Network attack link tracking and threat situation reasoning method based on knowledge graph

Abstract

The invention provides a network attack link tracking and threat situation reasoning method based on a knowledge graph, and relates to the technical field of network security, and the method comprises the steps: collecting and processing original data; extracting features and constructing a network attack knowledge graph; performing representation learning by adopting a graph neural network; identifying a time sequence dependency relationship; generating and analyzing candidate attack links; constructing a dynamic Bayesian network model; performing parameter learning by adopting a variational reasoning algorithm; future attack targets and means are predicted. According to the method, the network attack link can be effectively tracked, the future threat situation is accurately predicted, and the network security defense capability is improved.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to a network attack link tracking and threat situation reasoning method based on knowledge graph. Background Art

[0002] Existing network attack analysis methods often focus on data in a single dimension, such as analyzing network traffic or system logs, and lack the comprehensive use of multi-source heterogeneous data. This leads to an incomplete understanding of attack behavior and makes it difficult to accurately restore the complete attack chain.

[0003] Existing technologies are deficient in modeling the relationship between attack entities and attack behaviors. Most methods use simple statistical analysis or rule matching, which cannot effectively capture the complex temporal dependencies between attack entities and make it difficult to identify the hidden multi-stage attack process.

[0004] Most existing threat situation analysis methods are based on static rules or simple probability models, and lack the ability to describe the dynamic evolution of attack behaviors. This makes it difficult to accurately predict and warn of new attack methods, affecting the timeliness and effectiveness of defense measures. Summary of the invention

[0005] The embodiments of the present invention provide a network attack link tracking and threat situation reasoning method based on knowledge graph, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention,

[0007] Provides network attack link tracking and threat situation reasoning methods based on knowledge graph, including:

[0008] Collect network traffic data, system log data, and threat intelligence data as raw data; normalize the raw data to obtain standardized data; extract attacker features, attack means features, attack target features, and attack result features from the standardized data; establish entity nodes based on the extracted features, construct the association relationships between the entity nodes as relationship edges of a knowledge graph, and generate a network attack knowledge graph;

[0009] Based on the network attack knowledge graph, a graph neural network is used to perform representation learning on the attack entity nodes to obtain vector representations of the entity nodes; the vector representations of the entity nodes are input into a pre-trained temporal relationship classification model to identify the temporal dependencies between the entity nodes; based on the temporal dependencies, the shortest path algorithm is used to traverse the entity nodes to generate multiple candidate attack links; similarity calculation and cluster analysis are performed on the candidate attack links to identify the main attack links;

[0010] Based on the main attack link, a dynamic Bayesian network model is constructed; the vector representation of the entity node and the temporal dependency are used as input parameters of the dynamic Bayesian network model; a variational inference algorithm is used to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix; based on the network attack probability transfer matrix, the possible attack targets and attack methods in the next stage are predicted to generate network threat situation warning information.

[0011] Extracting attacker features, attack means features, attack target features, and attack result features from the standardized data; establishing entity nodes based on the extracted features, constructing the association relationships between the entity nodes as relationship edges of the knowledge graph, and generating a network attack knowledge graph includes:

[0012] The attacker characteristics include IP address, geographic location, activity time period, and vulnerability tool set used; the attack means characteristics include vulnerability exploitation method, attack tool, and attack technology; the attack target characteristics include the type of attacked asset, vulnerability information, and importance; the attack result characteristics include the degree of system damage, data leakage, and service interruption duration;

[0013] Establish an attacker entity node based on the attacker characteristics, establish an attack means entity node based on the attack means characteristics, establish an attack target entity node based on the attack target characteristics, and establish an attack result entity node based on the attack result characteristics; construct the association between the attacker entity node and the attack means entity node as a use relationship edge, construct the association between the attack means entity node and the attack target entity node as a for relationship edge, construct the association between the attack target entity node and the attack result entity node as a cause relationship edge, and construct the association between entity nodes of the same type as an association relationship edge;

[0014] The TransE algorithm is used to perform vector mapping on the entity nodes, and the semantic association scores between the entity nodes are calculated based on the vector representation of the entity nodes; the relationship credibility score of each relationship edge is calculated based on observation frequency, time correlation, expert confirmation, and intelligence verification; the weighted relationship edges of the network attack knowledge graph are constructed according to the semantic association scores and the relationship credibility scores, and a network attack knowledge graph with relationship weights is generated.

[0015] Based on the network attack knowledge graph, a graph neural network is used to perform representation learning on the attack entity nodes to obtain vector representations of the entity nodes; the vector representations of the entity nodes are input into a pre-trained temporal relationship classification model to identify the temporal dependency relationship between the entity nodes, including:

[0016] A graph attention network is constructed based on entity nodes in the network attack knowledge graph, wherein the graph attention network includes a first attention layer and a second attention layer; the first-order neighboring nodes of the entity node are input into the first attention layer, and the attention weight is calculated based on the similarity of node attribute features, the credibility score of the relationship edge, and the importance of the node structure, and the feature information of the first-order neighboring nodes is weightedly aggregated according to the attention weight to obtain local features; the local features are input into the second attention layer, and the global semantic information is obtained by expanding the receptive field, and the vector representation of the entity node is obtained by using residual connection and layer normalization operations;

[0017] Constructing a hierarchical bidirectional long short-term memory network, the hierarchical bidirectional long short-term memory network includes a first bidirectional layer and a second bidirectional layer; inputting the vector representation and relationship type features of the entity node into the first bidirectional layer, extracting the temporal evolution features of a single entity based on the behavior sequence in the time window; inputting the temporal evolution features into the second bidirectional layer, extracting the interaction features between entity pairs, and obtaining the temporal association pattern between entities;

[0018] A temporal relationship classification model is constructed by adopting a multi-task learning mechanism, which includes a temporal relationship classification task, an entity association strength prediction task, and a time interval estimation task; the temporal relationship classification model is pre-trained based on labeled typical attack scenario data, and samples with high model uncertainty are selected for labeling by an active learning method, and the temporal relationship classification model is fine-tuned;

[0019] The temporal relationship weight is dynamically adjusted based on the time decay factor, and the direct predecessor relationship, indirect predecessor relationship, concurrent relationship, and independent relationship between entity nodes are identified according to the temporal relationship classification model, and the entity relationship identification result with temporal constraints is output.

[0020] According to the temporal dependency, the entity nodes are traversed using the shortest path algorithm to generate multiple candidate attack links. Similarity calculation and cluster analysis are performed on the candidate attack links to identify the main attack links, including:

[0021] A comprehensive edge weight calculation model is constructed, the temporal dependency strength between entity nodes is normalized by a sigmoid function to obtain a first weight value, the edge weight in the knowledge graph is subjected to time decay processing by an exponential decay function to obtain a second weight value, the degree of harm of the attack behavior is calculated based on a predefined threat level assessment matrix to obtain a third weight value, and the first weight value, the second weight value, and the third weight value are weighted and fused using an adaptive weight coefficient to obtain an edge weight value;

[0022] A dynamic timing constraint mechanism is built based on the duration of the attack behavior. A sliding time window is maintained to perform timing checks on the edges to be extended. For the edges of direct predecessor relationships, the target node timestamp is required to be later than the source node timestamp. A time delay threshold is set for the edges of indirect predecessor relationships. For the edges of concurrent relationships, the node time overlap is calculated.

[0023] A bidirectional search strategy is adopted, starting from the initial attack behavior node set and the final attack result node set at the same time, performing loop detection based on the node access frequency, pruning the path when the node access frequency exceeds the preset threshold, and generating candidate attack links when the two search fronts meet;

[0024] Perform multi-dimensional similarity calculation on the candidate attack links, use pre-trained entity vectors to calculate node semantic similarity, construct edge feature vectors based on relationship type one-hot encoding, weight numerical features, and time series strength values ​​to calculate edge feature similarity, use the longest common subsequence algorithm to calculate structural similarity, and use the dynamic time warping algorithm to calculate time series similarity;

[0025] An attention mechanism is constructed to perform adaptive weighted fusion of node semantic similarity, edge feature similarity, structural similarity, and temporal similarity to obtain a link similarity matrix. A spectral clustering algorithm is used based on the link similarity matrix to perform link clustering. The number of clusters is determined by eigenvalue analysis, and a normalized Laplace matrix is ​​constructed to obtain the final attack link clustering result.

[0026] The vector representation of the entity node and the temporal dependency are used as input parameters of the dynamic Bayesian network model; the dynamic Bayesian network model is parameter learned using a variational inference algorithm to obtain a network attack probability transfer matrix including:

[0027] The attribute features, contextual semantic information, and topological structure features of the entity nodes are converted into low-dimensional dense vector representations, and the temporal dependency relationship is encoded as prior knowledge of the probability transfer matrix. A three-layer dynamic Bayesian network structure is constructed, which includes an observation layer, a hidden state layer, and a transfer layer. The observation layer contains explicit features of the entity nodes, the hidden state layer extracts the potential state of the attack behavior from the observed data through nonlinear transformation, and the transfer layer describes the state transfer relationship between different time steps.

