Asset threat detection and analysis method and system based on attack and defense game

Abstract

The invention discloses an attack and defense game-based asset threat detection analysis method and system, and relates to the technical field of network security and threat detection, and the method comprises the steps: collecting original network flow data, and carrying out the preprocessing; constructing an attack and defense random game network model based on the preprocessed data; and performing abnormal behavior detection based on the attack and defense game model. According to the asset threat detection and analysis system based on the attack and defense game, multi-source data preprocessing, random attack and defense game model construction, integrated multi-algorithm detection and ATTamp combination are used; according to the technical scheme of the CK knowledge base, the problems that in the prior art, the asset abnormal behavior detection precision is low, the dynamic adjustment capacity is poor, and unknown threats are difficult to deal with are solved, and the effects of improving the detection efficiency and accuracy, achieving dynamic defense strategy adjustment and continuously learning novel attack means are achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security and threat detection technology, and specifically to an asset threat detection and analysis method and system based on attack and defense game. Background Art

[0002] With the widespread application of computer network technology, the information system of digital power grid has become more and more dependent on the network. However, with the expansion of network scale and exponential growth in complexity, traditional single-point detection equipment faces the challenges of single data source and limited detection methods, and it is difficult to effectively respond to increasingly complex security threats. Attacks such as system vulnerabilities and advanced persistent threats continue to emerge. Traditional detection methods based on signatures and whitelists can only identify known threats, and it is difficult to identify new and unknown attacks in a timely manner. This leads to low alarm accuracy and high false alarm rate, which in turn affects the stability and security of information systems. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is: how to use the attack and defense game model to accurately detect abnormal behavior in network traffic, and combine the ATT&CK knowledge base to effectively analyze the threats to assets, so as to solve the problems of low accuracy of abnormal behavior detection, slow response speed and inability to timely identify new threats in the prior art.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: an asset threat detection and analysis method based on attack and defense game, which comprises the following steps:

[0006] Collect raw network traffic data and pre-process it;

[0007] Construct an attack and defense random game network model based on the preprocessed data;

[0008] Abnormal behavior detection based on attack and defense game model.

[0009] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the collection of original network traffic data includes:

[0010] The acquired raw network traffic data and the ATT&CK enemy technical and tactical knowledge base are preliminarily cleaned to filter out noise data, duplicate data, and irrelevant data packets, ensure the quality and consistency of the input data, and filter through custom data rules.

[0011] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, the preprocessing includes digitizing the character features, converting the non-numeric features into numerical data, processing them using the One-hot encoding method, splitting the character features into multiple columns, each column corresponding to a category, and if the value of a column is 1, it means that the sample belongs to the category, otherwise it is 0;

[0012] Finally, normalization processing is performed to scale each standardized value to the interval [0, 1] to eliminate the influence between features. The encoded non-continuous features are combined with the retained continuous features to form a complete feature vector as the input of the abnormal behavior detection model. The preprocessed data is formatted and converted into CSV file format.

[0013] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the construction of the attack and defense random game network model based on the pre-processed data includes:

[0014] Construct an attack-defense random game network model, and simulate the interaction between attackers and defenders through equilibrium strategy calculation. The random game network model is represented by a tuple:

[0015] SGN={N,P,T,F,π,v,R,U,S0}

[0016] Where N is the set of attackers and defenders, P is the set of asset positions, T is the set of behaviors, F is the set of arcs, and π is the probability distribution function of the attacker and the player's choice of strategy. v is the set of transition response rates, R is the set of results for each transition, and U is the set of attacker utility functions and defender utility functions.

[0017] By defining the prediction vector P K and P L To define the utility functions of the attacker and defender, the attacker utility function expression is:

[0018] U K (P K ,P L )=r K (P K ,P L )+δ·U(P j )

[0019] Among them, r K (P K ,P L ) is the attacker's choice of strategy P K and the defender chooses P L The return at time δ j∈[0,1] is the discount factor, U(P j ) represents the unknown expected utility in the future;

[0020] The defender utility function expression is:

[0021] U L (P K ,P L )=r L (P K ,P L )+δ·U(P j )

[0022] Among them, r L (P K ,P L ) is the direct reward of the defender, δ j ∈[0,1] is the discount factor, U(P j ) is the defender’s utility in the future state;

[0023] Initialize the strategy selection function. The strategy selection function π(k,l) represents the probability distribution of the attacker and defender under each combination strategy. The initialization expression is:

[0024]

[0025] Among them, U(k,l) represents the utility of the current strategy combination (k,l), is the parameter that controls the strategy selection, and K is the set of behaviors selected by the attacker;

[0026] Introduce the optimization objectives of maximizing the attacker's profit and minimizing the defender's profit to obtain the game equilibrium strategy P K* , P L* The expression is:

[0027]

[0028] By calculating P K* , P L* Determine the optimal strategy and output the behavior strategies of the attacker and defender.

