in the prior art, the present invention provides a network threat deduction system and method based on Transformer and graph attention network models.

[0005] The present invention is specifically implemented as follows: a network threat deduction system based on Transformer and graph attention network models, the system including a threat intelligence extraction module, a network threat entity construction module, a network threat deduction module, and a deduction result application module.

[0006] The threat intelligence extraction module is connected to the network threat entity construction module. This module is responsible for collecting security-related data from various data sources and pre-processing the data. Data sources include but are not limited to security logs, network traffic records, public threat databases, social media, etc.

[0007] The network threat entity construction module is connected to the threat intelligence extraction module and the network threat deduction module. It uses the Graph Attention Networks (GAT) to process the data received from the threat intelligence extraction module and construct a dynamically updated knowledge graph, which contains representations of network security related entities (such as attackers, victims, malware) and their relationships (such as attack and propagation).

[0008] The network threat deduction module is connected to the network threat entity construction module and the deduction result application module. This module combines the node and edge features obtained from the graph attention network, and deduces the potential attack path and the attacker's possible behavior based on the knowledge graph with the decision transformer, and outputs the final result. This module analyzes the time series and spatial characteristics of the nodes and edges in the graph, predicts the attacker's next move, including the attack target and attack method, and thus predicts the attacker's possible actions and outputs the result of successful threat deduction. If the deduction is successful, the potential attack path and strategy are provided; if there is no potential attack path, the operation is terminated.

[0009] The simulation result application module is connected to the network threat simulation module and is divided into two sub-modules: attack verification and protection optimization. The attack verification sub-module is tested in the same virtual environment as the simulation module to verify the accuracy of the simulation results; the protection optimization sub-module adjusts the existing protection strategies of the system in a timely manner according to the simulation and test results, such as updating firewall rules, enhancing intrusion detection systems, and configuring traffic control strategies.

[0010] Further, the implementation of the threat intelligence extraction module 1.

[0011] Multiple data source collection submodules:

[0012] This module is responsible for collecting various threat intelligence data including APT attack chain intelligence, malware text, vulnerabilities, network traffic characteristics, etc. Among them, the diverter is responsible for capturing data from network traffic, and the probe is used to monitor and record network behavior and events.

[0013] Data preprocessing submodule:

[0014] This module preprocesses the collected data, removes unnecessary information (such as irrelevant network noise and error log entries), duplicate information, and performs data standardization to ensure the consistency of the data format for subsequent analysis and processing of the data.

[0015] Intelligence fusion submodule:

[0016] This module integrates data from different sources and formats into a unified format, and applies algorithms such as entity recognition and relationship extraction to link scattered information points to form a complete intelligence network. Named entity recognition is used to identify entities with specific meanings (such as names of people, places, and organization names) from text, and is used to identify key entities such as attackers and victims involved in security intelligence analysis.

[0017] Further, the implementation of the 2. network threat entity building module:

[0018] Combined with GAT, the processed data is mapped into a graph structure; threat entities include attackers, victims, malware, and vulnerabilities; they are represented as nodes of the graph, and the relationships between entities include attack, propagation, and impact; as edges, a threat intelligence knowledge graph is constructed; attributes are assigned to each node and edge in the graph, and node attributes include the characteristic description and classification label of the entity, and edge attributes include the relationship type and weight. For the attacker node, the printed attribute labels include but are not limited to the attack capability level (high, medium, low), attack frequency (frequent, occasional, etc.); for the victim node, there may be labels such as vulnerability (high risk, medium risk, low risk); for the malware node, there are malware type (Trojan, virus, worm, etc.) labels; for the vulnerability node, there are vulnerability severity (serious, important, general, etc.) labels. The attacker's attack capability level is determined by analyzing the records of relevant attack behaviors in the security log, and the vulnerability severity is determined by the historical vulnerability data of the affected system.

[0019] Further, the implementation of the 3. network threat deduction module:

[0020] Feature extraction and fusion:

[0021] Extract node and edge features from GAT, including: node attributes, such as attacker behavior patterns and victim vulnerabilities; and edge relationship features, such as attack paths and propagation methods. Use graph convolution operations to aggregate the features of neighbor nodes to obtain a more comprehensive node representation;

[0022] Sequence analysis:

[0023] Use recurrent neural network (RNN) or long short-term memory (LSTM) network to analyze the time series data of historical attack behaviors to capture the temporal characteristics of the attacker's behavior. Then, the time series features are fused with the static features extracted from the graph to form a unified feature vector that reflects the attacker's dynamic behavior. ;

[0024] Transformer configuration:

[0025] Through the self-attention mechanism, Transformer can dynamically adjust the weights of each time step when processing the input sequence, which enables the model to effectively capture the complex relationship between different states, actions and rewards. The model adopts the standard Transformer architecture, which contains multiple layers of self-attention layers and feedforward neural network layers. These two structures work together to deeply analyze the input feature sequence, further predict the attacker's possible next move, and reveal potential attack strategies and paths. Finally, residual connections and layer normalization techniques are integrated to ensure that information flows stably in the multi-layer network of the model, preventing the gradient disappearance or explosion problems that may occur when training deep models, thereby maintaining the stability and reliability of the model output.

