Network attack risk mapping assessment method and system

Abstract

The invention provides a network attack risk mapping assessment method and system, and relates to the technical field of network attack risks, and the method comprises the steps: collecting a network flow data packet to extract a multi-dimensional attack feature vector, employing a deep neural network to carry out feature learning to obtain an attack type recognition result and an attack intensity assessment value, and constructing an attack feature standard model; based on the attack type identification result and the attack strength evaluation value, combining an asset weight coefficient, a vulnerability hazard level and a vulnerability utilization difficulty coefficient to construct an asset vulnerability evaluation model; and performing association analysis on the real-time attack feature data and the asset vulnerability assessment score, constructing a risk mapping matrix, calculating a comprehensive risk score, and generating risk early warning information. According to the invention, accurate identification, dynamic assessment and timely early warning of the network attack risk are realized, and the accuracy and real-time performance of risk assessment are improved.

Description

Technical Field

[0001] The present invention relates to network attack risk technology, and in particular to a network attack risk mapping assessment method and system. Background Art

[0002] With the rapid development of network technology, network attack methods are becoming more and more complex and diverse, and the security threats to critical information infrastructure are increasing. As an important means of network security protection, network attack risk mapping assessment can achieve quantitative assessment and early warning of network attack risks through correlation analysis between attack characteristics and asset vulnerabilities. Existing network attack risk assessment methods mainly use static rule matching and expert experience scoring, which are difficult to adapt to the dynamically changing network attack environment; Traditional feature extraction methods are difficult to effectively capture the multi-dimensional feature information of network attacks, resulting in insufficient accuracy and comprehensiveness in attack identification. Second, existing asset vulnerability assessment methods lack comprehensive consideration of business impact and data sensitivity, and cannot accurately reflect the actual extent of asset losses after being attacked. Third, existing risk assessment methods often separate attack threats and asset vulnerabilities for independent assessment, lacking in-depth analysis of the correlation between the two, affecting the accuracy of risk assessment results. The purpose of the present invention is to overcome the above technical defects and provide a network attack risk mapping assessment method based on deep learning. The method realizes automatic learning and identification of multi-dimensional attack features through deep neural networks, establishes a standard model of attack features; constructs an asset vulnerability assessment model by introducing factors such as business impact and data sensitivity; and uses a risk mapping matrix to realize the correlation analysis between attack threats and asset vulnerabilities, thereby achieving accurate assessment and timely warning of network attack risks. Summary of the invention

[0003] The embodiments of the present invention provide a network attack risk mapping assessment method and system, which can solve the problems in the prior art.

[0004] According to a first aspect of the embodiments of the present invention, Provides a cyber attack risk mapping assessment method, including: Collect network traffic data packets, extract multidimensional attack feature vectors from the network traffic data packets, the multidimensional attack feature vectors including attack time features, attack source address features, attack target features, attack traffic features, and attack protocol features; input the multidimensional attack feature vectors into a pre-trained deep neural network for feature learning, the deep neural network outputs attack type identification results and attack intensity evaluation values; and construct an attack feature standard model according to the attack type identification results and the attack intensity evaluation values; Determine an asset weight coefficient according to the attack type identification result, the asset weight coefficient is calculated based on business impact and data sensitivity; determine a vulnerability hazard level according to the attack intensity assessment value, the vulnerability hazard level is divided using a vulnerability scoring system; determine a vulnerability exploitation difficulty coefficient based on the attack type identification result; input the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain an asset vulnerability assessment score; The attack feature standard model is used to monitor real-time network traffic to generate real-time attack feature data; the real-time attack feature data is correlated with the asset vulnerability assessment score to construct a risk mapping matrix, wherein the horizontal axis of the risk mapping matrix represents the attack threat level and the vertical axis represents the asset vulnerability level; a comprehensive risk score is calculated based on the risk mapping matrix; risk warning information is generated based on the comprehensive risk score, and the risk warning information is sent to a network security management device.

[0005] Inputting the multi-dimensional attack feature vector into a pre-trained deep neural network for feature learning, the deep neural network outputting an attack type recognition result and an attack intensity evaluation value: constructing an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value includes: Performing minimum-maximum normalization processing on the multidimensional attack feature vector to obtain a standardized feature vector, wherein the multidimensional attack feature vector includes an attack time feature, an attack source address feature, an attack target feature, an attack traffic feature, and an attack protocol feature; Inputting the standardized feature vector into a one-dimensional convolutional neural network, the one-dimensional convolutional neural network comprises a plurality of parallel convolution branches, each of which has a convolution kernel size of 3 and a step size of 1, and each of which is connected to a batch normalization layer and a rectified linear unit activation function to obtain a local temporal feature; Inputting the local temporal features into a bidirectional gated recurrent unit network, wherein the bidirectional gated recurrent unit network comprises a forward gated recurrent unit and a reverse gated recurrent unit, and obtaining a fused hidden state by concatenating a forward hidden state output by the forward gated recurrent unit and a reverse hidden state output by the reverse gated recurrent unit; The fused hidden state is input into a self-attention mechanism network, the self-attention mechanism network calculates an attention score by linear transformation of a query vector, a key vector, and a value vector, and the attention score is normalized by a normalized exponential function and weighted with the value vector to obtain an attention output feature; Input the attention output feature into a multi-task learning framework, wherein the multi-task learning framework includes a shared encoder and two task decoders, wherein the shared encoder is a multi-layer perceptron structure with a dropout layer set between layers, and the two task decoders are a normalized exponential function classifier and a sigmoid regressor respectively; The multi-task learning framework is trained using a weighted loss function, wherein the weighted loss function is composed of a classification loss calculated by a cross entropy loss function and a regression loss calculated by a mean square error loss function, and a weight ratio of the classification loss to the regression loss is adjusted by a balancing factor; The attack type identification result output by the normalized exponential function classifier is stored in an attack type feature library, and the attack type feature library calculates the feature matching degree based on cosine similarity; the attack strength evaluation value output by the sigmoid regressor is input into an attack strength evaluation engine, and the attack strength evaluation engine calculates the comprehensive strength score based on fuzzy reasoning; An attack feature standard model is constructed based on the attack type feature library and the attack intensity assessment engine, and the attack feature standard model is updated through regular retraining and online fine-tuning.