[0029] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, the abnormal behavior detection based on the attack and defense game model includes:

[0030] Based on the attack and defense game model, an abnormal behavior detection model is built to detect abnormal behavior assets. The abnormal behavior of assets is predicted by integrating SVM, KNN and random forest algorithms to output the ATT&CK enemy technical and tactical knowledge base;

[0031] Abnormal behavior detection of assets based on the SVM algorithm is to label the traffic data after data preprocessing, combine historical security event data and the ATT&CK enemy technical and tactical knowledge base, divide it into two categories: normal behavior and abnormal behavior, generate a labeled data set, initialize the SVM classifier, select different kernel functions and set hyperparameters, and use the training data set to train the SVM classifier. During the training process, SVM distinguishes normal and abnormal traffic by constructing the optimal hyperplane to maximize the interval between classes and minimize the classification error. After the training is completed, the kernel function training results are compared;

[0032] The model is verified on the test set by selecting the best kernel function. By comparing the predicted results with the true labels, the accuracy, precision, recall and F1 score of the model are calculated to identify abnormal behaviors in the digital power grid and determine whether they belong to the attack behaviors in the ATT&CK enemy technical and tactical knowledge base.

[0033] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the abnormal behavior detection based on the attack and defense game model also includes:

[0034] The asset abnormal behavior detection based on the KNN algorithm is to preprocess the original network traffic data, create a KNN classifier by initializing the KNeighborsClassifier class, and train the training data set through the fit(X_train,y_train) method to learn the categories of neighboring samples, select the best K value through cross-validation, and optimize the classification performance; use the optimized K value and the predict(X_test) method to predict whether the test set sample belongs to the enemy technical tactics category of the ATT&CK knowledge base;

[0035] The model performance is systematically evaluated using the F1 value, precision, and recall evaluation metrics.

[0036] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the abnormal behavior detection based on the attack and defense game model also includes:

[0037] The asset abnormal behavior detection based on the KNN algorithm is to preprocess the original network traffic data, create a KNN classifier by initializing the KNeighborsClassifier class, and train the training data set through the fit(X_train,y_train) method to learn the categories of neighboring samples, select the best K value through cross-validation, and optimize the classification performance; use the optimized K value and the predict(X_test) method to predict whether the test set sample belongs to the enemy technical tactics category of the ATT&CK knowledge base;

[0038] The model performance is systematically evaluated using the F1 value, precision, and recall evaluation metrics.

[0039] Another object of the present invention is to provide an asset threat detection and analysis system based on attack and defense game, which can realize real-time monitoring and dynamic analysis of abnormal behavior of network assets through the collaborative work of data collection and preprocessing module, attack and defense random game model construction module, abnormal behavior detection module and knowledge base update module, thereby solving the problem that the asset threat detection system in the prior art cannot effectively model attack and defense strategies and is difficult to deal with unknown threats.

[0040] In order to solve the above technical problems, the present invention provides the following technical solutions: an asset threat detection and analysis system based on attack and defense game, comprising: a data collection and preprocessing module, an attack and defense random game model construction module, an abnormal behavior detection module, and a knowledge base update module;

[0041] The data collection and preprocessing module obtains the original network traffic data, performs preliminary cleaning and preprocessing in combination with the ATT&CK enemy technical and tactical knowledge base, performs numerical processing on character features, uses the One-hot encoding method to convert character features into multi-column vectors, performs normalization processing to eliminate the influence between features, and formats the processed data into a CSV file;

[0042] The attack and defense random game model construction module constructs an attack and defense random game network model based on the preprocessed data, simulates the interaction between the attacker and the defender, uses equilibrium strategy calculation to determine the optimal behavior strategy of the attacker and the defender, and analyzes the benefits and mutual influence under different strategies through utility functions;

[0043] The abnormal behavior detection module is based on the constructed attack and defense game model, combined with an integrated algorithm to detect abnormal behavior, using the annotated historical security event data and the ATT&CK knowledge base to classify and train the traffic data, identify the abnormal behavior of assets, and evaluate whether it is an attack behavior;

[0044] The knowledge base update module is a mechanism that triggers the knowledge base update when the abnormal behavior detection module discovers new abnormal behaviors that are not included in the ATT&CK knowledge base, automatically records relevant information of the abnormal behaviors, and integrates them into the existing ATT&CK knowledge base.

[0045] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned asset threat detection and analysis method based on attack and defense game are implemented.

[0046] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned asset threat detection and analysis method based on attack and defense game.

[0047] Beneficial effects of the invention: The invention solves the problems of low accuracy in detecting abnormal asset behavior, poor dynamic adjustment capability and difficulty in dealing with unknown threats in the prior art through an asset threat detection and analysis system based on attack and defense game, using a technical solution of multi-source data preprocessing, random attack and defense game model construction, integrated multi-algorithm detection and combining with the ATT&CK knowledge base, thereby achieving the effect of improving detection efficiency and accuracy, realizing dynamic defense strategy adjustment and continuous learning of new attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0049] Figure 1 An overall flow chart of an asset threat detection and analysis method based on attack and defense game provided in the first embodiment of the present invention;

[0050] Figure 2 An architecture diagram of an asset threat detection and analysis system based on attack and defense game in an asset threat detection and analysis method based on attack and defense game provided in the first embodiment of the present invention;