[0026] Attack path probability calculation

[0027] Based on the output of the Transformer, the success probability of each potential attack path is calculated. The output features of the Transformer are passed to a fully connected layer using the Sigmoid activation function to output the success probability of the output path.

[0028] Further, the implementation of the 4 deduction result application modules:

[0029] The simulation verification module is connected to the network threat simulation module and is divided into two sub-modules: attack verification and protection optimization. The attack verification sub-module is used to perform verification tests in the same virtual environment as the network threat simulation module. The protection optimization sub-module adjusts the protection optimization strategy of the original system according to the test results, such as updating firewall rules, enhancing the intrusion detection system, configuring traffic control strategies, etc.

[0030] Another object of the present invention is to provide a network threat deduction method based on Transformer and graph attention network, the method comprising:

[0031] Step 1: Through the threat intelligence extraction module, the system collects data from multiple data sources, including but not limited to APT attack intelligence, malicious code features, vulnerability information, and network traffic features. Through preprocessing operations, noise and duplicate information are removed, and the data format is standardized to prepare for the subsequent network threat entity construction;

[0032] Step 2: Through the network threat entity construction module, the system applies the GAT model to build a threat intelligence knowledge graph; this module maps threat entities and their relationships to nodes and edges of the graph attention network, providing a basis for subsequent analysis;

[0033] Step 3, through the network threat deduction module, the module obtains the node and edge features through the graph attention network and fuses them. In this process, the system uses the Transformer model to analyze the comprehensive sequence features, predict potential attack actions, comprehensively evaluate and deduce potential attack paths and strategies, and provide comprehensive threat intelligence analysis for different attack scenarios; (1) The system outputs "deduction successful", the deduction results show that there are multiple potential attack paths, and all the deduced potential attack paths and strategies are given, (2) The system outputs "no potential attack path found".

[0034] Step 4: Through the deduction result application module, a virtualized environment with the same or similar configuration is created in the attack verification submodule based on the configuration and environment of the original system as a test environment to simulate and execute the deduced attack path and test the effectiveness of the attack without affecting the native system. In the virtual environment, the attack is executed using the attack plan generated by the network threat deduction module, and the effect of the attack is monitored and recorded, including whether the attack is successful, the system changes caused by the attack and their impact. The protection optimization submodule optimizes the system's protection strategy based on the attack verification results, evaluates and adjusts the effectiveness of security measures, such as patching system vulnerabilities, updating firewall rules, and adjusting the sensitivity of the intrusion detection system.

[0035] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the network threat deduction method based on Transformer and graph attention network.

[0036] Another object of the present invention is to provide an information data processing terminal, which is used to implement the network threat deduction system based on Transformer and graph attention network.

[0037] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0038] First, the present invention mines network security threat intelligence data, including vulnerability data, vulnerability details, and APT attack chains, by preprocessing based on a graph attention network model; constructs a complete network threat intelligence knowledge graph and determines vulnerability exploitation weights; establishes threat attributes of network areas and boundaries; associates the threat attributes of network areas and boundaries with the asset security status to derive the interconnection coefficient between nodes; calculates the risk level of a single node, a single vulnerability, or a service being attacked; performs cross-weighted superposition to calculate risk levels of different paths, determine and deduce the optimal attack path, analyze attack path weaknesses, and simultaneously generate attack states between path nodes; evaluates and deduces potential attack paths, and completes quasi-dynamic deduction-based risk prediction and control.

[0039] The present invention models the inference path sequence through Transformer and generatively predicts the next inference sequence, thereby realizing fast network threat intelligence reasoning. This method not only reduces the complexity of attack deduction calculation and improves efficiency, but also can realize security risk investigation and early warning of large networks.

[0040] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0041] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0042] Through an efficient threat intelligence deduction system and intelligent path analysis and deduction, the business impact on the tested network can be eliminated, unnecessary security defense expenditures can be reduced, and the cost-effectiveness of network assessment can be improved.

[0043] (2) The technical solution of the present invention provides a new idea for constructing a network threat deduction system:

[0044] The present invention uses the attention mechanism of the graph attention network to assign different weights to nodes, process key nodes and edges in a hierarchical manner, obtain higher attention when extracting features, and make complex network deduction more feasible.