[0006] Determine an asset weight coefficient according to the attack type identification result, and the asset weight coefficient is calculated based on business impact and data sensitivity; determine a vulnerability hazard level according to the attack intensity assessment value, and the vulnerability hazard level is divided using a vulnerability scoring system; determine a vulnerability exploitation difficulty coefficient based on the attack type identification result, including: Determine the scope and type of affected assets based on the attack type identification results, and construct a business impact scoring matrix and a data sensitivity scoring matrix based on the affected assets. The business impact scoring matrix includes a business interruption duration score, a revenue loss degree score, and a user impact range score. The data sensitivity scoring matrix includes a personal privacy data score, a transaction business data score, and an operation and maintenance management data score. Multiplying the business impact scoring matrix by a first adjustment factor to obtain a business impact score, multiplying the data sensitivity scoring matrix by a second adjustment factor to obtain a data sensitivity score, and adding the business impact score to the data sensitivity score to obtain an asset weight coefficient; A vulnerability scoring index system is constructed based on the attack intensity assessment value, wherein the vulnerability scoring index system includes basic assessment indicators, time dimension indicators, and environment dimension indicators. The basic assessment indicators include permission requirements, user interactions, and impact scope. The time dimension indicators include vulnerability exploit code maturity, patch repair status, and vulnerability disclosure time. The environment dimension indicators include security requirement level, deployment environment, and existing protection measures. Calculate the vulnerability hazard level according to the vulnerability scoring indicator system, and the vulnerability hazard level is divided based on the general vulnerability scoring system; Building a vulnerability exploitation difficulty assessment system based on the attack type identification result, wherein the vulnerability exploitation difficulty assessment system includes attack chain complexity, technical requirements, and defense bypass difficulty; Multiply the attack chain complexity by the first weight coefficient to obtain an attack chain complexity score, multiply the technical requirements by the second weight coefficient to obtain a technical requirement score, multiply the protection bypass difficulty by the third weight coefficient to obtain a protection bypass difficulty score, and add the attack chain complexity score, the technical requirement score, and the protection bypass difficulty score to obtain a vulnerability exploitation difficulty coefficient.

[0007] Inputting the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain the asset vulnerability assessment score includes: The hierarchical structure of the asset vulnerability assessment model is constructed by using the hierarchical analysis method. The hierarchical structure includes top-level indicators, middle-level indicators, and bottom-level indicators. The top-level indicator is a comprehensive vulnerability assessment score. The middle-level indicators include asset weight dimension, vulnerability hazard dimension, and difficulty of use dimension. The bottom-level indicators include specific assessment parameters of each dimension. Perform minimum-maximum normalization processing on the asset weight coefficient, the vulnerability hazard level, and the vulnerability exploitation difficulty coefficient, and map the normalized values ​​to the [0,1] interval; Based on the expert scoring method, a judgment matrix is ​​constructed, wherein the judgment matrix includes the relative importance of asset weight and vulnerability hazard, the relative importance of vulnerability hazard and difficulty of exploitation, and the relative importance of asset weight and difficulty of exploitation. The maximum eigenvalue of the judgment matrix is ​​calculated and the corresponding eigenvector is solved. The eigenvector is normalized to obtain a weight vector. Establishing an evaluation factor set and an evaluation level set, wherein the evaluation factor set includes an asset weight dimension, a vulnerability hazard dimension, and an exploitation difficulty dimension, and the evaluation level set includes a high risk level, a medium risk level, and a low risk level; Determine a single factor evaluation matrix based on the evaluation factor set and the evaluation grade set, and perform fuzzy synthesis operation on the weight vector and the single factor evaluation matrix to obtain a comprehensive evaluation result; The asset weight coefficient is multiplied by the asset weight dimension weight to obtain the asset weight score, the vulnerability hazard level is multiplied by the vulnerability hazard dimension weight to obtain the vulnerability hazard score, and the vulnerability exploitation difficulty coefficient is multiplied by the exploitation difficulty dimension weight to obtain the exploitation difficulty score; A Sigmoid function is used to perform nonlinear mapping on the asset weight score, the vulnerability hazard score, and the exploit difficulty score to obtain a mapped standardized score; The mapped asset weight score is multiplied by the first weight coefficient, the mapped vulnerability hazard score is multiplied by the second weight coefficient, and the mapped utilization difficulty score is multiplied by the third weight coefficient, and the three are added together to obtain the asset vulnerability assessment score.

[0008] Using the attack feature standard model to monitor real-time network traffic and generate real-time attack feature data; correlating and analyzing the real-time attack feature data with the asset vulnerability assessment score to construct a risk mapping matrix includes: Extract traffic statistics features, protocol behavior features, connection mode features, and load content features from network traffic, wherein the traffic statistics features include data packet size distribution, traffic rate changes, and session duration, the protocol behavior features include protocol type distribution and protocol state transitions, the connection mode features include source and destination address distribution, port usage mode, and connection establishment method, and the load content features include load keywords, feature byte sequences, and abnormal instruction sequences; A hierarchical feature extraction strategy is used to extract packet-level features, session-level features, application-level features, and aggregation-level features. The packet-level features extract the basic attributes of a single packet, the session-level features analyze the behavioral characteristics of TCP / UDP sessions, the application-level features identify abnormal patterns of application-layer protocols, and the aggregation-level features calculate the statistical attributes of multi-dimensional features. Constructing an AC automaton to preprocess the pattern string, and using a sliding window technology to perform feature matching on the packet level features, the session level features, the application level features, and the aggregation level features; Establishing a normal behavior baseline model, calculating the degree of behavior deviation of the feature matching result based on the normal behavior baseline model, and setting a dynamic detection threshold according to the degree of behavior deviation; Converting the detected attack features into a standardized data format, wherein the standardized data format includes attack type identification, timestamp information, attack source features, attack target information, attack behavior description, and threat level assessment; Performing temporal correlation on the standardized data formats based on a time window, performing spatial correlation on the standardized data formats based on an attack target, and performing behavioral correlation on the standardized data formats based on an attack pattern; A multidimensional risk mapping matrix is ​​constructed, wherein the horizontal axis of the multidimensional risk mapping matrix is ​​the asset vulnerability assessment score range, the vertical axis of the multidimensional risk mapping matrix is ​​the real-time attack feature threat level, and the matrix elements of the multidimensional risk mapping matrix are comprehensive risk assessment values.

[0009] Calculating a comprehensive risk score based on the risk mapping matrix includes: Establish a multi-level risk quantification indicator system, which includes asset value impact, vulnerability exploitation possibility, threat event frequency, and security protection capability. The asset value impact includes asset importance, business relevance, and data sensitivity. The vulnerability exploitation possibility includes technical threshold, required resources, and exploitation conditions. The threat event frequency includes attack frequency, duration, and attack intensity. The security protection capability includes security measure effectiveness, response capability, and recovery capability. The weights of the asset value impact, the vulnerability exploitation possibility, the threat event frequency, and the security protection capability are calculated using the analytic hierarchy process and entropy weight method, and the weights are modified according to the indicator correlation to establish a dynamic adjustment mechanism for the weights; Establish risk level classification standards, design scoring calculation rules, and decompose risk scores into direct loss impact scores, indirect loss impact scores, reputation impact scores, and compliance impact scores; Calculate the asset-based risk score, evaluate the threat impact score, quantify the vulnerability severity score, and measure the protection capability score. Perform a weighted operation on the asset-based risk score, the threat impact score, the vulnerability severity score, the protection capability score, and the weight to obtain a weighted risk score.