[0051] Figure 3 An asset abnormal behavior detection algorithm diagram based on the SVM algorithm of an asset threat detection and analysis method based on attack and defense game provided in the first embodiment of the present invention;

[0052] Figure 4 A diagram of an asset anomaly detection algorithm based on a KNN algorithm in an asset threat detection and analysis method based on attack and defense game provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0054] Example 1, reference Figure 1 to Figure 4According to an embodiment of the present invention, a method for detecting and analyzing asset threats based on attack and defense game is provided, comprising:

[0055] The technical solution adopted by the present invention is: through the attack and defense game model and the ATT&CK enemy technical and tactical knowledge base, an asset threat detection and analysis system based on attack and defense game is constructed, aiming at comprehensive and real-time dynamic detection and analysis of the status of known and unknown threats to assets, so as to overcome the problems of insufficient alarm accuracy and high false alarm rate of traditional single-point detection equipment. The overall architecture of its detection and analysis system includes data acquisition module, attack and defense game model module, abnormal behavior detection module, evaluation and decision module, knowledge base management module and visualization layer, etc. The overall architecture of the asset threat detection system based on attack and defense game is as follows Figure 2 shown.

[0056] The specific functional steps are as follows:

[0057] 1) Data acquisition module: responsible for collecting relevant information of digital power grid network assets, including multi-source data such as equipment information, equipment operation information, network connection relationship, vulnerability information, etc., as input for the attack and defense game model.

[0058] 2) Attack and defense game model module: Build an attack and defense game model based on the collected information, present the interaction between attackers and defenders through equilibrium strategy calculation, and provide support for abnormal behavior detection.

[0059] 3) Abnormal behavior detection module: Based on the attack and defense game module, combined with the ATT&CK enemy technical and tactical knowledge base, the features are trained and predicted through SVM, KNN, and random forest algorithms.

[0060] 4) Evaluation and decision-making: Based on the above modules, the confusion matrix, accuracy, ROC curve and AUC value weighting method are used to comprehensively determine the ownership of the final assets, and make corresponding decisions on related assets.

[0061] 5) Knowledge base management module: The ATT&CK enemy technical and tactical knowledge base is imported to provide support for the anomaly analysis detection module. If the detected threat assets are determined not to belong to the knowledge base, the update mechanism is triggered to automatically update the new threat methods to this library.

[0062] 6) Data visualization layer: Generates security reports including threat detection results, attack analysis, game results, etc., providing administrators with detailed security situation information.

[0063] The asset threat detection and analysis platform based on attack and defense game adopts microservice architecture, with back-end functional components such as asset information collection and threat intelligence collection. The front-end uses Vue framework to obtain data through AJAX request interface. Each service module is deployed based on Docker container and publishes the application to the outside through Nginx reverse proxy.

[0064] The present invention constructs an asset detection model based on the attack and defense game theory. First, data related to digital power grid assets, including equipment status and operation information, are collected through network bypass listening technology. Subsequently, the collected data is preprocessed, including steps such as data cleaning, encoding and standardization. Next, an attack and defense game model is constructed to show the attack and defense interaction path, and abnormal behavior is detected using algorithms such as SVM, KNN and random forest combined with the ATT&CK enemy technical and tactical knowledge base. Finally, the detection results are analyzed through evaluation tools such as confusion matrix to determine the asset ownership and adjust the corresponding defense strategy to achieve effective monitoring and early warning of assets.

[0065] The core tasks of the data preprocessing module include two aspects: First, the original network traffic data obtained from the traffic monitoring module is normalized and structured. By effectively encoding and retaining discontinuous and continuous features, it is more suitable for the subsequent training of the random forest model and the construction of the asset abnormal behavior description model. Secondly, the features of the ATT&CK enemy technical and tactical knowledge base are processed accordingly to provide support for the subsequent asset attribution determination.

[0066] (1) Data cleaning and screening

[0067] Perform preliminary cleaning on the acquired raw network traffic data and the ATT&CK enemy technical and tactical knowledge base to filter out noise data, duplicate data, and irrelevant data packets to ensure the quality and consistency of the input data. Afterwards, users can customize data rules or screening criteria, such as using the IP address of an existing asset as the destination IP address for traffic data screening.

[0068] The key features of attack behaviors and tactics are effectively described for the ATT&CK enemy technical and tactical knowledge base, including attack phase features: initial access, execution, persistence and other related features; tool or technical features used: including specific malware families, vulnerability exploitation tools, etc.; and target asset related features: asset type, operating system version, etc.

[0069] (2) Data processing

[0070] First, the character features are digitized to convert non-numeric features into numeric data. Then, the one-hot encoding method is used to split the character features into multiple columns, each corresponding to a category. If the value of a column is 1, it means that the sample belongs to that category, otherwise it is 0. Finally, normalization is performed to scale each standardized value to the interval [0, 1] to eliminate the influence between features and ensure that the relative relationship between data is clearer, thereby improving the stability and effectiveness of the model when processing data. Assume that X ij For x ij The normalized value, the specific formula is as follows.

[0071]

[0072] Among them, x max Indicates the maximum value of all data in the current sample, x min It represents the minimum value of all data in the current sample.

