An asset threat detection analysis method and system based on attack and defense game

Abstract

The application discloses an asset threat detection and analysis method and system based on attack and defense game, relates to the technical field of network security and threat detection, and comprises the following steps: collecting original network flow data and performing pretreatment; constructing an attack and defense random game network model based on the pretreated data; and performing abnormal behavior detection based on the attack and defense game model. Through the asset threat detection and analysis system based on the attack and defense game, the technical scheme of using multi-source data pretreatment, constructing a random attack and defense game model, integrating multi-algorithm detection, and combining an ATT&CK knowledge base, the problems of low asset abnormal behavior detection precision, poor dynamic adjustment capability and difficulty in coping with unknown threats in the prior art are solved, and the effects of improving detection efficiency and accuracy, realizing dynamic defense strategy adjustment and continuously learning new attack means are achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security and threat detection technology, and in particular to an asset threat detection and analysis method and system based on attack and defense game. Background Art

[0002] With the widespread adoption of computer network technology, the digital power grid's information systems are becoming increasingly dependent on the network. However, as networks expand in size and complexity, traditional single-point detection equipment faces challenges with a single data source and limited detection methods, making it difficult to effectively address increasingly complex security threats. Attacks such as system vulnerabilities and advanced persistent threats continue to emerge. Traditional signature- and whitelist-based detection methods can only identify known threats and struggle to promptly identify new and unknown attacks. This results in low alert accuracy and high false alarm rates, which in turn impacts the stability and security of information systems. Summary of the Invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is: how to use the attack and defense game model to accurately detect abnormal behavior in network traffic, and combine it with the ATT&CK knowledge base to effectively analyze the threats to assets, so as to solve the problems of low accuracy in abnormal behavior detection, slow response speed and inability to timely identify new threats in the existing technology.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: an asset threat detection and analysis method based on attack and defense game, which includes the following steps:

[0006] Collect raw network traffic data and perform preprocessing;

[0007] Construct an attack and defense random game network model based on the preprocessed data;

[0008] Abnormal behavior detection based on attack and defense game model.

[0009] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the collection of original network traffic data includes:

[0010] Perform preliminary cleaning on the acquired raw network traffic data and the ATT&CK enemy technical and tactical knowledge base to filter out noise data, duplicate data, and irrelevant data packets, ensure the quality and consistency of the input data, and filter it using custom data rules.

[0011] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, the preprocessing includes digitizing character features, converting non-numeric features into numeric data, processing using a one-hot encoding method, splitting the character features into multiple columns, each column corresponding to a category, and if the value of a column is 1, it means that the sample belongs to that category, otherwise it is 0;

[0012] Finally, normalization is performed to scale each standardized value to the interval [0, 1] to eliminate the influence between features. The encoded non-continuous features are combined with the retained continuous features to form a complete feature vector, which serves as the input of the abnormal behavior detection model. The preprocessed data is formatted and converted into CSV file format.

[0013] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the construction of the attack and defense random game network model based on the pre-processed data includes:

[0014] Construct an attack-defense random game network model, and simulate the interaction between attackers and defenders through equilibrium strategy calculation. The random game network model is represented by a tuple:

[0015] SGN={N,P,T,F,π,v,R,U,S0}

[0016] Where N is the set of attackers and defenders, P is the set of asset positions, T is the set of behaviors, F is the set of arcs, and π is the probability distribution function of the attacker and player's choice of strategy. v is the set of transition response rates, R is the set of results for each transition, and U is the set of attacker utility functions and defender utility functions.

[0017] By defining the prediction vector P K and P L To define the utility functions of the attacker and defender, the attacker's utility function expression is:

[0018] U K (P K ,P L )=r K (P K ,P L )+δ·U(P j )

[0019] Among them, r K (P K ,P L ) is the attacker's choice of strategy P K and the defender chooses P L The return, δ j∈[0,1] is the discount coefficient, U(P j ) represents the unknown expected utility in the future;

[0020] The defender's utility function expression is:

[0021] U L (P K ,P L )=r L (P K ,P L )+δ·U(P j )

[0022] Among them, r L (P K ,P L ) is the defender’s direct reward, δ j ∈[0,1] is the discount coefficient, U(P j ) is the defender's utility in the future state;

[0023] Initialize the strategy selection function. The strategy selection function π(k,l) represents the probability distribution of the attacker and defender's choices under each combination strategy. The initialization expression is:

[0024]

[0025] Among them, U(k,l) represents the utility of the current strategy combination (k,l), is the parameter that controls the strategy selection, and K is the set of behaviors selected by the attacker;

[0026] Introducing the optimization objectives of maximizing the attacker's profit and minimizing the defender's profit to obtain the game equilibrium strategy P K* , P L* The expression is:

[0027]

[0028] By calculating P K* , P L* Determine the optimal strategy and output the behavioral strategies of the attacker and defender.

[0029] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, the abnormal behavior detection based on the attack and defense game model includes:

[0030] Based on the attack and defense game model, an abnormal behavior detection model is built to detect abnormal behavior assets. By integrating SVM, KNN and random forest algorithms, abnormal asset behavior is predicted and output to the ATT&CK enemy technical and tactical knowledge base.