[0010] According to a second aspect of the embodiments of the present invention, Provides a network attack risk mapping assessment system, including: The first unit is used to collect network traffic data packets, extract a multi-dimensional attack feature vector from the network traffic data packets, and the multi-dimensional attack feature vector includes attack time feature, attack source address feature, attack target feature, attack traffic feature and attack protocol feature; input the multi-dimensional attack feature vector into a pre-trained deep neural network for feature learning, and the deep neural network outputs an attack type recognition result and an attack intensity evaluation value; and construct an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value; The second unit is used to determine an asset weight coefficient according to the attack type identification result, the asset weight coefficient is calculated based on the business impact and data sensitivity; determine the vulnerability hazard level according to the attack intensity assessment value, the vulnerability hazard level is divided using a vulnerability scoring system; determine the vulnerability exploitation difficulty coefficient based on the attack type identification result; input the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain an asset vulnerability assessment score; The third unit is used to monitor real-time network traffic using the attack feature standard model to generate real-time attack feature data; perform correlation analysis on the real-time attack feature data and the asset vulnerability assessment score to construct a risk mapping matrix, wherein the horizontal axis of the risk mapping matrix represents the attack threat level and the vertical axis represents the asset vulnerability level; calculate a comprehensive risk score based on the risk mapping matrix; generate risk warning information based on the comprehensive risk score, and send the risk warning information to a network security management device.

[0011] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0012] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0013] The beneficial effects of this application are as follows: 1. Improve the accuracy and efficiency of network attack detection: Multi-dimensional feature extraction and deep learning: Utilizing multi-dimensional attack feature vectors and pre-trained deep neural networks, it is possible to more comprehensively and accurately identify attack types and assess attack intensity, effectively reducing false positive and false negative rates and improving detection efficiency.

[0014] Real-time monitoring and risk mapping: By monitoring network traffic in real time and correlating it with asset vulnerability assessment results to build a risk mapping matrix, high-risk attacks can be quickly identified, early warnings can be issued in a timely manner, and potential losses can be avoided.

[0015] 2. Accurately assess asset vulnerability and attack risks: Asset weight coefficient: The asset weight coefficient is calculated based on business impact and data sensitivity, making the vulnerability assessment more in line with the actual business scenario and more accurately reflecting the importance of the asset.

[0016] Vulnerability hazard level and difficulty of exploitation: Combine the vulnerability scoring system and attack type identification results to comprehensively evaluate the vulnerability hazard level and difficulty of exploitation to make risk assessment more accurate.

[0017] Comprehensive risk score: Calculating the comprehensive risk score through the risk mapping matrix can more comprehensively consider attack threats and asset vulnerabilities and provide more accurate risk assessment results.

[0018] 3. Enhance network security management capabilities: Risk warning: Generate risk warning information based on the comprehensive risk score and send it to the network security management device, which can help security personnel understand the network security situation in a timely manner and take corresponding defense measures.

[0019] Active defense: By providing early warning of potential risks, security personnel can take proactive defensive measures rather than passively waiting for an attack to occur before responding, thereby enhancing network security defense capabilities.

[0020] In summary, this patented technology can more effectively detect and assess cyber attack risks and improve network security management by combining methods such as deep learning, risk mapping, and asset vulnerability assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of a process flow of a network attack risk mapping and assessment method according to an embodiment of the present invention; Figure 2 Schematic diagram of the structure of a network attack risk mapping and assessment system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0024] Figure 1 FIG. 1 is a flow chart of a network attack risk mapping and assessment method according to an embodiment of the present invention. Figure 1 As shown, the method includes: S11. Collect network traffic data packets, extract a multidimensional attack feature vector from the network traffic data packets, the multidimensional attack feature vector includes attack time feature, attack source address feature, attack target feature, attack traffic feature and attack protocol feature; input the multidimensional attack feature vector into a pre-trained deep neural network for feature learning, the deep neural network outputs an attack type recognition result and an attack intensity evaluation value; and construct an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value; S12. Determine the asset weight coefficient according to the attack type recognition result, where the asset weight coefficient is calculated based on the business impact degree and data sensitivity; determine the vulnerability hazard level according to the attack intensity evaluation value, and the vulnerability hazard level is divided by using a vulnerability scoring system; determine the vulnerability exploitation difficulty coefficient based on the attack type recognition result; input the asset weight coefficient, the vulnerability hazard level, and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain the asset vulnerability assessment score; S13. Use the attack feature standard model to monitor the real-time network traffic and generate real-time attack feature data; perform correlation analysis on the real-time attack feature data and the asset vulnerability assessment score to construct a risk mapping matrix, where the abscissa of the risk mapping matrix represents the attack threat level and the ordinate represents the asset vulnerability level; calculate the comprehensive risk score based on the risk mapping matrix; generate risk warning information according to the comprehensive risk score and send the risk warning information to the network security management device.

[0025] First, collect network traffic data packets. Use technical means such as network traffic mirroring ports or network probes to capture data packets in the network in real time. These data packets contain rich network communication information, such as source IP address, destination IP address, port number, protocol type, timestamp, etc. For example, a data packet is captured with a source IP address of 192.168.1.10, a destination IP address of 10.0.0.20, a port number of 80, a protocol type of TCP, and a timestamp of 2024-07-27 10:00:00.

[0026] Next, extract multi-dimensional attack feature vectors from the captured network traffic data packets. This requires in-depth parsing of the data packets to extract features related to attack behaviors. These features can be divided into five dimensions: attack time features, attack source address features, attack target features, attack traffic features, and attack protocol features. For example, the attack time feature can be the number of connections per unit time, the attack source address feature can be the geographical location information of the source IP address, the attack target feature can be the known vulnerability information of the target port, the attack traffic feature can be the size and frequency of the data packets, and the attack protocol feature can be the protocol type and the specific field information contained therein. The extracted feature vectors can be represented as a multi-dimensional array, for example: [100, "China", "CVE-2023-1234", 1024, "TCPSYN"].

[0027] Then, the extracted multi-dimensional attack feature vector is input into the pre-trained deep neural network for feature learning. The deep neural network can automatically learn complex feature representations and identify potential attack patterns. The output of the deep neural network includes the attack type recognition result and the attack intensity evaluation value. For example, the deep neural network can identify that the attack is a DDoS attack, and the attack intensity evaluation value is 8 (ranging from 1-10, 10 represents the highest attack intensity).