[0073] (3) Data formatting and storage

[0074] The encoded discontinuous features are combined with the retained continuous features to form a complete feature vector as the input of the abnormal behavior detection model. The preprocessed data is formatted and converted into a CSV file format to ensure that it meets the input requirements of the anomaly detection model.

[0075] Construct an attack and defense random game network model, and simulate the interaction between attackers and defenders through equilibrium strategy calculation. Comprehensively consider the dynamic changes of attack and defense behaviors and strategies, form an attack and defense game scenario, and provide guidance for abnormal behavior detection, thereby improving the efficiency and accuracy of detection, and reducing the occurrence of false positives and false negatives.

[0076] Construction of attack and defense random game network model

[0077] This module builds an attack and defense random game network model, simulates the interaction between attackers and defenders through equilibrium strategy calculation, and provides support for the anomaly detection model. The random game network model is represented by a tuple:

[0078] SGN={N,P,T,F,π,v,R,U,S0}

[0079] Among them, N is the set of players, including attackers and defenders; P is the set of positions, which is associated with different security conditions of digital grid network assets; T is the set of behaviors, covering various behaviors that attackers and defenders may take in the digital grid network environment; F is the set of arcs, which describes the association between positions and behaviors; π is the weight function for selecting strategy arcs, which determines the possibility of transition; v is the set of transition response rates, which reflects the speed at which the behavior occurs; R is the set of results of each transition, which evaluates the impact of the behavior on the digital grid network assets; U is the utility function, which helps players choose the most favorable behavior;

[0080] For the above random game model, the equilibrium strategy calculation process first defines the prediction vector P K and P L To define the utility functions of the attacker and defender. The attacker utility function is as follows:

[0081] U K (P K ,P L )=r K (P K ,P L )+δ·U(P j )

[0082] where r K (P K ,P L ) is the attacker's choice of strategy P K and the defender chooses P L The return at time δ j ∈[0,1] is the discount factor, U(P j ) represents the unknown expected utility in the future. The defender’s utility function is as follows:

[0083] U L (P K ,P L )=r L (P K ,P L )+δ·U(P j )

[0084] where r L (P K ,P L ) is the direct reward of the defender, δ j ∈[0,1] is the discount factor, U(P j ) is the defender’s utility in the future state.

[0085] Next, initialize the strategy selection function. The strategy selection function π(k,l) represents the probability distribution of the attacker and defender under each combination strategy, and is initialized as follows:

[0086]

[0087] Where U(k,l) represents the utility of the current strategy combination (k,l), is the parameter that controls the strategy selection, and K is the set of behaviors selected by the attacker.

[0088] Finally, the game equilibrium strategy is obtained by introducing the optimization objectives of maximizing the attacker's profit and minimizing the defender's profit.

[0089]

[0090] In summary, through the above model, we can get To determine the optimal strategy and output the behavioral strategies of attackers and defenders, providing a basis for abnormal behavior attack and defense game behaviors.

[0091] Based on the attack and defense game model, the abnormal behavior detection model mainly detects abnormal behavior assets, and predicts whether the abnormal behavior of assets belongs to the ATT&CK enemy technical and tactical knowledge base by integrating SVM, KNN and random forest algorithms. After collecting the original flow data from the digital power grid network flow monitoring equipment, it is preprocessed, including cleaning, standardization and feature extraction, and then annotated into two categories according to historical security event data, such as belonging to the ATT&CK enemy technical and tactical knowledge base and not belonging to the ATT&CK enemy technical and tactical knowledge base. Finally, the annotated data is used to train the relevant model.

[0092] The asset abnormal behavior detection model based on the SVM algorithm includes the following steps: First, after data preprocessing, the traffic data is labeled in combination with historical security event data and the ATT&CK enemy technical and tactical knowledge base, and divided into two categories: normal behavior and abnormal behavior to generate a labeled data set. Next, initialize the SVM classifier, select different kernel functions such as linear, poly, rbf, and sigmoid, set hyperparameters, and use the training data set to train the model. During the training process, SVM distinguishes normal and abnormal traffic by constructing the optimal hyperplane to maximize the interval between classes and minimize the classification error. After the training is completed, compare the kernel function training results. Finally, the model is verified on the test set by selecting the best kernel function. By comparing the predicted results with the true labels, the model's accuracy, precision, recall rate, F1 score and other comprehensive evaluation indicators are calculated to effectively identify abnormal behaviors in digital power grids and determine whether they belong to attack behaviors in the ATT&CK enemy technical and tactical knowledge base. The specific algorithm flow chart is as follows Figure 3 shown.

[0093] The asset abnormal behavior detection process based on the KNN algorithm first preprocesses the original network traffic data, including data standardization; creates a KNN classifier by initializing the KNeighborsClassifier class, and trains the training data set through the fit(X_train, y_train) method to learn the categories of neighboring samples; then, selects the best K value through cross-validation to optimize the classification performance; uses the optimized K value and the predict(X_test) method to predict whether the test set sample belongs to the enemy technical tactics category of the ATT&CK knowledge base. Finally, the model performance is systematically evaluated through evaluation indicators such as F1 value, precision and recall rate to verify its applicability and robustness in the detection task. The specific algorithm flow chart is as above Figure 4 shown.