[0031] Abnormal asset behavior detection based on the SVM algorithm involves preprocessing data, combining historical security event data with the ATT&CK enemy technical and tactical knowledge base, to label traffic data, classifying it into normal and abnormal behavior. This generates a labeled dataset, initializes the SVM classifier, selects different kernel functions, and sets hyperparameters. The SVM classifier is then trained using the training dataset. During training, the SVM constructs an optimal hyperplane to distinguish normal from abnormal traffic, maximizing the inter-class separation and minimizing classification error. After training, the kernel function training results are compared.

[0032] The model is validated on the test set by selecting the best kernel function. By comparing the predicted results with the true labels, the model's accuracy, precision, recall, and F1 score are calculated to identify abnormal behaviors in the digital power grid and determine whether they belong to attack behaviors in the ATT&CK enemy technical and tactical knowledge base.

[0033] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the abnormal behavior detection based on the attack and defense game model also includes:

[0034] The KNN algorithm-based asset abnormal behavior detection preprocesses raw network traffic data. A KNN classifier is created by initializing the KNeighborsClassifier class. The training dataset is trained using the fit(X_train, y_train) method to learn the categories of neighboring samples. The optimal K value is selected through cross-validation to optimize classification performance. The optimized K value is then used with the predict(X_test) method to predict whether the test set sample belongs to the enemy technique and tactics category in the ATT&CK knowledge base.

[0035] The model performance is systematically evaluated using F1 value, precision and recall evaluation indicators.

[0036] As a preferred solution of the asset threat detection and analysis method based on attack and defense game described in the present invention, wherein: the abnormal behavior detection based on the attack and defense game model also includes:

[0037] The KNN algorithm-based asset abnormal behavior detection preprocesses raw network traffic data. A KNN classifier is created by initializing the KNeighborsClassifier class. The training dataset is trained using the fit(X_train, y_train) method to learn the categories of neighboring samples. The optimal K value is selected through cross-validation to optimize classification performance. The optimized K value is then used with the predict(X_test) method to predict whether the test set sample belongs to the enemy technique and tactics category in the ATT&CK knowledge base.

[0038] The model performance is systematically evaluated using F1 value, precision and recall evaluation indicators.

[0039] Another object of the present invention is to provide an asset threat detection and analysis system based on attack and defense game, which can realize real-time monitoring and dynamic analysis of abnormal behavior of network assets through the collaborative work of data collection and preprocessing module, attack and defense random game model construction module, abnormal behavior detection module and knowledge base update module, thereby solving the problem that asset threat detection systems in the existing technology cannot effectively model attack and defense strategies and have difficulty in responding to unknown threats.

[0040] To solve the above technical problems, the present invention provides the following technical solutions: an asset threat detection and analysis system based on attack and defense game, comprising: a data collection and preprocessing module, an attack and defense random game model construction module, an abnormal behavior detection module, and a knowledge base update module;

[0041] The data collection and preprocessing module obtains raw network traffic data, performs preliminary cleaning and preprocessing based on the ATT&CK enemy technical and tactical knowledge base, digitizes character features, converts character features into multi-column vectors using the one-hot encoding method, and performs normalization to eliminate the influence of features. The processed data is then formatted into a CSV file.

[0042] The attack-defense random game model construction module constructs an attack-defense random game network model based on preprocessed data, simulates the interaction between attackers and defenders, uses equilibrium strategy calculation to determine the optimal behavior strategies of attackers and defenders, and analyzes the benefits and mutual influence under different strategies through utility functions;

[0043] The abnormal behavior detection module is based on the established attack and defense game model and combines integrated algorithms to detect abnormal behavior. It uses annotated historical security event data and the ATT&CK knowledge base to classify and train traffic data, identify abnormal asset behavior, and assess whether it is an attack behavior.

[0044] The knowledge base update module is a mechanism that triggers the knowledge base update when the abnormal behavior detection module discovers new abnormal behavior that is not included in the ATT&CK knowledge base, automatically records relevant information about the abnormal behavior, and integrates it into the existing ATT&CK knowledge base.

[0045] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned asset threat detection and analysis method based on attack and defense game are implemented.

[0046] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned asset threat detection and analysis method based on attack and defense game.