[0028] The attack feature standard model is constructed based on the attack type identification results and attack intensity evaluation values. The model stores the feature vectors of various attack types and their corresponding attack intensity evaluation values ​​for subsequent real-time attack detection. For example, the standard model of DDoS attack can be defined as: the number of connections per unit time exceeds 1,000, the source IP address is widely distributed, the target port is 80, and the attack intensity evaluation value is 8.

[0029] The asset weight coefficient is determined based on the attack type identification results. The asset weight coefficient is calculated based on business impact and data sensitivity. For example, for an e-commerce website, the business impact and data sensitivity of its order database are both high, so its asset weight coefficient can be set to 0.9 (range 0-1, 1 represents the highest weight). The business impact and data sensitivity of the website's news announcement page are low, so its asset weight coefficient can be set to 0.2.

[0030] The vulnerability hazard level is determined based on the attack strength assessment value. The vulnerability hazard level is divided using a vulnerability scoring system, such as the CVSS scoring system. For example, if the attack strength assessment value is 8, the corresponding vulnerability hazard level is high risk.

[0031] Determine the vulnerability exploitation difficulty coefficient based on the attack type identification result. For example, for SQL injection attacks, if the target system does not perform input validation, the vulnerability exploitation difficulty coefficient is low and can be set to 0.2 (the range is 0-1, 0 represents the lowest exploitation difficulty). On the contrary, if the target system performs strict input validation, the vulnerability exploitation difficulty coefficient is high and can be set to 0.8.

[0032] Input the asset weight coefficient, vulnerability hazard level and vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain the asset vulnerability assessment score. For example, if the asset weight coefficient is 0.9, the vulnerability hazard level is high risk (corresponding score is 0.8), and the vulnerability exploitation difficulty coefficient is 0.2, the asset vulnerability assessment score is 0.9*0.8*0.2=0.144.

[0033] Use the attack feature standard model to monitor real-time network traffic and generate real-time attack feature data. For example, if the number of connections per unit time in real-time network traffic exceeds 1,000, the source IP addresses are widely distributed, and the target port is 80, then the real-time attack feature data is generated: [1200,"Global",80,"TCPSYN"].

[0034] The real-time attack feature data and the asset vulnerability assessment score are correlated and analyzed to construct a risk mapping matrix. The horizontal axis of the risk mapping matrix represents the attack threat level, and the vertical axis represents the asset vulnerability level. For example, if the real-time attack feature data matches the standard model of DDoS attack, the attack threat level is high, and the asset vulnerability assessment score is 0.144, the risk value is marked at the corresponding position in the risk mapping matrix.

[0035] The comprehensive risk score is calculated based on the risk mapping matrix. For example, based on the weighted average of the risk values ​​in the risk mapping matrix, the comprehensive risk score is calculated to be 7 (on a scale of 1-10, with 10 representing the highest risk).

[0036] Generate risk warning information based on the comprehensive risk score and send it to the network security management device. For example, if the comprehensive risk score is 7, a high risk warning information is generated and sent to the security information and event management (SIEM) system.

[0037] The beneficial effects of this method can be summarized in the following three aspects: 1. Improve the accuracy and efficiency of attack detection: Through deep learning models and multi-dimensional feature analysis, it is possible to more accurately identify various types of network attacks, assess their intensity, and reduce false positives and false negatives.

[0038] 2. Accurately assess asset vulnerabilities: Combine business impact, data sensitivity, vulnerability hazard level, and vulnerability exploitation difficulty to conduct a more comprehensive vulnerability assessment of assets, thereby providing more targeted security protection.

[0039] 3. Real-time monitoring and early warning of risks: Through real-time correlation analysis of attack characteristics and asset vulnerabilities, potential risks can be discovered in a timely manner, and early warning information can be generated to help security personnel quickly respond to and handle security incidents.

[0040] In an optional implementation, the multi-dimensional attack feature vector is input into a pre-trained deep neural network for feature learning, and the deep neural network outputs an attack type recognition result and an attack intensity evaluation value: constructing an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value includes: Performing minimum-maximum normalization processing on the multidimensional attack feature vector to obtain a standardized feature vector, wherein the multidimensional attack feature vector includes an attack time feature, an attack source address feature, an attack target feature, an attack traffic feature, and an attack protocol feature; Inputting the standardized feature vector into a one-dimensional convolutional neural network, the one-dimensional convolutional neural network comprises a plurality of parallel convolution branches, each of which has a convolution kernel size of 3 and a step size of 1, and each of which is connected to a batch normalization layer and a rectified linear unit activation function to obtain a local temporal feature; Inputting the local temporal features into a bidirectional gated recurrent unit network, wherein the bidirectional gated recurrent unit network comprises a forward gated recurrent unit and a reverse gated recurrent unit, and obtaining a fused hidden state by concatenating a forward hidden state output by the forward gated recurrent unit and a reverse hidden state output by the reverse gated recurrent unit; The fused hidden state is input into a self-attention mechanism network, the self-attention mechanism network calculates an attention score by linear transformation of a query vector, a key vector, and a value vector, and the attention score is normalized by a normalized exponential function and weighted with the value vector to obtain an attention output feature; Input the attention output feature into a multi-task learning framework, wherein the multi-task learning framework includes a shared encoder and two task decoders, wherein the shared encoder is a multi-layer perceptron structure with a dropout layer set between layers, and the two task decoders are a normalized exponential function classifier and a sigmoid regressor respectively; The multi-task learning framework is trained using a weighted loss function, wherein the weighted loss function is composed of a classification loss calculated by a cross entropy loss function and a regression loss calculated by a mean square error loss function, and a weight ratio of the classification loss to the regression loss is adjusted by a balancing factor; The attack type identification result output by the normalized exponential function classifier is stored in an attack type feature library, and the attack type feature library calculates the feature matching degree based on cosine similarity; the attack strength evaluation value output by the sigmoid regressor is input into an attack strength evaluation engine, and the attack strength evaluation engine calculates the comprehensive strength score based on fuzzy reasoning; An attack feature standard model is constructed based on the attack type feature library and the attack intensity assessment engine, and the attack feature standard model is updated through regular retraining and online fine-tuning.

[0041] First, collect network traffic data and extract multi-dimensional attack feature vectors from it. These feature vectors cover five dimensions: attack time feature, attack source address feature, attack target feature, attack traffic feature, and attack protocol feature. For example, attack time feature can include the date, time, and duration of the attack; attack source address feature can include source IP address, source port number, source geographic location, etc.; attack target feature can include target IP address, target port number, target service type, etc.; attack traffic feature can include packet size, number of packets, data transmission rate, etc.; attack protocol feature can include the type of network protocol used, protocol version number, etc.