[0094]

[0095] The pseudo code for the implementation of the asset abnormal behavior detection algorithm based on random forest is shown above. The specific process is as follows: First, after data preprocessing, the data is labeled and divided into normal and abnormal categories. In the model training stage, the random forest classifier RF is initialized and its related parameters are set. The random forest classifier is trained using the training data sets self.X_train and self.y_train through the fit() method. During the training process, a decision tree is constructed from multiple sub-datasets with replacement, and the optimal features are selected for node splitting based on criteria such as the Gini coefficient. After the training is completed, the trained model is used to predict the test data set self.X_test, generate the prediction result predicted_rf, and evaluate the classification effect of the model by calculating the accuracy svm_accuracy. Finally, the best accuracy of the model is output through string formatting, and the model is comprehensively evaluated by combining evaluation indicators such as precision, recall, and F1 score. According to the evaluation results, the model parameters are further optimized to improve the accuracy of the classifier in abnormal behavior detection, and to determine whether the detected behavior conforms to the attack behavior category in the ATT&CK knowledge base.

[0096] When the above three algorithms are used in combination for abnormal behavior detection, when the system determines that a behavior is abnormal and the behavior is not in the ATT&CK enemy technical and tactical knowledge base, the knowledge base update mechanism will be triggered. This mechanism automatically records the relevant information of the abnormal behavior, including behavioral characteristics, potential attack intentions, attack methods and their possible impact on digital power grid network traffic. Subsequently, this information will be dynamically learned and integrated into the ATT&CK enemy technical and tactical knowledge base, thereby realizing the continuous updating and improvement of the knowledge base and enhancing the system's ability to detect unknown attack behaviors.

[0097] In the asset decision module, the traffic data is predicted through the abnormal behavior detection model built earlier to obtain the judgment results of multiple network traffic sent by each device. These results include two categories: "belonging to the ATT&CK enemy technical and tactical knowledge base" or "not belonging to the ATT&CK enemy technical and tactical knowledge base".

[0098] This model uses three model evaluation tools, namely, confusion matrix, accuracy, ROC curve and AUC value, to make weighted decisions on the prediction results. The confusion matrix is ​​a table used to evaluate the performance of a classification model. It shows the correspondence between the model prediction results and the actual results, that is.

[0099]

[0100] The confusion matrix values ​​have the following meanings.

[0101] True Positive (TP): indicates the number of positive class samples correctly predicted by the model.

[0102] False Negative (FN): Indicates the number of positive class samples that the model failed to predict correctly.

[0103] False Positive (FP): Indicates the number of negative class samples that the model incorrectly predicts as positive classes.

[0104] True Negative (TN): indicates the number of negative category samples correctly predicted by the model.

[0105] Accuracy is the most intuitive evaluation indicator, that is, the ratio of the sum of correctly predicted items and predicted items to the total number of predictions. The comprehensive accuracy is obtained by calculating the sum of the number of samples correctly predicted by the random forest, SVM and KNN algorithms and dividing it by the total number of samples. If the comprehensive accuracy is high, it means that the system has a strong ability to predict abnormal behavior and is given a higher weight in the decision-making process.

[0106]

[0107] ROC curve is a common tool for evaluating the performance of binary classification models. The frequency of true positive rate is on the vertical axis and the frequency of false positive rate is on the horizontal axis. This is used to visualize the changes in two quantities.

[0108] False positive rate: the proportion of samples that are mistakenly classified as positive.

[0109]

[0110] False negative rate: The proportion of samples that are correctly predicted to be positive among all samples that are actually positive.

[0111]

[0112] ROC curve analyzes the classification results, and the AUC value is 0.5-1. The larger the value, the better the performance. This system draws the ROC curves of random forest, SVM and KNN algorithms and calculates the AUC value. The algorithm with a large AUC value has a higher weight in the decision-making.

[0113] It is further explained that:

[0114] The present invention constructs an asset threat detection and analysis system based on attack and defense game, which collects traffic data in real time through network bypass listening, and performs preprocessing and feature extraction. The system uses an attack and defense random game model to simulate attack and defense, uses SVM, KNN and random forest models to detect abnormal behavior, and combines the ATT&CK knowledge base to achieve dynamic updates. By comprehensively evaluating the detection results, the system supports dynamic adjustment of defense strategies and has a friendly user interface. The working principles of the corresponding steps of the present invention are as follows:

[0115] 1. Data Collection

[0116] To reduce the impact on the digital power grid network, network bypass listening technology is used to copy traffic data from the network to the port of the monitoring host through a shared hub or mirror switch. This method ensures real-time and non-interference network traffic collection. The collected traffic data is then transmitted to the system processing module to provide support for subsequent analysis and threat asset identification.

[0117] 2. Data Preprocessing

[0118] The traffic data entering the system first passes through the preprocessing module. This module reads the original network traffic data, followed by feature extraction, including encoding non-continuous features such as IP addresses and network protocols, and retaining continuous features such as traffic length. Through encoding and standardization, the data is converted into a format suitable for input into the abnormal behavior detection model, thus providing a basis for the subsequent construction of the asset feature description model.

