Network attack countering method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of network attack defense, and discloses a network attack countering method and device, computer equipment and a storage medium, and the method comprises the steps: constructing a network security knowledge graph through employing historical attack event data; mining an association relationship among key entities in the historical attack event data by using a graph embedding algorithm; screening the association relationships by using a similarity calculation algorithm to obtain a historical attack event data set with the highest similarity with the current security event data in each dimension; and mining an association path between the current security event data and the historical attack event data set with the highest similarity by using the network security knowledge graph, and integrating to obtain countering information corresponding to the current security event data. According to the method, the key entities of the network attack event and the incidence relation of the key entities are deeply mined, the insight ability for the attack mode is remarkably improved, the counterattack strategy information for the network attack event is efficiently mined, and accurate counterattack of the network attack event is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack defense, and in particular to a network attack countermeasure method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, the frequency and complexity of cyber attacks are increasing, and cyber security has become a global issue. Whether it is individual users, enterprises or national governments, they are facing increasingly complex cyber threats. In order to improve the efficiency and flexibility of cyber security defense, data-driven intelligent security protection technology has gradually become a research hotspot in recent years.

[0003] In the related technologies, the existing network attack countermeasures need to collect and analyze network attack data to extract key attack patterns, which can provide effective support for active defense and countermeasures. However, traditional network security incident processing only exists in isolation and in a single way. It is unable to discover the implicit correlation in network attack incidents, making it difficult to counter network attack incidents. Summary of the invention

[0004] In view of this, the present invention provides a network attack countermeasure method, apparatus, computer equipment and storage medium to solve the problem that it is difficult to counter network attack events.

[0005] In a first aspect, the present invention provides a network attack countermeasure method, the method comprising:

[0006] Obtain historical attack event data;

[0007] Use historical attack event data to build a network security knowledge graph;

[0008] Using graph embedding algorithms, based on the network security knowledge graph, we can mine the associations between key entities in historical attack event data.

[0009] Obtain current security event data, use similarity calculation algorithms to filter associations, and obtain a set of historical attack event data with the highest similarity to current security event data in each dimension;

[0010] The network security knowledge graph is used to mine the association path between the current security event data and the historical attack event data set with the highest similarity. Based on the association path, the countermeasure information corresponding to the current security event data is integrated.

[0011] In the present invention, by deeply mining the historical attack event data, the multi-dimensional identification of entities, relationships, attributes, etc. is realized, and a more accurate knowledge graph can be constructed. By using the knowledge graph, combined with the graph embedding algorithm and node similarity calculation, the key entities and their associations of network attack events are deeply mined, which significantly improves the insight into the attack mode and successfully identifies several nodes that are similar to the input attack event in multiple entity dimensions. By using the association relationships and several similarity nodes in the knowledge graph and setting different thresholds, the counterattack strategy information for network attack events is efficiently mined, realizing accurate countermeasures against network attack events.

[0012] In an optional implementation, historical attack event data is used to construct a network security knowledge graph, including:

[0013] Based on historical attack event data, a paradigm representation of network security knowledge graph is constructed;

[0014] Using the deep learning network structure based on CRF and the embedding model, the historical attack event data is embedded and represented, and the entity recognition of the historical attack event data is performed;

[0015] By using preset matching rules and combining paradigm representation, entities, relationships, and attributes of historical attack event data are extracted to obtain entity graph representation and form a network security knowledge graph.

[0016] In this approach, the knowledge graph is closely combined with the deep learning algorithm. By constructing a refined, comprehensive and integrated network security knowledge graph, the various entities and their relationships in the attack incidents are systematically characterized, covering the entire life cycle of network attacks. This breaks the isolation of traditional network security incident processing, makes the mining of correlation relationships more in-depth, and provides strong technical support for the implementation of intelligent countermeasure strategies.

[0017] In an optional implementation, entities, relationships, and attributes of historical attack event data are extracted by using preset matching rules in combination with paradigm representation, including:

[0018] When the historical attack event data is structured data, identifying the field content of the historical attack event data, and establishing a relationship between the historical attack event data and related attack event data based on the field content;

[0019] When the historical attack event data has a preset regular rule match, the historical attack event data is matched by the paradigm representation;

[0020] When the historical attack event data is not structured data and the historical attack event data has preset regular rule matching, entity recognition is performed on the historical attack event data to convert the historical attack event data into structured historical attack event data.

[0021] In this method, targeted information extraction is performed on different types of historical attack event data, and different types of historical attack event data are associated, which facilitates the construction of a more refined, comprehensive and integrated network security knowledge graph, and achieves a systematic characterization of various entities and their interrelationships in attack events.

[0022] In an optional implementation, a graph embedding algorithm is used to mine the association relationship between key entities in the historical attack event data based on the network security knowledge graph, including:

[0023] The Node2Vec algorithm is used based on the random walk strategy to perform vector representation on each key entity in the historical attack event data, and the vector representation between each key entity is obtained;

[0024] The vector representation corresponding to each key entity is stored as an attribute vector in the node of each key entity to mine the association relationship between key entities in historical attack event data.

