Network attack path prediction and defense method and device, computer equipment and medium

Abstract

The invention relates to the technical field of network security, and discloses a network attack path prediction and defense method and device, computer equipment and a medium, and the method comprises the steps: obtaining current attack event information; performing feature extraction on the current attack event information to obtain key information corresponding to the current attack event information; screening a set of related attack events most similar to the current attack event information from a pre-constructed knowledge graph by using a graph theory algorithm; and integrating defensive measure information corresponding to all related attack events. According to the method, the complexity of the network attack can be more comprehensively understood, and more comprehensive data is provided for subsequent steps of generating measures corresponding to the current attack event by utilizing the knowledge graph. The related attack event set most similar to the current attack event information is screened out from the knowledge graph by using a graph theory algorithm, and an appropriate defense strategy is positioned, so that the new attack event can be dealt with more quickly and effectively, and the accuracy and efficiency of network attack defense are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack path prediction and defense method, device, computer equipment and storage medium. Background Art

[0002] With the rapid progress in the field of information technology, cyber attacks have become a serious security issue in today's society. Hackers' technical means are constantly evolving, and their attack methods are becoming more complex and covert, which poses an unprecedented test to the network security protection system. Cyber ​​attacks not only threaten the security of personal privacy, but also lead to the leakage and loss of information of critical infrastructure, and the economic damage and social impact they bring are increasing. Although traditional security measures such as firewalls and intrusion detection systems provide necessary protection to a certain extent, the effectiveness of these measures is limited when dealing with emerging unknown attack types.

[0003] In related technologies, traditional penetration testing procedures usually include target confirmation, intelligence collection, vulnerability identification, vulnerability exploitation, and follow-up actions. However, in actual cyber attacks, the boundaries between these steps have become increasingly blurred, and a single level of defense is no longer sufficient to withstand multi-stage attack activities. In addition, the rapid iteration of attackers' strategies and technologies makes it difficult for traditional protection methods to keep up with new threat situations. Summary of the invention

[0004] In view of this, the present invention provides a network attack path prediction and defense method, device, computer equipment and storage medium to solve the problem that the existing single-level defense is not sufficient to withstand multi-stage attack activities and it is difficult to achieve effective network attack defense.

[0005] In a first aspect, the present invention provides a network attack path prediction and defense method, the method comprising:

[0006] Get current attack event information;

[0007] Extract features of the current attack event information to obtain key information corresponding to the current attack event information, where the key information is used to characterize the information in the current attack event information used for similarity matching;

[0008] Using graph theory algorithms, we filter out the set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph;

[0009] Based on relevant attack events and combined with the pre-built knowledge graph, the defense measures information corresponding to all relevant attack events is integrated to obtain the defense measures corresponding to the current attack event information.

[0010] In the present invention, the pre-built comprehensive network security knowledge graph helps to more fully understand the complexity of network attacks, and provides more comprehensive data for the subsequent steps to use the knowledge graph to generate measures corresponding to the current attack event. The graph theory algorithm is used to filter out the set of related attack events that are most similar to the current attack event information from the knowledge graph, and locate the appropriate mitigation measures or defense strategies, so that new attack events can be responded to more quickly and effectively, and the accuracy and efficiency of network attack defense can be improved. The automated and intelligent processing method for power grid characteristics not only improves the response speed, but also reduces human errors, and improves the efficiency and accuracy of power grid network security defense.

[0011] In an optional implementation, a pre-built knowledge graph is constructed as follows:

[0012] Obtain public attack event data and historical network attack instance data, where public attack event data is structured data and historical network attack instance data is unstructured data;

[0013] Using automated tools to extract information from public attack event data to obtain processed public attack event data;

[0014] Utilize automated tools to extract key fields from historical attack event instance data, and process the historical attack event instance data using natural language processing to obtain processed historical network attack instance data;

[0015] The processed public attack event data and the processed historical network attack instance data are integrated to construct a knowledge graph.

[0016] In this approach, a multi-dimensional knowledge graph is constructed by integrating standardized public network security data with unstructured log data within the power grid system. This method of integrating data of different types and sources not only enhances the richness and accuracy of the data, but also provides conditions for in-depth analysis of the complex relationships between attack events, which is difficult to achieve with traditional single data source analysis. Especially in the power grid scenario, it can help to better understand the security situation of the power system, discover potential threats, and make defensive preparations in advance. Not only does it utilize standardized public data sets, but it also integrates unstructured log data within the power grid system, making the knowledge graph more comprehensive and practical. The use of comprehensive data sources increases the depth and breadth of analysis and helps to more fully understand the complexity of cyber attacks.

[0017] In an optional implementation, feature extraction is performed on the current attack event information to obtain key information corresponding to the current attack event information, including:

[0018] Preprocessing the current attack event information to obtain preprocessed current attack event information;

[0019] Determine whether the current attack event information is structured data;

[0020] When the current attack event information is unstructured data, natural language processing is used to convert the pre-processed current attack event information into structured data;

[0021] When the current attack event information is structured data, feature extraction is performed on the preprocessed current attack event information according to a preset key information list to obtain key information corresponding to the current attack event information, including timestamp information, IP address information, scanned port information, attack technology information and vulnerability information.