[0119] 3. Construction of attack and defense game model

[0120] By constructing an attack-defense random game network model and using equilibrium strategy calculation to simulate the interaction between attackers and defenders, the dynamic changes of attack-defense behaviors and strategies are fully considered. Finally, the optimal defense strategy is determined to provide guidance for anomaly detection, thereby improving the efficiency and accuracy of detection and enhancing the robustness of the model.

[0121] 4. Construction of abnormal behavior detection model

[0122] The preprocessed data is input into the SVM, KNN and random forest models for training. By analyzing historical network traffic data and data from the ATT&CK enemy technical and tactical knowledge base, the model learns and captures the behavioral patterns and characteristics in digital grid assets to determine whether the assets constitute historical threats or attack behaviors in the ATT&CK knowledge base. When the prediction results of the three algorithms are combined to identify a behavior as abnormal, and the behavior is not in the ATT&CK knowledge base, the system will automatically trigger the knowledge base update mechanism and record the abnormal behavior and related information.

[0123] 5. Evaluate your decision

[0124] After the asset is determined based on the above anomaly detection model, the system summarizes the results and uses the confusion matrix, accuracy, ROC curve and AUC value weighting method to comprehensively determine the final asset ownership. Users can dynamically weight the confusion matrix, accuracy, ROC curve and AUC values ​​of the three algorithms to dynamically adjust the defense strategy to help administrators optimize the asset management of the digital power grid.

[0125] 6. System Implementation

[0126] This system adopts a multi-layered architecture design, involving multiple parts such as the front-end user interface, business logic layer, and data access layer. The following is an explanation of the system implementation and its functions.

[0127] (1) Front-end UI implementation

[0128] The system front end builds the basic structure and style of the user interface based on HTML and CSS, and combines VUE and SpringBoot framework to achieve dynamic interaction to enhance the user experience. At the same time, the jQuery and Bootstrap libraries are used to simplify the front-end development process, improve development efficiency and interface responsiveness. In addition, the system uses Ajax technology to achieve asynchronous data interaction, supports POST and GET requests, ensures smooth user operation and dynamically updates page content.

[0129] (2) Business module functions

[0130] The business layer consists of multiple key modules, including the attack and defense game module, asset detection model, security response and strategy, asset management, and permission management. These modules work together to achieve efficient asset detection management and statistical report generation. The attack and defense game module is responsible for displaying the optimal strategy path for attackers and defenders, providing a theoretical basis for asset detection; the asset detection module is used to monitor assets and query related dynamic information; the security response and strategy layer takes timely response measures after asset detection. The ATT&CK enemy technical and tactical knowledge base provides support for asset detection and realizes automatic learning and updating of new threats; the permission management module ensures system security and provides corresponding access control based on user permissions.

[0131] (3) System management and services

[0132] The system also includes basic components such as account management, role allocation, data center, log center and system management, which together support the daily operation and management of the system. The log center and log service provide system monitoring and problem diagnosis functions. At the same time, the scheduled task function enables the system to automatically execute scheduled operations, thereby improving operation and maintenance efficiency.

[0133] (4) Data processing layer

[0134] The data processing layer goes through data cleaning, format conversion, preprocessing and feature extraction. In the data cleaning stage, noise, errors and duplicate data are removed to ensure the accuracy and purity of the data. Subsequently, the format conversion is performed to make the data meet the requirements of subsequent processing. The preprocessing stage performs operations such as standardization and normalization on the data to improve the availability of the data. Finally, the feature extraction stage mines out key information that can reflect the essential characteristics of the data, providing a solid data foundation for the business layer.

[0135] (4) Database layer

[0136] As the data support of the system, the data center optimizes data access speed and efficiency through technologies such as stored procedures and data caching. The system supports a variety of database technologies, including MySQL, DAMO, DM database and Oracle, to meet different data storage requirements.

[0137] Through the attack and defense game model and the ATT&CK enemy technical and tactical knowledge base, an asset threat detection and analysis system based on attack and defense game is constructed, which overcomes the defects in data collection and processing, intelligent threat asset model construction, and high false alarm rate.

[0138] Targeting the defects of data collection and processing: Due to its single data source, the scope of the collected data set is limited. Therefore, an eavesdropping device is deployed in the data collection module to monitor and collect assets such as traffic flow to achieve real-time network monitoring of the digital power grid. Through a shared hub or mirror switch, the data flow in the network is copied to the port of the monitoring host to avoid interference with network communications. At the same time, a known ATT&CK enemy technical and tactical knowledge base is built to collect attack methods and intelligence of known threat assets to meet the challenges of integrating and processing multi-source data and achieve accurate and efficient data management.

[0139] Difficulties in building threat asset models: To address the challenges in building threat asset models, based on the business characteristics of digital power grids, a random attack and defense game model is used to simulate the interaction between attackers and defenders through equilibrium strategy calculations. By comprehensively considering the diversity of attack and defense behaviors and the dynamic changes of strategies, potential threat assets can be effectively identified, thereby enhancing the overall security protection capabilities of digital power grids.