[0025] In this method, by introducing the Node2Vec algorithm, a dynamic embedding representation of nodes in the knowledge graph is achieved, thereby capturing the potential and complex associations between different attack entities. The random walk strategy is used to embed the nodes, which not only enhances the system's understanding of attack patterns, but also enables the update of graph embedding vectors based on the constantly changing attack data, ensuring that the countermeasure plan is always consistent with the latest data.

[0026] In an optional implementation, the association relationships are screened to obtain a set of historical attack event data with the highest similarity to the current security event data in each dimension, including:

[0027] Determine whether the number of nodes is greater than a number threshold, and whether the number of associated relationships of the nodes is greater than a relationship number threshold;

[0028] When the number of nodes is greater than the number threshold, and the number of associated relationships of the nodes is greater than the relationship number threshold, the similarity between the historical attack event data and the current security event data in each dimension is calculated using the cosine similarity calculation method according to the attribute vector, and the historical attack event data set with the highest similarity to the current security event data in each dimension is screened;

[0029] When the number of nodes is not greater than the number threshold, or the number of associated relationships of the nodes is not greater than the relationship number threshold, the similarity between the historical attack event data and the current security event data in each dimension is calculated using the distance calculation method according to the attribute vector; the historical attack event data set with the highest similarity to the current security event data in each dimension is screened out.

[0030] In this method, a similarity calculation algorithm is innovatively introduced. The distance measurement of key entity embedding vectors is performed through the cosine similarity algorithm or the Euclidean similarity algorithm. The similarity of the current attack event on multiple entities is quickly identified, providing accurate data support for generating highly accurate countermeasure strategies.

[0031] In an optional implementation, the network security knowledge graph is used to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and based on the association path, the countermeasure information corresponding to the current security event data is integrated, including:

[0032] Using the preset similarity threshold, filter out the most similar historical attack event data set in each dimension;

[0033] Through the A* shortest path discovery and Dijkstra shortest path discovery algorithms, the association path between the historical attack event data set and the current security event data of each dimension is mined to determine the relevant entities on the association path;

[0034] Obtain the historical countermeasure information corresponding to each relevant entity, integrate the historical countermeasure information corresponding to all relevant entities, and obtain the countermeasure information corresponding to the current security event data.

[0035] In this method, by verifying and constraining the similarity thresholds of multiple types of entities, and using the A* algorithm and Dijkstra algorithm, the most likely entities associated with the current attack event are mined, and countermeasure information is output, ensuring the accuracy and effectiveness of the countermeasure information.

[0036] In a second aspect, the present invention provides a network attack countermeasure device, the device comprising:

[0037] A data acquisition module is used to acquire historical attack event data;

[0038] The knowledge graph construction module is used to build a network security knowledge graph using historical attack event data;

[0039] The association mining module is used to mine the association relationships between key entities in historical attack event data based on the network security knowledge graph using the graph embedding algorithm;

[0040] The similarity screening module is used to obtain the current security event data, and use the similarity calculation algorithm to screen the association relationship to obtain the historical attack event data set with the highest similarity to the current security event data in each dimension;

[0041] The countermeasure information integration module is used to use the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and integrate the countermeasure information corresponding to the current security event data based on the association path.

[0042] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the network attack countermeasure method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the network attack countermeasure method of the first aspect or any corresponding embodiment thereof.

[0044] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the network attack countermeasure method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 4 is a flow chart of a network attack countermeasure method according to an embodiment of the present invention.

[0047] Figure 2 It is a schematic diagram of a paradigm representation for establishing a knowledge graph according to an embodiment of the present invention.

[0048] Figure 3 It is a flowchart of a network attack countermeasure method based on network attack events and Node2vec algorithm according to an embodiment of the present invention.

[0049] Figure 4 The figure is a flowchart of another network attack countermeasure method according to an embodiment of the present invention.

[0050] Figure 5 It is a flowchart of another network attack countermeasure method according to an embodiment of the present invention.

[0051] Figure 6 It is a schematic diagram of an entity embedding representation constructed by Node2Vec based on a random walk strategy according to an embodiment of the present invention.

[0052] Figure 7 4 is a structural block diagram of a network attack countermeasure device according to an embodiment of the present invention.

[0053] Figure 8 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0055] In related technologies, through deep mining of historical attack event data, multi-dimensional identification of entities, relationships, attributes, etc. can be achieved, and a more accurate knowledge graph can be constructed. By using the knowledge graph, combined with the graph embedding algorithm and node similarity calculation, the key entities and their associations of network attack events are deeply mined, which significantly improves the ability to understand the attack pattern and successfully identifies several nodes that are similar to the input attack event in multiple entity dimensions. By using the association relationships and several similarity nodes in the knowledge graph and setting different thresholds, the counterattack strategy information for network attack events can be efficiently mined, achieving accurate countermeasures against network attack events.