[0045] Transformer uses sequence processing to effectively solve the multi-dimensional and time series problems of intelligence data. By learning the best sequence in historical data, it dynamically adjusts the node weights of the graph attention network during the deduction process, thereby improving the credibility of the deduction of potential risks and attack paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a structural block diagram of a network threat deduction system based on Transformer and graph attention network models provided by an embodiment of the present invention.

[0047] Figure 2It is a flow chart of the implementation method of the network threat deduction module provided by an embodiment of the present invention.

[0048] Figure 3 It is a flow chart of a network threat deduction method based on Transformer and graph attention network model provided by an embodiment of the present invention.

[0049] Figure 4 It is a flow chart of the system architecture provided by an embodiment of the present invention.

[0050] Figure 1 In: 1. Threat intelligence extraction module; 2. Network threat entity construction module; 3. Network threat deduction module; 4. Deduction result application module. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0052] like Figure 1 As shown, an embodiment of the present invention provides a network threat deduction system based on Transformer and graph attention network, including a threat intelligence extraction module 1, a network threat entity construction module 2, a network threat deduction module 3, and a deduction result application module 4.

[0053] The threat intelligence extraction module 1 is connected to the network threat entity construction module 2 and is used to collect data from multiple data sources, and collect security-related data from various data sources. The data sources may include but are not limited to target network security logs, network traffic records, public threat databases, social media, etc.; and pre-process and fuse the data.

[0054] The network threat entity construction module 2 is connected with the threat intelligence extraction module 1 and the network threat deduction module 3, and GAT is used to construct a threat intelligence knowledge graph, mapping threat entities and inter-entity relationships to the nodes and edges of the graph; threat entities include attackers, victims, and malware; inter-entity relationships include attack and propagation;

[0055] The network threat deduction module 3 is connected to the network threat entity construction module 2. It is used to fuse the features of nodes and edges obtained from the graph attention network, use Transformer to analyze time series features and spatial features, and predict the next action taken by the attacker, including the attack target and attack method, so as to generate attack path information and calculate the success probability of each potential attack path.

[0056] The deduction result application module 4 is connected to the network threat deduction module 3. In the attack verification submodule, a virtual environment with the same or similar configuration is created based on the configuration and environment of the original system as a test environment to simulate the deduced attack path and test the effectiveness of the attack without affecting the native system. In the virtual environment, the attack is executed using the results generated by the network threat deduction module, and the effect of the attack is monitored and recorded, including whether the attack is successful, the system changes caused by the attack and their impact. The protection optimization submodule optimizes the existing protection strategy of the system based on the attack verification results, and evaluates and adjusts the effectiveness of security measures.

[0057] Implementation of the threat intelligence extraction module provided by the embodiment of the present invention:

[0058] Multiple data sources collected:

[0059] The threat intelligence data collected includes APT attack chain data, malware text data, vulnerability data, network traffic characteristics and user behavior records, and the collected data is preprocessed to remove noise and duplicate information and standardize the data format. After the data is collected from multiple sources, it is usually organized into JSON format after preprocessing and intelligence fusion. For example, the APT attack chain contains: {name, type, array (containing different entities related to the threat, such as attackers, malware and vulnerabilities), and network behaviors related to the threat}.

[0060] The network threat entity construction module construction method provided by the embodiment of the present invention is as follows:

[0061] Combined with the graph attention network, the processed data is mapped into a graph structure; threat entities include attackers, victims, malware, and vulnerabilities; they are represented as nodes of the graph, and the relationships between entities include attack, propagation, and impact; as edges, a threat intelligence knowledge graph is constructed; attributes are assigned to each node and edge in the graph, and node attributes include the characteristic description and classification label of the entity, and edge attributes include relationship type and weight.

[0062] like Figure 2 As shown, the implementation of the network threat deduction module provided by the embodiment of the present invention is:

[0063] S101, feature extraction and fusion:

[0064] The features of nodes and edges are extracted from GAT. Each node represents a network entity, such as an attacker or a victim. Its attributes may include the attacker's behavior pattern (such as the type of frequent attacks, preferred attack time, etc.) and the victim's vulnerability (such as the type of system vulnerable to specific vulnerabilities). GAT aggregates the features of neighboring nodes by calculating the attention coefficient between the node and its neighbors, thereby obtaining a more comprehensive and context-related representation of each node; and the relationship features of the edges include attack paths and propagation methods. By operating on the feature vectors corresponding to the connected nodes, the features representing the edges are constructed. After feature fusion, the information of the edge is re-characterized by fusing the updated features from the nodes at both ends. For example, if the edge connects an attacker node and a victim node, the features of the edge may contain information extracted from the attacker's features and the victim's features, such as the effectiveness of the attack method and the victim's response measures.

[0065] S102, sequence analysis:

[0066] The time series data of historical attack behaviors are analyzed using recurrent neural networks (RNN) or long short-term memory (LSTM) networks to capture the temporal characteristics of the attacker's behavior. Then, the time series features are fused with the static features extracted from the graph to form a unified feature vector that reflects the attacker's dynamic behavior.