[0028] Constructing a time-varying transition probability matrix based on the current state vector and historical information, wherein each element of the time-varying transition probability matrix is ​​dynamically adjusted through a parameterized function;

[0029] Construct a variational posterior distribution, use the mean field approximation to decompose the posterior distribution into the product of multiple simple distributions, and define a variational objective function containing the expected log-likelihood term and the KL divergence regularization term;

[0030] A parameterized variational distribution family is constructed using categorical distribution for discrete state variables, Gaussian distribution for continuous state variables, and Dirichlet distribution for transition probability matrices;

[0031] The variational objective function is optimized through the stochastic gradient variational inference algorithm, the gradient is estimated using the reparameterization technique, the variance is reduced through Monte Carlo sampling, and the learning rate is adaptively adjusted using the Adam optimizer;

[0032] The coordinate ascent method is used to update the variational parameters in turn, sparsity constraints are introduced into the transfer probability matrix, Gaussian noise and time perturbations are added to the training samples for data enhancement, and L1 / L2 regularization terms are added to the objective function to control the complexity of the model. Finally, a network attack probability transfer matrix that can be dynamically adjusted over time is obtained.

[0033] Based on the network attack probability transfer matrix, the possible attack targets and attack means in the next stage are predicted, and the network threat situation warning information is generated, including:

[0034] Construct a sliding time window, perform matrix multiplication on the current state vector and the network attack probability transfer matrix to obtain the state probability distribution at the next moment, and use the exponential smoothing method to perform weighted fusion on the prediction results of multiple time windows;

[0035] An attack target prediction model is built based on a hierarchical probability graph. The asset vulnerability score and historical attack frequency are used to predict the attack asset type. The asset importance weight and network topology location are used to predict the specific attack target. The asset dependency graph is used to predict the attack impact range.

[0036] Build an attack method knowledge base, calculate the feasibility probability of attack methods based on the target asset security configuration, evaluate the attacker's preference based on historical attack patterns, and obtain the attack method set through Bayesian reasoning;

[0037] A multi-dimensional threat assessment index system including time series dimension, space dimension, target dimension and technology dimension is established. The fuzzy comprehensive evaluation model is used to map the assessment scores of each dimension to the threat level range, construct a fuzzy relationship matrix and perform multi-layer fuzzy synthesis operations.

[0038] Generate core warning information including predicted attack targets, attack methods, occurrence time, threat level, key observation data and evidence information based on reasoning, and defense suggestions and countermeasures;

[0039] Use parallel computing to process prediction tasks, perform incremental updates on changed parts, set dynamic thresholds to filter low-confidence warning results, and merge similar warning information;

[0040] By comparing warning information with actual attack events, the accuracy, recall rate, and timeliness of warnings are calculated, and warning failure cases are analyzed and prediction model parameters and warning thresholds are dynamically adjusted.

[0041] According to a second aspect of the embodiments of the present invention,

[0042] Provides a network attack link tracking and threat situation reasoning system based on knowledge graph, including:

[0043] The first unit is used to collect network traffic data, system log data, and threat intelligence data as raw data; normalize the raw data to obtain standardized data; extract attacker features, attack means features, attack target features, and attack result features from the standardized data; establish entity nodes based on the extracted features, construct the association relationships between the entity nodes as relationship edges of the knowledge graph, and generate a network attack knowledge graph;

[0044] The second unit is used to use a graph neural network to perform representation learning on the attack entity nodes based on the network attack knowledge graph to obtain a vector representation of the entity nodes; input the vector representation of the entity nodes into a pre-trained temporal relationship classification model to identify the temporal dependency between the entity nodes; according to the temporal dependency, use the shortest path algorithm to traverse the entity nodes to generate multiple candidate attack links; perform similarity calculation and cluster analysis on the candidate attack links to identify the main attack links;

[0045] The third unit is used to construct a dynamic Bayesian network model based on the main attack link; use the vector representation of the entity node and the temporal dependency as input parameters of the dynamic Bayesian network model; use a variational inference algorithm to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix; predict the attack targets and attack methods that may appear in the next stage based on the network attack probability transfer matrix, and generate network threat situation warning information.

[0046] According to a third aspect of the embodiments of the present invention,

[0047] An electronic device is provided, comprising:

[0048] processor;

[0049] a memory for storing processor-executable instructions;

[0050] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0051] A fourth aspect of the embodiments of the present invention is:

[0052] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0053] The beneficial effects of this application are as follows:

[0054] 1. Improved the accuracy and comprehensiveness of network attack link tracking:

[0055] The present invention collects multi-source heterogeneous data, constructs a network attack knowledge graph, and combines graph neural networks and temporal relationship classification models to more accurately identify the associations and temporal dependencies between attack entities. This method not only considers static features, but also incorporates dynamic temporal information, so that complex attack links can be tracked and restored more comprehensively.

[0056] 2. Automated threat situation reasoning:

[0057] The present invention adopts a dynamic Bayesian network model and a variational reasoning algorithm to automatically learn the probability transfer rules of network attacks. This data-driven reasoning method avoids the limitations of traditional rule-based methods, can adapt to the ever-changing network attack patterns, and improves the accuracy and adaptability of threat situation reasoning.

[0058] 3. Provides forward-looking threat warning capabilities:

[0059] By analyzing the learned network attack probability transfer matrix, the present invention can predict the possible attack targets and attack methods in the next stage. This forward-looking threat warning information can help network security personnel take defensive measures in advance, shifting from passive defense to active defense, greatly improving the effectiveness of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic diagram of a flow chart of a network attack link tracking and threat situation reasoning method based on a knowledge graph according to an embodiment of the present invention;

[0061] Figure 2 It is a structural diagram of a network attack link tracing and threat situation reasoning system based on a knowledge graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0064] Figure 1 Schematic diagram of the flow of the network attack link tracking and threat situation reasoning method based on the knowledge graph in the embodiment of the present invention. Figure 1 As shown, the method includes:

[0065] S101. Collect network traffic data, system log data, and threat intelligence data as raw data; normalize the raw data to obtain standardized data; extract attacker features, attack means features, attack target features, and attack result features from the standardized data; establish entity nodes based on the extracted features, construct the association relationships between the entity nodes as relationship edges of the knowledge graph, and generate a network attack knowledge graph;

[0066] S102. Based on the network attack knowledge graph, a graph neural network is used to perform representation learning on the attack entity nodes to obtain vector representations of the entity nodes; the vector representations of the entity nodes are input into a pre-trained temporal relationship classification model to identify the temporal dependencies between the entity nodes; based on the temporal dependencies, the shortest path algorithm is used to traverse the entity nodes to generate multiple candidate attack links; similarity calculation and cluster analysis are performed on the candidate attack links to identify the main attack links;

[0067] S103. Based on the main attack link, a dynamic Bayesian network model is constructed; the vector representation of the entity node and the temporal dependency are used as input parameters of the dynamic Bayesian network model; a variational inference algorithm is used to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix; based on the network attack probability transfer matrix, possible attack targets and attack methods in the next stage are predicted to generate network threat situation warning information.

[0068] This embodiment provides a network attack link tracking and threat situation reasoning method based on knowledge graph. The method first collects network traffic data, system log data and threat intelligence data as raw data. For example, network traffic data can be collected from security devices such as firewalls and intrusion detection systems; system log data can be collected from devices such as servers and terminals; and the latest threat intelligence data can be collected from threat intelligence platforms.

[0069] Normalize the collected raw data to obtain standardized data. Specifically, the data from different sources and in different formats can be mapped and formatted to a unified JSON format. For example, IP addresses can be unified into a dotted decimal format, and timestamps can be unified into a Unix timestamp format.

[0070] Extract attacker features, attack means features, attack target features, and attack result features from standardized data. For example, you can extract features such as source IP address, destination IP address, port number, protocol type, attack type, and attack result. Specifically, you can use regular expressions and other methods to extract these feature information from the log.

[0071] Entity nodes are established based on the extracted features, and the associations between entity nodes are constructed as the relationship edges of the knowledge graph to generate a network attack knowledge graph. For example, the attacker IP, attack target IP, attack type, etc. can be used as entity nodes, and "launch attack", "attack target", etc. can be used as relationship edges. The generated knowledge graph is stored in a graph database.

[0072] Based on the generated network attack knowledge graph, a graph neural network is used to learn the representation of the attack entity nodes and obtain the vector representation of the entity nodes. Specifically, models such as graph convolutional neural networks (GCN) or graph attention networks (GAT) can be used to aggregate the features of entity nodes and neighbor node information to obtain a low-dimensional vector representation of each node.

