A network threat deduction system and method based on a Transformer and a graph attention network model

Abstract

The application discloses a network threat deduction system and method based on a Transformer and a graph attention network model, wherein the system mainly comprises four modules of threat intelligence extraction, network threat entity construction, network threat deduction and deduction result application. The application utilizes a graph attention network (GAT) model to preprocess and mine network security threat intelligence data, constructs a complete network threat intelligence knowledge graph based on data correlation, and determines a vulnerability utilization weight in the graph. The application models a reasoning path sequence based on a Transformer model, predictively generates a next reasoning sequence, and realizes fast and efficient network threat intelligence reasoning. This method not only reduces the complexity of attack deduction calculation and improves deduction efficiency, but also can perform security risk investigation and early warning for a large network environment.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a network threat inference system and method based on Transformer and graph attention network models. Background Technology

[0002] The increasingly complex network environment and the diverse range of unknown threats have led many organizations and institutions to realize that building absolutely secure and robust business networks is unrealistic, necessitating continuous, objective, and comprehensive security assessments. However, current methods of directly conducting network security testing and evaluation present two main problems: first, the tools used in the testing process are not entirely harmless and may cause irreversible or potential damage to the network under test; second, the testing and evaluation cycle is uncertain, and the testing itself consumes business network resources and may even affect the normal operation of the business network. Therefore, there is an urgent need for an auxiliary testing method that can simultaneously address the destructive nature of testing methods and the uncertainty of the testing cycle.

[0003] As a network testing technique to assist testers in identifying network attack paths and discovering security risks, network threat simulation constructs network entities (attackers, defenders, security devices, network devices, etc.) and their interrelationships (attacks, paths, defenses, importance) of the network under test on a virtualization platform or desktop simulation. This allows for the analysis of attackers' attack paths and the identification of potential risk points, effectively overcoming the two problems mentioned above. A rigorous and reliable simulation system must be capable of handling complex network entity relationships and can calculate and evaluate the evolution of network threats according to time series. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a network threat inference system and method based on Transformer and graph attention network models.

[0005] The present invention is specifically implemented as follows: a network threat inference system based on Transformer and graph attention network models, the system including a threat intelligence extraction module, a network threat entity construction module, a network threat inference module, and an inference result application module.

[0006] The threat intelligence extraction module, connected to the network threat entity construction module, is responsible for collecting security-related data from various data sources and preprocessing the data. Data sources include, but are not limited to, security logs, network traffic records, public threat databases, and social media.

[0007] The network threat entity construction module is connected to the threat intelligence extraction module and the network threat inference module. It uses Graph Attention Networks (GAT) to process the data received from the threat intelligence extraction module and build a dynamically updated knowledge graph. The graph contains representations of network security-related entities (such as attackers, victims, and malware) and their relationships (such as attacks and propagation).

[0008] The network threat simulation module, connected to the network threat entity construction module and the simulation result application module, fuses node and edge features obtained from a graph attention network and, combined with a decision transformer, infers potential attack paths and possible attacker behaviors based on a knowledge graph, outputting the final result. This module analyzes the temporal and spatial characteristics of nodes and edges in the graph to predict the attacker's next action, including the attack target and method, thereby predicting the attacker's possible actions and outputting a successful threat simulation result. If the simulation is successful, it provides potential attack paths and strategies; if no potential attack paths exist, the operation terminates.

[0009] The simulation results application module, connected to the network threat simulation module, is divided into two sub-modules: attack verification and protection optimization. The attack verification sub-module conducts tests in a virtual environment originating from the simulation module to verify the accuracy of the simulation results; the protection optimization sub-module adjusts the system's existing protection strategies in a timely manner based on the simulation and test results, such as updating firewall rules, enhancing the intrusion detection system, and configuring traffic control policies.

[0010] Furthermore, the implementation of the threat intelligence extraction module, 1. is as follows:

[0011] Multiple data source collection submodule:

[0012] This module is responsible for collecting various threat intelligence data, including APT attack chain intelligence, malware text, vulnerabilities, and network traffic characteristics. The traffic splitter is responsible for capturing data from network traffic, while the probe is used to monitor and record network behavior and events.

[0013] Data preprocessing submodule:

[0014] This module preprocesses the collected data, removing unnecessary information (such as irrelevant network noise and error log entries) and duplicate information, and performs data standardization to ensure data format consistency for subsequent data analysis and processing.

[0015] Intelligence Fusion Submodule:

[0016] This module integrates data from different sources and formats into a unified format, and applies algorithms such as entity recognition and relation extraction to link scattered information points and form a complete intelligence network. Named entity recognition is used to identify entities with specific meanings (such as names of people, places, and organizations) from text, and is used in security intelligence analysis to identify key entities such as attackers and victims.

[0017] Furthermore, the implementation of the network threat entity construction module in section 2:

[0018] By combining GAT (Ground-Aware Threat Detection), the processed data is mapped into a graph structure. Threat entities include attackers, victims, malware, and vulnerabilities. Nodes are represented as graph nodes, and relationships between entities include attack, propagation, and impact. These are used as edges to construct a threat intelligence knowledge graph. Attributes are assigned to each node and edge in the graph. Node attributes include entity feature descriptions and classification labels, while edge attributes include relationship type and weight. For attacker nodes, printed attribute labels include, but are not limited to, attack capability level (high, medium, low) and attack frequency (frequent, occasional, etc.). For victim nodes, there may be labels such as vulnerability level (high risk, medium risk, low risk). For malware nodes, there are malware type labels (Trojan, virus, worm, etc.). For vulnerability nodes, there are vulnerability severity labels (critical, important, general, etc.). The attacker's attack capability level is determined by analyzing relevant attack behavior records in security logs, and the vulnerability severity is determined by analyzing historical vulnerability data of affected systems.