[0067] S103, Transformer configuration:

[0068] Through the self-attention mechanism, Transformer can dynamically adjust the weights of each time step when processing the input sequence, which enables the model to effectively capture the complex relationship between different states, actions and rewards. The model adopts the standard Transformer architecture, which contains multiple layers of self-attention layers and feedforward neural network layers. These two structures work together to deeply analyze the input feature sequence, further predict the attacker's possible next move, and reveal potential attack strategies and paths. Finally, residual connections and layer normalization techniques are integrated to ensure that information flows stably in the multi-layer network of the model, preventing the gradient disappearance or explosion problems that may occur when training deep models, thereby maintaining the stability and reliability of the model output.

[0069] S104, attack path probability calculation

[0070] Based on the output of the Transformer, the success probability of each potential attack path is calculated. The output features of the Transformer are passed to a fully connected layer using the Sigmoid activation function to output the success probability of the output path.

[0071] like Figure 3As shown, a network threat deduction method based on Transformer and graph attention network model provided by an embodiment of the present invention includes:

[0072] S201, through the threat intelligence extraction module, the system collects data from multiple data sources, including but not limited to APT attack chain intelligence, malware characteristics, vulnerability information, and network traffic characteristics and security logs of the target system. Through preprocessing operations, noise and duplicate information are eliminated, and the data format is standardized to prepare for the subsequent construction of network threat entities;

[0073] S202, through the network threat entity construction module, the graph attention network is used to build a threat intelligence knowledge graph; this module maps threat entities and their relationships to nodes and edges of the graph, providing a basis for subsequent analysis;

[0074] S203, through the network threat deduction module, the system uses the node and edge features obtained by the graph attention network to fuse and analyze the sequence features to predict the next action taken by the attacker; the system uses the Transformer model to generate threat intelligence deduction results for different attack scenarios and assist in generating test plans.

[0075] S204, through the deduction result application module, the system creates a homologous virtual environment and uses it as a test environment to simulate and execute the deduced attack path to ensure the effectiveness of the attack without affecting the native system. Using the results generated by the network threat deduction module, the attack is executed in the virtual environment, and the effect of the attack is monitored and recorded, including whether the attack is successful, the system changes caused by the attack and their impact.

[0076] like Figure 4 As shown, the embodiment of the present invention provides a network threat deduction system based on Transformer and graph attention network model. The analysis method involved can be divided into the following key steps, which are summarized in detail as follows:

[0077] Step 1: Extract threat intelligence

[0078] First, the system collects network security training data, including network packets, log files, etc. These data reflect various activities and potential threats in the network, with the purpose of generating model training data for deduction.

[0079] The step 1 provided in the embodiment of the present invention specifically includes the following steps:

[0080] Step 1.1: Extraction of network security threat intelligence; including (1) vulnerability data: vulnerability data is collected from major vulnerability disclosure platforms, and data types include vulnerability system type, system version and exploitation method; (2) APT attack chain data: APT attack chain data is collected from the APTnotes platform; including 689 APT reports in the past 10 years; (3) malware text data: including the name, type, common functions, hash and exploitation system platform of the malware in the threat intelligence; this part of data is collected from the threat intelligence source AlienVault; (4) security community discussion data: this part of data is collected from the StackExchange website and is the text of recent security incidents; (5) security simple content aggregation (Really Simple Syndication, RSS) subscription data: this part of data is collected from major network security RSS and is recent network security news.

[0081] Step 1.2: Preprocessing of network data

[0082] The collected network data is preprocessed to ensure the quality and consistency of the data and make it suitable for training the deduction model.

[0083] Detailed process of step 1.2:

[0084] 1) Deduplication operation

[0085] First, the system deduplicates the data set, removes duplicate data entries, ensures the uniqueness and validity of the data, and reduces the impact of redundant information on model training.

[0086] 2) Filter irrelevant data

[0087] The system filters the raw data, eliminating information that is not relevant to threat analysis, and ensures that the model only processes data related to security threats.

[0088] 3) Denoising and smoothing

[0089] There are noisy data or outliers in the data set, which will interfere with the analysis and judgment of the model. Through denoising and smoothing, the system can remove the noise in the data and maintain the smoothness of the data, making the model input more accurate.

[0090] 4) Standardization

[0091] Since Transformer has specific requirements for input data, the data needs to be standardized. This step ensures that all data are in the same scale range (for example, by normalizing data in different units) to avoid data differences in model processing leading to biased results.

[0092] Step 2: Cyber ​​threat entity construction

[0093] Apply graph attention network to build threat intelligence knowledge graph; this module maps threat entities and their relationships to nodes and edges of the graph, providing a basis for subsequent analysis;.