[0140] In view of the defect of high false alarm rate: When making decisions and analyzing assets, traditional systems use simple rules and manual judgment to make decisions. In this invention, based on the game process of the attack and defense game model, an abnormal analysis behavior detection model is constructed, and the abnormal behavior analysis model is trained and predicted by random forest, SVM, and KNN. Finally, the prediction results of three model evaluation tools, namely confusion matrix, accuracy, ROC curve and AUC value, are dynamically assigned and evaluated, so that users can customize the degree of certainty of the decision and provide more intelligent decision support.

[0141] To improve the user-friendliness of the system: To improve the user-friendliness of the system, we adopt native microservice architecture and containerized deployment solutions. The front-end design is reasonable, with fast and dynamic interaction functions to enhance the user experience. The business modules work well together and are easy to operate and manage. The system management functions are complete to ensure stability and monitoring. The data processing is optimized to provide high-accuracy data support, and the database design is flexible to adapt to various storage needs and meet the usage scenarios of different users.

[0142] Embodiment 2 is an embodiment of the present invention, which provides a system for asset threat detection and analysis method based on attack and defense game, including: a data collection and preprocessing module, an attack and defense random game model construction module, an abnormal behavior detection module, and a knowledge base update module;

[0143] The data collection and preprocessing module obtains the original network traffic data, performs preliminary cleaning and preprocessing in combination with the ATT&CK enemy technical and tactical knowledge base, performs numerical processing on character features, uses the One-hot encoding method to convert character features into multi-column vectors, performs normalization processing to eliminate the influence between features, and formats the processed data into a CSV file;

[0144] The attack and defense random game model construction module constructs an attack and defense random game network model based on the preprocessed data, simulates the interaction between the attacker and the defender, uses equilibrium strategy calculation to determine the optimal behavior strategy of the attacker and the defender, and analyzes the benefits and mutual influence under different strategies through utility functions;

[0145] The abnormal behavior detection module is based on the constructed attack and defense game model, combined with an integrated algorithm to detect abnormal behavior, using the annotated historical security event data and the ATT&CK knowledge base to classify and train the traffic data, identify the abnormal behavior of assets, and evaluate whether it is an attack behavior;

[0146] The knowledge base update module is a mechanism that triggers the knowledge base update when the abnormal behavior detection module discovers new abnormal behaviors that are not included in the ATT&CK knowledge base, automatically records relevant information of the abnormal behaviors, and integrates them into the existing ATT&CK knowledge base.

[0147] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0148] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0149] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0150] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0151] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An asset threat detection and analysis method based on attack and defense game, characterized in that: include: Collect raw network traffic data and perform preprocessing; Construct an attack and defense random game network model based on the preprocessed data; Abnormal behavior detection based on attack and defense game model.

2. The asset threat detection and analysis method based on attack and defense game as claimed in claim 1, characterized in that: The collection of raw network traffic data includes: The acquired raw network traffic data and the ATT&CK enemy technical and tactical knowledge base are preliminarily cleaned to filter out noise data, duplicate data, and irrelevant data packets, ensure the quality and consistency of the input data, and filter through custom data rules.

3. The asset threat detection and analysis method based on attack and defense game as claimed in claim 2, characterized in that: The preprocessing includes digitizing the character features, converting non-numeric features into numeric data, processing them using the One-hot encoding method, splitting the character features into multiple columns, each column corresponding to a category, and if the value of a column is 1, it means that the sample belongs to the category, otherwise it is 0; Finally, normalization processing is performed to scale each standardized value to the interval [0, 1] to eliminate the influence between features. The encoded non-continuous features are combined with the retained continuous features to form a complete feature vector as the input of the abnormal behavior detection model. The preprocessed data is formatted and converted into CSV file format.

4. The asset threat detection and analysis method based on attack and defense game as claimed in claim 3, characterized in that: The construction of the attack and defense random game network model based on the pre-processed data includes: Construct an attack-defense random game network model, and simulate the interaction between attackers and defenders through equilibrium strategy calculation. The random game network model is represented by a tuple: SGN={N,P,T,F,π,v,R,U,S0} Where N is the set of attackers and defenders, P is the set of asset positions, T is the set of behaviors, F is the set of arcs, and π is the probability distribution function of the attacker and the player's choice of strategy. v is the set of transition response rates, R is the set of results for each transition, and U is the set of attacker utility functions and defender utility functions. By defining the prediction vector P K and P L To define the utility functions of the attacker and defender, the attacker utility function expression is: U K (P K ,P L )=r K (P K ,P L )+δ·U(P j ) Among them, r K (P K ,P L ) is the attacker's choice of strategy P K and the defender chooses P L The return at time δ j ∈[0,1] is the discount factor, U(P j ) represents the unknown expected utility in the future; The defender utility function expression is: U L (P K ,P L )=r L (P K ,P L )+δ·U(P j ) Among them, r L (P K ,P L ) is the direct reward of the defender, δ j ∈[0,1] is the discount factor, U(P j ) is the defender’s utility in the future state; Initialize the strategy selection function. The strategy selection function π(k,l) represents the probability distribution of the attacker and defender under each combination strategy. The initialization expression is: Among them, U(k,l) represents the utility of the current strategy combination (k,l), is the parameter that controls the strategy selection, and K is the set of behaviors selected by the attacker; Introduce the optimization objectives of maximizing the attacker's profit and minimizing the defender's profit to obtain the game equilibrium strategy The expression is: By calculating Determine the optimal strategy and output the behavior strategies of the attacker and defender.