[0047] Beneficial effects of the present invention: The present invention solves the problems of low accuracy in asset abnormal behavior detection, poor dynamic adjustment capabilities, and difficulty in responding to unknown threats in the existing technology through an asset threat detection and analysis system based on attack and defense game, using multi-source data preprocessing, random attack and defense game model construction, integrated multi-algorithm detection, and a technical solution combined with the ATT&CK knowledge base. It achieves the effects of improving detection efficiency and accuracy, realizing dynamic defense strategy adjustment, and continuously learning new attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort. Among them:

[0049] Figure 1 This is an overall flow chart of an asset threat detection and analysis method based on attack and defense game provided by the first embodiment of the present invention;

[0050] Figure 2 This is an architecture diagram of an asset threat detection and analysis system based on attack and defense game in an asset threat detection and analysis method based on attack and defense game provided by the first embodiment of the present invention;

[0051] Figure 3 This is a diagram of an asset abnormal behavior detection algorithm based on an attack-defense game-based asset threat detection and analysis method provided by the first embodiment of the present invention;

[0052] Figure 4 This is a diagram of an asset anomaly detection algorithm based on the KNN algorithm in an asset threat detection and analysis method based on attack and defense game provided by the first embodiment of the present invention. DETAILED DESCRIPTION

[0053] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0054] Example 1, with reference to Figures 1 to 4According to one embodiment of the present invention, a method for detecting and analyzing asset threats based on attack and defense game is provided, comprising:

[0055] The technical solution adopted by this invention is to build an asset threat detection and analysis system based on attack and defense game model and ATT&CK enemy technical tactics knowledge base, aiming to comprehensively and dynamically detect and analyze the status of known and unknown threats to assets in real time, so as to overcome the problems of insufficient alarm accuracy and high false alarm rate of traditional single-point detection equipment. The overall architecture of its detection and analysis system includes data acquisition module, attack and defense game model module, abnormal behavior detection module, evaluation and decision module, knowledge base management module and visualization layer. The overall architecture of the asset threat detection system based on attack and defense game is as follows: Figure 2 shown.

[0056] The specific functional steps are as follows:

[0057] 1) Data acquisition module: Responsible for collecting relevant information of digital grid network assets, including multi-source data such as device information, device operation information, network connection relationships, vulnerability information, etc., as input for the attack and defense game model.

[0058] 2) Attack and Defense Game Model Module: Builds an attack and defense game model based on the collected information, presents the interaction between attackers and defenders through equilibrium strategy calculation, and provides support for abnormal behavior detection.

[0059] 3) Abnormal behavior detection module: Based on the attack and defense game module and combined with the ATT&CK enemy technical and tactical knowledge base, features are trained and predicted using the SVM, KNN, and random forest algorithms.

[0060] 4) Evaluation and decision-making: Based on the above modules, the confusion matrix, accuracy, ROC curve and AUC value weighting method are used to comprehensively determine the ownership of the final assets and make corresponding decisions on related assets.

[0061] 5) Knowledge base management module: The ATT&CK enemy technical and tactical knowledge base is imported to provide support for the anomaly analysis and detection module. If the detected threat asset is determined not to belong to the knowledge base, the update mechanism is triggered to automatically update the new threat method to this library.

[0062] 6) Data visualization layer: Generates security reports including threat detection results, attack analysis, game results, etc., providing administrators with detailed security situation information.

[0063] The asset threat detection analysis platform based on attack-defense game adopts a micro-service architecture. The backend functional components such as asset information collection and threat intelligence collection. The front end uses the Vue framework to obtain data through AJAX request interfaces. Each service module is deployed based on a Docker container and published externally through Nginx reverse proxy.

[0064] The application constructs an asset detection model based on attack-defense game theory. First, network bypass listening technology is used to collect data related to digital power grid assets, including device status and operation information. Then, the collected data is preprocessed, including data cleaning, encoding and standardization. Next, an attack-defense game model is constructed to show the attack-defense interaction path, and algorithms such as SVM, KNN and random forest are used to detect abnormal behavior in combination with the ATT&CK enemy technology and tactics knowledge base. Finally, the detection results are analyzed using evaluation tools such as confusion matrix to determine asset ownership and adjust the corresponding defense strategy, achieving effective monitoring and early warning of assets.

[0065] The core task of the data preprocessing module includes two aspects: first, the raw network traffic data obtained from the traffic listening module is standardized and structured. Through effective coding and preservation of non-continuous and continuous features, it is more suitable for subsequent random forest model training and asset anomaly behavior description model construction. Second, the features of the ATT&CK enemy technology and tactics knowledge base are processed accordingly to support subsequent asset ownership determination.

[0066] (1) Data cleaning and filtering

[0067] The obtained raw network traffic data and the ATT&CK enemy technology and tactics knowledge base are preliminarily cleaned to filter out noise data, duplicate data and irrelevant data packets, ensuring the quality and consistency of the input data. After that, users can customize data rules or filtering standards, such as filtering traffic data with the IP address of existing assets as the destination IP address.

[0068] The ATT&CK enemy technology and tactics knowledge base effectively describes the key features of attack behavior and tactics. Including attack phase features: initial access, execution, persistence, etc. Related features; tool or technology features used: including specific malware families, vulnerability exploitation tools, etc.; and target asset-related features: asset type, operating system version, etc.

[0069] (2) Data processing

[0070] First, the character features are digitized, converting non-numeric features into numerical data. Then, the one-hot encoding method is used to split the character features into multiple columns, each corresponding to a category. If the value of a column is 1, it means that the sample belongs to that category, otherwise it is 0. Finally, normalization is performed to scale each standardized value to the range [0, 1] to eliminate the influence of features and ensure that the relative relationship between data is clearer, thereby improving the stability and effectiveness of the model when processing data. Assume that X ij is x ij The normalized value, the specific formula is as follows.