[0094] Step 2 provided in the embodiment of the present invention specifically includes the following steps:

[0095] Step 2.1: Based on real data analysis experience, network threat intelligence organization modeling is performed and the threat intelligence knowledge graph structure is designed. Furthermore, network security entity recognition is performed on the prepared network security threat intelligence dataset.

[0096] Step 2.2: Design regular expressions to extract regular threat intelligence entities, and use commercial technical analysis tools to map sentences to TTPs items in ATT&CK. For example, for text describing network attack methods, use the regular expression CVE-\d{4}-\d+ to match the CVE number to extract information. And for all entities with a confidence level of 100%, use them directly for further analysis and deduction.

[0097] Step 2.3: Use static feature analysis to further explore the homology of malicious code and build a heterogeneous network graph of threat intelligence. On this basis, initialize the feature vector to ensure that the attribute information of each node is retained, thereby giving the vector representation practical meaning.

[0098] Step 2.4: For the relationship weights between different entities, such as the association weight between attackers and malware, it is calculated based on the frequency of their co-occurrence in known attack events; for example, if attacker A and malware M co-occur 30 times in 100 attack event samples, the association weight between them can be initially set to 30 / 100 = 0.3. For the weights of the entity's own attributes, such as the severity weight of the vulnerability, it is comprehensively determined in combination with the industry standard vulnerability scoring system (such as CVSS) and the potential impact in the actual network environment. For example, for vulnerability V, if it is 7 points (out of 10 points) in the CVSS score and affects the core business system in the actual network, its final weight can be calculated according to certain weighting rules (such as the actual impact weight is 0.6 and the CVSS weight is 0.4) as 7×0.4+8 (assuming that the weight of the core business system affected is 8)×0.6=7.6.

[0099] Step 2.5: Map the heterogeneous network graph to a homogeneous graph, and train the node classification model based on GAT combined with the cross entropy loss function and the gradient descent method, so as to iteratively adjust the weights and parameters in the network to improve the classification accuracy. The cross entropy loss function is a commonly used loss function in classification tasks, which is suitable for measuring the difference between the probability distribution predicted by the model and the probability distribution of the true label. Its function expression is as shown in formula (1).

[0100]

[0101] K is the total number of categories, y o，c is the one-hot encoding of the node target value. If the class label c is the correct classification of node o, it is 1, otherwise it is 0. o，c is the probability that the model predicts that node o belongs to category c.

[0102] The gradient descent method calculates the gradient of the loss function relative to the model parameters and uses this gradient information to update the parameters to reduce the value of the loss function. Its formula is as shown in (2).

[0103]

[0104] θ represents the model parameters, η is the learning rate, It is the gradient of the loss function L with respect to the parameter θ.

[0105] Step 2.6: Use the homogeneous graph attention mechanism on the threat intelligence report homogeneous information network. The core of the graph neural network is the message passing mechanism, which learns the target node feature vector by aggregating neighbor feature information.

[0106] Step 2.7: The graph attention network first transforms the input feature vector through a linearly changing weight matrix W.

[0107] h={h1,…,h N}, h i ∈R F Convert to high-level features, where N is the number of nodes and F is the dimension of the node features.

[0108] Specifically, the graph attention network first converts it into high-level features through a linear transformation W. Different neighbor nodes have different importance and contribute differently to the feature representation of the target node.

[0109] Step 2.8: GAT weight construction, by calculating the attention weight to determine the contribution of each neighbor node in the node feature aggregation process, to distinguish the importance of neighbor nodes. The original attention score is shown in formula (3).

[0110] e ij =LeakyReLU(α T[H i W, H j W]) (3)

[0111] W is the linear transformation weight matrix, H j is the input initial vector, usually the feature vector of node j, which represents the original attribute or encoding information of the node, α T represents the transpose of the vector α.

[0112] In order to make the weight distribution reasonable, the Softmax function is used for all e ij Normalize to get the final attention weight α ij , as shown in formula (4).

[0113]

[0114] Where N(i) is the set of neighbor nodes of node i, ensuring that all neighbor nodes j of node i have an attention weight α ij The sum is 1.

[0115] Specifically, the vector α is used as the weight of a single-layer feedforward neural network to learn and adjust the attention mechanism, and then LeakyReLU is selected for nonlinearization. Finally, Softmax is used to normalize the neighbor nodes of the central node to obtain the weights of the neighbor nodes.

[0116] And aggregate the neighbor node feature representations scaled by different attention weights. The aggregate feature representation of node i is shown in formula (5).

[0117] H i =σ(∑ j∈N(i) α ij H j W) (5)

[0118] σ is a nonlinear activation function.