[0022] In this method, when the attack event data is unstructured data, the attack event data is parsed through natural language processing methods, and feature extraction is used to obtain key information corresponding to the current attack event information, thereby improving the ability and accuracy of automated processing and facilitating subsequent calculations of the similarity between the current attack event and the attack events in the knowledge graph.

[0023] In an optional implementation, a graph theory algorithm is used to filter a set of related attack events that are most similar to the current attack event information from a pre-built knowledge graph, including:

[0024] Using graph theory algorithms, we evaluate the similarities between all attack events in the pre-built knowledge graph and predict potential attack paths.

[0025] Combined with potential attack paths, calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph;

[0026] Based on the similarity, a set of related attack events that are most similar to the current attack event information is screened.

[0027] In this method, graph theory algorithms are used to evaluate the similarity of nodes in the knowledge graph, thereby predicting potential attack paths. The correlation between a certain attack event and other attack events can be identified, and the potential connection between CVE and CWE can be revealed, providing data support and theoretical basis for the formulation of subsequent defense strategies.

[0028] In an optional implementation, calculating the similarity between the current attack event information and all attack events in the pre-built knowledge graph includes:

[0029] When the data in the current attack event information is unstructured data, the cosine similarity is used to calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph;

[0030] When the data in the current attack event information is structured data, the Euclidean distance is used to calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph.

[0031] In this method, when the attack event data is unstructured data, the cosine similarity calculation method suitable for scenarios where the similarity between data features needs to be measured is used to compare whether the behavior patterns of different attack events or log entries are similar; when the attack event data is structured data, since the Euclidean distance is suitable for scenarios with numerical features and the need to evaluate absolute differences, the Euclidean distance can be used to effectively calculate the straight-line distance between two numerical data, thereby evaluating their differences in physical features or quantitative indicators.

[0032] In an optional implementation, based on relevant attack events and in combination with a pre-built knowledge graph, the defense measures information corresponding to all relevant attack events are integrated to obtain the defense measures corresponding to the current attack event information, including:

[0033] Perform attack event recognition and extraction on the current attack event information to obtain the attack event corresponding to the current attack event information;

[0034] Query vulnerability information of attack events to obtain vulnerability information corresponding to the current attack event information;

[0035] Based on the obtained vulnerability information, the pre-built knowledge graph is queried to generate security suggestion information corresponding to the vulnerability information;

[0036] According to the attack event, the attack technology corresponding to the current attack event is identified, and based on the attack technology, the defense measure information corresponding to the current attack event is generated;

[0037] According to the attack event, determine the information of the attacked component in the current attack event, and generate security update suggestions corresponding to the current attack event based on the component information;

[0038] Integrate security advice information, defense measures information and security update suggestions to obtain defense measures corresponding to the current attack event information.

[0039] In this way, by analyzing the entity attributes and association relationships of the current attack event and combining it with the knowledge graph, it is possible to locate appropriate mitigation measures or defense strategies, making it faster and more effective to respond to new attack events, further improving the accuracy and efficiency of network attack defense.

[0040] In a second aspect, the present invention provides a network attack path prediction and defense device, the device comprising:

[0041] Data acquisition module, used to obtain current attack event information;

[0042] A feature extraction module is used to extract features from the current attack event information to obtain key information corresponding to the current attack event information. The key information is used to characterize the information in the current attack event information used for similarity matching;

[0043] The similar information screening module is used to use graph theory algorithms to screen the set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph;

[0044] The defense measures generation module is used to integrate the defense measures information corresponding to all relevant attack events based on relevant attack events and combined with the pre-built knowledge graph to obtain the defense measures corresponding to the current attack event information.

[0045] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network attack path prediction and defense method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0046] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the network attack path prediction and defense method of the first aspect or any corresponding embodiment thereof.

[0047] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the network attack path prediction and defense method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 It is a flowchart of a network attack path prediction and defense method according to an embodiment of the present invention.

[0050] Figure 2 It is a schematic diagram of the architecture of a network attack path prediction and defense system based on a knowledge graph according to an embodiment of the present invention.

[0051] Figure 3 It is a flowchart of another network attack path prediction and defense method according to an embodiment of the present invention.

[0052] Figure 4 It is a schematic diagram of a knowledge graph paradigm according to an embodiment of the present invention.

[0053] Figure 5 It is a flowchart of another network attack path prediction and defense method according to an embodiment of the present invention.

[0054] Figure 6 It is a structural block diagram of a network attack path prediction and defense device according to an embodiment of the present invention.

[0055] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0057] In related technologies, traditional penetration testing procedures usually include target confirmation, intelligence collection, vulnerability identification, vulnerability exploitation, and follow-up actions. However, in actual cyber attacks, the boundaries between these steps have become increasingly blurred, and a single level of defense is no longer sufficient to withstand multi-stage attack activities. In addition, the rapid iteration of attackers' strategies and technologies makes it difficult for traditional protection methods to keep up with new threat situations.