[0056] In order to solve the above problems, a network attack countermeasure method is provided in an embodiment of the present invention, which is used in a computer device. It should be noted that its execution subject can be a network attack countermeasure device, which can be implemented as part or all of the computer device through software, hardware, or a combination of software and hardware. The computer device can be a terminal, a client, or a server. The server can be a single server or a server cluster composed of multiple servers. The terminal in the embodiment of the present application can be a smart phone, a personal computer, a tablet computer, or other intelligent hardware devices. In the following method embodiments, the execution subject is a computer device as an example for explanation.

[0057] The computer equipment in this embodiment is suitable for maintaining the stable operation of the power grid system and accurately outputting countermeasure information for external network security attack events. The present invention provides a network attack countermeasure method, which realizes the identification of multiple dimensions such as entities, relationships, and attributes by deeply mining historical attack event data, and thus can construct a more accurate knowledge graph. By utilizing the knowledge graph, combined with the graph embedding algorithm and node similarity calculation, the key entities and their associations of the network attack event are deeply mined, the insight into the attack mode is significantly improved, and several nodes similar to the input attack event in multiple entity dimensions are successfully identified. By utilizing the association relationships and several similarity nodes in the knowledge graph and setting different thresholds, the counterattack strategy information for the network attack event is efficiently mined, and accurate countermeasures against the network attack event are achieved.

[0058] According to an embodiment of the present invention, an embodiment of a network attack countermeasure method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0059] In this embodiment, a network attack countermeasure method is provided, which can be used for the above-mentioned computer device. Figure 1 is a flow chart of a network attack countermeasure method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0060] Step S101, obtaining historical attack event data.

[0061] In one example, the main sources of historical attack event data may include the following channels: Network attack logs: including firewall logs, IDS / IPS logs, server and client system logs, which record the time, source, target, etc. of the intrusion. Public vulnerability intelligence: The public intelligence data sources on the Internet, such as CVE, CWE, CPE, ATTCK, etc., can provide information on vulnerabilities and related countermeasures and repair measures on the one hand, and information on attack organizations and the technologies used by attack organizations on the other hand.

[0062] Step S102, using historical attack event data to build a network security knowledge graph.

[0063] In one example, a comprehensive and integrated network security knowledge graph is constructed, covering the entire life cycle of network attacks, including attack organizations, attack techniques, target systems, vulnerability intelligence, attack techniques, IP, services and other multi-dimensional information. On the one hand, the paradigm representation of the knowledge graph is established through the analysis of the data set. Figure 2is a schematic diagram of a paradigm representation of establishing a knowledge graph according to an embodiment of the present invention. The paradigm representation of the knowledge graph is as follows Figure 2 On the other hand, using the deep learning network structure based on CRF (Conditional Random Fields), with the help of the Embedding model of Bert and Transform series, the text is embedded and represented, and the entity recognition task is realized with the network structure of Embedding + CRF; at the same time, the entities and related attributes with clear rules are extracted with the help of regular matching rules to build a network security knowledge graph.

[0064] Step S103, using a graph embedding algorithm, based on the network security knowledge graph, to mine the association relationship between key entities in the historical attack event data.

[0065] In one example, after the network security knowledge graph is built, the next step is to use the Node2Vec algorithm and similarity calculation algorithm in graph theory to mine the association relationship of key entities in network security events. Among them, Node2Vec is a graph embedding algorithm that can map the nodes in the graph to a low-dimensional vector space through random walks, thereby retaining the local and global structural information of the nodes.

[0066] Step S104, obtaining current security event data, and screening the association relationship using a similarity calculation algorithm to obtain a set of historical attack event data with the highest similarity to the current security event data in each dimension.

[0067] In one example, a similarity calculation algorithm is used to calculate the similarity of the input current security event data in the network security knowledge graph to screen the Top K nodes with the greatest similarity to the current security event data.

[0068] Step S105, using the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and based on the association path, integrating and obtaining the countermeasure information corresponding to the current security event data.

[0069] In one example, K similarity nodes for multiple dimensions of current security event data are obtained through the network security knowledge graph, Node2Vec, and multiple similarities. The input attack events are constrained through the K nodes in each dimension to ensure that there is a correlation between the K nodes in each dimension and the current security event data, and the countermeasure information corresponding to the current security event data is filtered and output.

[0070] In one implementation scenario, Figure 3FIG. 1 is a flow chart of a network attack countermeasure method based on network attack events and Node2vec algorithm according to an embodiment of the present invention. Figure 3 As shown, a network attack countermeasure method based on network attack events and Node2vec algorithm may include: collecting network attack data; preprocessing network attack data, including entity recognition and feature extraction; using network attack data to construct a comprehensive network attack knowledge graph; executing Node2vec based on the comprehensive network attack knowledge graph; using a similarity calculation algorithm to screen and obtain the Top K network attack-related entities with the greatest similarity; mining associated paths from various dimensions such as vulnerability entities (such as CVE, CWE and other vulnerabilities, and the present invention does not limit the vulnerability type), attack technology, ATTCK attack organization, network attack event entity, etc., performing multi-dimensional constraints through the network security knowledge graph, and outputting countermeasure information corresponding to the current security event data; and integrating to obtain the output result.