[0073] The vector representation of the entity node is input into the pre-trained temporal relationship classification model to identify the temporal dependency between entity nodes. The classification model can use a recurrent neural network structure such as a long short-term memory network (LSTM) to model the node vector sequence and output the temporal relationship type between nodes, such as "occurring one after another" and "occurring at the same time".

[0074] According to the identified temporal dependencies, the shortest path algorithm is used to traverse the entity nodes to generate multiple candidate attack links. Specifically, the Dijkstra algorithm can be used to traverse all possible attack paths with the attack source node as the starting point and the attack target node as the end point to generate a set of candidate attack links.

[0075] Perform similarity calculation and cluster analysis on the generated candidate attack links to identify the main attack links. You can use methods such as edit distance to calculate the similarity between links, and then use clustering algorithms such as K-means to cluster similar links, and finally get representative main attack links.

[0076] Based on the identified main attack links, a dynamic Bayesian network model is constructed. Each node in the attack link is used as a random variable of the Bayesian network, and the temporal relationship between nodes is used as the conditional probability dependency.

[0077] The vector representation of entity nodes and temporal dependencies are used as input parameters of the dynamic Bayesian network model. Node vectors can be used as observation variables, and temporal relationships can be used to construct network structures.

[0078] The variational inference algorithm is used to learn the parameters of the dynamic Bayesian network model and obtain the network attack probability transfer matrix. Specifically, the variational expectation maximization (VEM) algorithm can be used to estimate the model parameters through iterative optimization to obtain the conditional probability distribution between each node.

[0079] Based on the learned network attack probability transfer matrix, the possible attack targets and attack methods in the next stage are predicted, and network threat situation warning information is generated. For example, based on the currently observed attack features, the probability transfer matrix can be used to calculate the most likely attack targets and methods in the next step, and generate corresponding warning information.

[0080] The beneficial effects of this method include:

[0081] 1) By constructing a network attack knowledge graph and integrating multi-source heterogeneous data, a unified representation and correlation analysis of complex network attack behaviors can be achieved.

[0082] 2) Combining graph neural networks and temporal relationship classification models, the temporal dependencies between attack entities can be effectively identified and the attack links can be accurately restored.

[0083] 3) The dynamic Bayesian network is used to model the evolution process of attack behavior, which can make probabilistic predictions of future attack situations and improve the accuracy and timeliness of threat warnings.

[0084] In an optional implementation, extracting attacker features, attack means features, attack target features, and attack result features from the standardized data; establishing entity nodes based on the extracted features, constructing the association relationships between the entity nodes as relationship edges of the knowledge graph, and generating a network attack knowledge graph includes:

[0085] The attacker characteristics include IP address, geographic location, activity time period, and vulnerability tool set used; the attack means characteristics include vulnerability exploitation method, attack tool, and attack technology; the attack target characteristics include the type of attacked asset, vulnerability information, and importance; the attack result characteristics include the degree of system damage, data leakage, and service interruption duration;

[0086] Establish an attacker entity node based on the attacker characteristics, establish an attack means entity node based on the attack means characteristics, establish an attack target entity node based on the attack target characteristics, and establish an attack result entity node based on the attack result characteristics; construct the association between the attacker entity node and the attack means entity node as a use relationship edge, construct the association between the attack means entity node and the attack target entity node as a for relationship edge, construct the association between the attack target entity node and the attack result entity node as a cause relationship edge, and construct the association between entity nodes of the same type as an association relationship edge;

[0087] The TransE algorithm is used to perform vector mapping on the entity nodes, and the semantic association scores between the entity nodes are calculated based on the vector representation of the entity nodes; the relationship credibility score of each relationship edge is calculated based on observation frequency, time correlation, expert confirmation, and intelligence verification; the weighted relationship edges of the network attack knowledge graph are constructed according to the semantic association scores and the relationship credibility scores, and a network attack knowledge graph with relationship weights is generated.

[0088] This embodiment provides a method for constructing a network attack knowledge graph, comprising the following steps:

[0089] First, the collected network attack data is standardized to form structured data in a unified format. Then, the attacker characteristics, attack means characteristics, attack target characteristics, and attack result characteristics are extracted from the standardized data. Specifically, the attacker characteristics include IP address, geographic location, activity time period, and vulnerability tool set used; the attack means characteristics include vulnerability exploitation methods, attack tools, and attack techniques; the attack target characteristics include the type of attacked assets, vulnerability information, and importance; the attack result characteristics include the degree of system damage, data leakage, and service interruption duration.

[0090] Taking a specific network attack incident as an example, the following features can be extracted from the standardized data: the attacker's IP is 192.168.1.100, located in California, USA, the active time period is 22:00-02:00, and the vulnerability tool used is Metasploit; the attack method is to exploit the SQL injection vulnerability, use the sqlmap tool, and adopt the blind injection technology; the attack target is the user database of an e-commerce website, which has an SQL injection vulnerability with a high degree of importance; the attack result is that the database table is deleted, 1 million user information is leaked, and the website service is interrupted for 8 hours.

[0091] Next, entity nodes are established based on the extracted features. Specifically, an attacker entity node is established based on the attacker features, an attack means entity node is established based on the attack means features, an attack target entity node is established based on the attack target features, and an attack result entity node is established based on the attack result features. Taking the above-mentioned network attack event as an example, the following entity nodes can be established: attacker node (IP: 192.168.1.100, location: California, USA, time: 22:00-02:00, tool: Metasploit); attack means node (vulnerability: SQL injection, tool: sqlmap, technology: blind injection); attack target node (asset: user database, vulnerability: SQL injection, importance: high); attack result node (damage: database table deletion, leakage: 1 million user information, interruption: 8 hours).

[0092] Then, the association between entity nodes is constructed as the relationship edge of the knowledge graph. Specifically, the association between the attacker entity node and the attack means entity node is constructed as the use relationship edge, the association between the attack means entity node and the attack target entity node is constructed as the target relationship edge, the association between the attack target entity node and the attack result entity node is constructed as the cause relationship edge, and the association between entity nodes of the same type is constructed as the association relationship edge. Taking the above-mentioned network attack event as an example, the following relationship edge can be constructed: the attacker uses the attack means, the attack means targets the attack target, and the attack target causes the attack result.

[0093] Next, the TransE algorithm is used to perform vector mapping on the entity nodes. The core idea of ​​the TransE algorithm is to embed both entities and relationships into the same vector space, so that the head entity vector plus the relationship vector is close to the tail entity vector. In the specific implementation, the vector representations of entities and relationships are first randomly initialized, and then the training triples are constructed through negative sampling, and the vector representations of entities and relationships are iteratively optimized until convergence. Taking the above-mentioned network attack incident as an example, the vector representations of four types of entity nodes, namely attackers, attack methods, attack targets, and attack results, can be obtained.

[0094] Based on the vector representation of entity nodes, the semantic association score between entity nodes is calculated. Specifically, cosine similarity can be used to measure the semantic similarity between two entity vectors. The higher the score, the closer the semantic association. For example, by calculating the cosine similarity between the attacker node vector and the attack means node vector, the semantic association score between them can be obtained.

[0095] For each relationship edge, the relationship credibility score is calculated based on factors such as observation frequency, time correlation, expert confirmation, and intelligence verification. The higher the observation frequency, the stronger the time correlation, the higher the expert confirmation, and the higher the intelligence verification, the higher the relationship credibility score. For example, for the relationship edge of the attacker using the attack method, we can count its frequency in historical data, analyze its time distribution characteristics, consult security experts, query the threat intelligence library for verification, and comprehensively obtain a credibility score.

[0096] Finally, the weighted relationship edge of the network attack knowledge graph is constructed based on the semantic association score and the relationship credibility score, and a network attack knowledge graph with relationship weights is generated. Specifically, the semantic association score and the relationship credibility score can be weighted and summed as the weight of the relationship edge. The higher the weight, the more important the relationship is. For example, the weight of the edge where the attacker uses the attack method may be higher than the weight of the edge where the attack target leads to the attack result.

[0097] The beneficial effects of this embodiment include:

[0098] 1) By extracting multi-dimensional features and constructing entity nodes, the various elements of network attacks are comprehensively characterized, so that the generated knowledge graph can describe the network attack scenario more comprehensively.

[0099] 2) The TransE algorithm is used to perform vector mapping on entities and calculate the semantic association score based on the vector representation, which effectively captures the semantic relationship between entities and improves the semantic expression ability of the knowledge graph.

[0100] 3) The relationship credibility score is calculated by comprehensively considering multiple factors, and the weighted relationship edge is constructed in combination with the semantic association score, so that the generated knowledge graph has the ability to evaluate credibility and distinguish relationship importance, which can provide more reliable support for subsequent analysis and decision-making.