[0058] In order to solve the above problems, a network attack path prediction and defense method is provided in an embodiment of the present invention, which is used in a computer device. It should be noted that its execution subject can be a network attack path prediction and defense device, which can be implemented as part or all of a computer device through software, hardware, or a combination of software and hardware. The computer device can be a terminal, a client, or a server. The server can be a single server or a server cluster composed of multiple servers. The terminal in the embodiment of the present application can be a smart phone, a personal computer, a tablet computer, or other intelligent hardware devices. In the following method embodiments, the execution subject is a computer device as an example for explanation.

[0059] The computer device in this embodiment is suitable for analyzing the relationship between network attack events in the power grid system and for use scenarios in which network attacks against the power grid system are defended. The present invention provides a network attack path prediction and defense method, and a pre-built comprehensive network security knowledge graph helps to more fully understand the complexity of network attacks, and provides more comprehensive data for the subsequent steps to use the knowledge graph to generate measures corresponding to the current attack event. The graph theory algorithm is used to filter out the set of related attack events that are most similar to the current attack event information from the knowledge graph, and locate the appropriate mitigation measures or defense strategies, so that new attack events can be responded to more quickly and effectively, and the accuracy and efficiency of network attack defense are improved. The automated and intelligent processing method for the characteristics of the power grid not only improves the response speed, but also reduces human errors, and improves the efficiency and accuracy of the power grid network security defense.

[0060] According to an embodiment of the present invention, an embodiment of a network attack path prediction and defense method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0061] In this embodiment, a network attack path prediction and defense method is provided, which can be used for the above-mentioned computer device. Figure 1 is a flow chart of a network attack path prediction and defense method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0062] Step S101, obtaining current attack event information.

[0063] In one example, obtaining current attack event information may include: abnormal access behavior to the database server is detected through monitoring tools within a specific time period. Through in-depth review of network traffic logs, application logs, and security logs, a series of signs of suspected malicious activities are identified, including but not limited to detailed scans of server ports and services and attempts to exploit known vulnerabilities to perform SQL injection attacks. Given that these behaviors do not conform to regular user behaviors and pose security risks, the incident is characterized as a targeted network attack.

[0064] Step S102: extract features from the current attack event information to obtain key information corresponding to the current attack event information.

[0065] In the embodiment of the present invention, the key information is used to characterize the information used for similarity matching in the current attack event information.

[0066] In one example, feature extraction is performed on the current attack event information to obtain key information corresponding to the current attack event information. The key information may include a timestamp, an IP address, and a scanned port, etc., which is not limited in the present invention.

[0067] Step S103, using a graph theory algorithm, filter a set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph.

[0068] In one example, a graph theory algorithm (such as cosine similarity, Euclidean distance, etc.) is used to determine the top K related attack events that are most similar to the current attack event.

[0069] Step S104, based on the relevant attack events and in combination with the pre-built knowledge graph, the defense measures information corresponding to all relevant attack events is integrated to obtain the defense measures corresponding to the current attack event information.

[0070] In one example, based on these related attack events, mitigation measures for related attack events are found, covering vulnerability mitigation, component hardening, and countermeasures for technologies used by specific organizations, so as to quickly respond to new attack events and prevent further damage.

[0071] In one implementation scenario, Figure 2 is a schematic diagram of the architecture of a network attack path prediction and defense system based on a knowledge graph according to an embodiment of the present invention. Figure 2 As shown, the network attack path prediction and defense system based on the knowledge graph may include: obtaining attack intelligence information; extracting attack event related features in the attack intelligence information; using the related features to retrieve related attack information in the pre-built knowledge graph, and searching from four dimensions of CVE, CPE, CWE and IP to obtain related attack information; retrieving related attack events in the knowledge graph, and associating from four dimensions of organization name, organization attack events, organization attack technology and organization attack method; and outputting defense measures corresponding to the attack intelligence information.

[0072] The network attack path prediction and defense method provided in this embodiment, through the pre-built comprehensive network security knowledge graph, helps to more fully understand the complexity of network attacks, and provides more comprehensive data for the subsequent steps to use the knowledge graph to generate measures corresponding to the current attack event. The graph theory algorithm is used to filter out the set of related attack events that are most similar to the current attack event information from the knowledge graph, and locate the appropriate mitigation measures or defense strategies, so that new attack events can be responded to more quickly and effectively, and the accuracy and efficiency of network attack defense can be improved. The automated and intelligent processing method for the characteristics of the power grid not only improves the response speed, but also reduces human errors, and improves the efficiency and accuracy of the power grid network security defense.

[0073] In this embodiment, a network attack path prediction and defense method is provided, which can be used for the above-mentioned computer device. Figure 3 FIG. 4 is a flow chart of another network attack path prediction and defense method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0074] Step S301, obtain current attack event information. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0075] Step S302: extract features of the current attack event information to obtain key information corresponding to the current attack event information.

[0076] Specifically, the above step S302 includes:

[0077] Step S3021, pre-processing the current attack event information to obtain the pre-processed current attack event information.

[0078] Step S3022: determine whether the current attack event information is structured data.

[0079] Step S3023: when the current attack event information is unstructured data, the pre-processed current attack event information is converted into structured data by using natural language processing.

[0080] Step S3024, when the current attack event information is structured data, feature extraction is performed on the pre-processed current attack event information according to a preset key information list to obtain key information corresponding to the current attack event information.