[0071]

[0072] Among them, x max Indicates the maximum value of all data in the current sample, x min It represents the minimum value of all data in the current sample.

[0073] (3) Data formatting and storage

[0074] The encoded discontinuous features are combined with the retained continuous features to form a complete feature vector, which serves as the input for the anomaly detection model. The preprocessed data is formatted and converted into a CSV file to ensure that it meets the input requirements of the anomaly detection model.

[0075] We construct a randomized attack-defense game network model, simulating the interaction between attackers and defenders through equilibrium strategy calculations. By comprehensively considering the dynamic changes in attack and defense behaviors and strategies, we develop an attack-defense game scenario, providing guidance for abnormal behavior detection, thereby improving detection efficiency and accuracy and reducing false positives and missed detections.

[0076] Construction of attack and defense random game network model

[0077] This module builds an attack-defense random game network model and simulates the interaction between attackers and defenders through equilibrium strategy calculation to provide support for the anomaly detection model. The random game network model is represented by a tuple as follows:

[0078] SGN={N,P,T,F,π,v,R,U,S0}

[0079] Where N is the set of players, including attackers and defenders; P is the set of locations, associated with different security conditions of digital grid network assets; T is the set of behaviors, covering various behaviors that attackers and defenders may take in the digital grid network environment; F is the set of arcs, describing the association between locations and behaviors; π is the weight function for selecting strategy arcs, which determines the probability of transition; v is the set of transition response rates, reflecting the speed at which the behavior occurs; R is the set of results for each transition, evaluating the impact of the behavior on the digital grid network assets; U is the utility function, which helps players choose the most advantageous behavior.

[0080] For the above random game model, the equilibrium strategy calculation process first defines the prediction vector P K and P L To define the utility functions of attacker and defender. The attacker utility function is as follows:

[0081] U K (P K ,P L )=r K (P K ,P L )+δ·U(P j )

[0082] where r K (P K ,P L ) is the attacker's choice of strategy P K and the defender chooses P L The return, δ j ∈[0,1] is the discount coefficient, U(P j ) represents the unknown expected utility in the future. The defender’s utility function is as follows:

[0083] U L (P K ,P L )=r L (P K ,P L )+δ·U(P j )

[0084] where r L (P K ,P L ) is the defender’s direct reward, δ j ∈[0,1] is the discount coefficient, U(P j ) is the defender's utility in the future state.

[0085] Next, we initialize the strategy selection function. The strategy selection function π(k,l) represents the probability distribution of the attacker and defender's choices under each strategy combination, and is initialized as follows:

[0086]

[0087] where U(k, l) represents the utility of the current strategy combination (k, l), is the parameter of control strategy selection, and K is the set of attacker's choice behavior.

[0088] Finally, the optimal strategy is obtained by introducing the optimization objectives of maximizing the attacker's revenue and minimizing the defender's revenue

[0089]

[0090] In summary, the optimal strategy is determined by the above model and the behavior strategies of the attacker and the defender are outputted, providing a basis for the attack-defense game behavior of abnormal behavior.

[0091] Based on the attack-defense game model, the abnormal behavior detection model mainly detects abnormal behavior assets, and applies prediction algorithms such as SVM, KNN and random forest to determine whether the abnormal behavior of assets belongs to the ATT&CK enemy technology and tactics knowledge base. After collecting the original flow data from the digital power grid network flow monitoring equipment, preprocessing is performed, including cleaning, standardization and feature extraction, then according to the historical security event data, etc. are labeled as belonging to the ATT&CK enemy technology and tactics knowledge base and not belonging to the ATT&CK enemy technology and tactics knowledge base, and finally the labeled data is used to train the related model.

[0092] The asset abnormal behavior detection model based on SVM algorithm includes the following steps: first, after data preprocessing, combined with historical security event data and ATT&CK enemy technology and tactics knowledge base, the flow data is labeled and divided into normal behavior and abnormal behavior, and a labeled data set is generated. Next, initialize the SVM classifier, select different kernel functions linear, poly, rbf, sigmoid, and set the hyperparameters, and use the training data set to train the model. In the training process, SVM distinguishes between normal and abnormal flow by constructing an optimal hyperplane to maximize the interval between classes and minimize classification error. After training, compare the kernel function training results. Finally, use the selected best kernel function to validate the model on the test set, compare the prediction results with the true labels, and calculate the accuracy, precision, recall and F1 score of the model. Comprehensive evaluation indicators, such as to effectively identify abnormal behavior in the digital power grid, and determine whether it belongs to the attack behavior in the ATT&CK enemy technology and tactics knowledge base, the specific algorithm flow chart is as follows Figure 3 .

[0093] The asset abnormal behavior detection process based on the KNN algorithm first preprocesses the original network traffic data, including data standardization; creates a KNN classifier by initializing the KNeighborsClassifier class, and trains the training data set through the fit(X_train, y_train) method to learn the categories of neighboring samples; then, selects the best K value through cross-validation to optimize the classification performance; uses the optimized K value and the predict(X_test) method to predict whether the test set sample belongs to the enemy technical tactics category of the ATT&CK knowledge base. Finally, the model performance is systematically evaluated through evaluation indicators such as F1 value, precision and recall rate to verify its applicability and robustness in the detection task. The specific algorithm flow chart is as above Figure 4 shown.