[0101] In an optional implementation, based on the network attack knowledge graph, a graph neural network is used to perform representation learning on the attack entity node to obtain a vector representation of the entity node; the vector representation of the entity node is input into a pre-trained temporal relationship classification model, and the temporal dependency relationship between the entity nodes is identified, including:

[0102] A graph attention network is constructed based on entity nodes in the network attack knowledge graph, wherein the graph attention network includes a first attention layer and a second attention layer; the first-order neighboring nodes of the entity node are input into the first attention layer, and the attention weight is calculated based on the similarity of node attribute features, the credibility score of the relationship edge, and the importance of the node structure, and the feature information of the first-order neighboring nodes is weightedly aggregated according to the attention weight to obtain local features; the local features are input into the second attention layer, and the global semantic information is obtained by expanding the receptive field, and the vector representation of the entity node is obtained by using residual connection and layer normalization operations;

[0103] Constructing a hierarchical bidirectional long short-term memory network, the hierarchical bidirectional long short-term memory network includes a first bidirectional layer and a second bidirectional layer; inputting the vector representation and relationship type features of the entity node into the first bidirectional layer, extracting the temporal evolution features of a single entity based on the behavior sequence in the time window; inputting the temporal evolution features into the second bidirectional layer, extracting the interaction features between entity pairs, and obtaining the temporal association pattern between entities;

[0104] A temporal relationship classification model is constructed by adopting a multi-task learning mechanism, which includes a temporal relationship classification task, an entity association strength prediction task, and a time interval estimation task; the temporal relationship classification model is pre-trained based on labeled typical attack scenario data, and samples with high model uncertainty are selected for labeling by an active learning method, and the temporal relationship classification model is fine-tuned;

[0105] The temporal relationship weight is dynamically adjusted based on the time decay factor, and the direct predecessor relationship, indirect predecessor relationship, concurrent relationship, and independent relationship between entity nodes are identified according to the temporal relationship classification model, and the entity relationship identification result with temporal constraints is output.

[0106] Implementation method:

[0107] The present invention provides a method for identifying the temporal relationship of network attack entities based on knowledge graph and graph neural network. The method first constructs a network attack knowledge graph, which contains nodes and relationships such as attack entities, attack types, and attack methods. Then, based on the knowledge graph, a graph neural network is used to perform representation learning on the attack entity nodes to obtain the vector representation of the entity nodes. Finally, the vector representation of the entity node is input into a pre-trained temporal relationship classification model to identify the temporal dependency relationship between the entity nodes. The specific implementation steps are as follows:

[0108] First, a graph attention network is constructed based on the entity nodes in the network attack knowledge graph, which includes the first attention layer and the second attention layer. The first-order neighbor nodes of the entity node (i.e., the nodes directly connected to the node) are input into the first attention layer, and the attention weight is calculated based on the similarity of node attribute features, the credibility score of the relationship edge, and the importance of the node structure. For example, for the entity node "SQL injection", its first-order neighbor nodes include defense measure nodes such as "input validation" and "parameterized query", as well as attack target nodes such as "obtain database information" and "execute any SQL statement". The attribute feature similarity between these neighbor nodes and the central node "SQL injection", the credibility score of the relationship edge, and the importance of the node in the entire graph structure are calculated to obtain the attention weight. Then, the feature information of the first-order neighbor nodes is weighted and aggregated according to the attention weight to obtain the local feature representation.

[0109] Next, the local features obtained in the previous step are input into the second attention layer to obtain global semantic information by expanding the receptive field. Specifically, the second attention layer considers the second-order or even higher-order neighborhood nodes to capture a wider range of contextual information. For example, for the "SQL injection" node, the second layer can focus on more distant related nodes such as "database server" and "web application". On this basis, residual connection and layer normalization operations are used to obtain the final vector representation of the entity node. Residual connection can alleviate the gradient vanishing problem of deep networks, and layer normalization helps to accelerate model convergence.

[0110] Then, a hierarchical bidirectional long short-term memory network (Bi LSTM) is constructed, including the first bidirectional layer and the second bidirectional layer. The entity node vector representation and relationship type features (such as "attack-defense", "attack-target", etc.) obtained in the previous step are input into the first bidirectional layer, and the temporal evolution features of a single entity are extracted based on the behavior sequence within a predefined time window (such as 1 hour, 1 day, etc.). For example, for the "SQL injection" entity, there may be a temporal behavior pattern of "scan-detect-inject-obtain data". The first layer of Bi LSTM can capture the temporal features of such a single entity.

[0111] The temporal evolution features output by the first-layer Bi LSTM are input into the second bidirectional layer to extract the interaction features between entity pairs and obtain the temporal association pattern between entities. For example, there may be a temporal relationship of "occurring one after another" or "occurring at the same time" between the two entities "SQL injection" and "XSS attack". The second-layer Bi LSTM can learn this temporal interaction pattern between entities by processing the temporal features of multiple entities.

[0112] Next, a temporal relationship classification model is constructed using a multi-task learning mechanism, including temporal relationship classification tasks, entity association strength prediction tasks, and time interval estimation tasks. The temporal relationship classification task is used to determine the type of temporal relationship between entities (such as direct predecessor, indirect predecessor, etc.). The entity association strength prediction task is used to evaluate the closeness of the association between two entities. The time interval estimation task predicts the time span between two related entities. The multi-task model is pre-trained based on labeled typical attack scenario data (such as APT attack chain, ransomware attack process, etc.).

[0113] On the basis of pre-training, active learning is used to select samples with high model uncertainty for manual labeling and fine-tune the temporal relationship classification model. Specifically, information entropy or Bayesian uncertainty can be used to measure the uncertainty of the model's prediction results for a certain sample. A batch of samples with the highest uncertainty are selected for manual labeling, and then these newly labeled samples are used to fine-tune the model to improve the performance of the model on challenging samples.

[0114] Finally, the temporal relationship weight is dynamically adjusted based on the time decay factor. For example, an exponential decay function can be used so that the larger the time interval, the smaller the relationship weight. According to the adjusted temporal relationship classification model, the direct predecessor relationship between entity nodes (such as "scanning" directly leads to "vulnerability discovery"), indirect predecessor relationship (such as "social engineering" indirectly leads to "privilege escalation"), concurrent relationship (such as "data theft" and "data encryption" occur at the same time), independent relationship (such as "DDoS attack" and "password cracking" are independent of each other) are identified, and the entity relationship recognition results with temporal constraints are finally output.

[0115] Beneficial effects:

[0116] 1. This method combines knowledge graphs and graph neural networks to make full use of prior knowledge and graph structure information in the field of cyber attacks, improving the quality and interpretability of entity representation. At the same time, the use of attention mechanisms and multi-layer structures can effectively capture local and global semantic information and enhance the expressiveness of the model.

[0117] 2. The hierarchical bidirectional long short-term memory network can not only extract the temporal evolution characteristics of a single entity, but also capture the interaction patterns between entities, effectively modeling complex temporal dependencies. The introduction of the multi-task learning mechanism enables the model to learn multiple related tasks at the same time, improving the generalization ability and robustness of the model.

[0118] 3. The application of active learning strategy helps to improve the annotation efficiency and model performance. The introduction of time decay factor enables the model to dynamically adjust the importance of temporal relationship, which is more in line with the actual application scenario. Overall, this method has strong adaptability and accuracy in the task of identifying the temporal relationship of network attack entities.

[0119] In an optional implementation, according to the timing dependency, the entity nodes are traversed using the shortest path algorithm to generate multiple candidate attack links; similarity calculation and cluster analysis are performed on the candidate attack links to identify the main attack links including:

[0120] A comprehensive edge weight calculation model is constructed, the temporal dependency strength between entity nodes is normalized by a sigmod function to obtain a first weight value, the edge weight in the knowledge graph is subjected to time decay processing by an exponential decay function to obtain a second weight value, the degree of harm of the attack behavior is calculated based on a predefined threat level assessment matrix to obtain a third weight value, and the first weight value, the second weight value, and the third weight value are weighted and fused by an adaptive weight coefficient to obtain an edge weight value;

[0121] A dynamic timing constraint mechanism is built based on the duration of the attack behavior. A sliding time window is maintained to perform timing checks on the edges to be extended. For the edges of direct predecessor relationships, the target node timestamp is required to be later than the source node timestamp. A time delay threshold is set for the edges of indirect predecessor relationships. For the edges of concurrent relationships, the node time overlap is calculated.