[0071] By collecting network security data (such as CVE, CWE, CPE, etc.) and network attacks, network attack log information, combined with the entity recognition technology in NLP (based on the Bert series model plus conditional random field as the benchmark network structure), a knowledge graph is constructed, and the graph embedding technology Node2Vec algorithm is used to realize the feature representation of the entity nodes in the graph. Furthermore, the similarity calculation algorithm based on distance measurement is used to realize the similarity calculation of key entities in network attack events, and the multi-dimensional countermeasure information is converged through the similarity threshold, so as to realize the accurate output of countermeasure information for external network security attack events and ensure the stable operation of the power grid system.

[0072] The network attack countermeasure method provided in this embodiment realizes the identification of entities, relationships, attributes and other dimensions by deeply mining the historical attack event data, and thus can construct a more accurate knowledge graph. By utilizing the knowledge graph, combined with the graph embedding algorithm and node similarity calculation, the key entities and their associations of the network attack events are deeply mined, the insight into the attack mode is significantly improved, and several nodes similar to the input attack events in multiple entity dimensions are successfully identified. By using the association relationships and several similarity nodes in the knowledge graph and setting different thresholds, the counterattack strategy information for network attack events is efficiently mined, and accurate countermeasures against network attack events are achieved.

[0073] In this embodiment, a network attack countermeasure method is provided, which can be used for the above-mentioned computer device. Figure 4 is a flow chart of another network attack countermeasure method according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0074] Step S401, obtain historical attack event data. For details, see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0075] Step S402: construct a network security knowledge graph using historical attack event data.

[0076] Specifically, the above step S402 includes:

[0077] Step S4021, construct a paradigm representation of the network security knowledge graph based on historical attack event data.

[0078] Step S4022, using a deep learning network structure based on CRF and combining it with an embedding model, embedding and representing the historical attack event data, and performing entity recognition on the historical attack event data.

[0079] Step S4023, using preset matching rules and combining paradigm representation to extract entities, relationships and attributes from historical attack event data, obtain entity graph representation, and form a network security knowledge graph.

[0080] In some optional implementations, the above step S4023 includes:

[0081] Step a1: when the historical attack event data is structured data, identifying the field content of the historical attack event data, and establishing a relationship between the historical attack event data and related attack event data based on the field content.

[0082] Step a2: when the historical attack event data has a preset regular rule match, the historical attack event data is matched with the regular rule using the paradigm representation.

[0083] Step a3: When the historical attack event data is not structured data and the historical attack event data has a preset regular rule match, entity recognition is performed on the historical attack event data to convert the historical attack event data into structured historical attack event data.

[0084] In one example, a deep learning network structure based on CRF (Conditional Random Fields) is used to embed text with the help of the Embedding model of the Bert and Transform series, and the entity recognition task is realized with the Embedding+CRF network structure. At the same time, regular matching rules are used to extract entities and related attributes with clear rules to build a knowledge graph.

[0085] By analyzing the entity paradigm representation constructed in the above steps and the above historical attack event data, three types of information extraction are performed on the data, including:

[0086] 1. There are strict field descriptions for structured data. Structured data needs to have a clear format. For example, json data has strict field names, so it is structured data. Entity recognition of structured data is achieved through the entity recognition technology in the NLP field, that is, the Bert+CRF neural network structure training model.

[0087] Taking the Related_Weaknesses field in CAPEC data as an example, the Related_Weaknesses field in CAPEC data represents the CWE type it affects. The relationship between it and CWE data can be established, including: the content of the Related_Weaknesses field of CAPEC-101 is: ::97::74::20::, which indicates that the CWE vulnerability type numbers associated with CAPEC-101 are: CWE-97, CWE-74, and CWE-20.

[0088] 2. For some attack event data whose entity names match certain regular rules, the corresponding entities are determined through manual analysis and combined with existing data research. The Bert+CRF neural network structure training model is used to realize entity recognition of attack event data with certain regular rule matching: For example, the CVE vulnerability number can be matched through the following rules: (?i)cve-\d{4}-\d{4,7}. The rule means ignoring the case and starting with CVE like "CVE-2024-1234", followed by a connector "-", followed by 4 digits from 0 to 9, followed by a connector "-", and then a 4 to 7 digit 0 to 9 content.

[0089] 3. For attack event data that does not belong to the above two, such as attack report text data, entity recognition is performed through the Bert+CRF network structure. It is necessary to build a training set. The following steps show one of the samples in the training set: IP10.0.0.5 launched a remote code execution attack on January 23, 2024 by exploiting the CWE-79 type vulnerability of the power grid CVE-2023-1234 system, [[2,10,IP],[33,39,CWE],[48,54,attack event]]. The 2nd to 10th characters express an IP entity, the 33rd to 39th entities express CWE type entities, and the 48th to 54th characters express an attack event entity.