[0042] Then, the extracted multi-dimensional attack feature vector is subjected to minimum-maximum normalization. Minimum-maximum normalization scales the numerical range of each feature to between 0 and 1 to eliminate the impact of dimensional differences between different features. Taking the attack time feature as an example, assuming that the time range of the attack samples we collected is from 2024-03-15 00:00:00 to 2024-03-15 23:59:59, the attack time of the sample 2024-03-15 10:00:00 is converted to a value between 0 and 1. After normalization, the feature vector of the above attack sample may become: [0.417, 0.5, 0.8, 0.6, 1, 0.5, 0.5, 0.9, 0.1].

[0043] Next, the normalized feature vector is input into a one-dimensional convolutional neural network for feature learning. The network contains multiple parallel convolution branches, each with a convolution kernel size of 3 and a stride of 1. Each convolution branch is followed by a batch normalization layer and a rectified linear unit activation function to extract local temporal features. Assuming that the convolution kernel of a convolution branch is [0.1, 0.2, 0.3], the branch performs a convolution operation on the first three elements of the input vector [0.417, 0.5, 0.8, 0.6, 1, 0.5, 0.5, 0.9, 0.1] to obtain local features.

[0044] The local temporal features output by the convolutional neural network are input into the bidirectional gated recurrent unit network. The network contains forward and reverse gated recurrent units, which process the forward and reverse temporal information respectively. The outputs of the forward and reverse gated recurrent units are concatenated to obtain the fused hidden state, which captures the temporal features more comprehensively.

[0045] The fused hidden state is input into the self-attention mechanism network, which weights the features at different time steps and extracts global correlation features by calculating the attention scores between the query vector, key vector, and value vector.

[0046] The output features of the self-attention mechanism network are input into the multi-task learning framework. The framework consists of a shared encoder and two task decoders. The shared encoder is a multi-layer perceptron structure with dropout layers between layers to extract high-level features. The two task decoders are a normalized exponential function classifier and a sigmoid regressor, which are used for attack type identification and attack intensity assessment, respectively.

[0047] The multi-task learning framework is trained using a weighted loss function. The loss function is composed of the weighted classification loss calculated by the cross entropy loss function and the regression loss calculated by the mean square error loss function. The weight ratio of the classification loss and the regression loss is adjusted by the balance factor.

[0048] The attack type identification result output by the normalized exponential function classifier is stored in the attack type feature library. The feature library calculates the feature matching degree based on cosine similarity and is used to quickly identify attacks of known types. The attack strength evaluation value output by the sigmoid regressor is input into the attack strength evaluation engine. The engine calculates the comprehensive strength score based on fuzzy reasoning and is used to evaluate the degree of harm of the attack.

[0049] Finally, a standard attack feature model is built based on the attack type feature library and attack intensity assessment engine. The model is updated through regular retraining and online fine-tuning to adapt to the ever-changing network attack environment.

[0050] The beneficial effects of this method can be summarized in the following three aspects: 1. Improve attack detection accuracy: By learning multi-dimensional attack features through deep neural networks and combining a multi-task learning framework to simultaneously identify attack types and assess attack intensity, various types of network attacks can be detected more accurately.

[0051] 2. Enhanced attack intensity assessment capabilities: Using fuzzy reasoning to calculate the comprehensive intensity score can more comprehensively and finely assess the degree of harm of the attack, providing a more effective decision-making basis for security protection.

[0052] 3. Improve model adaptability: Through regular retraining and online fine-tuning, the attack feature standard model can continuously learn new attack patterns and maintain sensitivity to the latest attack types, thereby better adapting to the ever-changing network security environment.

[0053] In an optional implementation, determining an asset weight coefficient according to the attack type identification result, the asset weight coefficient is calculated based on business impact and data sensitivity; determining a vulnerability hazard level according to the attack intensity assessment value, the vulnerability hazard level is divided using a vulnerability scoring system; determining a vulnerability exploitation difficulty coefficient based on the attack type identification result includes: Determine the scope and type of affected assets based on the attack type identification results, and construct a business impact scoring matrix and a data sensitivity scoring matrix based on the affected assets. The business impact scoring matrix includes a business interruption duration score, a revenue loss degree score, and a user impact range score. The data sensitivity scoring matrix includes a personal privacy data score, a transaction business data score, and an operation and maintenance management data score. Multiplying the business impact scoring matrix by a first adjustment factor to obtain a business impact score, multiplying the data sensitivity scoring matrix by a second adjustment factor to obtain a data sensitivity score, and adding the business impact score to the data sensitivity score to obtain an asset weight coefficient; A vulnerability scoring index system is constructed based on the attack intensity assessment value, wherein the vulnerability scoring index system includes basic assessment indicators, time dimension indicators, and environment dimension indicators. The basic assessment indicators include permission requirements, user interactions, and impact scope. The time dimension indicators include vulnerability exploit code maturity, patch repair status, and vulnerability disclosure time. The environment dimension indicators include security requirement level, deployment environment, and existing protection measures. Calculate the vulnerability hazard level according to the vulnerability scoring indicator system, and the vulnerability hazard level is divided based on the general vulnerability scoring system; Building a vulnerability exploitation difficulty assessment system based on the attack type identification result, wherein the vulnerability exploitation difficulty assessment system includes attack chain complexity, technical requirements, and defense bypass difficulty; Multiply the attack chain complexity by the first weight coefficient to obtain an attack chain complexity score, multiply the technical requirements by the second weight coefficient to obtain a technical requirement score, multiply the protection bypass difficulty by the third weight coefficient to obtain a protection bypass difficulty score, and add the attack chain complexity score, the technical requirement score, and the protection bypass difficulty score to obtain a vulnerability exploitation difficulty coefficient.

[0054] A vulnerability hazard assessment method based on attack type identification results can more accurately assess vulnerability risks and help security personnel prioritize high-risk vulnerabilities. The core of this method is to conduct a comprehensive assessment based on business impact, data sensitivity, attack intensity, and vulnerability exploitation difficulty.

[0055] First, identify the attack type. For example, identify the attack type as a SQL injection attack.

[0056] Next, determine the scope and type of affected assets. If the attack type is SQL injection, the affected assets may be database servers and databases that store sensitive user information. Determine the type of affected assets, such as database servers, web servers, file servers, etc.

[0057] Then, construct a business impact scoring matrix and a data sensitivity scoring matrix. The business impact scoring matrix includes scores for business interruption duration, revenue loss, and user impact range. For example, if the database server is interrupted, the business interruption duration may be 24 hours, and the score is set to 10; the revenue loss may be medium, and the score is set to 5; the user impact range may be 1,000 users, and the score is set to 8. The data sensitivity scoring matrix includes scores for personal privacy data, transaction business data, and operation and maintenance management data. For example, if a large amount of personal privacy data is stored in the database, the score is set to 10; if a small amount of transaction business data is stored, the score is set to 3; if a small amount of operation and maintenance management data is stored, the score is set to 2.