[0019] Furthermore, the implementation of the 3. Network Threat Simulation Module:

[0020] Feature extraction and fusion:

[0021] Features of nodes and edges are extracted from the Graph Atlas (GAT). These features include node attributes, such as attacker behavior patterns and victim vulnerabilities, and edge relationship features, such as attack paths and propagation methods. Graph convolution operations are used to aggregate the features of neighboring nodes to obtain a more comprehensive node representation.

[0022] Sequence analysis:

[0023] Recurrent Neural Networks (RNNs) or Long Short-Term Memory Networks (LSTMs) are used to analyze time-series data of historical attack behaviors to capture the temporal characteristics of attacker actions. Then, the time-series features are fused with static features extracted from the graph to form a unified feature vector that reflects the dynamic behavior of the attacker.

[0024] Transformer configuration:

[0025] Through its self-attention mechanism, the Transformer can dynamically adjust the weights at each time step when processing the input sequence. This allows the model to effectively capture the complex relationships between different states, actions, and rewards. The model employs a standard Transformer architecture, containing multiple layers of self-attention layers and feedforward neural network layers. These two structures work together to deeply analyze the input feature sequence, further predicting the attacker's possible next action and revealing potential attack strategies and paths. Finally, residual connections and layer normalization techniques are integrated to ensure stable information flow within the model's multi-layered network, preventing gradient vanishing or exploding problems that may occur when training deep models, thus maintaining the stability and reliability of the model's output.

[0026] Attack path probability calculation

[0027] Based on the output of the Transformer, the success probability of each potential attack path is calculated. This is achieved by passing the Transformer's output features to a fully connected layer using a Sigmoid activation function, thus outputting the success probability of the output path.

[0028] Furthermore, the implementation of the fourth deduction result application module:

[0029] The simulation and verification module is connected to the network threat simulation module and is divided into two sub-modules: attack verification and protection optimization. The attack verification sub-module is used to perform verification tests in a virtual environment that is the same as the network threat simulation module. The protection optimization sub-module adjusts the protection optimization strategy of the original system based on the test results, such as updating firewall rules, enhancing the intrusion detection system, and configuring traffic control policies.

[0030] Another objective of this invention is to provide a network threat inference method based on Transformer and graph attention networks, the method comprising:

[0031] Step 1: Through the threat intelligence extraction module, the system collects data from multiple data sources, including but not limited to APT attack intelligence, malware characteristics, vulnerability information, and network traffic characteristics. Preprocessing steps remove noise and duplicate information, standardize the data format, and prepare for subsequent network threat entity construction.

[0032] Step 2: Through the network threat entity construction module, the system applies the GAT model to construct a threat intelligence knowledge graph; this module maps threat entities and their relationships to nodes and edges of a graph attention network, providing a foundation for subsequent analysis;

[0033] Step 3: The network threat simulation module is used to fuse the features of nodes and edges obtained by the graph attention network. In this process, the system uses the Transformer model to analyze the comprehensive sequence features, predict potential attack actions, comprehensively evaluate and deduce potential attack paths and strategies, and provide comprehensive threat intelligence analysis for different attack scenarios; (1) The system outputs 'Simulation successful', the simulation results show that there are multiple potential attack paths, and give all the simulated potential attack paths and strategies; (2) The system outputs 'No potential attack path found'.

[0034] Step 4: Using the simulation results application module, a virtualized environment with the same or similar configuration as the original system is created in the attack verification submodule. This virtualized environment serves as a test environment to simulate and execute the simulated attack paths, testing the effectiveness of the attack without affecting the original system. In the virtual environment, the attack scheme generated by the network threat simulation module is executed, and the effects of the attack are monitored and recorded, including whether the attack was successful, the resulting system changes, and their impact. The protection optimization submodule then optimizes the system's protection strategy based on the attack verification results, evaluating and adjusting the effectiveness of security measures, such as patching system vulnerabilities, updating firewall rules, and adjusting the sensitivity of the intrusion detection system.

[0035] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the network threat inference method based on Transformer and graph attention network.

[0036] Another objective of this invention is to provide an information data processing terminal for implementing the network threat inference system based on Transformer and graph attention network.

[0037] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0038] First, this invention mines cybersecurity threat intelligence data, including vulnerability data, vulnerability details, and APT attack chains, through preprocessing based on a graph attention network model; constructs a complete cybersecurity threat intelligence knowledge graph and determines vulnerability exploitation weights; establishes threat attributes for network regions and boundaries; correlates the threat attributes of network regions and boundaries with the current security status of assets to derive the interconnection coefficients between nodes; calculates the risk level of a single node, single vulnerability, or service being attacked; performs cross-weighted overlay to achieve risk level calculation for different paths, determination and deduction of the optimal attack path, analysis of attack path weaknesses, and simultaneous generation of attack states between path nodes; evaluates and deduces potential attack paths, completing a quasi-dynamic deductive risk prediction and control.