[0094]

[0095] The pseudocode for implementing the random forest-based asset anomaly behavior detection algorithm is shown above. The specific process is as follows: First, after data preprocessing, the data is labeled and classified into normal and abnormal categories. During the model training phase, the random forest classifier (RF) is initialized and its parameters are set. Using the fit() method, the random forest classifier is trained using the training datasets self.X_train and self.y_train. During training, a decision tree is constructed from multiple subsets of the dataset using replacement, and the optimal features are selected for node splitting based on criteria such as the Gini coefficient. After training, the trained model is used to predict the test dataset self.X_test, generating the predicted result predicted_rf. The model's classification performance is evaluated by calculating the accuracy score svm_accuracy. Finally, the model's optimal accuracy is output via string formatting, and the model is comprehensively evaluated using metrics such as precision, recall, and F1 score. Based on the evaluation results, the model parameters are further optimized to improve the classifier's accuracy in anomaly detection and determine whether the detected behavior matches the attack behavior categories in the ATT&CK knowledge base.

[0096] When the three algorithms described above are combined for abnormal behavior detection, if the system determines a behavior to be abnormal and not included in the ATT&CK adversary techniques and tactics knowledge base, an update mechanism for the knowledge base will be triggered. This mechanism automatically records relevant information about the abnormal behavior, including behavioral characteristics, potential attack intent, attack methods, and the possible impact on digital power grid network traffic. This information is then dynamically learned and integrated into the ATT&CK adversary techniques and tactics knowledge base, enabling continuous updating and improvement of the knowledge base and enhancing the system's detection capabilities for unknown attack behaviors.

[0097] In the asset decision module, the previously constructed abnormal behavior detection model is used to predict traffic data and obtain judgment results for multiple network traffic flows sent by each device. These results are classified as either "belonging to the ATT&CK adversary techniques and tactics knowledge base" or "not belonging to the ATT&CK adversary techniques and tactics knowledge base."

[0098] This model uses three model evaluation tools: confusion matrix, accuracy, ROC curve, and AUC value to make weighted decisions on prediction results. The confusion matrix is ​​a table used to evaluate the performance of a classification model. It shows the correspondence between the model's predictions and the actual results.

[0099]

[0100] The confusion matrix values ​​have the following meanings.

[0101] True Positive (TP): Indicates the number of positive class samples correctly predicted by the model.

[0102] False Negative (FN): Indicates the number of positive class samples that the model failed to predict correctly.

[0103] False Positive (FP): Indicates the number of negative class samples that the model incorrectly predicts as positive classes.

[0104] True Negative (TN): Indicates the number of negative category samples correctly predicted by the model.

[0105] Accuracy is the most intuitive evaluation metric, representing the ratio of correctly predicted items to incorrect items to the total number of predicted items. The overall accuracy is calculated by summing the number of samples correctly predicted by the Random Forest, SVM, and KNN algorithms and dividing it by the total number of samples. A high overall accuracy indicates a strong predictive ability for abnormal behavior, giving it a higher weight in the decision-making process.

[0106]

[0107] The ROC curve is a common tool for evaluating the performance of binary classification models. The true positive rate is plotted on the vertical axis, while the false positive rate is plotted on the horizontal axis. This is used to visualize the changes in these two quantities.

[0108] False positive rate: the proportion of samples that are mistakenly classified as positive.

[0109]

[0110] False negative rate: The proportion of samples that are correctly predicted to be positive among all samples that are actually positive.

[0111]

[0112] ROC curves analyze classification results, with an AUC value ranging from 0.5 to 1, where a larger value indicates better performance. This system plots ROC curves for random forest, SVM, and KNN algorithms and calculates their AUC values. Algorithms with larger AUC values ​​are given greater weight in the decision-making process.

[0113] It should be further explained that:

[0114] This paper constructs an asset threat detection and analysis system based on attack-defense game theory. This system collects real-time traffic data through network bypass interception, performs preprocessing, and extracts features. The system uses a randomized attack-defense game model to simulate attacks and defenses, utilizes support vector machines (SVMs), k-NNs, and random forest models to detect abnormal behavior, and integrates the ATT&CK knowledge base for dynamic updates. By comprehensively evaluating detection results, the system supports dynamic adjustment of defense strategies and features a user-friendly interface. The corresponding steps of this paper operate as follows:

[0115] 1. Data Collection

[0116] To minimize the impact on the digital power grid, network bypass listening technology is employed. Traffic data is copied from the network to the monitoring host's port via a shared hub or mirrored switch. This ensures real-time, non-intrusive network traffic collection. The collected traffic data is then transmitted to the system processing module, supporting subsequent analysis and threat asset identification.