[0081] In the embodiment of the present invention, the key information includes timestamp information, IP address information, scanned port information, attack technology information and vulnerability information.

[0082] In one example, the key information used for similarity matching may include: timestamp: used to identify the time when the event occurred, helping to analyze the time series characteristics of the attack; IP address: can be used to identify the network location of the attack source and associate it with other attack events; scanned ports: certain attacks often scan certain common open ports, and identifying port patterns can reveal potential attack types; attack techniques: such as SQL injection, port scanning, etc., used to match based on the similarity of attack methods or techniques; vulnerability information (CVE): the specific vulnerability number used by the attack, used to find attacks using similar or identical vulnerabilities. Vulnerability category (CWE): the weakness category corresponding to the attack, used to analyze the association between attack events at a high level.

[0083] The extraction of key information can include: 1. Data preprocessing: First, the raw data needs to be cleaned to remove irrelevant information. 2. Feature identification: According to the key information list mentioned above, the corresponding features in the data are identified and extracted. For structured data (such as CVE, CWE, etc.), it can be directly obtained through database query or regular expression matching. For unstructured data (such as network attack logs), natural language processing technology needs to be used.

[0084] In this method, when the attack event data is unstructured data, the attack event data is parsed through natural language processing methods, and feature extraction is used to obtain key information corresponding to the current attack event information, thereby improving the ability and accuracy of automated processing and facilitating subsequent calculations of the similarity between the current attack event and the attack events in the knowledge graph.

[0085] Step S303, using a graph theory algorithm, filter a set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph.

[0086] Specifically, the pre-built knowledge graph is constructed in the following way:

[0087] Step a1, obtaining public attack event data and historical network attack instance data, the public attack event data is structured data, and the historical network attack instance data is unstructured data.

[0088] Step a2: using automated tools to extract information from the public attack event data to obtain processed public attack event data.

[0089] Step a3: Use automated tools to extract key fields from historical attack event instance data, and use natural language processing to process the historical attack event instance data to obtain processed historical network attack instance data.

[0090] Step a4: Integrate the processed public attack event data and the processed historical network attack instance data to construct a knowledge graph.

[0091] In one example, attack event data collection comes from two main channels: one is standardized public attack event data sets, such as CVE, CWE, ATT&CK, etc.; the other is historical network attack instance data from the power grid system, which covers security alarm data, attack traffic records, protection logs, attack logs, and warning information triggered by the system. The following are specific processing methods for these two types of data sources:

[0092] 1. For public attack event data from standard databases such as CVE, CWE, and ATT&CK, since these data sets are structured and have clear identifiers and links to related objects, automated tools such as regular expressions can be used to directly extract the required information.

[0093] 2. Most of the historical cyber attack instance data within the power grid system exists in the form of unstructured logs, so it needs to be preprocessed. First, regular expressions are used to extract key fields from the original logs, such as timestamps, IP addresses, ports and other basic information to ensure data consistency and availability. Subsequently, natural language processing (NLP) technology is used to deeply parse these structured logs. Here, a pre-trained model (BERT) is used for fine-tuning to better understand and extract specific information in the logs, including core elements such as attack types, attacked devices, and intruder action patterns. Support vector machines (SVMs) are used to classify and annotate various attack events, warning notifications, and protection operations to improve the ability and accuracy of automated processing. Finally, the processed data is integrated into the knowledge graph to form a detailed graph database. Among them, CVE (Common Vulnerabilities and Exposures) is an open standard for identifying information security vulnerabilities and exposures. Each CVE identifier is unique and contains basic information about known software vulnerabilities, such as the discovery date, vulnerability description, and impact range. CWE (Common Weakness Enumeration) is a classified list of software weaknesses that aims to promote the understanding and prevention of common errors in software development and testing, which may be the cause of security vulnerabilities. CPE (Common Platform Enumeration) is a standardized method for describing the names of IT system components (such as operating systems, applications, hardware devices, etc.), with the goal of providing a unified way to identify and describe product configurations, so as to accurately determine which systems may be affected by specific security issues in scenarios such as vulnerability management and software updates. ATT&CK is a global knowledge base that lists the techniques and tactics that cyber attackers may use during an attack, and organizes these techniques and tactics according to different stages of the attack life cycle (such as initial access, execution, persistence, privilege escalation, defense evasion, etc.). The ATT&CK framework helps security teams understand attacker action patterns, develop effective defense strategies, and improve detection and response mechanisms.

[0094] Figure 4 is a schematic diagram of a knowledge graph paradigm according to an embodiment of the present invention. The constructed knowledge graph paradigm is as follows Figure 4As shown in the figure, the knowledge graph provides data support for the follow-up. The graph uses the open source database Neo4j as the storage medium to facilitate subsequent searches and queries.

[0095] In this approach, a multi-dimensional knowledge graph is constructed by integrating standardized public network security data with unstructured log data within the power grid system. This method of integrating data of different types and sources not only enhances the richness and accuracy of the data, but also provides conditions for in-depth analysis of the complex relationships between attack events, which is difficult to achieve with traditional single data source analysis. Especially in the power grid scenario, it can help to better understand the security situation of the power system, discover potential threats, and make defensive preparations in advance. Not only does it utilize standardized public data sets, but it also integrates unstructured log data within the power grid system, making the knowledge graph more comprehensive and practical. The use of comprehensive data sources increases the depth and breadth of analysis and helps to more fully understand the complexity of cyber attacks.