[0039] This invention models the path sequence of inference using Transformer and generatively predicts the next inference sequence, thereby achieving rapid network threat intelligence inference. This approach not only reduces the complexity of attack inference calculations and improves efficiency, but also enables security risk screening and early warning for large-scale networks.

[0040] Secondly, as supplementary evidence of the inventive step of the claims of this invention, it is also reflected in the following important aspects:

[0041] (1) The expected benefits and commercial value of the technical solution of this invention after transformation are as follows:

[0042] Through an efficient threat intelligence simulation system, intelligent path analysis and simulation can eliminate the impact on the network under test, reduce unnecessary security defense expenditures, and improve the cost-effectiveness of network assessment.

[0043] (2) The technical solution of the present invention provides a new approach to the construction of a network threat simulation system:

[0044] This invention utilizes the attention mechanism of graph attention networks to assign different weights to nodes, enabling hierarchical processing of key nodes and edges, gaining higher attention when extracting features, and making complex network deduction more feasible.

[0045] Transformer effectively addresses the multi-dimensional and time-series issues of intelligence data through sequence processing. By learning the best sequences from historical data, it dynamically adjusts the node weights of the graph attention network during the inference process, thereby improving the credibility of inferring potential risks and attack paths. Attached Figure Description

[0046] Figure 1 This is a block diagram of the network threat inference system based on the Transformer and graph attention network models provided in this embodiment of the invention.

[0047] Figure 2This is a flowchart illustrating the implementation method of the network threat simulation module provided in this embodiment of the invention.

[0048] Figure 3 This is a flowchart of a network threat inference method based on Transformer and graph attention network models provided in this embodiment of the invention.

[0049] Figure 4 This is a system architecture flowchart provided in an embodiment of the present invention.

[0050] Figure 1 The module consists of: 1. Threat intelligence extraction module; 2. Network threat entity construction module; 3. Network threat simulation module; 4. Simulation result application module. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0052] like Figure 1 As shown in the figure, the network threat inference system based on Transformer and graph attention network provided by the present invention includes a threat intelligence extraction module 1, a network threat entity construction module 2, a network threat inference module 3, and an inference result application module 4.

[0053] The threat intelligence extraction module 1, connected to the network threat entity construction module 2, is used to collect data from multiple data sources, including but not limited to target network security logs, network traffic records, public threat databases, and social media; and to preprocess and fuse the data.

[0054] The Network Threat Entity Construction Module 2 is connected to the Threat Intelligence Extraction Module 1 and the Network Threat Inference Module 3. It uses GAT to construct a threat intelligence knowledge graph, mapping threat entities and relationships between entities to nodes and edges of the graph. Threat entities include attackers, victims, and malware; relationships between entities include attacks and propagation.

[0055] The network threat simulation module 3, connected to the network threat entity construction module 2, is used to fuse the features of nodes and edges obtained from the graph attention network, and use Transformer to analyze time series features and spatial features to predict the next action taken by the attacker, including the attack target and attack method, thereby generating attack path information and calculating the success probability of each potential attack path.

[0056] The simulation results application module 4, connected to the network threat simulation module 3, creates a virtual environment with the same or similar configuration as the original system within the attack verification submodule. This virtual environment serves as a test environment to simulate the simulated attack paths and test the effectiveness of the attacks without affecting the native system. In this virtual environment, attacks are executed using the results generated by the network threat simulation module. The effects of the attacks are monitored and recorded, including whether the attacks were successful, the resulting system changes, and their impact. The protection optimization submodule then optimizes the system's existing protection strategies based on the attack verification results, evaluating and adjusting the effectiveness of security measures.

[0057] Implementation of the threat intelligence extraction module provided in this embodiment of the invention:

[0058] Collection from multiple data sources:

[0059] Threat intelligence data collection includes APT attack chain data, malware text data, vulnerability data, network traffic characteristics, and user behavior records. The collected data undergoes preprocessing to remove noise and duplicate information, and the data format is standardized. After being collected from multiple sources, the data is preprocessed and fused, and is typically organized into JSON format. For example, an APT attack chain includes: {the name and type of the threat, an array (containing different entities related to the threat, such as attackers, malware, and vulnerabilities), and threat-related network behaviors, etc.}.

[0060] The network threat entity construction module construction method provided in this embodiment of the invention:

[0061] By combining graph attention networks, the processed data is mapped into a graph structure; threat entities include attackers, victims, malware, and vulnerabilities; nodes are represented as graph nodes, and the relationships between entities include attack, propagation, and impact; as edges, a threat intelligence knowledge graph is constructed; attributes are assigned to each node and edge in the graph, with node attributes including entity feature descriptions and classification labels, and edge attributes including relationship type and weight.

[0062] like Figure 2 As shown, the implementation of the network threat inference module provided in this embodiment of the invention is as follows:

[0063] S101, Feature Extraction and Fusion:

[0064] Features of nodes and edges are extracted from the Generic Atlas (GAT). Each node represents a network entity, such as an attacker or a victim. Its attributes may include the attacker's behavioral patterns (e.g., the types of attacks that occur frequently, the preferred attack times, etc.) and the victim's vulnerabilities (e.g., the type of system susceptible to specific vulnerabilities). The GAT aggregates the features of neighboring nodes by calculating the attention coefficient between the node and its neighbors, thus obtaining a more comprehensive and context-sensitive representation of each node. Relationship features with edges include attack paths and propagation methods. Features representing the edges are constructed by operating on the feature vectors corresponding to the connected nodes. After feature fusion, the edge information is re-represented by fusing updated features from the nodes at both ends. For example, if an edge connects an attacker node and a victim node, the edge's features may include information extracted from both attacker and victim features, such as the effectiveness of the attack methods and the victim's response measures.