[0119] Step 2.9: GAT uses a multi-head attention mechanism to learn node feature representations from different aspects. The multi-head attention mechanism refers to the use of multiple independent attention mechanisms (called "heads") in parallel in the same layer to process nodes in the graph. Each head learns different aspects of the interaction between nodes and outputs its own node feature representation. In this way, multiple different feature representations of the target node are obtained, and finally the multi-head attention mechanism is output in the form of an average. K is the number of heads set, as shown in Formula 6.

[0120]

[0121] Step 3: Transformer-based deduction model construction

[0122] A Transformer-based inference model is constructed to analyze the time series and spatial features in the network. The model combines the node and edge features extracted by GAT to simulate the propagation and attack methods of threats in the network.

[0123] Step 3 provided in the embodiment of the present invention specifically includes the following steps:

[0124] Step 3.1: The system extracts node and edge features from the knowledge graph generated by the graph attention network, defined as the feature set F = {f1, f2, ..., f m}, these features include the relationship between threat entities, attack patterns and historical behavior data, etc. The input is the feature set F and the current network status S.

[0125] The node and edge features in the graph are fused through linear transformation to form the context representation C, as shown in formula (7).

[0126] C=W f *F+b f (7)

[0127] Specifically, W f is the weight matrix, b f is the bias term.

[0128] Step 3.2: In the encoder part, the model adopts a multi-layer self-attention mechanism, in which each layer contains multiple self-attention heads, which can capture the features of input data from different subspaces in parallel. This structure helps the model to deeply understand complex and multi-level entity relationships.

[0129] First, the knowledge graph processed by GAT is used as the sequence input, and the node features and edge features are fused through the multi-head attention mechanism to capture the complex interactions between different entities and relations, as shown in Formula 8.

[0130]

[0131] Where Q, K, and V are query, key, and value, respectively, representing the current node, the target node features for query comparison, and the data or features associated with each key. k is the dimension of the key vector K, that is, the number of features of each key vector.

[0132] Specifically, by modeling the path sequence of reasoning, the next reasoning sequence is generatively predicted, thereby achieving fast knowledge reasoning. It adjusts the autoregressive architecture to generate the next action based on past rewards, states, and actions.

[0133] Specifically, during the encoding process, the knowledge graph embedding model is applied to embed the states representing entities in the knowledge graph and the actions representing relations in the knowledge graph into vectors of the same dimension. The position time step encoding is then added to each corresponding token to indicate the reasoning order.

[0134] Specifically, during decoding, token embeddings are fed into the Transformer decoder architecture, which uses causal self-attention mask autoregression to predict the next entity or relation. The path sequence is generated directly using the Transformer framework instead of using reinforcement learning for a large amount of trial-and-error exploration, so it can achieve faster reasoning by processing the entire reasoning sequence at once in a highly parallel manner without exploring a large search space.

[0135] As shown in Formula 9, the model modeling sequence number knowledge reasoning process is described, where the starting point is a given entity e s and a relation q Composition, determined by multi-step reasoning and e s By r q The target entity e connected by the relationship o , the tail entity e of the sequence o The whole reasoning process of the model is represented by an operation sequence T.

[0136] q:=(e s , r q ), τ: =( <bos>,R1,a1,s1,...,R n ,a n ,e o , <eos>(9)

[0137] in, <bos>and <eos< are the identifiers for the start and end of a sequence, respectively, R i represents a series of relationships, a i represents the operation corresponding to R i corresponding operation.

[0138] The knowledge graph representation learning model ConvE embeds each entity and relationship in the sequence, mapping each token to a vector of the same dimension. At the same time, to further distinguish the sequential relationship of the inference sequence, the model adds corresponding position embedding codes to the embedding representation of each entity or relationship, and the formed semantic encoding is input into the decoder module.

[0139] Step 3.3: Combine path semantic similarity with attention mechanism and rules to guide the sampling of high-quality training paths. First, the model uses the attention mechanism to focus on the semantic information of local paths, and strengthens the path features most relevant to the current inference task according to the attention weights. In addition, global information is introduced in a rule-guided manner to ensure that the selected paths are not only locally valid but also representative in the entire knowledge graph. By combining these two strategies, the model can calculate the selection probability of each possible path. In the decoder module, as shown in Equation 10, the model generates the next sequence item (i.e., inference action) autoregressively by learning the sequence patterns in the inference path, including the semantic encoding of the encoder and the previous sequence items.

[0140]

[0141] p(τ|q) represents the probability that the entire inference sequence τ occurs given the query q. The starting item of each sequence is <bos>, representing the start of the sequence: when the decoder generates <eos> or reaches the maximum sequence length, the inference ends and the last generated sequence is output. During this process, action selection depends on the calculated path selection probabilities, which are based on a comprehensive evaluation of path semantic similarity and global information.