[0096] The above step S303 includes:

[0097] Step S3031, using graph theory algorithms, evaluate the similarities between all attack events in the pre-built knowledge graph and predict potential attack paths.

[0098] In one example, attack path prediction may include: the knowledge graph constructed in the above steps is stored in a Neo4j database. There are many methods for evaluating the similarity between nodes in the knowledge graph, and these methods can be directly applied through the algorithms provided by the built-in graph data science (GDS) library of Neo4j, such as cosine similarity, which is an indicator for measuring the similarity of two vector directions, and Euclidean distance, which is used to calculate the straight-line distance between two points in Euclidean space.

[0099] Step S3032, combining the potential attack paths, calculates the similarity between the current attack event information and all attack events in the pre-built knowledge graph.

[0100] In some optional implementations, the above step S3032 includes:

[0101] Step a1, when the data in the current attack event information is unstructured data, the cosine similarity is used to calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph.

[0102] Step a2: When the data in the current attack event information is structured data, the Euclidean distance is used to calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph.

[0103] In one example, in graph theory, similarity calculation is based on the connection relationship between nodes. For example, when calculating the similarity between node s and node t, it is actually based on the relationship between the entity set connected to s and the entity set connected to t.

[0104] Cosine similarity is suitable for scenarios where it is necessary to measure the similarity between data features, especially when comparing the features of text, events, or logs in high-dimensional space. For example, after NLP processing, the network attack event data within the power grid system can extract feature vectors such as attack type and intrusion mode. In this case, cosine similarity can be used to compare whether the behavior patterns of different attack events or log entries are similar. The calculation formula of cosine similarity is as follows:

[0105]

[0106] Among them, p s (i) represents the vector p s The value in the i-th dimension, usually the first vector (such as the feature value of an event or object); p t (i) represents the vector p t The values ​​in the i-th dimension, typically a second vector (feature values ​​of another event or object).

[0107] Euclidean distance is suitable for scenarios with numerical features and where absolute differences need to be evaluated. For example, for structured data in standard databases such as CVE, CWE, and ATT&CK, the fields of these data are clear and the values ​​are clear, such as the impact range of different vulnerabilities, risk scores, etc. In this case, Euclidean distance can effectively calculate the straight-line distance between two numerical data, thereby evaluating their differences in physical features or quantitative indicators. The calculation formula for Euclidean distance is as follows:

[0108]

[0109] Among them, p s (i) represents the vector p s The value in the i-th dimension, p t (i) represents the vector p t The value in the i-th dimension, p s (i)-p t (i) represents the vector p s and p t The difference in the i-th dimension.

[0110] Through the above calculations, we can obtain similarity metrics of the correlation between attack events (ranging from [0,1]). We can identify the correlation between a specific attack event and other events, and then reveal the potential connection between CVE and CWE, providing data support and theoretical basis for the formulation of subsequent defense strategies.

[0111] In this method, when the attack event data is unstructured data, the cosine similarity calculation method suitable for scenarios where the similarity between data features needs to be measured is used to compare whether the behavior patterns of different attack events or log entries are similar; when the attack event data is structured data, since the Euclidean distance is suitable for scenarios with numerical features and the need to evaluate absolute differences, the Euclidean distance can be used to effectively calculate the straight-line distance between two numerical data, thereby evaluating their differences in physical features or quantitative indicators.

[0112] Step S3033: based on the similarity, filter and obtain a set of related attack events that are most similar to the current attack event information.

[0113] In this method, graph theory algorithms are used to evaluate the similarity of nodes in the knowledge graph, thereby predicting potential attack paths. The correlation between a certain attack event and other attack events can be identified, and the potential connection between CVE and CWE can be revealed, providing data support and theoretical basis for the formulation of subsequent defense strategies.

[0114] Step S304: Based on the relevant attack events and in combination with the pre-built knowledge graph, the defense measures information corresponding to all relevant attack events are integrated to obtain the defense measures corresponding to the current attack event information. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0115] The network attack path prediction and defense method provided in this embodiment constructs a multi-dimensional knowledge graph by integrating standardized public network security data with unstructured log data within the power grid system. This method of integrating data of different types and sources not only enhances the richness and accuracy of the data, but also provides conditions for in-depth analysis of the complex relationship between attack events, which is difficult to achieve with traditional single data source analysis. Especially in the power grid scenario, it can help to better understand the security situation of the power system, discover potential threats, and thus make defense preparations in advance. Not only does it utilize standardized public data sets, but it also integrates unstructured log data within the power grid system, making the knowledge graph more comprehensive and practical. The use of comprehensive data sources improves the depth and breadth of analysis and helps to more fully understand the complexity of network attacks. When the attack event data is unstructured data, the attack event data is parsed by a natural language processing method, and feature extraction obtains key information corresponding to the current attack event information, which improves the ability and accuracy of automated processing, and facilitates subsequent calculation of the similarity between the current attack event and the attack event in the knowledge graph. By using graph theory algorithms to evaluate the similarity of nodes in the knowledge graph and predict potential attack paths, we can identify the correlation between a certain attack event and other attack events, and then reveal the potential connection between CVE and CWE, providing data support and theoretical basis for the formulation of subsequent defense strategies. When the attack event data is unstructured data, the cosine similarity calculation method suitable for scenarios where the similarity between data features needs to be measured is used to compare whether the behavior patterns of different attack events or log entries are similar; when the attack event data is structured data, since the Euclidean distance is suitable for scenarios with numerical features and the need to evaluate absolute differences, the Euclidean distance can effectively calculate the straight-line distance between two numerical data, thereby evaluating their differences in physical features or quantitative indicators.