[0117] 2. Data Preprocessing

[0118] Traffic data entering the system first passes through the preprocessing module. This module reads the raw network traffic data and then performs feature extraction, including encoding non-continuous features such as IP addresses and network protocols, while retaining continuous features such as traffic length. Through encoding and standardization, the data is converted into a format suitable for input into the anomaly detection model, providing a foundation for the subsequent construction of the asset characterization model.

[0119] 3. Construction of attack and defense game model

[0120] By constructing a randomized attack-defense game network model and employing equilibrium strategy calculation to simulate the interaction between attackers and defenders, the paper comprehensively considers the dynamic changes in attack and defense behaviors and strategies. Ultimately, the paper determines the optimal defense strategy to guide anomaly detection, thereby improving detection efficiency and accuracy and enhancing the robustness of the model.

[0121] 4. Abnormal behavior detection model construction

[0122] The preprocessed data is fed into the SVM, KNN, and random forest models for training. By analyzing historical network traffic data and data from the ATT&CK adversary tactics and techniques knowledge base, the models learn and capture behavioral patterns and characteristics of digital grid assets to determine whether an asset poses a historical threat or an attack behavior listed in the ATT&CK knowledge base. If the combined predictions of the three algorithms identify a behavior as anomalous and that behavior is not included in the ATT&CK knowledge base, the system automatically triggers a knowledge base update mechanism and records the anomalous behavior and related information.

[0123] 5. Evaluate Decisions

[0124] After determining an asset based on the aforementioned anomaly detection model, the system summarizes these results and uses the confusion matrix, accuracy, ROC curve, and AUC values ​​to comprehensively determine the final asset ownership. Users can dynamically assign weights based on the confusion matrix, accuracy, ROC curve, and AUC values ​​of the three algorithms to dynamically adjust defense strategies, helping administrators optimize digital grid asset management.

[0125] 6. System Implementation

[0126] This system adopts a multi-layered architecture design, involving multiple parts such as the front-end user interface, business logic layer, and data access layer. The following is an explanation of the system implementation and its functions.

[0127] (1) Front-end UI implementation

[0128] The system's front-end uses HTML and CSS to build the user interface's infrastructure and styles, integrating VUE and the Spring Boot framework to enable dynamic interaction and enhance the user experience. Furthermore, the jQuery and Bootstrap libraries streamline the front-end development process, improving development efficiency and interface responsiveness. Furthermore, the system utilizes Ajax technology for asynchronous data interaction, supporting both POST and GET requests, ensuring smooth user operation and dynamic page updates.

[0129] (2) Business module functions

[0130] The business layer consists of several key modules, including the Attack and Defense Game Module, an asset detection model, security response and strategy, asset management, and permissions management. These modules work together to achieve efficient asset detection management and statistical report generation. The Attack and Defense Game Module demonstrates the optimal strategic paths for attackers and defenders, providing a theoretical basis for asset detection. The Asset Detection Module monitors assets and retrieves relevant dynamic information. The Security Response and Strategy Layer implements timely response measures after asset detection. The ATT&CK Adversary Techniques and Tactics Knowledge Base supports asset detection and enables automatic learning and updating of new threats. The Permission Management Module ensures system security and provides access control based on user permissions.

[0131] (3) System management and services

[0132] The system also includes foundational components such as account management, role assignment, data center, log center, and system management, which together support the system's daily operations and management. The log center and log service provide system monitoring and problem diagnosis capabilities. Furthermore, the scheduled task feature enables the system to automatically execute scheduled operations, thereby improving operational efficiency.

[0133] (4) Data processing layer

[0134] The data processing layer goes through steps such as data cleaning, format conversion, preprocessing, and feature extraction. During the data cleaning phase, noise, errors, and duplicate data are removed to ensure data accuracy and purity. Subsequently, format conversion is performed to ensure the data meets subsequent processing requirements. The preprocessing phase performs operations such as standardization and normalization on the data to improve data usability. Finally, the feature extraction phase uncovers key information that reflects the essential characteristics of the data, providing a solid data foundation for the business layer.

[0135] (4) Database layer

[0136] As the data support for the system, the data center optimizes data access speed and efficiency through technologies such as stored procedures and data caching. The system supports multiple database technologies, including MySQL, DM Database, and Oracle, to meet different data storage requirements.

[0137] Through the attack and defense game model and the ATT&CK enemy technical and tactical knowledge base, an asset threat detection and analysis system based on attack and defense game is constructed, which overcomes the defects in data collection and processing, the construction of intelligent threat asset models, and the high false alarm rate.

[0138] To address shortcomings in data collection and processing: Due to a single data source, the scope of the collected data set is limited. Therefore, eavesdropping devices are deployed within the data collection module to monitor and collect data, such as traffic flow, enabling real-time network monitoring of the digital power grid. Through shared hubs or mirrored switches, data flows within the network are replicated to ports on the monitoring host, preventing interference with network communications. Furthermore, a knowledge base of known ATT&CK enemy techniques and tactics is built to collect attack methods and intelligence on known threat assets. This addresses the challenges of integrating and processing multi-source data, enabling accurate and efficient data management.