[0065] S102, Sequence Analysis:

[0066] Recurrent Neural Networks (RNNs) or Long Short-Term Memory Networks (LSTMs) are used to analyze time-series data of historical attack behaviors to capture the temporal characteristics of attacker behavior. Then, the time-series features are fused with static features extracted from the graph to form a unified feature vector that reflects the dynamic behavior of the attacker.

[0067] S103, Transformer configuration:

[0068] Through its self-attention mechanism, the Transformer can dynamically adjust the weights at each time step when processing the input sequence. This allows the model to effectively capture the complex relationships between different states, actions, and rewards. The model employs a standard Transformer architecture, containing multiple layers of self-attention layers and feedforward neural network layers. These two structures work together to deeply analyze the input feature sequence, further predicting the attacker's possible next action and revealing potential attack strategies and paths. Finally, residual connections and layer normalization techniques are integrated to ensure stable information flow within the model's multi-layered network, preventing gradient vanishing or exploding problems that may occur when training deep models, thus maintaining the stability and reliability of the model's output.

[0069] S104, Attack Path Probability Calculation

[0070] Based on the output of the Transformer, the success probability of each potential attack path is calculated. This is achieved by passing the Transformer's output features to a fully connected layer using a Sigmoid activation function, thus outputting the success probability of the output path.

[0071] like Figure 3As shown, an embodiment of the present invention provides a network threat inference method based on Transformer and graph attention network models, which includes:

[0072] S201, through its threat intelligence extraction module, collects data from multiple data sources, including but not limited to APT attack chain intelligence, malware signatures, vulnerability information, and network traffic characteristics and security logs of target systems. Preprocessing steps remove noise and duplicate information, standardize data formats, and prepare the system for subsequent network threat entity construction.

[0073] S202 uses a network threat entity construction module to build a threat intelligence knowledge graph using graph attention networks. This module maps threat entities and their relationships to nodes and edges of the graph, providing a foundation for subsequent analysis.

[0074] S203, through the network threat simulation module, the system uses the features of nodes and edges obtained by graph attention network to fuse them and analyze sequence features to predict the next action taken by the attacker; the system adopts the Transformer model to generate threat intelligence simulation results for different attack scenarios, and assists in generating test plans.

[0075] S204, through the simulation result application module, the system creates a homogeneous virtual environment and uses it as a test environment to simulate and execute the simulated attack paths, ensuring the effectiveness of the attack is tested without affecting the original system. Using the results generated by the network threat simulation module, attacks are executed in the virtual environment, and the effects of the attacks are monitored and recorded, including whether the attack was successful, the resulting system changes, and their impact.

[0076] like Figure 4 As shown, this embodiment of the invention provides a network threat inference system based on the Transformer and graph attention network models. The analysis method involved can be divided into the following key steps, which are summarized in detail below:

[0077] Step 1: Threat Intelligence Extraction

[0078] First, the system collects network security training data, including network packets and log files. This data reflects various activities and potential threats in the network, with the aim of generating training data for simulation models.

[0079] Step 1 provided in this embodiment of the invention specifically includes the following steps:

[0080] Step 1.1: Extraction of cybersecurity threat intelligence; including (1) vulnerability data: vulnerability data is collected from major vulnerability disclosure platforms, and the data types include the system type, system version and exploitation method of the vulnerability; (2) APT attack chain data: APT attack chain data is collected from the APTnotes platform; it includes 689 APT reports in the past 10 years; (3) malware text data: it includes the name, type, common functions, hash and exploitation system platform of malware in threat intelligence; this part of the data is collected from the threat intelligence source AlienVault; (4) security community discussion data: this part of the data is collected from the StackExchange website and is the text of recent security incidents; (5) Really Simple Syndication (RSS) subscription data: this part of the data is collected from major cybersecurity RSS and is the recent cybersecurity news.

[0081] Step 1.2: Preprocessing of network data

[0082] The collected network data is preprocessed to ensure its quality and consistency, making it suitable for training the inference model.

[0083] Detailed process of step 1.2:

[0084] 1) Deduplication operation

[0085] First, the system performs deduplication on the dataset to remove duplicate data entries, ensuring the uniqueness and validity of the data and reducing the impact of redundant information on model training.

[0086] 2) Filter irrelevant data

[0087] The system filters raw data, removing information irrelevant to threat analysis, ensuring that the model only processes data related to security threats.

[0088] 3) Noise reduction and smoothing

[0089] Noisy data or outliers in the dataset can interfere with the model's analysis and judgment. Through denoising and smoothing processes, the system can remove noise from the data and maintain its smoothness, making the model's input more accurate.

[0090] 4) Standardization Processing

[0091] Because Transformer has specific requirements for input data, data standardization is necessary. This step ensures that all data are within the same scale (e.g., by normalizing data of different units) to avoid bias in results caused by differences in data processing during modeling.