[0122] A bidirectional search strategy is adopted, starting from the initial attack behavior node set and the final attack result node set at the same time, performing loop detection based on the node access frequency, pruning the path when the node access frequency exceeds the preset threshold, and generating candidate attack links when the two search fronts meet;

[0123] Perform multi-dimensional similarity calculation on the candidate attack links, use pre-trained entity vectors to calculate node semantic similarity, construct edge feature vectors based on relationship type one-hot encoding, weight numerical features, and time series strength values ​​to calculate edge feature similarity, use the longest common subsequence algorithm to calculate structural similarity, and use the dynamic time warping algorithm to calculate time series similarity;

[0124] An attention mechanism is constructed to perform adaptive weighted fusion of node semantic similarity, edge feature similarity, structural similarity, and temporal similarity to obtain a link similarity matrix. A spectral clustering algorithm is used based on the link similarity matrix to perform link clustering. The number of clusters is determined by eigenvalue analysis, and a normalized Laplace matrix is ​​constructed to obtain the final attack link clustering result.

[0125] According to the timing dependency, the shortest path algorithm is used to traverse the entity nodes to generate multiple candidate attack links. First, a timing dependency graph between entity nodes is constructed, where nodes represent attack behaviors or system states, and edges represent timing dependencies between nodes. Then, the Dijkstra shortest path algorithm is used to traverse the graph, starting from the initial attack behavior node, and visiting adjacent nodes in chronological order until the final attack result node is reached, generating multiple possible attack paths. For example, for a timing dependency graph containing 10 nodes, 5-10 different candidate attack links may be generated.

[0126] The candidate attack links are similarity calculated and clustered to identify the main attack links. Specifically, a comprehensive edge weight calculation model is constructed to integrate multiple factors such as the temporal dependency strength between entity nodes, the edge weight in the knowledge graph, and the degree of harm of the attack behavior to obtain the comprehensive weight value of the edge. First, the temporal dependency strength between entity nodes is normalized by the sigmod function to obtain the first weight value, which ranges from 0 to 1. Secondly, the edge weight in the knowledge graph is time-decayed by the exponential decay function to obtain the second weight value, and the decay coefficient can be set to 0.9. Then, based on the predefined threat level assessment matrix, the degree of harm of the attack behavior is calculated to obtain the third weight value. The threat level can be divided into 5 levels, and the corresponding weight values ​​are 0.2, 0.4, 0.6, 0.8, and 1.0. Finally, the first weight value, the second weight value, and the third weight value are weighted and integrated using an adaptive weight coefficient to obtain the edge weight value. The initial weight coefficient can be set to 0.4, 0.3, and 0.3, and dynamically adjusted during the iteration process.

[0127] A dynamic timing constraint mechanism is built based on the duration of the attack behavior, and a sliding time window is maintained to perform timing checks on the edges to be extended. For edges with direct predecessor relationships, the target node timestamp is required to be later than the source node timestamp. For example, for nodes A and B, if there is a direct dependency relationship A->B, the timestamp of B must be later than the timestamp of A. For edges with indirect predecessor relationships, a time delay threshold is set. For example, the threshold can be set to 1 hour. If the time interval between two indirectly related nodes exceeds 1 hour, it is considered that the timing constraint is not met. For edges with concurrent relationships, the node time overlap is calculated and the overlap threshold is set to 0.5. When the time overlap between two nodes exceeds 0.5, it is considered that there is a concurrent relationship.

[0128] A bidirectional search strategy is adopted, and the search starts from the initial attack behavior node set and the final attack result node set at the same time. During the search process, loop detection is performed based on the node access frequency, and the path is pruned when the number of node accesses exceeds the preset threshold. For example, the node access frequency threshold can be set to 3. When a node is visited more than 3 times, it is considered that there is a loop and the path is pruned. When the two search fronts meet, a candidate attack link is generated. The bidirectional search can effectively reduce the search space and improve the efficiency of the algorithm.

[0129] Multi-dimensional similarity calculation is performed on the candidate attack links. First, the semantic similarity of the nodes is calculated using the pre-trained entity vector. The entities can be vectorized using methods such as Word2Vec, and then the vector cosine similarity is calculated. Secondly, the edge feature vector is constructed based on the unique hot encoding of the relationship type, the weight numerical feature, and the time series strength value to calculate the edge feature similarity. The relationship type is uniquely encoded. For example, the relationship type can be divided into 5 categories and represented by a 5-dimensional vector. The weight numerical feature directly uses the weight value of the edge, and the time series strength value can use the reciprocal of the normalized time interval. These features are spliced ​​into an edge feature vector, and the vector Euclidean distance is calculated to obtain the edge feature similarity. Then, the longest common subsequence algorithm is used to calculate the structural similarity, and the number of identical nodes and edges in the two links is counted and divided by the link length to obtain the structural similarity. Finally, the dynamic time warping algorithm is used to calculate the time series similarity, and the timestamp sequence in the link is aligned to calculate the similarity of the aligned time series.

[0130] Construct an attention mechanism to adaptively weight and fuse node semantic similarity, edge feature similarity, structural similarity, and temporal similarity to obtain a link similarity matrix. Design a multi-head attention layer, take the four similarities as input, and obtain the weight coefficient of the similarity of each dimension through training. Initially, the weights of the four similarities can be set equal, that is, 0.25. During the training process, the weights are dynamically adjusted according to the importance of the similarity of each dimension in different scenarios. Fill the weighted fused similarity values ​​into the link similarity matrix.

[0131] Based on the link similarity matrix, a spectral clustering algorithm is used to perform link clustering. First, the number of clusters is determined by eigenvalue analysis. The inflection point method can be used to select the inflection point with the most significant eigenvalue change as the number of clusters. Then, a normalized Laplace matrix is ​​constructed and the eigenvector of the matrix is ​​calculated. Finally, K-means clustering is performed on the eigenvector to obtain the final attack link clustering result. For example, for 20 candidate attack links, they may be clustered into 3-5 main attack link categories.

[0132] The beneficial effects of this technical solution include the following three aspects:

[0133] First, by constructing a comprehensive edge weight calculation model and a dynamic timing constraint mechanism, multi-dimensional information is effectively integrated to improve the accuracy of attack link identification. Taking into account factors such as timing dependency strength, knowledge graph weight, and attack harm degree, the correlation between attack behaviors is more comprehensively characterized. The dynamic timing constraint mechanism can effectively filter out links that do not conform to timing logic and reduce the false alarm rate.

[0134] Secondly, the bidirectional search strategy and multi-dimensional similarity calculation method are adopted to improve the efficiency and robustness of the algorithm. Bidirectional search can significantly reduce the search space and accelerate the convergence speed. Multi-dimensional similarity calculation measures the similarity of links from multiple perspectives such as semantics, features, structure, and timing, which enhances the robustness of similarity calculation.

[0135] Finally, the attention mechanism and spectral clustering algorithm are introduced to achieve adaptive fusion and clustering of attack links. The attention mechanism can dynamically adjust the importance of similarity in each dimension according to different scenarios, improving the generalization ability of the model. The spectral clustering algorithm can effectively discover non-convex clustering structures and is suitable for complex attack link clustering scenarios.

[0136] In an optional implementation, the vector representation of the entity node and the temporal dependency are used as input parameters of the dynamic Bayesian network model; a variational inference algorithm is used to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix including:

[0137] The attribute features, contextual semantic information, and topological structure features of the entity nodes are converted into low-dimensional dense vector representations, and the temporal dependency relationship is encoded as prior knowledge of the probability transfer matrix. A three-layer dynamic Bayesian network structure is constructed, which includes an observation layer, a hidden state layer, and a transfer layer. The observation layer contains explicit features of the entity nodes, the hidden state layer extracts the potential state of the attack behavior from the observed data through nonlinear transformation, and the transfer layer describes the state transfer relationship between different time steps.

[0138] Constructing a time-varying transition probability matrix based on the current state vector and historical information, wherein each element of the time-varying transition probability matrix is ​​dynamically adjusted through a parameterized function;

[0139] Construct a variational posterior distribution, use the mean field approximation to decompose the posterior distribution into the product of multiple simple distributions, and define a variational objective function containing the expected log-likelihood term and the KL divergence regularization term;

[0140] A parameterized variational distribution family is constructed using categorical distribution for discrete state variables, Gaussian distribution for continuous state variables, and Dirichlet distribution for transition probability matrices;

[0141] The variational objective function is optimized through the stochastic gradient variational inference algorithm, the gradient is estimated using the reparameterization technique, the variance is reduced through Monte Carlo sampling, and the learning rate is adaptively adjusted using the Adam optimizer;

[0142] The coordinate ascent method is used to update the variational parameters in turn, sparsity constraints are introduced into the transfer probability matrix, Gaussian noise and time perturbations are added to the training samples for data enhancement, and L1 / L2 regularization terms are added to the objective function to control the complexity of the model. Finally, a network attack probability transfer matrix that can be dynamically adjusted over time is obtained.