[0139] Addressing the challenges of building a threat asset model: Based on the business characteristics of digital power grids, this approach employs a stochastic attack-defense game model, simulating the interaction between attackers and defenders through equilibrium strategy calculations. By comprehensively considering the diversity of attack and defense behaviors and the dynamic changes in strategies, potential threat assets can be effectively identified, thereby enhancing the overall security protection capabilities of the digital power grid.

[0140] Addressing the high false alarm rate: Traditional systems rely on simple rules and manual judgment when making decisions and analyzing assets. This invention builds an abnormal behavior analysis detection model based on the attack-defense game process. This model is trained and predicted using random forests, support vector machines (SVMs), and k-nearest neural networks (KNNs). Finally, a dynamic evaluation is performed by combining the prediction results of three model evaluation tools: confusion matrix, accuracy, receiver operating characteristic (ROC) curve, and area under the curve (AUC). This allows users to customize the degree of certainty in their decisions, providing more intelligent decision support.

[0141] To enhance the system's user-friendliness, we utilize a native microservices architecture and containerized deployment. The front-end is well-designed, featuring fast and dynamic interaction, enhancing the user experience. Business modules work well together, making operation and management easy. Comprehensive system management features ensure stability and monitoring. Optimized data processing provides highly accurate data, and the database design is flexible to accommodate diverse storage needs and satisfy diverse user scenarios.

[0142] Example 2, an embodiment of the present invention, provides a system for asset threat detection and analysis based on attack and defense game, including: a data collection and preprocessing module, an attack and defense random game model construction module, an abnormal behavior detection module, and a knowledge base update module;

[0143] The data collection and preprocessing module obtains raw network traffic data, performs preliminary cleaning and preprocessing based on the ATT&CK enemy technical and tactical knowledge base, digitizes character features, converts character features into multi-column vectors using the one-hot encoding method, and performs normalization to eliminate the influence of features. The processed data is then formatted into a CSV file.

[0144] The attack-defense random game model construction module constructs an attack-defense random game network model based on preprocessed data, simulates the interaction between attackers and defenders, uses equilibrium strategy calculation to determine the optimal behavior strategies of attackers and defenders, and analyzes the benefits and mutual influence under different strategies through utility functions;

[0145] The abnormal behavior detection module is based on the established attack and defense game model and combines integrated algorithms to detect abnormal behavior. It uses annotated historical security event data and the ATT&CK knowledge base to classify and train traffic data, identify abnormal asset behavior, and assess whether it is an attack behavior.

[0146] The knowledge base update module is a mechanism that triggers the knowledge base update when the abnormal behavior detection module discovers new abnormal behavior that is not included in the ATT&CK knowledge base, automatically records relevant information about the abnormal behavior, and integrates it into the existing ATT&CK knowledge base.