[0092] Step 2: Constructing Network Threat Entities

[0093] A threat intelligence knowledge graph is constructed using graph attention networks; this module maps threat entities and their relationships to nodes and edges of the graph, providing a foundation for subsequent analysis.

[0094] Step 2 provided in this embodiment of the invention specifically includes the following steps:

[0095] Step 2.1: Based on real-world data analysis experience, conduct network threat intelligence organization modeling and design a threat intelligence knowledge graph structure. Further, perform network security entity identification on the created network security threat intelligence dataset.

[0096] Step 2.2: Design regular expressions to extract threat intelligence entities with patterns. Use commercial technical analysis tools to map sentences to TTPs items in ATT&CK. For example, for text describing network attack methods, use the regular expression CVE-\d{4}-\d+ to match CVE numbers to extract information. All entities with a confidence level of 100% are directly used for further analysis and deduction.

[0097] Step 2.3: Utilize static feature analysis to further uncover the homology relationships of malicious code and construct a heterogeneous network graph of threat intelligence. Based on this, initialize feature vectors, ensuring that the attribute information of each node is preserved, thereby giving the vector representation practical meaning.

[0098] Step 2.4: For the relationship weights between different entities, such as the association weight between an attacker and malware, the weight is calculated based on the frequency of their simultaneous occurrence in known attack events. For example, if attacker A and malware M appear simultaneously 30 times in 100 attack event samples, their association weight can be initially set as 30 / 100 = 0.3. For the weights of the entity's own attributes, such as the severity weight of the vulnerability, the weight is determined by combining industry-standard vulnerability scoring systems (such as CVSS) and the potential impact in the actual network environment. For example, for vulnerability V, if it scores 7 points (out of 10) in CVSS and affects the core business system in the actual network, its final weight can be calculated according to certain weighting rules (such as an actual impact weight of 0.6 and a CVSS weight of 0.4) as 7 × 0.4 + 8 (assuming the weight of the core business system being affected is 8) × 0.6 = 7.6.

[0099] Step 2.5: Map the heterogeneous network graph to a homogeneous graph, and train the node classification model based on GAT combined with the cross-entropy loss function and gradient descent method, thereby iteratively adjusting the weights and parameters in the network to improve classification accuracy. The cross-entropy loss function is a commonly used loss function in classification tasks, suitable for measuring the difference between the probability distribution predicted by the model and the probability distribution of the true labels. Its function expression is shown in formula (1).

[0100]

[0101] K is the total number of categories, y o，c It is the one-hot encoding of the node's target value. It is 1 if the class label c is the correct classification for node o, and 0 otherwise. o，c It is the probability that the model predicts that node o belongs to category c.

[0102] Gradient descent calculates the gradient of the loss function with respect to the model parameters and uses this gradient information to update the parameters in order to reduce the value of the loss function. Its formula is shown in (2).

[0103]

[0104] θ represents the model parameters, and η is the learning rate. This is the gradient of the loss function L with respect to the parameter θ.

[0105] Step 2.6: Apply the isomorphic graph attention mechanism to the isomorphic information network of threat intelligence reports. The core of the graph neural network is the message passing mechanism, which learns the feature vector of the target node by aggregating the feature information of its neighbors.

[0106] Step 2.7: The graph attention network first transforms the input feature vector by linearly changing the weight matrix W.

[0107] h = {h1, ..., h} N}, h i ∈R F Convert to high-level features, where N is the number of nodes and F is the dimension of the node features.

[0108] Specifically, the graph attention network first transforms it into high-level features through a linear transformation W, where different neighboring nodes have different importance and contribute differently to the feature representation of the target node.

[0109] Step 2.8: GAT weight construction. Attention weights are calculated to determine the contribution of each neighboring node in the node feature aggregation process, thereby distinguishing the importance of neighboring nodes. The original attention score is shown in formula (3).

[0110] e ij =LeakyReLU(α) T[H i W, H j W]) (3)

[0111] W is the linear transformation weight matrix, H j The initial input vector is typically the feature vector of node j, representing the original attributes or encoded information of that node. α T This represents the transpose of vector α.

[0112] To ensure a reasonable weight distribution, the Softmax function is used for all e. ij Normalization is performed to obtain the final attention weight α. ij As shown in formula (4).

[0113]

[0114] Where N(i) is the set of neighboring nodes of node i, and it is guaranteed that the attention weight α of all neighboring nodes j of node i is... ij The sum is 1.

[0115] Specifically, the vector α is used as the weight of a single-layer feedforward neural network to learn and adjust the attention mechanism, and then LeakyReLU is selected for non-linearization. Finally, Softmax is used to normalize the neighboring nodes of the center node to obtain the weights of the neighboring nodes.

[0116] The features of neighboring nodes are aggregated and scaled according to different attention weights. The aggregated feature representation of node i is shown in Equation (5).

[0117] H i =σ(∑ j∈N(i) α ij H j W) (5)

[0118] σ is a nonlinear activation function.

[0119] Step 2.9: GAT uses a multi-head attention mechanism to learn node feature representations from different aspects. Multi-head attention refers to using multiple independent attention mechanisms (called "heads") in parallel within the same layer to process nodes in the graph. Each head learns different aspects of the interaction relationships between nodes and outputs its own node feature representation. This results in multiple different feature representations of the target node. Finally, the average value is used to output the multi-head attention mechanism, where K is the set number of multi-heads, as shown in Equation 6.