[0143] This embodiment provides a network attack prediction method based on a dynamic Bayesian network. The method first uses the vector representation and temporal dependency of the entity node as the input parameters of the dynamic Bayesian network model, and then uses the variational inference algorithm to learn the parameters of the model, and finally obtains the network attack probability transfer matrix. The specific implementation steps are as follows:

[0144] Step 1: Construct a vector representation of the entity node. Convert the attribute features, contextual semantic information, and topological structure features of the entity node into a low-dimensional dense vector. Specifically, first extract the attribute features of the node, such as node type, importance, etc.; secondly, use natural language processing technology to analyze the text information related to the node and extract semantic features; finally, extract the topological structure features of the node based on the graph neural network. After splicing these features, map them to the vector space of the same dimension through the fully connected layer to obtain a comprehensive vector representation of the node.

[0145] Step 2: Encode the temporal dependency. Encode the temporal dependency into the prior knowledge of the probability transition matrix. Specifically, analyze the historical attack data, count the frequency of node state transitions in different time intervals, and construct the initial transition probability matrix. For the missing time intervals, use the interpolation method to fill in. Then normalize the matrix to obtain the prior transition probability distribution.

[0146] Step 3: Construct a three-layer dynamic Bayesian network structure. The structure includes an observation layer, a hidden state layer, and a transfer layer. The observation layer contains explicit features of entity nodes, such as traffic, number of connections, and other directly observable indicators. The hidden state layer extracts the potential state of attack behavior from the observed data through nonlinear transformation, which can capture complex attack patterns. The transfer layer describes the state transfer relationship between different time steps and reflects the evolution of attack behavior.

[0147] Step 4: Construct a time-varying transition probability matrix. Based on the current state vector and historical information, dynamically adjust each element of the transition probability matrix. Specifically, design a parameterized function whose input includes the current state vector, historical state sequence, timestamp and other information, and outputs the updated value of the transition probability matrix. This function can be a multi-layer perceptron or a recurrent neural network, which can capture complex temporal dependencies.

[0148] Step 5: Construct the variational posterior distribution. Use the mean field approximation to decompose the posterior distribution into the product of multiple simple distributions. For discrete state variables, use the categorical distribution, for continuous state variables, use the Gaussian distribution, and for the transition probability matrix, use the Dirichlet distribution. These distribution families have good mathematical properties and are convenient for variational inference. Define the variational objective function, which includes the expected log-likelihood term and the KL divergence regularization term.

[0149] Step 6: Optimize the variational objective function. The stochastic gradient variational inference algorithm is used to optimize the objective function. The reparameterization technique is used to estimate the gradient and the variance is reduced by Monte Carlo sampling. Specifically, the reparameterization technique is used for continuous variables to represent the random sampling process as a deterministic function plus noise. The Gumbel-Softmax relaxation technique is used for discrete variables to approximate discrete sampling as continuous sampling. The Adam optimizer is used to adaptively adjust the learning rate to improve the convergence speed and stability.

[0150] Step 7: Update model parameters. Use coordinate ascent method to update variational parameters in turn. Introduce sparsity constraints to the transfer probability matrix to encourage matrix elements to tend to 0 or 1. Add Gaussian noise and time perturbations to the training samples for data enhancement to improve the robustness of the model. Add L1 / L2 regularization terms to the objective function to control model complexity and avoid overfitting. Through multiple rounds of iterative optimization, a network attack probability transfer matrix that can be dynamically adjusted over time is obtained.

[0151] In the specific implementation, a network with 100 nodes can be taken as an example. Each node has 10-dimensional attribute features, 20-dimensional semantic features, and 30-dimensional topological features. These features are concatenated and mapped to a 50-dimensional vector space through a two-layer fully connected network. The time series data contains attack records from the past 30 days, with a time granularity of 1 hour. An initial transition probability matrix of 720×720 is constructed as prior knowledge. The observation layer contains 5 explicit features of each node, and the hidden state layer sets 10 discrete states. The parameterized function uses a two-layer LSTM network, with a 50-dimensional state vector and a historical sequence of the past 24 hours as input, and a 100×100 transition probability matrix update value as output. In the variational distribution family, the discrete state uses a 10-dimensional category distribution, the continuous state uses a 50-dimensional Gaussian distribution, and the transfer matrix uses a 100×100-dimensional Dirichlet distribution. The optimization process adopts the mini-batch method, randomly selecting 1000 time steps of data in each batch, setting the initial value of the learning rate to 0.001, and the hyperparameters of the Adam optimizer are beta1=0.9 and beta2=0.999. The model is trained for 500 rounds, and the learning rate is reduced every 100 rounds. The final transition probability matrix can be dynamically adjusted according to the current network state to achieve accurate prediction of future attack behaviors.

[0152] The beneficial effects of this method are mainly reflected in the following three aspects:

[0153] 1. Improved the accuracy and timeliness of network attack prediction. By constructing a dynamic Bayesian network model, the multimodal characteristics and temporal dependencies of entity nodes are fully utilized to capture complex attack patterns and evolution processes. The variational inference algorithm is used for parameter learning, which overcomes the computational complexity of traditional methods when processing high-dimensional data and realizes real-time analysis and prediction of large-scale networks.

[0154] 2. Enhanced the adaptability and robustness of the model. The introduction of the time-varying transition probability matrix enables the model to dynamically adjust parameters according to the current network state and adapt to the rapid changes in attack behavior. Through data enhancement and regularization techniques, the model's robustness to noise and abnormal samples is improved, reducing the risk of overfitting.

[0155] 3. Provides interpretable prediction results. The probabilistic graph model based on the Bayesian network has good interpretability and can track the propagation path and impact range of attack behaviors. By analyzing the learned transition probability matrix, potential vulnerabilities and key nodes can be discovered, providing decision support for network security protection.

[0156] In an optional implementation, predicting the possible attack targets and attack methods in the next stage based on the network attack probability transfer matrix and generating network threat situation warning information includes:

[0157] Construct a sliding time window, perform matrix multiplication on the current state vector and the network attack probability transfer matrix to obtain the state probability distribution at the next moment, and use the exponential smoothing method to perform weighted fusion on the prediction results of multiple time windows;

[0158] An attack target prediction model is built based on a hierarchical probability graph. The asset vulnerability score and historical attack frequency are used to predict the attack asset type. The asset importance weight and network topology location are used to predict the specific attack target. The asset dependency graph is used to predict the attack impact range.

[0159] Build an attack method knowledge base, calculate the feasibility probability of attack methods based on the target asset security configuration, evaluate the attacker's preference based on historical attack patterns, and obtain the attack method set through Bayesian reasoning;

[0160] A multi-dimensional threat assessment index system including time series dimension, space dimension, target dimension and technology dimension is established. The fuzzy comprehensive evaluation model is used to map the assessment scores of each dimension to the threat level range, construct a fuzzy relationship matrix and perform multi-layer fuzzy synthesis operations.

[0161] Generate core warning information including predicted attack targets, attack methods, occurrence time, threat level, key observation data and evidence information based on reasoning, and defense suggestions and countermeasures;

[0162] Use parallel computing to process prediction tasks, perform incremental updates on changed parts, set dynamic thresholds to filter low-confidence warning results, and merge similar warning information;

[0163] By comparing warning information with actual attack events, the accuracy, recall rate, and timeliness of warnings are calculated, and warning failure cases are analyzed and prediction model parameters and warning thresholds are dynamically adjusted.

[0164] The specific implementation method of predicting the possible attack targets and attack methods in the next stage based on the network attack probability transfer matrix and generating network threat situation warning information is as follows:

[0165] First, a sliding time window is constructed, and the current network security state vector is multiplied by the network attack probability transfer matrix to obtain the probability distribution of the network security state at the next moment. Specifically, 24 hours is selected as the sliding time window, and the state transfer is calculated every hour. The current state vector contains 10 states, such as normal, scanning detection, denial of service, and unauthorized access. The probability value of each state is between 0 and 1 and the sum is 1. The network attack probability transfer matrix is ​​a 10x10 square matrix, which represents the transition probability between each state. The probability distribution of the 10 states at the next moment is obtained by matrix multiplication.

[0166] Then, the exponential smoothing method is used to perform weighted fusion of the prediction results of multiple time windows. Specifically, different weights are assigned to the prediction results of the last 24 hours, with the weight of the last hour being 0.3, the weight of 2-6 hours being 0.4, the weight of 7-12 hours being 0.2, and the weight of 13-24 hours being 0.1. The prediction results of each time window are multiplied by the corresponding weights and summed to obtain the fused prediction results.

[0167] Next, we build an attack target prediction model based on the hierarchical probability graph. First, we use the asset vulnerability score and the historical attack frequency to predict the attack asset type. Specifically, for asset types such as servers, databases, and network equipment, we calculate the vulnerability score based on the CVSS scoring system, and count the frequency of recent attacks on each type of asset. After normalizing the vulnerability score and attack frequency, we take the weighted average to get the probability of each type of asset being attacked.

[0168] The asset importance weight and network topology position are then used to predict specific attack targets. For each specific asset, a weight of 1-5 is assigned according to its business importance, and the centrality is calculated according to its position in the network topology. The asset weight and centrality are normalized and then the weighted average is calculated to obtain the probability of each asset becoming an attack target.