[0116] In this embodiment, a network attack path prediction and defense method is provided, which can be used for the above-mentioned computer device. Figure 5 FIG. 1 is a flowchart of another network attack path prediction and defense method according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0117] Step S501, obtain current attack event information. Figure 3 Step S301 of the illustrated embodiment will not be described in detail here.

[0118] Step S502: extract features from the current attack event information to obtain key information corresponding to the current attack event information. Figure 3 Step S302 of the illustrated embodiment will not be described in detail here.

[0119] Step S503: Filter the set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph using a graph theory algorithm. Figure 3 Step S303 of the illustrated embodiment will not be described in detail here.

[0120] Step S504, based on the relevant attack events and in combination with the pre-built knowledge graph, the defense measures information corresponding to all relevant attack events is integrated to obtain the defense measures corresponding to the current attack event information.

[0121] Specifically, the above step S504 includes:

[0122] Step S5041: perform attack event identification and extraction on the current attack event information to obtain the attack event corresponding to the current attack event information.

[0123] Step S5042, query vulnerability information of the attack event to obtain vulnerability information corresponding to the current attack event information.

[0124] Step S5043, query the pre-built knowledge graph based on the obtained vulnerability information to generate security suggestion information corresponding to the vulnerability information.

[0125] Step S5044: According to the attack event, the attack technology corresponding to the current attack event is identified, and based on the attack technology, defense measure information corresponding to the current attack event is generated.

[0126] Step S5045: According to the attack event, determine the information of the component attacked in the current attack event, and generate a security update suggestion corresponding to the current attack event based on the component information.

[0127] Step S5046, integrating the security suggestion information, the defense measure information and the security update suggestion to obtain the defense measures corresponding to the current attack event information.

[0128] In one example, based on relevant attack events, find relevant mitigation measures, including vulnerability mitigation, component reinforcement, and countermeasures for technologies used by specific organizations, so as to quickly respond to new attack events and prevent further damage. The process is as follows:

[0129] (1) Identification and extraction of attack events: Attack events are extracted based on various logs in the power grid system (such as network traffic logs, application logs, security logs, etc.). From these logs, attack behaviors can be identified by analyzing information such as abnormal requests, scanning activities, and injection attempts. Specifically, it includes: 1. Log collection: Collect various log data from the power grid system, including but not limited to network traffic logs, application logs, security logs, etc. 2. Preprocessing: Use regular expressions and other methods to perform preliminary processing on the original log data, extract basic information such as timestamps, IP addresses, ports, etc., ensure that the data format is consistent, and facilitate subsequent analysis. 3. Anomaly detection: Detect abnormal behaviors in the logs through pattern matching and other methods, such as abnormal requests, frequent port scanning activities, SQL injection attempts, etc., which are usually signs of attack behaviors.

[0130] (2) Find vulnerability information associated with the attack event: The essence of the attack is to perform vulnerability scanning, port scanning, etc. on the system to achieve intrusion. The power grid system itself has various defense mechanisms and alarm systems that can identify specific vulnerabilities based on the corresponding request information. For example, if a SQL injection attack is detected, it can be associated with vulnerability information related to SQL injection. Specifically include: 1. Attack feature analysis: Based on the identified attack event, analyze its characteristics, such as the attack type (SQL injection, port scanning, etc.). 2. Vulnerability library matching: Compare the attack characteristics with known vulnerability databases (such as CVE, CWE) to find related vulnerability information. 3. Vulnerability details acquisition: Once a match is found, a detailed description of the vulnerability can be obtained, including the scope of the vulnerability, severity, possible attack paths, etc. 4. Correlation assessment: Evaluate the correlation between the attack event and the found vulnerability information to determine whether the vulnerability may be the target of the attacker.

[0131] (3) Find related CVE information: CVE information is essentially a standardized representation of vulnerability information. By searching for CVE information related to the attack event, you can obtain detailed vulnerability descriptions, impact scope, severity, etc. For example, in the knowledge graph, you can search for CVE numbers related to SQL injection and obtain a detailed description of the vulnerability. Specifically, it includes: 1. Vulnerability information analysis: Starting from the vulnerability information extracted from the attack event, clarify the nature and characteristics of the vulnerability. 2. CVE database query: Use vulnerability information as keywords to perform precise or fuzzy queries in the CVE database to find matching CVE entries. 3. CVE information parsing: Parse the queried CVE entries to extract important information such as vulnerability description, impact scope, disclosure date, and repair suggestions. 4. Security recommendation generation: Based on CVE information, generate security recommendations or patch update guidelines for the vulnerability to guide system administrators to take timely measures to reduce risks.