[0147] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0148] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0149] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0150] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0151] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An asset threat detection and analysis method based on attack and defense game, characterized in that: include: Collect raw network traffic data and perform preprocessing; Construct an attack and defense random game network model based on the preprocessed data; Detect abnormal behavior based on the attack-defense game model; The collection of raw network traffic data includes: Perform preliminary cleaning of the acquired raw network traffic data and the ATT&CK enemy technical and tactical knowledge base to filter out noise data, duplicate data, and irrelevant data packets, ensuring the quality and consistency of the input data, and filtering using custom data rules; The construction of the attack and defense random game network model based on the pre-processed data includes: Construct an attack-defense random game network model, and simulate the interaction between attackers and defenders through equilibrium strategy calculation. The random game network model is represented by a tuple: SGN={N,P,T,F,π,v,R,U,S0} Where N is the set of attackers and defenders, P is the set of asset positions, T is the set of behaviors, F is the set of arcs, π is the probability distribution function of the attacker and player's choice strategy, v is the set of transition response rates, R is the set of results of each transition, and U is the set of attacker utility function and defender utility function; By defining the prediction vector P K and P L To define the utility functions of the attacker and defender, the attacker's utility function expression is: U K (P K ,P L )=r K (P K ,P L )+δ·U(P j ) Among them, r K (P K ,P L ) is the attacker's choice of strategy P K and the defender chooses P L The return when δ∈[0,1] is the discount coefficient, U(P j ) represents the unknown expected utility in the future; The defender's utility function expression is: U L (P K ,P L )=r L (P K ,P L )+δ·U(P j ) Among them, r L (P K ,P L ) is the direct reward of the defender, δ∈[0,1] is the discount factor, U(P j ) is the defender's utility in the future state; Initialize the strategy selection function. The strategy selection function π(k,l) represents the probability distribution of the attacker and defender's choices under each combination strategy. The initialization expression is: Among them, U(k,l) represents the utility of the current strategy combination (k,l), is the parameter that controls the strategy selection, and K is the set of behaviors selected by the attacker; Introducing the optimization objectives of maximizing the attacker's profit and minimizing the defender's profit to obtain the game equilibrium strategy P K *, P L *The expression is: By calculating P K *, P L *Determine the optimal strategy and output the behavioral strategies of attackers and defenders; The abnormal behavior detection based on the attack-defense game model includes: Based on the attack and defense game model, an abnormal behavior detection model is built to detect abnormal behavior assets. By integrating SVM, KNN and random forest algorithms, abnormal asset behavior is predicted and output to the ATT&CK enemy technical and tactical knowledge base. Abnormal asset behavior detection based on the SVM algorithm involves preprocessing data, combining historical security event data with the ATT&CK enemy technical and tactical knowledge base, to label traffic data, classifying it into normal and abnormal behavior. This generates a labeled dataset, initializes the SVM classifier, selects different kernel functions, and sets hyperparameters. The SVM classifier is then trained using the training dataset. During training, the SVM constructs an optimal hyperplane to distinguish normal from abnormal traffic, maximizing the inter-class separation and minimizing classification error. After training, the kernel function training results are compared. The model is validated on the test set using the optimal kernel function. By comparing the predicted results with the true labels, the model's accuracy, precision, recall, and F1 score are calculated to identify abnormal behaviors in the digital power grid and determine whether they fall within the attack behaviors defined in the ATT&CK enemy technical and tactical knowledge base. The abnormal behavior detection based on the attack-defense game model also includes: The KNN algorithm-based asset abnormal behavior detection preprocesses raw network traffic data. A KNN classifier is created by initializing the KNeighborsClassifier class. The training dataset is trained using the fit(X_train, y_train) method to learn the categories of neighboring samples. The optimal K value is selected through cross-validation to optimize classification performance. The optimized K value is then used with the predict(X_test) method to predict whether the test set sample belongs to the enemy technique and tactics category in the ATT&CK knowledge base. Systematically evaluate model performance using F1 value, precision, and recall evaluation metrics; The abnormal behavior detection based on the attack-defense game model also includes: Abnormal asset behavior detection based on random forests involves preprocessing the data, labeling it, and classifying it into normal and abnormal categories. The random forest classifier (RF) is initialized and its parameters are set. The fit() method is used to train the random forest classifier using the training datasets self.X_train and self.y_train. During the training process, a decision tree is constructed from multiple sub-datasets with replacement, and the optimal features are selected for node splitting based on criteria such as the Gini coefficient. Predict the test dataset self.X_test and generate the predicted result predicted_rf. The model's classification performance is evaluated by calculating the accuracy svm_accuracy. The model's optimal accuracy is output through string formatting. A comprehensive evaluation is performed using the precision, recall, and F1 score evaluation metrics. Based on the evaluation results, the model parameters are further optimized and the detected behavior is determined to match the attack behavior categories in the ATT&CK knowledge base. Abnormal asset behavior detection is predicted using SVM, KNN, and random forest algorithms. When a behavior is determined to be abnormal and the current behavior is not in the ATT&CK enemy technical and tactical knowledge base, the knowledge base update mechanism will be triggered to automatically record the relevant information of the abnormal behavior and integrate it into the ATT&CK enemy technical and tactical knowledge base.

2. The asset threat detection and analysis method based on attack-defense game according to claim 1, characterized in that: The preprocessing includes digitizing character features, converting non-numeric features into numeric data, and processing them using the One-hot encoding method. The character features are split into multiple columns, each corresponding to a category. If the value of a column is 1, it means that the sample belongs to that category, otherwise it is 0; Finally, normalization is performed to scale each standardized value to the interval [0, 1] to eliminate the influence between features. The encoded non-continuous features are combined with the retained continuous features to form a complete feature vector, which serves as the input of the abnormal behavior detection model. The preprocessed data is formatted and converted into CSV file format.

3. A system using the asset threat detection and analysis method based on attack and defense game as described in any one of claims 1 to 2, characterized in that: It includes data collection and preprocessing module, attack and defense random game model construction module, abnormal behavior detection module, and knowledge base update module; The data collection and preprocessing module obtains raw network traffic data, performs preliminary cleaning and preprocessing based on the ATT&CK enemy technical and tactical knowledge base, digitizes character features, converts character features into multi-column vectors using the one-hot encoding method, and performs normalization to eliminate the influence of features. The processed data is then formatted into a CSV file. The attack-defense random game model construction module constructs an attack-defense random game network model based on preprocessed data, simulates the interaction between attackers and defenders, uses equilibrium strategy calculation to determine the optimal behavior strategies of attackers and defenders, and analyzes the benefits and mutual influence under different strategies through utility functions; The abnormal behavior detection module is based on the established attack and defense game model and combines integrated algorithms to detect abnormal behavior. It uses annotated historical security event data and the ATT&CK knowledge base to classify and train traffic data, identify abnormal asset behavior, and assess whether it is an attack behavior. The knowledge base update module is a mechanism that triggers the knowledge base update when the abnormal behavior detection module discovers new abnormal behavior that is not included in the ATT&CK knowledge base, automatically records relevant information about the abnormal behavior, and integrates it into the existing ATT&CK knowledge base.

4. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the asset threat detection and analysis method based on attack and defense game described in any one of claims 1 to 2 are implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the asset threat detection and analysis method based on attack and defense game described in any one of claims 1 to 2 are implemented.

Images