[0169] Finally, the asset dependency graph is used to predict the impact range of attacks. A directed graph of dependency relationships between assets is constructed, and the scope of other assets that may be affected by an attack on an asset is analyzed through a graph traversal algorithm.

[0170] On this basis, we build an attack means knowledge base and calculate the feasibility probability of the attack means based on the target asset security configuration. Specifically, we build a knowledge base containing common attack means such as SQL injection, buffer overflow, and cross-site scripting. For each attack means, we calculate the feasibility probability of the attack means based on the target asset security configuration, such as whether the firewall is turned on and whether the vulnerability is repaired.

[0171] Combine historical attack patterns to evaluate attacker preferences. Statistically analyze the frequency of use of various attack methods in historical attack events and calculate the attacker's preference for different methods. Weightedly integrate the feasibility probability of the attack method with the attacker's preference.

[0172] The attack means set is obtained through Bayesian reasoning. Based on the target asset type, security configuration, etc., combined with the feasibility of the attack means and the attacker's preference, Bayesian reasoning is used to calculate the posterior probability of each attack means, and the top three with the highest probability are selected as the predicted attack means set.

[0173] Establish a multi-dimensional threat assessment indicator system that includes time series, space, target, and technology dimensions. The time series dimension considers the trend of attack frequency changes, the space dimension considers the geographical distribution of attack sources, the target dimension considers the importance of attacked assets, and the technology dimension considers the degree of harm of attack methods. Set 3-5 assessment indicators for each dimension.

[0174] The fuzzy comprehensive evaluation model is used to map the evaluation scores of each dimension to the threat level interval. The evaluation index value is normalized to the interval [0,1], and the fuzzy membership function from the evaluation index to the threat level is established. The fuzzy relationship matrix is ​​constructed, and multi-layer fuzzy synthesis operations are performed to obtain the final threat level evaluation result.

[0175] Generates core warning information including predicted attack targets, attack methods, occurrence time, and threat level. The predicted attack targets include asset types and specific asset names, the attack methods are the three possible methods predicted, the occurrence time is a specific time period within the next 24 hours, and the threat level is divided into three levels: low, medium, and high.

[0176] Contains key observation data and evidence information for reasoning. Lists key observation data that supports the warning results, such as abnormal traffic, suspicious IP, etc. Provides the reasoning process and basis for the prediction results.

[0177] Contains defense suggestions and countermeasures. Based on the predicted attack targets and methods, it provides targeted defense suggestions, such as strengthening the security configuration of specific assets, deploying specific protection measures, etc. It also provides specific measures for emergency response.

[0178] Use parallel computing to process prediction tasks and perform incremental updates on the parts that have changed. Use distributed computing frameworks such as Spark to process large-scale data in parallel. Perform incremental calculations on the parts that have changed, such as network topology and asset configuration, to improve computing efficiency.

[0179] Set dynamic thresholds to filter low-confidence warning results. Dynamically adjust the warning confidence threshold based on historical warning accuracy. Warning results below the threshold are filtered to reduce false alarms.

[0180] Merge similar warning information. Perform cluster analysis on multiple warning information with similar prediction targets, means, and time, merge warnings with high similarity, and generate aggregated warning information.

[0181] Calculate the accuracy, recall, and timeliness of warnings by comparing warning information with actual attack events. Record all generated warning information and compare it with subsequent actual attack events. Calculate the accuracy and recall indicators of warnings to evaluate the timeliness of warnings.

[0182] Analyze warning failure cases and dynamically adjust prediction model parameters and warning thresholds. Perform failure analysis on attack events that failed to provide timely warnings to identify deficiencies in the prediction model. Dynamically adjust model parameters such as state transition probability and indicator weights based on analysis results. Appropriately adjust warning thresholds to balance false positives and missed negatives.

[0183] The beneficial effects of this technical solution include:

[0184] 1. Improved the accuracy and timeliness of network threat situation warnings. Through multi-dimensional and multi-level comprehensive analysis and prediction, combined with historical data and real-time observations, it can more accurately predict potential network attacks and issue warnings in a timely manner.

[0185] 2. Enhanced the interpretability and operability of early warning information. Early warning information contains detailed evidence and reasoning, as well as specific defense suggestions, which helps security personnel quickly understand the threat situation and take corresponding measures.

[0186] 3. Improved the adaptability and scalability of the early warning system. The parallel computing and incremental update mechanism can efficiently process large-scale data. By dynamically adjusting model parameters and early warning thresholds, the system can continuously optimize and adapt to changes in the network environment.

[0187] Figure 2 Schematic diagram of the structure of the network attack link tracking and threat situation reasoning system based on knowledge graph in an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0188] The first unit is used to collect network traffic data, system log data, and threat intelligence data as raw data; normalize the raw data to obtain standardized data; extract attacker features, attack means features, attack target features, and attack result features from the standardized data; establish entity nodes based on the extracted features, construct the association relationships between the entity nodes as relationship edges of the knowledge graph, and generate a network attack knowledge graph;

[0189] The second unit is used to use a graph neural network to perform representation learning on the attack entity nodes based on the network attack knowledge graph to obtain a vector representation of the entity nodes; input the vector representation of the entity nodes into a pre-trained temporal relationship classification model to identify the temporal dependency between the entity nodes; according to the temporal dependency, use the shortest path algorithm to traverse the entity nodes to generate multiple candidate attack links; perform similarity calculation and cluster analysis on the candidate attack links to identify the main attack links;

[0190] The third unit is used to construct a dynamic Bayesian network model based on the main attack link; use the vector representation of the entity node and the temporal dependency as input parameters of the dynamic Bayesian network model; use a variational inference algorithm to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix; predict the attack targets and attack methods that may appear in the next stage based on the network attack probability transfer matrix, and generate network threat situation warning information.

[0191] According to a third aspect of the embodiments of the present invention,

[0192] An electronic device is provided, comprising:

[0193] processor;

[0194] a memory for storing processor-executable instructions;

[0195] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0196] A fourth aspect of the embodiments of the present invention is:

[0197] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0198] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0199] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network attack link tracking and threat situation reasoning method based on knowledge graph, characterized by: include: Collect network traffic data, system log data, and threat intelligence data as raw data; normalize the raw data to obtain standardized data; Extracting attacker characteristics, attack means characteristics, attack target characteristics, and attack result characteristics from the standardized data; Establishing entity nodes based on the extracted features, constructing the association relationships between the entity nodes as relationship edges of the knowledge graph, and generating a network attack knowledge graph; Based on the network attack knowledge graph, a graph neural network is used to perform representation learning on the attack entity nodes to obtain vector representations of the entity nodes; the vector representations of the entity nodes are input into a pre-trained temporal relationship classification model to identify the temporal dependencies between the entity nodes; based on the temporal dependencies, the shortest path algorithm is used to traverse the entity nodes to generate multiple candidate attack links; similarity calculation and cluster analysis are performed on the candidate attack links to identify the main attack links; Based on the main attack link, a dynamic Bayesian network model is constructed; the vector representation of the entity node and the temporal dependency are used as input parameters of the dynamic Bayesian network model; A variational inference algorithm is used to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix; based on the network attack probability transfer matrix, possible attack targets and attack methods in the next stage are predicted to generate network threat situation warning information.

2. The method according to claim 1, characterized in that Extracting attacker characteristics, attack means characteristics, attack target characteristics, and attack result characteristics from the standardized data; Establish entity nodes based on the extracted features, construct the associations between the entity nodes as relationship edges of the knowledge graph, and generate a network attack knowledge graph include: The attacker characteristics include IP address, geographic location, activity time period, and vulnerability tool set used; the attack means characteristics include vulnerability exploitation method, attack tool, and attack technology; the attack target characteristics include the type of attacked asset, vulnerability information, and importance; the attack result characteristics include the degree of system damage, data leakage, and service interruption duration; Establish an attacker entity node based on the attacker characteristics, establish an attack means entity node based on the attack means characteristics, establish an attack target entity node based on the attack target characteristics, and establish an attack result entity node based on the attack result characteristics; construct the association between the attacker entity node and the attack means entity node as a use relationship edge, construct the association between the attack means entity node and the attack target entity node as a for relationship edge, construct the association between the attack target entity node and the attack result entity node as a cause relationship edge, and construct the association between entity nodes of the same type as an association relationship edge; The TransE algorithm is used to perform vector mapping on the entity nodes, and the semantic association scores between the entity nodes are calculated based on the vector representation of the entity nodes; the relationship credibility score of each relationship edge is calculated based on observation frequency, time correlation, expert confirmation, and intelligence verification; the weighted relationship edges of the network attack knowledge graph are constructed according to the semantic association scores and the relationship credibility scores, and a network attack knowledge graph with relationship weights is generated.