[0058] According to the pre-set rules, the scores of each item in the business impact scoring matrix are multiplied by the corresponding adjustment factors, and then added to obtain the business impact score. For example, the business interruption duration score of 10 is multiplied by the adjustment factor of 0.8, the income loss score of 5 is multiplied by the adjustment factor of 0.5, and the user impact range score of 8 is multiplied by the adjustment factor of 0.7, and the business impact score is obtained as 8+2.5+5.6=16.1. Similarly, the scores of each item in the data sensitivity scoring matrix are multiplied by the corresponding adjustment factors, and then added to obtain the data sensitivity score. For example, the personal privacy data score of 10 is multiplied by the adjustment factor of 0.9, the transaction business data score of 3 is multiplied by the adjustment factor of 0.6, and the operation and maintenance management data score of 2 is multiplied by the adjustment factor of 0.3, and the data sensitivity score of 9+1.8+0.6=11.4 is obtained. The business impact score of 16.1 is added to the data sensitivity score of 11.4 to obtain the asset weight coefficient of 27.5.

[0059] Then, a vulnerability scoring indicator system is constructed. The system includes basic evaluation indicators, time dimension indicators, and environment dimension indicators. Basic evaluation indicators include permission requirements, user interaction, and scope of impact. Time dimension indicators include vulnerability exploit code maturity, patch repair status, and vulnerability disclosure time. Environment dimension indicators include security requirement level, deployment environment, and existing protection measures. For example, for SQL injection vulnerabilities, the permission requirement may be no permission required, and the score is set to 10; the user interaction may be user interaction required, and the score is set to 5; the scope of impact may be a single system, and the score is set to 3. The vulnerability exploit code maturity may be publicly available, and the score is set to 10; the patch repair status may be a released patch, and the score is set to 5; the vulnerability disclosure time may be one month ago, and the score is set to 3. The security requirement level may be high, and the score is set to 10; the deployment environment may be a production environment, and the score is set to 8; the existing protection measure may be WAF, and the score is set to 5.

[0060] According to the scores of each item in the vulnerability scoring indicator system, the vulnerability hazard level is calculated by referring to the Common Vulnerability Scoring System (CVSS). For example, if the CVSS score calculated based on the scores is 7.5, the vulnerability hazard level is high risk.

[0061] Next, we build a vulnerability exploit difficulty assessment system. This system includes attack chain complexity, technical requirements, and defense bypass difficulty. For example, for a SQL injection vulnerability, the attack chain complexity may be simple, with a score of 3; the technical requirements may be medium, with a score of 5; and the defense bypass difficulty may be difficult, with a score of 8.

[0062] Multiply the attack chain complexity score, technical requirement score, and defense bypass difficulty score by the corresponding weight coefficients, and then add them together to get the vulnerability exploitation difficulty coefficient. For example, multiply the attack chain complexity score of 3 by the weight coefficient of 0.2, the technical requirement score of 5 by the weight coefficient of 0.5, and the defense bypass difficulty score of 8 by the weight coefficient of 0.3 to get the vulnerability exploitation difficulty coefficient of 0.6+2.5+2.4=5.5.

[0063] Finally, the final vulnerability risk score is obtained by comprehensively considering the asset weight coefficient, vulnerability hazard level and vulnerability exploitation difficulty coefficient. For example, the asset weight coefficient of 27.5, the high-risk vulnerability hazard level (the corresponding score is set to 8, for example), and the vulnerability exploitation difficulty coefficient of 5.5 are weighted averaged to obtain the final vulnerability risk score.

[0064] The beneficial effects of this method are reflected in three aspects: 1. Improve the accuracy of vulnerability assessment: This method takes into account multiple factors such as business impact, data sensitivity, attack intensity, and vulnerability exploitation difficulty, and can assess vulnerability risks more comprehensively and accurately.

[0065] 2. Improve vulnerability repair efficiency: By scoring the risks of vulnerabilities, security personnel can prioritize high-risk vulnerabilities, thereby improving vulnerability repair efficiency.

[0066] 3. Enhance overall security protection capabilities: By accurately assessing vulnerability risks and promptly repairing high-risk vulnerabilities, security risks can be effectively reduced and overall security protection capabilities can be enhanced.

[0067] In an optional implementation, the asset weight coefficient, the vulnerability hazard level, and the vulnerability exploitation difficulty coefficient are input into the asset vulnerability assessment model to obtain an asset vulnerability assessment score, including: The hierarchical structure of the asset vulnerability assessment model is constructed by using the hierarchical analysis method. The hierarchical structure includes top-level indicators, middle-level indicators, and bottom-level indicators. The top-level indicator is a comprehensive vulnerability assessment score. The middle-level indicators include asset weight dimension, vulnerability hazard dimension, and difficulty of use dimension. The bottom-level indicators include specific assessment parameters of each dimension. Perform minimum-maximum normalization processing on the asset weight coefficient, the vulnerability hazard level, and the vulnerability exploitation difficulty coefficient, and map the normalized values ​​to the [0,1] interval; Based on the expert scoring method, a judgment matrix is ​​constructed, wherein the judgment matrix includes the relative importance of asset weight and vulnerability hazard, the relative importance of vulnerability hazard and difficulty of exploitation, and the relative importance of asset weight and difficulty of exploitation. The maximum eigenvalue of the judgment matrix is ​​calculated and the corresponding eigenvector is solved. The eigenvector is normalized to obtain a weight vector. Establishing an evaluation factor set and an evaluation level set, wherein the evaluation factor set includes an asset weight dimension, a vulnerability hazard dimension, and an exploitation difficulty dimension, and the evaluation level set includes a high risk level, a medium risk level, and a low risk level; Determine a single factor evaluation matrix based on the evaluation factor set and the evaluation grade set, and perform fuzzy synthesis operation on the weight vector and the single factor evaluation matrix to obtain a comprehensive evaluation result; The asset weight coefficient is multiplied by the asset weight dimension weight to obtain the asset weight score, the vulnerability hazard level is multiplied by the vulnerability hazard dimension weight to obtain the vulnerability hazard score, and the vulnerability exploitation difficulty coefficient is multiplied by the exploitation difficulty dimension weight to obtain the exploitation difficulty score; A Sigmoid function is used to perform nonlinear mapping on the asset weight score, the vulnerability hazard score, and the exploit difficulty score to obtain a mapped standardized score; The mapped asset weight score is multiplied by the first weight coefficient, the mapped vulnerability hazard score is multiplied by the second weight coefficient, and the mapped utilization difficulty score is multiplied by the third weight coefficient, and the three are added together to obtain the asset vulnerability assessment score.