[0090] Through the above three methods of extracting entities, relationships and attributes, the above entity graph representation is obtained, and the Neo4j graph database is used as the data storage carrier to form a network security knowledge graph based on network security events.

[0091] In this approach, the knowledge graph is closely combined with the deep learning algorithm. By constructing a refined, comprehensive, and integrated network security knowledge graph, various entities and their interrelationships in attack events are systematically characterized, covering the entire life cycle of network attacks, breaking the isolation of traditional network security event processing, making the mining of associations more in-depth, and providing strong technical support for the implementation of intelligent countermeasure strategies. By extracting targeted information from different types of historical attack event data and associating different types of historical attack event data, it is convenient to construct a more refined, comprehensive, and integrated network security knowledge graph, and achieves the systematic characterization of various entities and their interrelationships in attack events.

[0092] Step S403, using a graph embedding algorithm, based on the network security knowledge graph, to mine the associations between key entities in the historical attack event data. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0093] Step S404: obtain the current security event data, and use the similarity calculation algorithm to filter the association relationship to obtain the historical attack event data set with the highest similarity to the current security event data in each dimension. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0094] Step S405: Use the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and integrate the countermeasure information corresponding to the current security event data based on the association path. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0095] The network attack countermeasure method provided in this embodiment closely combines the knowledge graph with the deep learning algorithm, and systematically characterizes various entities and their interrelationships in the attack event by constructing a refined, comprehensive and integrated network security knowledge graph, covering the entire life cycle of network attacks, breaking the isolation of traditional network security event processing, making the mining of association relationships more in-depth, and providing strong technical support for the implementation of intelligent countermeasure strategies. By performing targeted information extraction on different types of historical attack event data and associating different types of historical attack event data, it is convenient to construct a more refined, comprehensive and integrated network security knowledge graph, and realizes the systematic characterization of various entities and their interrelationships in the attack event.

[0096] In this embodiment, a network attack countermeasure method is provided, which can be used for the above-mentioned computer device. Figure 5 is a flow chart of another network attack countermeasure method according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0097] Step S501, obtain historical attack event data. For details, see Figure 4 Step S401 of the illustrated embodiment will not be described in detail here.

[0098] Step S502: Use historical attack event data to build a network security knowledge graph. Figure 4 Step S402 of the illustrated embodiment will not be described in detail here.

[0099] Step S503, using a graph embedding algorithm, based on the network security knowledge graph, to mine the association relationship between key entities in the historical attack event data.

[0100] Specifically, the above step S503 includes:

[0101] Step S5031, using the Node2Vec algorithm based on the random walk strategy, vector representation is performed on each key entity in the historical attack event data to obtain vector representations between each key entity.

[0102] Step S5032: storing the vector representation corresponding to each key entity as an attribute vector in the node of each key entity, so as to mine the association relationship between the key entities in the historical attack event data.

[0103] In one example, Node2Vec is an entity embedding representation built based on the Random Walk strategy. The following is a description of the algorithm: Figure 6 is a schematic diagram of an entity embedding representation constructed by Node2Vec based on a random walk strategy according to an embodiment of the present invention. Assume that there are 10 nodes in the figure such as Figure 6 As shown in the figure, the number of random walk steps is set to 4, the context window length is set to 2, the embedding dimension is set to 128, and the 10 nodes are represented by A, B, C, D, E, F, G, H, I, and J.

[0104] Assume that one of the training data is to take 4 steps from A, and each step randomly selects the next node connected to it. Assume that the resulting path is ABCD. ABCD as a whole can be represented as a sentence in NLP, and each of A, B, C, and D can be represented as a word in NLP. Since the window length is set to 2, the following two samples are obtained:

[0105] Sample 1: A, BC

[0106] Sample 2: B, CD

[0107] It means that the next word predicted by A and B is C, and the next word predicted by B and C is D. Further combining the algorithm principle of Word2Vector in NLP, it is characterized by one-hot vector encoding as follows:

[0108] Word A can be represented as: [1,0,0,0,0,0,0,0,0,0,0,]

[0109] Word B can be represented as: [0,1,0,0,0,0,0,0,0,0,]

[0110] The word C can be represented as: [0,0,1,0,0,0,0,0,0,0,]

[0111] The word D can be represented as: [0,0,0,1,0,0,0,0,0,0,]

[0112] …

[0113] For sample 1, the input is the vector representation of A and B, and the output is the C vector. The one-hot encoding of vectors A, B, C, and D is a 1*10 vector. Here, we need to first sum the vectors of A and B to get a new feature vector [1,1,0,0,0,0,0,0,0,0] represented by ab. Since we want to get a 1*128 vector, we need to send the ab vectors into the 10*128 and 128*10 matrices respectively. These two matrices are the parameter matrices that need to be trained. The embedding representation of the node is the embedding representation obtained by sending the one-hot code of each node into the 10*128 matrix. At this point, we get the embedded data based on the connection relationship of the entity nodes from the perspective of the entire graph. It is placed in the node as the attribute information of each node. The attribute name is: node_embedding, [0,1,0.011,0.001.....].