3. The method according to claim 1, characterized in that Based on the network attack knowledge graph, a graph neural network is used to perform representation learning on the attack entity nodes to obtain vector representations of the entity nodes; the vector representations of the entity nodes are input into a pre-trained temporal relationship classification model to identify the temporal dependency relationship between the entity nodes, including: A graph attention network is constructed based on entity nodes in the network attack knowledge graph, wherein the graph attention network includes a first attention layer and a second attention layer; the first-order neighboring nodes of the entity node are input into the first attention layer, and the attention weight is calculated based on the similarity of node attribute features, the credibility score of the relationship edge, and the importance of the node structure, and the feature information of the first-order neighboring nodes is weightedly aggregated according to the attention weight to obtain local features; the local features are input into the second attention layer, and the global semantic information is obtained by expanding the receptive field, and the vector representation of the entity node is obtained by using residual connection and layer normalization operations; Constructing a hierarchical bidirectional long short-term memory network, the hierarchical bidirectional long short-term memory network includes a first bidirectional layer and a second bidirectional layer; inputting the vector representation and relationship type features of the entity node into the first bidirectional layer, extracting the temporal evolution features of a single entity based on the behavior sequence in the time window; inputting the temporal evolution features into the second bidirectional layer, extracting the interaction features between entity pairs, and obtaining the temporal association pattern between entities; A temporal relationship classification model is constructed by adopting a multi-task learning mechanism, which includes a temporal relationship classification task, an entity association strength prediction task, and a time interval estimation task; the temporal relationship classification model is pre-trained based on labeled typical attack scenario data, and samples with high model uncertainty are selected for labeling by an active learning method, and the temporal relationship classification model is fine-tuned; The temporal relationship weight is dynamically adjusted based on the time decay factor, and the direct predecessor relationship, indirect predecessor relationship, concurrent relationship, and independent relationship between entity nodes are identified according to the temporal relationship classification model, and the entity relationship identification result with temporal constraints is output.

4. The method according to claim 1, characterized in that: According to the temporal dependency, the entity nodes are traversed using the shortest path algorithm to generate multiple candidate attack links. Similarity calculation and cluster analysis are performed on the candidate attack links to identify the main attack links, including: Construct a comprehensive edge weight calculation model, normalize the temporal dependency strength between entity nodes through a sigmoid function to obtain a first weight value, perform time decay processing on the edge weights in the knowledge graph through an exponential decay function to obtain a second weight value, calculate the degree of harm of the attack behavior based on a predefined threat level assessment matrix to obtain a third weight value, and use an adaptive weight coefficient to weightedly fuse the first weight value, the second weight value, and the third weight value to obtain an edge weight value; A dynamic timing constraint mechanism is built based on the duration of the attack behavior. A sliding time window is maintained to perform timing checks on the edges to be extended. For the edges of direct predecessor relationships, the target node timestamp is required to be later than the source node timestamp. A time delay threshold is set for the edges of indirect predecessor relationships. For the edges of concurrent relationships, the node time overlap is calculated. A bidirectional search strategy is adopted, starting from the initial attack behavior node set and the final attack result node set at the same time, performing loop detection based on the node access frequency, pruning the path when the node access frequency exceeds the preset threshold, and generating candidate attack links when the two search fronts meet; Perform multi-dimensional similarity calculation on the candidate attack links, use pre-trained entity vectors to calculate node semantic similarity, construct edge feature vectors based on relationship type one-hot encoding, weight numerical features, and time series strength values ​​to calculate edge feature similarity, use the longest common subsequence algorithm to calculate structural similarity, and use the dynamic time warping algorithm to calculate time series similarity; An attention mechanism is constructed to perform adaptive weighted fusion of node semantic similarity, edge feature similarity, structural similarity, and temporal similarity to obtain a link similarity matrix. A spectral clustering algorithm is used based on the link similarity matrix to perform link clustering. The number of clusters is determined by eigenvalue analysis, and a normalized Laplace matrix is ​​constructed to obtain the final attack link clustering result.

5. The method according to claim 1, characterized in that Using the vector representation of the entity node and the temporal dependency as input parameters of the dynamic Bayesian network model; The variational inference algorithm is used to learn the parameters of the dynamic Bayesian network model, and the network attack probability transfer matrix is ​​obtained, including: The attribute features, contextual semantic information, and topological structure features of the entity nodes are converted into low-dimensional dense vector representations, and the temporal dependency relationship is encoded as prior knowledge of the probability transfer matrix. A three-layer dynamic Bayesian network structure is constructed, which includes an observation layer, a hidden state layer, and a transfer layer. The observation layer contains explicit features of the entity nodes, the hidden state layer extracts the potential state of the attack behavior from the observed data through nonlinear transformation, and the transfer layer describes the state transfer relationship between different time steps. Constructing a time-varying transition probability matrix based on the current state vector and historical information, wherein each element of the time-varying transition probability matrix is ​​dynamically adjusted through a parameterized function; Construct a variational posterior distribution, use the mean field approximation to decompose the posterior distribution into the product of multiple simple distributions, and define a variational objective function containing the expected log-likelihood term and the KL divergence regularization term; A parameterized variational distribution family is constructed using categorical distribution for discrete state variables, Gaussian distribution for continuous state variables, and Dirichlet distribution for transition probability matrices; The variational objective function is optimized through the stochastic gradient variational inference algorithm, the gradient is estimated using the reparameterization technique, the variance is reduced through Monte Carlo sampling, and the learning rate is adaptively adjusted using the Adam optimizer; The coordinate ascent method is used to update the variational parameters in turn, sparsity constraints are introduced into the transfer probability matrix, Gaussian noise and time perturbations are added to the training samples for data enhancement, and L1 / L2 regularization terms are added to the objective function to control the complexity of the model. Finally, a network attack probability transfer matrix that can be dynamically adjusted over time is obtained.

6. The method according to claim 1, characterized in that Based on the network attack probability transfer matrix, the possible attack targets and attack means in the next stage are predicted, and the network threat situation warning information is generated, including: Construct a sliding time window, perform matrix multiplication on the current state vector and the network attack probability transfer matrix to obtain the state probability distribution at the next moment, and use the exponential smoothing method to perform weighted fusion on the prediction results of multiple time windows; An attack target prediction model is built based on a hierarchical probability graph. The asset vulnerability score and historical attack frequency are used to predict the attack asset type. The asset importance weight and network topology location are used to predict the specific attack target. The asset dependency graph is used to predict the attack impact range. Build an attack method knowledge base, calculate the feasibility probability of attack methods based on the target asset security configuration, evaluate the attacker's preference based on historical attack patterns, and obtain the attack method set through Bayesian reasoning; A multi-dimensional threat assessment index system including time series dimension, space dimension, target dimension and technology dimension is established. The fuzzy comprehensive evaluation model is used to map the assessment scores of each dimension to the threat level range, construct a fuzzy relationship matrix and perform multi-layer fuzzy synthesis operations. Generate core warning information including predicted attack targets, attack methods, occurrence time, threat level, key observation data and evidence information based on reasoning, and defense suggestions and countermeasures; Use parallel computing to process prediction tasks, perform incremental updates on changed parts, set dynamic thresholds to filter low-confidence warning results, and merge similar warning information; By comparing warning information with actual attack events, the accuracy, recall rate, and timeliness of warnings are calculated, and warning failure cases are analyzed and prediction model parameters and warning thresholds are dynamically adjusted.

7. A network attack link tracking and threat situation reasoning system based on knowledge graph, used to implement the method described in any one of claims 1 to 6, characterized in that: include: The first unit is used to collect network traffic data, system log data, and threat intelligence data as raw data; and normalize the raw data to obtain standardized data; Extracting attacker characteristics, attack means characteristics, attack target characteristics, and attack result characteristics from the standardized data; Establishing entity nodes based on the extracted features, constructing the association relationships between the entity nodes as relationship edges of the knowledge graph, and generating a network attack knowledge graph; The second unit is used to use a graph neural network to perform representation learning on the attack entity nodes based on the network attack knowledge graph to obtain a vector representation of the entity nodes; input the vector representation of the entity nodes into a pre-trained temporal relationship classification model to identify the temporal dependency between the entity nodes; according to the temporal dependency, use the shortest path algorithm to traverse the entity nodes to generate multiple candidate attack links; perform similarity calculation and cluster analysis on the candidate attack links to identify the main attack links; The third unit is used to construct a dynamic Bayesian network model based on the main attack link; the vector representation of the entity node and the temporal dependency relationship are used as input parameters of the dynamic Bayesian network model; A variational inference algorithm is used to perform parameter learning on the dynamic Bayesian network model to obtain a network attack probability transfer matrix; based on the network attack probability transfer matrix, possible attack targets and attack methods in the next stage are predicted to generate network threat situation warning information.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images