5. The asset threat detection and analysis method based on attack and defense game as claimed in claim 4, characterized in that: The abnormal behavior detection based on the attack-defense game model includes: Based on the attack and defense game model, an abnormal behavior detection model is built to detect abnormal behavior assets. The abnormal behavior of assets is predicted by integrating SVM, KNN and random forest algorithms to output the ATT&CK enemy technical and tactical knowledge base; Abnormal behavior detection of assets based on the SVM algorithm is to label the traffic data after data preprocessing, combine historical security event data and the ATT&CK enemy technical and tactical knowledge base, divide it into two categories: normal behavior and abnormal behavior, generate a labeled data set, initialize the SVM classifier, select different kernel functions and set hyperparameters, and use the training data set to train the SVM classifier. During the training process, SVM distinguishes normal and abnormal traffic by constructing the optimal hyperplane to maximize the interval between classes and minimize the classification error. After the training is completed, the kernel function training results are compared; The model is verified on the test set by selecting the best kernel function. By comparing the predicted results with the true labels, the accuracy, precision, recall and F1 score of the model are calculated to identify abnormal behaviors in the digital power grid and determine whether they belong to the attack behaviors in the ATT&CK enemy technical and tactical knowledge base.

6. The asset threat detection and analysis method based on attack and defense game as claimed in claim 5, characterized in that: The abnormal behavior detection based on the attack and defense game model also includes: The asset abnormal behavior detection based on the KNN algorithm is to preprocess the original network traffic data, create a KNN classifier by initializing the KNeighborsClassifier class, and train the training data set through the fit(X_train,y_train) method to learn the categories of neighboring samples, select the best K value through cross-validation, and optimize the classification performance; use the optimized K value and the predict(X_test) method to predict whether the test set sample belongs to the enemy technical tactics category of the ATT&CK knowledge base; The model performance is systematically evaluated using the F1 value, precision, and recall evaluation metrics.

7. The asset threat detection and analysis method based on attack and defense game as claimed in claim 6, characterized in that: The abnormal behavior detection based on the attack and defense game model also includes: The asset abnormal behavior detection based on random forest is to label the data after data preprocessing, divide it into normal and abnormal categories, initialize the random forest classifier RF, and set its related parameters. Through the fit() method, the training data sets self.X_train and self.y_train are used to train the random forest classifier. During the training process, a decision tree is constructed from multiple sub-datasets with replacement, and the optimal features are selected for node splitting based on criteria such as the Gini coefficient. Predict the test data set self.X_test, generate the prediction result predicted_rf, and evaluate the classification effect of the model by calculating the accuracy svm_accuracy. Output the best accuracy of the model through string formatting, and conduct a comprehensive evaluation based on the precision, recall and F1 score evaluation indicators. According to the evaluation results, further optimize the model parameters and determine whether the detected behavior conforms to the attack behavior category in the ATT&CK knowledge base. The SVM, KNN and random forest algorithms are used to predict abnormal asset behavior detection. When a behavior is determined to be abnormal and the current behavior is not in the ATT&CK enemy technical and tactical knowledge base, the knowledge base update mechanism will be triggered to automatically record the relevant information of the abnormal behavior and integrate it into the ATT&CK enemy technical and tactical knowledge base.

8. A system using an asset threat detection and analysis method based on attack and defense game as claimed in any one of claims 1 to 7, characterized in that: It includes data collection and preprocessing module, attack and defense random game model construction module, abnormal behavior detection module, and knowledge base update module; The data collection and preprocessing module obtains the original network traffic data, performs preliminary cleaning and preprocessing in combination with the ATT&CK enemy technical and tactical knowledge base, performs numerical processing on character features, uses the One-hot encoding method to convert character features into multi-column vectors, performs normalization processing to eliminate the influence between features, and formats the processed data into a CSV file; The attack and defense random game model construction module constructs an attack and defense random game network model based on the preprocessed data, simulates the interaction between the attacker and the defender, uses equilibrium strategy calculation to determine the optimal behavior strategy of the attacker and the defender, and analyzes the benefits and mutual influence under different strategies through utility functions; The abnormal behavior detection module is based on the constructed attack and defense game model, combined with an integrated algorithm to detect abnormal behavior, using the annotated historical security event data and the ATT&CK knowledge base to classify and train the traffic data, identify the abnormal behavior of assets, and evaluate whether it is an attack behavior; The knowledge base update module is a mechanism that triggers the knowledge base update when the abnormal behavior detection module discovers new abnormal behaviors that are not included in the ATT&CK knowledge base, automatically records relevant information of the abnormal behaviors, and integrates them into the existing ATT&CK knowledge base.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of an asset threat detection and analysis method based on attack and defense game described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of an asset threat detection and analysis method based on attack and defense game described in any one of claims 1 to 7 are implemented.

Images