[0068] In order to achieve accurate assessment of asset vulnerability, this implementation provides an asset vulnerability assessment method based on hierarchical analysis method and fuzzy comprehensive evaluation.

[0069] First, a hierarchical architecture model is constructed. The model is divided into three layers from top to bottom: the top layer is the comprehensive vulnerability assessment score, which represents the final assessment result; the middle layer contains three dimensions: asset weight dimension, vulnerability hazard dimension and exploit difficulty dimension; the bottom layer contains specific assessment parameters under each dimension, such as asset value, data sensitivity, vulnerability type, attack complexity, etc.

[0070] Next, the collected asset weight coefficients, vulnerability hazard levels, and vulnerability exploitation difficulty coefficients are preprocessed. The minimum-maximum standardization method is used to scale the original data to between 0 and 1 to eliminate the impact of dimensional differences between data of different dimensions. For example, assuming that there are three assets with weight coefficients of 10, 20, and 30, the minimum value is 10 and the maximum value is 30. The standardized weight coefficient of the first asset is (10-10) / (30-10)=0. The standardized weight coefficient of the second asset is (20-10) / (30-10)=0.5. The standardized weight coefficient of the third asset is (30-10) / (30-10)=1.

[0071] Then, determine the relative importance of each dimension. Invite domain experts to compare different dimensions in pairs and construct a judgment matrix. For example, judge the importance of the asset weight dimension relative to the vulnerability hazard dimension, and so on, to construct a 3x3 judgment matrix. By calculating the maximum eigenvalue of the judgment matrix and its corresponding eigenvector, and normalizing the eigenvector, we can get the weight vector of each dimension. For example, assuming that the obtained eigenvector is (0.2, 0.5, 0.3), the weights of asset weight, vulnerability hazard, and difficulty of exploitation are 0.2, 0.5, and 0.3 respectively. Next, establish the evaluation factor set and the evaluation level set. The evaluation factor set is the middle-level indicator: asset weight dimension, vulnerability hazard dimension, and exploit difficulty dimension. The evaluation level set is set to three risk levels: high, medium, and low. Based on the evaluation factor set and the evaluation level set, construct a single factor evaluation matrix. The matrix represents the degree of membership of each dimension at different risk levels. For example, the degree of membership of the asset weight dimension at high, medium, and low risk levels may be 0.8, 0.5, and 0.2, respectively.

[0072] The weight vector obtained previously is subjected to fuzzy synthesis operation with the single factor evaluation matrix to obtain a comprehensive evaluation result. The fuzzy synthesis operation method can adopt weighted average method and the like.

[0073] Multiply the standardized asset weight coefficient by the weight of the asset weight dimension to get the asset weight score. Similarly, multiply the standardized vulnerability hazard level by the weight of the vulnerability hazard dimension to get the vulnerability hazard score; multiply the standardized vulnerability exploitation difficulty coefficient by the weight of the exploitation difficulty dimension to get the exploitation difficulty score. For example, assuming that the standardized weight coefficient of an asset is 0.5 and the weight of the asset weight dimension is 0.2, the asset weight score of the asset is 0.5*0.2=0.1.

[0074] The Sigmoid function is used to perform nonlinear mapping on the asset weight score, vulnerability hazard score, and exploit difficulty score, and convert the score into a standardized score between 0 and 1. The Sigmoid function can amplify the differences between scores and improve the sensitivity of the assessment.

[0075] Finally, the mapped asset weight score, vulnerability hazard score, and difficulty of use score are multiplied by the preset first, second, and third weight coefficients, respectively, and the three are added together to obtain the final asset vulnerability assessment score. These three weight coefficients can be determined through expert experience or data analysis. For example, assuming that the mapped asset weight score is 0.6, the vulnerability hazard score is 0.8, the difficulty of use score is 0.4, and the first, second, and third weight coefficients are 0.3, 0.5, and 0.2, respectively, then the final asset vulnerability assessment score is 0.6*0.3+0.8*0.5+0.4*0.2=0.66.

[0076] The beneficial effects of this method are reflected in the following three aspects: 1. The evaluation results are more comprehensive and objective: This method comprehensively considers the three dimensions of asset weight, vulnerability hazard and difficulty of exploitation, and determines the weight of each dimension through hierarchical analysis, making the evaluation results more comprehensive and objective, avoiding the one-sidedness caused by single factor evaluation.

[0077] 2. The evaluation process is more scientific and standardized: This method uses technical means such as standardized processing, fuzzy comprehensive evaluation and nonlinear mapping to make the evaluation process more scientific and standardized, and improve the reliability and accuracy of the evaluation results.

[0078] 3. The evaluation results are easier to understand and apply: This method quantifies the evaluation results into a score between 0 and 1, which is easy to understand and compare, and also convenient for security managers to formulate corresponding security policies and measures based on the evaluation results.

[0079] In an optional implementation, the attack feature standard model is used to monitor real-time network traffic to generate real-time attack feature data; the real-time attack feature data is correlated with the asset vulnerability assessment score to construct a risk mapping matrix, including: Extract traffic statistics features, protocol behavior features, connection mode features, and load content features from network traffic, wherein the traffic statistics features include data packet size distribution, traffic rate changes, and session duration, the protocol behavior features include protocol type distribution and protocol state transitions, the connection mode features include source and destination address distribution, port usage mode, and connection establishment method, and the load content features include load keywords, feature byte sequences, and abnormal instruction sequences; A hierarchical feature extraction strategy is used to extract packet-level features, session-level features, application-level features, and aggregation-level features. The packet-level features extract the basic attributes of a single packet, the session-level features analyze the behavioral characteristics of TCP / UDP sessions, the application-level features identify abnormal patterns of application-layer protocols, and the aggregation-level features calculate the statistical attributes of multi-dimensional features. Constructing an AC automaton to preprocess the pattern string, and using a sliding window technology to perform feature matching on the packet level features, the session level features, the application level features, and the aggregation level features; Establishing a normal behavior baseline model, calculating the degree of behavior deviation of the feature matching result based on the normal behavior baseline model, and setting a dynamic detection threshold according to the degree of behavior deviation; Converting the detected attack features into a standardized data format, wherein the standardized data format includes attack type identification, timestamp information, attack source features, attack target information, attack behavior description, and threat level assessment; Performing temporal correlation on the standardized data formats based on a time window, performing spatial correlation on the standardized data formats based on an attack target, and performing behavioral correlation on the standardized data formats based on an attack pattern; A multidimensional risk mapping matrix is ​​constructed, wherein the horizontal axis of the multidimensional risk mapping matrix is ​​the asset vulnerability assessment score range, the vertical axis of the multidimensional risk mapping matrix is ​​the real-time attack feature threat level, and the matrix elements of the multidimensional risk mapping matrix are comprehensive risk assessment values.