[0114] In this method, by introducing the Node2Vec algorithm, a dynamic embedding representation of nodes in the knowledge graph is achieved, thereby capturing the potential and complex associations between different attack entities. The random walk strategy is used to embed the nodes, which not only enhances the system's understanding of attack patterns, but also enables the update of graph embedding vectors based on the constantly changing attack data, ensuring that the countermeasure plan is always consistent with the latest data.

[0115] Step S504, obtaining current security event data, and screening the association relationship using a similarity calculation algorithm to obtain a set of historical attack event data with the highest similarity to the current security event data in each dimension.

[0116] Specifically, in an optional implementation, the above step S504 includes:

[0117] Determine whether the number of nodes is greater than a number threshold, and whether the number of associated relationships of the nodes is greater than a relationship number threshold.

[0118] When the number of nodes is greater than the number threshold and the number of associated relationships of the nodes is greater than the relationship number threshold, the similarity between the historical attack event data and the current security event data in each dimension is calculated based on the attribute vector using the cosine similarity calculation method, and the historical attack event data set with the highest similarity to the current security event data in each dimension is screened out.

[0119] When the number of nodes is not greater than the number threshold, or the number of associated relationships of the nodes is not greater than the relationship number threshold, the similarity between the historical attack event data and the current security event data in each dimension is calculated using the distance calculation method according to the attribute vector; the historical attack event data set with the highest similarity to the current security event data in each dimension is screened out.

[0120] In one example, a similarity calculation algorithm is used to calculate the similarity of the input attack events in the graph to filter the Top K nodes related to the current security event. Here, calculation needs to be performed based on the node_embedding attribute vector of each node. The specific calculation method is selected based on whether the node type is sparse. If it is relatively sparse, the following distance calculation method can be selected, namely Euclidean similarity:

[0121]

[0122] where p s and p t is the data vector to be calculated. In this patent, it represents the node attributes of each node after Embedding: node_embedding, which is a 128-dimensional vector. s (i) represents the value of the i-th dimension in 128 dimensions. The value of i ranges from 1 to 128, indicating the dimension.

[0123] If it is not too sparse, you can choose to calculate cosine similarity:

[0124]

[0125] Whether a node is sparse or not can be preliminarily judged by checking the number of nodes of this type and the number of relationships. For example, if the number is greater than 2K and the number of relationships is greater than 5K, it is considered not too sparse. In the present invention, the number of nodes and the number of relationships are not calculated. Through the calculation method of similarity, the input network attack data is converged from multiple dimensions such as vulnerabilities, network security events, and attack organizations. K similarity nodes are obtained for nodes in each dimension, such as obtaining K attack events associated with an attack event.

[0126] In this method, a similarity calculation algorithm is innovatively introduced. The distance measurement of key entity embedding vectors is performed through the cosine similarity algorithm or the Euclidean similarity algorithm. The similarity of the current attack event on multiple entities is quickly identified, providing accurate data support for generating highly accurate countermeasure strategies.

[0127] Step S505, using the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and based on the association path, integrating and obtaining the countermeasure information corresponding to the current security event data.

[0128] Specifically, the above step S505 includes:

[0129] Step S5051, using a preset similarity threshold, filter out the most similar historical attack event data set in each dimension.

[0130] Step S5052, through the A* shortest path discovery and Dijkstra shortest path discovery algorithms, the association path between the historical attack event data set of each dimension and the current security event data is mined to determine the related entities on the association path.

[0131] Step S5053, obtaining the historical countermeasure information corresponding to each relevant entity, integrating the historical countermeasure information corresponding to all relevant entities, and obtaining the countermeasure information corresponding to the current security event data.

[0132] In one example, K multi-dimensional similarity nodes for the input attack event are obtained through the knowledge graph, Node2Vec and multiple similarities. The input attack event is constrained by the K nodes in each dimension to ensure that there is a correlation among the K nodes of each type, so as to screen the output of the countermeasure method.

[0133] On the one hand, the similarities of the K entities of each entity dimension obtained in the above steps are inconsistent. For example, the smallest similarity of the K entities of the attack event is 0.81, and the smallest similarity of the K entities related to the ATTCK organization is 0.5. Here, it is necessary to set a similarity threshold for each type of entity based on historical expert experience to screen out the most similar entities in each dimension (the reason for not selecting the most similar entity is that the relationship of each type of entity needs to be mined later to generate corresponding countermeasure information, so as to avoid the situation where only one entity cannot mine the association relationship or the association relationship is abnormal due to one entity, thereby improving the robustness of the system). The setting of the similarity threshold is not limited in the present invention.

[0134] Through the entities of each dimension, the association relationship is mined, and the K entities in each type of entity and the related entities on the input event association path are mined through the A* shortest path discovery and Dijkstra shortest path discovery algorithms, and countermeasure information is output. In the case where the association relationship between the K entities in each type of entity and the related entities on the input current security event association path cannot be mined, the node with the largest similarity in each dimension is directly used to output countermeasure information.