[0132] (4) Associated technology mapping: Associated technologies will eventually be mapped to specific technologies in the MITRE ATT&CK framework. For example, port scanning may be mapped to T1432 (PortScan), while SQL injection may be mapped to T1275 (SQLInjection). In this way, targeted mitigation measures can be formulated based on the technical descriptions in the ATT&CK framework. Specifically, it includes: 1. Attack technology identification: Based on the characteristics of the attack event, identify the techniques or tactics used by the attacker, such as port scanning, SQL injection, etc. 2. ATT&CK framework comparison: Compare the identified techniques or tactics with the techniques in the MITRE ATT&CK framework to find the corresponding technology numbers (such as T1432, T1275). 3. Technical description acquisition: Obtain a detailed description of the corresponding technology through the ATT&CK framework, including the purpose of the technology, common implementation methods, possible defense measures, etc. 4. Defense strategy formulation: Based on the technical description, formulate targeted defense strategies or mitigation measures to reduce the risk of similar attacks in the future.

[0133] (5) Find component information of related events: Component refers to the object that the vulnerability ultimately affects, such as operating system, database management system, Web server, etc. For each related attack event, you can find its corresponding component information to facilitate the implementation of targeted repair measures. For example, if it is a vulnerability in the database system, then the component information points to the database management software and its version. Specifically include: 1. Identification of attacked components: Determine the specific components attacked from the attack event, such as operating system, database management system, Web server, etc. 2. Component information collection: Collect detailed information about the attacked components, including the component name, version number, configuration information, etc. 3. Component vulnerability query: Use component information to query whether the component has a known vulnerability in the vulnerability database (such as CVE). 4. Security update recommendations: Based on the query results, provide security update recommendations for the attacked components, such as upgrading to the latest version, patching, reconfiguration, etc., to eliminate or reduce the risks brought by the vulnerability.

[0134] The network attack path prediction and defense method provided in this embodiment can locate suitable mitigation measures or defense strategies by analyzing the entity attributes and association relationships of the current attack event and combining with the knowledge graph, so as to respond to new attack events more quickly and effectively, further improving the accuracy and efficiency of network attack defense.

[0135] In this embodiment, a network attack path prediction and defense device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0136] This embodiment provides a network attack path prediction and defense device, such as Figure 6 As shown, including:

[0137] The data acquisition module 601 is used to obtain the current attack event information. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0138] The feature extraction module 602 is used to extract features from the current attack event information to obtain key information corresponding to the current attack event information. The key information is used to characterize the information used for similarity matching in the current attack event information. For details, please refer to Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0139] The similar information screening module 603 is used to use graph theory algorithms to screen the set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0140] The defense measure generation module 604 is used to integrate the defense measure information corresponding to all relevant attack events based on relevant attack events and in combination with the pre-built knowledge graph to obtain the defense measures corresponding to the current attack event information. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0141] In some optional implementations, the network attack path prediction and defense device includes:

[0142] The data acquisition unit is used to acquire public attack event data and historical network attack instance data, where the public attack event data is structured data and the historical network attack instance data is unstructured data.

[0143] The regular matching unit is used to extract information from the public attack event data using an automated tool to obtain processed public attack event data.

[0144] The key field extraction unit is used to extract key fields from historical attack event instance data using an automated tool, and to process the historical attack event instance data using natural language processing to obtain processed historical network attack instance data.

[0145] The knowledge graph construction unit is used to integrate the processed public attack event data and the processed historical network attack instance data to construct a knowledge graph.

[0146] In some optional implementations, the feature extraction module 602 includes:

[0147] The data preprocessing unit is used to preprocess the current attack event information to obtain the preprocessed current attack event information.

[0148] The structured data judgment unit is used to judge whether the current attack event information is structured data.

[0149] The natural language processing unit is used to convert the pre-processed current attack event information into structured data by using natural language processing when the current attack event information is unstructured data.

[0150] The feature extraction unit is used to extract features of the pre-processed current attack event information according to a preset key information list when the current attack event information is structured data, so as to obtain key information corresponding to the current attack event information, wherein the key information includes timestamp information, IP address information, scanned port information, attack technology information and vulnerability information.

[0151] In some optional implementations, the similar information screening module 603 includes:

[0152] The similarity evaluation unit is used to use graph theory algorithms to evaluate the similarities between all attack events in the pre-built knowledge graph and predict potential attack paths.

[0153] The similarity calculation unit is used to combine the potential attack paths and calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph.

[0154] The event screening unit is used to screen and obtain a set of related attack events that are most similar to the current attack event information based on similarity.

[0155] In some optional implementations, the similarity calculation unit includes:

[0156] The cosine similarity calculation subunit is used to calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph using cosine similarity when the data in the current attack event information is unstructured data.

[0157] The Euclidean distance calculation subunit is used to calculate the similarity between the current attack event information and all attack events in the pre-built knowledge graph using the Euclidean distance when the data in the current attack event information is structured data.

[0158] In some optional implementations, the defense measure generation module 604 includes:

[0159] The attack event extraction unit is used to perform attack event identification and extraction on the current attack event information to obtain the attack event corresponding to the current attack event information.