[0120]

[0121] Step 3: Constructing a Transformer-based inference model

[0122] A Transformer-based inference model is constructed to analyze the temporal and spatial characteristics of networks. This model, combined with node and edge features extracted by GAT, can simulate the propagation and attack methods of threats within the network.

[0123] Step 3 provided in this embodiment of the invention specifically includes the following steps:

[0124] Step 3.1: The system extracts the features of nodes and edges from the knowledge graph generated by the graph attention network, defined as the feature set F = {f1, f2, ..., f...} m These features include relationships between threat entities, attack patterns, and historical behavior data, with the input being the feature set F and the current network state S.

[0125] The node and edge features in the graph are fused through linear transformation to form the context representation C, as shown in formula (7).

[0126] C = W f *F+b f (7)

[0127] Specifically, W f Let b be the weight matrix. f This is a bias term.

[0128] Step 3.2: In the encoder part, the model adopts a multi-layer self-attention mechanism, in which each layer contains multiple self-attention heads, which can capture the features of the input data in parallel from different subspaces. This structure helps the model to deeply understand complex and multi-layered entity relationships.

[0129] First, the knowledge graph processed by GAT is used as the sequence input. Node features and edge features are then fused using a multi-head attention mechanism to capture the complex interactions between different entities and relationships, as shown in Equation 8.

[0130]

[0131] Where Q, K, and V represent the query, key, and value, respectively, and represent the current node, the target node features for the query comparison, and the data or features associated with each key. k Let K be the dimension of the key vector, i.e., the number of features in each key vector.

[0132] Specifically, rapid knowledge reasoning is achieved by modeling the path sequence of reasoning and generatively predicting the next reasoning sequence. Its modulated autoregressive architecture generates the next action based on past rewards, states, and actions.

[0133] Specifically, during the encoding process, a knowledge graph embedding model is applied to embed the states representing entities in the knowledge graph and the actions representing relationships in the knowledge graph into vectors of the same dimension. Then, positional time step encodings are added to each corresponding token to indicate the reasoning order.

[0134] Specifically, during decoding, the token embedding is fed into the Transformer decoder architecture, employing causal self-attention masked autoregressive prediction of the next entity or relation. Instead of extensive trial-and-error exploration using reinforcement learning, the Transformer framework directly generates path sequences, enabling faster inference by processing the entire inference sequence at once in a highly parallel manner, without needing to explore a large search space.

[0135] As shown in Equation 9, the modeling sequence number knowledge reasoning process is described, where it begins with a given entity e. s and a relation r q Composition, determined through multi-step reasoning, is related to e. s via r q The target entity e with the relationship o The tail entity e of this sequence o This is the reasoning result. The entire reasoning process of the model is represented by an operation sequence T.

[0136] q:=(e s r q ), τ:=( <bos>,R1,a1,s1,...,R n ,a n ,e o , <eos>(9)

[0137] in, <bos>and <eos< are the identifiers for the start and end of the sequence, respectively, R i represents a series of relationships, a i represents the operation corresponding to R i corresponding operation.

[0138] The knowledge graph representation learning model ConvE embeds each entity and relationship in the sequence, mapping each token to a vector of the same dimension. At the same time, to further distinguish the sequential relationship of the inference sequence, the model adds corresponding position embedding codes to the embedding representation of each entity or relationship, and the formed semantic encoding is input into the decoder module.

[0139] Step 3.3: Combine path semantic similarity with attention mechanism and rules to guide the sampling of high-quality training paths. First, the model uses the attention mechanism to focus on the semantic information of local paths, and strengthens the path features most relevant to the current inference task according to the attention weights. In addition, global information is introduced in a rule-guided manner to ensure that the selected paths are not only locally valid but also representative in the entire knowledge graph. By combining these two strategies, the model can calculate the selection probability of each possible path. In the decoder module, as shown in Equation 10, the model generates the next sequence item (i.e., inference action) autoregressively by learning the sequence patterns in the inference path, including the semantic encoding of the encoder and the previous sequence items.

[0140]

[0141] p(τ|q) represents the probability that the entire inference sequence τ occurs given the query q. The starting item of each sequence is <bos>, representing the start of the sequence: when the decoder generates <eos> or reaches the maximum sequence length, the inference ends and the last generated sequence is output. During this process, action selection depends on the calculated path selection probabilities, which are obtained based on a comprehensive evaluation of path semantic similarity and global information.

[0142] Step 3.4: During the training process of the model, as shown in Equation 11, cross-entropy is used as the loss function for the sequence classification task. At the same time, to prevent the model from overfitting the training data, label smoothing is used for regularization operations. Regularization is a technique used to improve the generalization ability of the model, that is, its performance on unseen new data, by adding additional information or constraints to limit the model complexity, as shown in Equation 12.

[0143]

[0144] Among them, V is all candidate generation items, including all entities, relationships, sequence start identifier <bos> and sequence end identifier <eos>. ∈ is the error rate of model label smoothing, that is, the probability of the correct sample is reduced from 1 to 1 - ∈, and the probability of the wrong sample is ∈.