[0135] In the case of mining the association relationship between K entities in each type of entity and the related entities on the input current security event association path, for the current security event X, the most similar entities that have a connection association relationship with the ATTCK attack organization, ATTCK attack technology, vulnerability, and attack event related entities associated with the current security event X are entity 1, entity 2, entity 3, and entity 4. From the above four entities, the countermeasure method for each entity is obtained, such as: countering the commonly used IPs of a certain organization, banning certain IPs, countering the attack technology that it uses well, detecting whether the system has loopholes in the current attack technology, etc., countering attack events. Some attack events often occur at night, and relevant personnel can be arranged to be on duty at night to capture real-time attack details.

[0136] The network attack countermeasure method provided in this embodiment realizes the dynamic embedding representation of nodes in the knowledge graph by introducing the Node2Vec algorithm, thereby capturing the potential and complex associations between different attack entities, and embedding the nodes with a random walk strategy, which not only enhances the system's understanding of the attack mode, but also enables the update of the graph embedding vector according to the constantly changing attack data, ensuring that the countermeasure plan is always consistent with the latest data. By innovatively introducing a similarity calculation algorithm, the distance measurement of the key entity embedding vector is performed through the cosine similarity algorithm or the Euclidean similarity algorithm, and the similarity of the current attack event on multiple entities is quickly identified, providing accurate data support for the generation of highly accurate countermeasure strategies.

[0137] In this embodiment, a network attack countermeasure device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0138] This embodiment provides a network attack countermeasure device, such as Figure 7 As shown, including:

[0139] The data acquisition module 701 is used to acquire historical attack event data. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0140] The knowledge graph construction module 702 is used to construct a network security knowledge graph using historical attack event data. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0141] The association mining module 703 is used to mine the associations between key entities in the historical attack event data based on the network security knowledge graph using the graph embedding algorithm. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0142] The similarity screening module 704 is used to obtain the current security event data, and use the similarity calculation algorithm to screen the association relationship to obtain the historical attack event data set with the highest similarity to the current security event data in each dimension. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0143] The countermeasure information integration module 705 is used to use the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and integrate the countermeasure information corresponding to the current security event data based on the association path. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0144] In some optional implementations, the knowledge graph construction module 702 includes:

[0145] The paradigm representation construction unit is used to construct the paradigm representation of the network security knowledge graph based on historical attack event data.

[0146] The entity recognition unit is used to use the deep learning network structure based on CRF and the embedding model to embed the historical attack event data and perform entity recognition on the historical attack event data.

[0147] The attribute extraction unit is used to use preset matching rules and combine paradigm representation to extract entities, relationships and attributes from historical attack event data, obtain entity graph representation, and form a network security knowledge graph.

[0148] In some optional implementations, the attribute extraction unit includes:

[0149] The first attribute extraction subunit is used to identify the field content of the historical attack event data when the historical attack event data is structured data, and to establish a relationship between the historical attack event data and related attack event data based on the field content.

[0150] The second attribute extraction subunit is used to perform rule matching on the historical attack event data using the paradigm representation when the historical attack event data has a preset regular rule matching.

[0151] The third attribute extraction subunit is used to perform entity recognition on the historical attack event data when the historical attack event data is not structured data and the historical attack event data has a preset regular rule match, and convert the historical attack event data into structured historical attack event data.

[0152] In some optional implementations, the association relationship mining module 703 includes:

[0153] The vector representation unit is used to perform vector representation on each key entity in the historical attack event data based on the random walk strategy using the Node2Vec algorithm to obtain the vector representation between each key entity.

[0154] The embedding representation unit is used to store the vector representation corresponding to each key entity as an attribute vector in the node of each key entity, so as to realize the mining of the association relationship between the key entities in the historical attack event data.

[0155] In some optional implementations, the similarity screening module 704 includes:

[0156] The threshold judgment unit is used to judge whether the number of nodes is greater than the number threshold, and whether the number of associated relationships of the nodes is greater than the relationship number threshold.

[0157] The cosine similarity calculation unit is used to calculate the similarity between the historical attack event data and the current security event data in each dimension according to the attribute vector using the cosine similarity calculation method when the number of nodes is greater than the number threshold and the number of associated relationships of the nodes is greater than the relationship number threshold, and screen out the historical attack event data set with the highest similarity to the current security event data in each dimension.

[0158] The distance calculation unit is used to calculate the similarity between the historical attack event data and the current security event data in each dimension according to the attribute vector using the distance calculation method when the number of nodes is not greater than the number threshold, or the number of associated relationships of the nodes is not greater than the relationship number threshold; and screen out the historical attack event data set with the highest similarity to the current security event data in each dimension.

[0159] In some optional implementations, the countermeasure information integration module 705 includes:

[0160] The similarity screening unit is used to screen and obtain the most similar historical attack event data set in each dimension by using a preset similarity threshold.