[0160] The vulnerability information query unit is used to query the vulnerability information of the attack event and obtain the vulnerability information corresponding to the current attack event information.

[0161] The security suggestion information generation unit is used to query the pre-built knowledge graph based on the vulnerability information obtained, and generate security suggestion information corresponding to the vulnerability information.

[0162] The attack technology identification unit is used to identify the attack technology corresponding to the current attack event according to the attack event, and generate defense measure information corresponding to the current attack event based on the attack technology.

[0163] The component information identification unit is used to determine the component information attacked in the current attack event according to the attack event, and generate a security update suggestion corresponding to the current attack event based on the component information.

[0164] The defense measure integration unit is used to integrate security suggestion information, defense measure information and security update suggestions to obtain defense measures corresponding to the current attack event information.

[0165] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0166] The network attack path prediction and defense device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0167] The embodiment of the present invention also provides a computer device having the above Figure 6 The network attack path prediction and defense device shown.

[0168] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0169] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0170] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0171] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0172] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0173] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0174] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0175] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0176] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0177] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network attack path prediction and defense method, characterized in that: The method comprises: Get current attack event information; Extract features of the current attack event information to obtain key information corresponding to the current attack event information, where the key information is used to characterize information in the current attack event information for similarity matching; Using graph theory algorithms, we filter out the set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph; Based on the related attack events and in combination with the pre-built knowledge graph, the defense measures information corresponding to all the related attack events are integrated to obtain the defense measures corresponding to the current attack event information.

2. The method according to claim 1, characterized in that: The pre-built knowledge graph is constructed as follows: Acquire public attack event data and historical network attack instance data, wherein the public attack event data is structured data and the historical network attack instance data is unstructured data; Using an automated tool to extract information from the public attack event data to obtain processed public attack event data; Using an automated tool to extract key fields from the historical attack event instance data, and using natural language processing to process the historical attack event instance data to obtain processed historical network attack instance data; The processed public attack event data and the processed historical network attack instance data are integrated to construct the knowledge graph.

3. The method according to claim 1, characterized in that: The feature extraction of the current attack event information to obtain key information corresponding to the current attack event information includes: Preprocessing the current attack event information to obtain preprocessed current attack event information; Determine whether the current attack event information is structured data; When the current attack event information is unstructured data, converting the pre-processed current attack event information into structured data by using natural language processing; When the current attack event information is structured data, feature extraction is performed on the pre-processed current attack event information according to a preset key information list to obtain key information corresponding to the current attack event information, wherein the key information includes timestamp information, IP address information, scanned port information, attack technology information and vulnerability information.

4. The method according to claim 1, characterized in that: The method of using a graph theory algorithm to filter a set of related attack events that are most similar to the current attack event information from a pre-built knowledge graph includes: Using graph theory algorithms, the similarities between all attack events in the pre-built knowledge graph are evaluated to predict potential attack paths; In combination with the potential attack path, calculating the similarity between the current attack event information and all attack events in the pre-built knowledge graph; Based on the similarity, a set of related attack events that are most similar to the current attack event information is screened and obtained.

5. The method according to claim 4, characterized in that The calculating the similarity between the current attack event information and all attack events in the pre-built knowledge graph includes: When the data in the current attack event information is unstructured data, the similarity between the current attack event information and all attack events in the pre-built knowledge graph is calculated using cosine similarity; When the data in the current attack event information is structured data, the Euclidean distance is used to calculate the similarity between the current attack event information and all attack events in the pre-constructed knowledge graph.

6. The method according to claim 2, characterized in that Based on the related attack events, combined with the pre-built knowledge graph, the defense measures information corresponding to all the related attack events are integrated to obtain the defense measures corresponding to the current attack event information, including: Perform attack event recognition and extraction on the current attack event information to obtain the attack event corresponding to the current attack event information; Perform vulnerability information query on the attack event to obtain vulnerability information corresponding to the current attack event information; Based on the obtained vulnerability information, the pre-built knowledge graph is queried to generate security suggestion information corresponding to the vulnerability information; According to the attack event, an attack technology corresponding to the current attack event is identified, and based on the attack technology, defense measure information corresponding to the current attack event is generated; According to the attack event, determine the component information attacked in the current attack event, and generate a security update suggestion corresponding to the current attack event based on the component information; The security suggestion information, the defense measure information and the security update suggestion are integrated to obtain the defense measure corresponding to the current attack event information.

7. A network attack path prediction and defense device, characterized in that: The device comprises: Data acquisition module, used to obtain current attack event information; A feature extraction module is used to extract features from the current attack event information to obtain key information corresponding to the current attack event information, where the key information is used to characterize information used for similarity matching in the current attack event information; The similar information screening module is used to use graph theory algorithms to screen the set of related attack events that are most similar to the current attack event information from the pre-built knowledge graph; The defense measures generation module is used to integrate the defense measures information corresponding to all the related attack events based on the related attack events and in combination with the pre-built knowledge graph to obtain the defense measures corresponding to the current attack event information.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network attack path prediction and defense method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the network attack path prediction and defense method according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes computer instructions, and the computer instructions are used to enable a computer to execute the network attack path prediction and defense method according to any one of claims 1 to 6.

Images