[0145] Step 3.5: During the model training process, adopt the "Teacher Forcing" strategy to generate sequence items in an autoregressive manner. Use the real sequence items as input instead of using the output of the model at the previous time step. When the model predicts the potential attack path of threat intelligence, ensure the relevance and accuracy of the model output. The Transformer model relies on its multi-layer self-attention mechanism to utilize the context representation output by the encoder at each time step to accurately generate the next sequence item in an autoregressive manner. Ensure that the model can quickly and accurately learn how to deduce the next state from the current input state during the training process, and improve the overall deduction performance of the model.

[0146] Step 3.6: When the decoder generates each output, consider the information of all previous outputs to generate a decision sequence related to the future attack path. When processing the input sequence, the Transformer model first converts the entities and relationships in the knowledge graph into standardized input vectors.

[0147] Specifically, in the sequence processing stage, the decoder uses the global context information provided by the encoder to iteratively generate a decision sequence. Each decision takes into account the previous output and predicts the next potential attack state or defense action based on the output of the previous state and the global context of the encoder.

[0148] Specifically, the model learns how to transfer from one network state to another by simulating attack scenarios, continuously generating multiple steps to form a complete attack path. The self-attention mechanism evaluates and weights the relevance of all elements in the sequence during this process, enabling the model to capture long-distance dependencies and optimize the output of each step.

[0149] Specifically, combine the context representation and the current state information to generate a protection strategy through a fully connected layer. As shown in Equation 13.

[0150] P = σ(W p *[C; S] + b p ) (13)

[0151] Among them, [C; S] represents the concatenation of the feature representation and the state information, and σ is the activation function.

[0152] Step 3.7: During the inference path generation process, the model receives new input data, such as new security events or threat intelligence, and dynamically adjusts its inference strategy. Finally, based on the inference results, it outputs a conclusion indicating whether the inference was successful or unsuccessful. If successful, it outputs all potential attack paths; otherwise, it outputs that there are no potential attack paths.

[0153] Step 4: Application of the simulation results

[0154] Step 4 provided in this embodiment of the invention specifically includes the following steps:

[0155] Step 4.1: The system first categorizes and preliminarily assesses the results output by the network threat simulation module, including possible attack paths and recommended protective measures. Subsequently, a detailed analysis is conducted based on the practicality and feasibility of the results.

[0156] Step 4.2: The attack verification submodule verifies the effectiveness of the simulated attack paths by reproducing them in a shared virtual environment. The real system environment is simulated in the test environment to ensure the accuracy of the verification results. In this way, the attack verification module tests whether the simulated attack paths are truly feasible, thereby collecting critical security vulnerabilities and flaws.

[0157] Step 4.3: Based on the test results of the attack verification submodule, the protection optimization submodule adjusts and updates existing security policies and protective measures. This includes updating firewall rules, optimizing the configuration of the intrusion detection system, and adjusting network traffic control policies to block confirmed attack paths, and ensuring timely updates of system protection measures to defend against verified and potential attacks.

[0158] The analysis method of this invention forms a complete network threat simulation process, from threat intelligence extraction and data preprocessing to the construction of simulation models and the application of simulation results.

[0159] This solution combines graph attention networks and deep learning techniques to achieve a dynamic and efficient network threat simulation system. Utilizing graph attention networks, the system can effectively capture the complex relationships between entities in the network, while the deep learning model enhances its ability to mine historical data. Through real-time analysis and reasoning, the system can quickly identify potential attack patterns and generate corresponding protection strategies, ensuring the timeliness and accuracy of network security defenses. This combination not only improves the system's intelligence level but also enhances its adaptability to constantly evolving network threats.

[0160] The following is a specific implementation of a network threat inference system based on Transformer and graph attention networks:

[0161] Example 1: Threat Intelligence Simulation Based on APT Attacks

[0162] APT attacks are a type of cyberattack characterized by their long duration and high degree of stealth. Attackers typically lurk within the network for a period of time, gradually acquiring sensitive data or privileges. To protect against APT attacks, this embodiment employs a threat intelligence inference system based on Transformer and graph attention networks.

[0163] 1) Network Threat Entity Construction: Through the network threat entity construction module, the system extracts information from APT attack chain data, publicly available APT reports, security logs, and network traffic to create a threat intelligence knowledge graph. The APT attack chain contains entities such as attackers, victims, and malware, and the attack path is represented by the edges of the graph.

[0164] 2) Network Threat Simulation: GAT extracts features from nodes and edges in the APT attack chain and analyzes the time-series characteristics of the attack using a Transformer model to predict the attacker's next move. The system can predict the targets the attacker will target and the attack methods they will use (such as malware implantation, privilege escalation, etc.), and deduce the potential APT attack paths of the system.

[0165] This implementation successfully intercepted the attacker's privilege escalation attempts in the early stages of an APT attack, preventing further data breaches. Through dynamic feedback and optimization, the system enhanced its ability to predict APT attack behavior, shortened response time, and improved overall protection effectiveness.

[0166] The above embodiments demonstrate the specific application of a network threat inference system based on Transformer and graph attention networks in APT attack and malware propagation scenarios. Through the construction of knowledge graphs, analysis of inference models, and automated protection response, it achieves efficient detection and defense against complex network attacks.