[0142] Step 3.4: During the training process of the model, as shown in Equation 11, cross-entropy is used as the loss function for the sequence classification task. At the same time, to prevent the model from overfitting to the training data (i.e., overfitting), label smoothing is used for regularization operations. Regularization is a technique used to improve the generalization ability of the model, i.e., its performance on newly unseen data, by adding additional information or constraints to limit the model complexity, as shown in Equation 12.

[0143]

[0144] Among them, V is all candidate generation items, including all entities, relationships, sequence start identifier <bos> and sequence end identifier <eos>. ∈ is the error rate of model label smoothing, that is, the probability of the correct sample is reduced from 1 to 1 - ∈, and the probability of the wrong sample is ∈.

[0145] Step 3.5: During the model training process, adopt the "Teacher Forcing" strategy to generate sequence items in an autoregressive manner. Use the real sequence items as the input instead of using the output of the model at the previous time step. When the model predicts the potential attack path of threat intelligence, ensure the relevance and accuracy of the model output. The Transformer model relies on its multi-layer self-attention mechanism, and uses the context representation output by the encoder at each time step to accurately generate the next sequence item in an autoregressive manner. Ensure that the model can quickly and accurately learn how to deduce the next state from the current input state during the training process, and improve the overall deduction performance of the model.

[0146] Step 3.6: When the decoder generates each output, consider the information of all previous outputs, so as to generate a decision sequence related to the future attack path. When processing the input sequence, the Transformer model first converts the entities and relationships in the knowledge graph into standardized input vectors.

[0147] Specifically, in the sequence processing stage, the decoder uses the global context information provided by the encoder to iteratively generate a decision sequence. Each decision takes into account the previous output, and predicts the next potential attack state or defense action based on the output of the previous state and the global context of the encoder.

[0148] Specifically, the model learns how to transfer from one network state to another by simulating attack scenarios, continuously generating multiple steps to form a complete attack path. The self-attention mechanism evaluates and weights the relevance of all elements in the sequence during this process, enabling the model to capture long-distance dependencies and optimize the output of each step.

[0149] Specifically, combine the context representation and the current state information to generate a protection strategy through a fully connected layer. As shown in Equation 13.

[0150] P = σ(W p * [C; S] + b p ) (13)

[0151] Among them, [C; S] represents the concatenation of the feature representation and the state information, and σ is the activation function.

[0152] Step 3.7: During the process of generating the inference path, the model receives new input data, such as new security events or threat intelligence, and dynamically adjusts its inference strategy. Finally, the conclusion of success or failure is output based on the inference result. If successful, all potential attack paths are output; otherwise, no potential attack paths are output.

[0153] Step 4: Application of simulation results

[0154] Step 4 provided in the embodiment of the present invention specifically includes the following steps:

[0155] Step 4.1: The system first categorizes and preliminarily evaluates the results output by the network threat modeling module, including possible attack paths and recommended protection measures. Subsequently, a detailed analysis is conducted based on the practicality and feasibility of the results.

[0156] Step 4.2: The attack verification submodule verifies the validity of the deduced attack paths by reproducing them in the same virtual environment. The real system environment is simulated in the test environment to ensure the accuracy of the verification results. In this way, the attack verification module tests whether the deduced attack paths are real and feasible, thereby collecting key security vulnerabilities and defect information.

[0157] Step 4.3: Based on the test results of the attack verification submodule, the protection optimization submodule adjusts and updates the existing security policies and protection measures. This includes updating firewall rules, optimizing the configuration of the intrusion detection system, and adjusting the network traffic control policy to block confirmed attack paths and ensure that system protection measures are updated in a timely manner to resist verified and potential attacks.

[0158] The analysis method of the present invention forms a complete network threat deduction process from threat intelligence extraction, data preprocessing to deduction model construction and deduction result application.

[0159] This solution realizes a dynamic and efficient network threat deduction system by combining graph attention network and deep learning technology. Using graph attention network, the system can effectively capture the complex relationship between entities in the network, while the deep learning model enhances the ability to mine historical data. Through real-time analysis and reasoning, the system can quickly identify potential attack patterns and generate corresponding protection strategies to ensure the timeliness and accuracy of network security defense. Such a combination can not only improve the intelligence level of the system, but also enhance its adaptability to ever-changing network threats.

[0160] The following is a specific example of a network threat deduction system based on Transformer and graph attention network:

[0161] Example 1: Threat intelligence deduction based on APT attacks

[0162] APT attacks are a type of network attack that lasts a long time and is highly concealed. Attackers usually lurk in the network for a period of time and gradually obtain sensitive data or permissions. In order to protect against APT attacks, a threat intelligence deduction system based on Transformer and graph attention network is applied in this embodiment.

[0163] 1) Network Threat Entity Construction: Through the network threat entity construction module, the system extracts information from APT attack chain data, public APT reports, security logs and network traffic to create a threat intelligence knowledge graph. The APT attack chain contains entities such as attackers, victims, and malware, and the attack path is represented by the edges of the graph.