[0161] The association path mining unit is used to mine the association path between the historical attack event data set of each dimension and the current security event data through the A* shortest path discovery and Dijkstra shortest path discovery algorithms, and determine the related entities on the association path.

[0162] The countermeasure information integration unit is used to obtain the historical countermeasure information corresponding to each relevant entity, integrate the historical countermeasure information corresponding to all relevant entities, and obtain the countermeasure information corresponding to the current security event data.

[0163] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0164] The network attack countermeasure device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0165] The embodiment of the present invention also provides a computer device having the above Figure 7 The network attack countermeasure device shown.

[0166] See also Figure 8 , Figure 8 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 8 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 10 is taken as an example.

[0167] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0168] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0169] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0171] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0172] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0173] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0174] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0175] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network attack countermeasure method, characterized in that: The method comprises: Obtain historical attack event data; Using the historical attack event data, construct a network security knowledge graph; Using a graph embedding algorithm, based on the network security knowledge graph, mining the association relationship between key entities in the historical attack event data; Acquire current security event data, and use a similarity calculation algorithm to screen the association relationship to obtain a set of historical attack event data with the highest similarity to the current security event data in each dimension; The network security knowledge graph is used to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and based on the association path, the countermeasure information corresponding to the current security event data is integrated.

2. The method according to claim 1, characterized in that The method of using the historical attack event data to construct a network security knowledge graph includes: Based on the historical attack event data, construct a paradigm representation of the network security knowledge graph; Using a deep learning network structure based on CRF and combining it with an embedding model, the historical attack event data is embedded and represented, and entity recognition is performed on the historical attack event data; By using preset matching rules and combining the paradigm representation, entities, relationships and attributes of historical attack event data are extracted to obtain an entity graph representation and form the network security knowledge graph.

3. The method according to claim 2, characterized in that The method of extracting entities, relationships and attributes from historical attack event data by using preset matching rules and combining the paradigm representation includes: When the historical attack event data is structured data, identifying field content of the historical attack event data, and establishing a relationship between the historical attack event data and related attack event data based on the field content; When the historical attack event data has a preset regular rule match, using the paradigm representation to perform rule matching on the historical attack event data; When the historical attack event data is not structured data and the historical attack event data has a preset regular rule match, entity recognition is performed on the historical attack event data to convert the historical attack event data into structured historical attack event data.

4. The method according to claim 2, characterized in that: The method of using a graph embedding algorithm to mine the association relationship between key entities in the historical attack event data based on the network security knowledge graph includes: Using the Node2Vec algorithm based on the random walk strategy, vector representation is performed on each key entity in the historical attack event data to obtain vector representations between each key entity; The vector representation corresponding to each key entity is stored as an attribute vector in the node of each key entity, so as to mine the association relationship between the key entities in the historical attack event data.

5. The method according to claim 4, characterized in that The association relationships are screened to obtain a set of historical attack event data with the highest similarity to the current security event data in each dimension, including: Determine whether the number of the nodes is greater than a number threshold, and whether the number of associated relationships of the nodes is greater than a relationship number threshold; When the number of the nodes is greater than the number threshold, and the number of associated relationships of the nodes is greater than the relationship number threshold, the similarity between the historical attack event data and the current security event data in each dimension is calculated using a cosine similarity calculation method according to the attribute vector, and a historical attack event data set having the highest similarity to the current security event data in each dimension is screened out; When the number of the nodes is not greater than the number threshold, or the number of associated relationships of the nodes is not greater than the relationship number threshold, the similarity between the historical attack event data and the current security event data in each dimension is calculated using a distance calculation method based on the attribute vector; and the historical attack event data set with the highest similarity to the current security event data in each dimension is screened.

6. The method according to claim 5, characterized in that The method of using the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and integrating and obtaining the countermeasure information corresponding to the current security event data based on the association path, includes: Using the preset similarity threshold, filter out the most similar historical attack event data set in each dimension; By using the A* shortest path discovery and Dijkstra shortest path discovery algorithms, the association path between the historical attack event data set and the current security event data in each dimension is mined to determine the related entities on the association path; The historical countermeasure information corresponding to each of the related entities is obtained, and the historical countermeasure information corresponding to all the related entities is integrated to obtain the countermeasure information corresponding to the current security event data.

7. A network attack countermeasure device, characterized in that: The device comprises: A data acquisition module is used to acquire historical attack event data; A knowledge graph construction module, used to construct a network security knowledge graph using the historical attack event data; An association mining module, used to mine the association between key entities in the historical attack event data based on the network security knowledge graph using a graph embedding algorithm; A similarity screening module is used to obtain current security event data, and screen the association relationship using a similarity calculation algorithm to obtain a set of historical attack event data with the highest similarity to the current security event data in each dimension; The countermeasure information integration module is used to use the network security knowledge graph to mine the association path between the current security event data and the historical attack event data set with the highest similarity, and based on the association path, integrate the countermeasure information corresponding to the current security event data.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network attack countermeasure method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the network attack countermeasure method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the network attack countermeasure method according to any one of claims 1 to 6.

Images