[0167] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0168] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.< / bos> < / eos> < / bos>

Claims

1. A network threat inference system based on Transformer and graph attention network models, characterized in that, include: The threat intelligence extraction module is used to collect threat intelligence data and application results from various data sources, including security logs, network traffic records, public threat databases, and Internet network attack reports. The network threat entity construction module uses GAT to build a threat intelligence knowledge graph, mapping threat entities and their relationships as nodes and edges of the graph; The network threat simulation module, connected to the network threat entity construction module, is used to fuse node and edge features extracted by graph attention network, and uses Transformer to analyze time series and spatial features to predict the attacker's next move, so as to infer potential attack paths and possible attacker behaviors. The simulation results application module, connected to the network threat simulation module, is divided into an attack verification module and a protection optimization module. It is used to perform attack simulation verification on the same-source mirror virtual environment and adjust the protection strategy according to the verification results. The construction of a Transformer-based inference model includes: Step 3.1: The system extracts the features of nodes and edges from the knowledge graph generated by the graph attention network, and defines them as the feature set. These features include relationships between threat entities, attack patterns, and historical behavior data, with the input being the feature set F and the current network state S; Step 3.2: In the encoder part, the model adopts a multi-layer self-attention mechanism, where each layer contains multiple self-attention heads, which can capture the features of the input data in parallel from different subspaces; Step 3.3: Combining path semantic similarity with attention mechanisms and rule-guided sampling of high-quality training paths; First, the model employs an attention mechanism to focus on the semantic information of local paths, reinforcing the path features most relevant to the current inference task based on attention weights; In addition, global information is introduced through rule guidance to ensure that the selected paths are not only locally effective but also representative of the entire knowledge graph; By combining these two strategies, the model can calculate the selection probability of each possible path; In the decoder module, the model learns the sequence patterns in the inference path, including the semantic encoding of the encoder and previous sequence items, and autoregressively generates the next sequence item; Step 3.4: During the model training process, cross-entropy is used as the loss function for the sequence classification task; at the same time, label smoothing is used for regularization to prevent the model from overfitting to the training data. Step 3.5: During model training, a "teacher-forced" strategy is adopted to generate sequence terms in an autoregressive manner, using real sequence terms as input; Step 3.6: When generating each output, the decoder takes into account the information of all previous outputs to generate a decision sequence related to the future attack path; when processing the input sequence, the Transformer model first transforms the entities and relations in the knowledge graph into standardized input vectors; Step 3.7: During the inference path generation process, the model receives new input data.

2. The system as described in claim 1, characterized in that, The threat intelligence extraction module further includes a function to preprocess the collected data, which includes deduplication, filtering, smoothing, and standardization to ensure the consistency, availability, and accuracy of the data input.

3. The system as described in claim 2, characterized in that, The network threat inference module aggregates the features of neighboring nodes of a threat entity through graph convolution operations to generate a more comprehensive node representation. It then combines this with a Transformer model to analyze the temporal and spatial features in threat intelligence and predict the attacker's next move, including potential attack targets and attack methods.

4. The system as described in claim 3, characterized in that, The application module for the inference results includes: The attack verification module performs attack path verification tests in a virtual environment that is similar to or of the same origin as the network threat simulation module, simulating possible attack behaviors to ensure the accuracy of the simulation results. The protection optimization module optimizes and adjusts the original system's protection strategy based on the attack verification results, updates firewall rules, enhances the intrusion detection system, and configures traffic control policies to deal with the attack paths discovered during verification.

5. A method for network threat inference based on Transformer and graph attention network models, implementing the network threat inference system based on any one of claims 1-4, characterized in that, The network threat simulation method includes: Collect cyber threat intelligence data from multiple data sources, including security logs, network traffic records, public threat databases, and social media, to identify threat entities and the relationships between them; The threat intelligence knowledge graph is constructed using the Graph Attention Network (GAT), which maps threat entities to nodes in the graph and the relationships between entities to edges in the graph, thus forming a graph structure. Features are extracted from the nodes and edges in the graph, and the features are input into the Transformer to analyze the time series features and spatial features, infer the potential path of the attacker, and output the result of whether the inference is successful or unsuccessful. The simulation results were tested using a mirror system. Verification tests were conducted in a virtual environment mirrored from the target network. Based on the simulation and test results, the original system's protection optimization strategies were adjusted in a timely manner, including updating firewall rules, enhancing the intrusion detection system, and configuring traffic control policies.

6. The method as described in claim 5, characterized in that, Includes the following steps: The collected network data is preprocessed, including deduplication, filtering, smoothing, and standardization, to ensure data consistency, usability, and accuracy. Based on the input requirements of the Transformer, feature extraction and processing are performed on the standardized data to ensure that it is suitable for time series and spatial dimension analysis.

7. The method as described in claim 5, characterized in that, Includes the following steps: By using the Transformer model, node and edge features generated by the graph attention network are fused with time series features. Combined with the self-attention mechanism and the feedforward neural network, a feature vector is generated to predict the attacker's next action; and the result of whether the attacker's behavior was successfully predicted is output.

8. The method as described in claim 5, characterized in that, Includes the following steps: The attack verification module conducts attack verification tests using a virtual environment of the same origin, evaluates the success of the deduced attack path based on the test results, and feeds the verification results back to the protection optimization module. Based on the attack verification results, the protection optimization module adjusts and optimizes the protection strategy, including updating firewall rules, enhancing the intrusion detection system, and configuring traffic control policies to defend against the attack behaviors detected.

Images