[0164] 2) Network threat deduction: GAT extracts features from nodes and edges in the APT attack chain, and combines the Transformer model to analyze the time series features of the attack to predict the attacker's next move. The system can predict the target that the attacker will target and the attack method to be used next (such as malware implantation, privilege escalation, etc.), and deduce the potential APT attack path of the system.

[0165] This embodiment successfully intercepted the attacker's privilege escalation behavior in the early stage of APT attack and prevented further data leakage. Through dynamic feedback and optimization, the system enhances the ability to predict APT attack behavior, shortens the response time, and improves the overall protection effect.

[0166] The above embodiments demonstrate the specific application of the network threat inference system based on Transformer and graph attention network in APT attack and malware propagation scenarios, and achieve efficient detection and defense of complex network attacks through the construction of knowledge graphs, analysis of inference models, and automated protection response.

[0167] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0168] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.< / bos> < / eos> < / bos>

Claims

1. A network threat deduction system based on Transformer and graph attention network model, characterized in that: include: Threat intelligence extraction module, which is used to collect threat intelligence data and application results from multiple data sources such as security logs, network traffic records, public threat databases, and Internet network attack reports; The network threat entity construction module applies GAT to build a threat intelligence knowledge graph, mapping threat entities and their relationships into nodes and edges of the graph; The network threat deduction module is connected to the network threat entity construction module. It is used to fuse the node and edge features extracted by the graph attention network, use Transformer to analyze the time series features and spatial features, and predict the next action taken by the attacker to deduce the potential attack path and the attacker's possible behavior. The simulation result application module is connected to the network threat simulation module and is divided into an attack verification module and a protection optimization module. It is used to perform attack simulation verification on the same-source mirror virtual environment and adjust the protection strategy according to the verification results.

2. The system according to claim 1, characterized in that The threat intelligence extraction module further includes a function of preprocessing the collected data, wherein the preprocessing includes deduplication, filtering, smoothing and standardization to ensure the consistency, availability and accuracy of the data input.

3. The system according to claim 2, characterized in that The network threat deduction module aggregates the neighbor node features of the threat entity through graph convolution operations to generate a more comprehensive node representation, and combines the Transformer model to analyze the time and space characteristics in the threat intelligence to predict the attacker's next move, including potential attack targets and attack methods.

4. The system according to claim 3, characterized in that The deduction result application module includes: The attack verification module conducts attack path verification tests in a virtual environment that is the same or similar to the network threat simulation module, simulating possible attack behaviors to ensure the accuracy of the simulation results; The protection optimization module optimizes and adjusts the protection strategy of the original system according to the attack verification results, updates the firewall rules, enhances the intrusion detection system, and configures the traffic control strategy to deal with the attack paths discovered by the verification.

5. A network threat deduction system and method based on Transformer and graph attention network model according to any one of claims 1 to 4, characterized in that: The network threat deduction method comprises: Collect cyber threat intelligence data from multiple data sources, including security logs, network traffic records, public threat databases, and social media, to identify threat entities and the relationships between them; Use the Graph Attention Network (GAT) to build a threat intelligence knowledge graph, map threat entities to graph nodes, and map the relationships between entities to graph edges to form a graph structure; The nodes and edges in the graph are feature extracted and input into Transformer to analyze the time series and spatial features, deduce the potential path of the attacker, and output the result of successful or unsuccessful deduction. Conduct homologous mirror system testing on the simulation results, and conduct verification tests in a virtual environment with the same homologous mirror as the target network. According to the simulation and test results, timely adjust the protection optimization strategy of the original system, such as updating firewall rules, enhancing intrusion detection systems, and configuring traffic control strategies.

6. The method according to claim 5, characterized in that The following steps are involved: Preprocess the collected network data, including deduplication, filtering, smoothing and standardization, to ensure the consistency, availability and accuracy of the data; According to the input requirements of Transformer, the standardized data is subjected to feature extraction and processing to ensure that it is suitable for the analysis of time series and spatial dimensions.

7. The method according to claim 5, characterized in that The following steps are involved: Through the Transformer model, the node and edge features generated by the graph attention network are integrated with the time series features, combined with the self-attention mechanism and the feedforward neural network to generate a feature vector for predicting the attacker's next action; and the result of whether the attacker's behavior is successfully predicted is output.

8. The method according to claim 5, characterized in that The following steps are involved: The attack verification module uses the same virtual environment to perform attack verification tests, evaluates whether the deduced attack path is successful based on the test results, and feeds the verification results back to the protection optimization module; Based on the attack verification results, the protection optimization module adjusts and optimizes the protection strategy, including updating firewall rules, enhancing the intrusion detection system, and configuring traffic control strategies to resist the attack behaviors discovered by the verification.

Images