[0080] Real-time network attack detection and risk assessment methods analyze network traffic, identify attack characteristics, and combine asset vulnerability assessment to build a risk mapping matrix to achieve real-time assessment of network security risks.

[0081] First, the network traffic is collected and preprocessed in real time. Preprocessing includes data cleaning, deduplication, format conversion and other operations to ensure the validity and consistency of the data. For example, the original network traffic data is converted into pcap format and duplicate data packets are removed.

[0082] Then, multi-dimensional attack features are extracted from the pre-processed network traffic, which includes four levels: packet level, session level, application level and aggregation level.

[0083] At the packet level, extract the basic properties of a single packet, such as packet size, timestamp, source IP address, destination IP address, protocol type, etc. For example, extract a packet with a size of 1500 bytes, a timestamp of 2024-07-27 10:00:00, a source IP address of 192.168.1.1, a destination IP address of 192.168.1.2, and a protocol type of TCP.

[0084] At the session level, analyze the behavioral characteristics of TCP / UDP sessions, such as session duration, number of packets, number of bytes, connection establishment method (such as three-way handshake), etc. For example, analyze a TCP session with a duration of 10 seconds, 100 packets, and 10,000 bytes.

[0085] At the application level, identify abnormal patterns of application layer protocols, such as HTTP request method distribution, URL parameter characteristics, DNS query types, etc. For example, identify an HTTP request that contains abnormal URL parameters, such as ".. / " or ";".

[0086] At the aggregation level, the statistical attributes of multi-dimensional features are calculated, such as the number of visits from a specific IP address within a period of time, the traffic volume of a specific port, etc. For example, the number of visits from a certain IP address to the target server within an hour is calculated to be 1,000 times, which exceeds the normal baseline value.

[0087] In order to perform feature matching efficiently, an AC automaton is constructed to pre-process the pattern string. For example, a known attack feature string is pre-constructed into an AC automaton for fast matching. Then, the extracted features are matched using a sliding window technique. For example, a sliding window of 100 packets is used to perform feature matching on the traffic data in each window.

[0088] In order to improve the accuracy of detection, a normal behavior baseline model is established. For example, by counting normal network traffic data over a period of time, a normal behavior baseline model is constructed. The degree of behavioral deviation of the feature matching results is calculated based on the model. For example, if the frequency of occurrence of a feature is significantly higher than the normal baseline value, it is considered to be abnormal. Dynamic detection thresholds are set according to the degree of behavioral deviation. For example, if the deviation degree of a feature exceeds the preset threshold, an alarm is triggered.

[0089] Convert the detected attack features into a standardized data format. For example, identify the attack type as "SQL injection", the timestamp information is "2024-07-27 10:00:00", the attack source feature is "192.168.1.1", the attack target information is "192.168.1.2", the attack behavior description is "trying to insert SQL statements in HTTP requests", and the threat level is assessed as "high".

[0090] In order to analyze the attack behavior more comprehensively, correlation analysis is performed on the standardized data. Time series correlation is performed based on the time window, for example, the time window is set to 1 minute, and the attack events that occurred in the same time window are correlated. Spatial correlation is performed based on the attack target, for example, the attack events against the same target server are correlated. Behavior correlation is performed based on the attack pattern, for example, events with similar attack patterns are correlated.

[0091] Finally, a multi-dimensional risk mapping matrix is ​​constructed. The horizontal axis of the matrix is ​​the asset vulnerability assessment score range, for example, the score range is divided into three levels: low, medium, and high. The vertical axis of the matrix is ​​the real-time attack feature threat level, for example, the threat level is divided into three levels: low, medium, and high. The elements of the matrix are comprehensive risk assessment values, for example, the risk assessment value is divided into three levels: low, medium, and high. For example, if the vulnerability assessment score of an asset is "high" and the detected attack feature threat level is "high", the comprehensive risk assessment value is "high".

[0092] The beneficial effects are reflected in three aspects: 1. Improve the accuracy and efficiency of attack detection: Through multi-dimensional feature extraction and dynamic threshold setting, it can more accurately identify attack behaviors and reduce false alarm rates. At the same time, the application of AC automata and sliding window technology improves the efficiency of feature matching.

[0093] 2. Enhance the comprehensiveness and real-time nature of risk assessment: By building a multi-dimensional risk mapping matrix and combining attack characteristics with asset vulnerability assessment, a comprehensive assessment of network security risks is achieved. The application of real-time attack characteristic data enables risk assessment to be conducted in real time and potential risks to be discovered in a timely manner.

[0094] 3. Improve the pertinence and effectiveness of security protection: Through correlation analysis of attack behaviors, we can have a deeper understanding of the attacker's intentions and methods, so as to formulate more targeted security protection strategies and improve the effectiveness of security protection.

[0095] In an optional implementation, calculating a comprehensive risk score based on the risk mapping matrix includes: Establish a multi-level risk quantification indicator system, which includes asset value impact, vulnerability exploitation possibility, threat event frequency, and security protection capability. The asset value impact includes asset importance, business relevance, and data sensitivity. The vulnerability exploitation possibility includes technical threshold, required resources, and exploitation conditions. The threat event frequency includes attack frequency, duration, and attack intensity. The security protection capability includes security measure effectiveness, response capability, and recovery capability. The weights of the asset value impact, the vulnerability exploitation possibility, the threat event frequency, and the security protection capability are calculated using the analytic hierarchy process and entropy weight method, and the weights are modified according to the indicator correlation to establish a dynamic adjustment mechanism for the weights; Establish risk level classification standards, design scoring calculation rules, and decompose risk scores into direct loss impact scores, indirect loss impact scores, reputation impact scores, and compliance impact scores; Calculate the asset-based risk score, evaluate the threat impact score, quantify the vulnerability severity score, and measure the protection capability score. Perform a weighted operation on the asset-based risk score, the threat impact score, the vulnerability severity score, the protection capability score, and the weight to obtain a weighted risk score.

[0096] First, a multi-level risk quantification indicator system is constructed. The system includes four first-level indicators: asset value impact, vulnerability exploitation possibility, threat event frequency, and security protection capability. Asset value impact is further subdivided into three second-level indicators: asset importance, business relevance, and data sensitivity. Vulnerability exploitation possibility is subdivided into three second-level indicators: technical threshold, required resources, and exploitation conditions. Threat event frequency is subdivided into three second-level indicators: attack frequency, duration, and attack intensity. Security protection capability is subdivided into three second-level indicators: security measure effectiveness, response capability, and recovery capability.

[0097] Next, determine the weight of each indicator. Use the analytic hierarchy process and entropy weight method to calculate the weights of the primary and secondary indicators respectively. For example, for the indicator of "asset value impact", you can invite multiple experts to compare the three secondary indicators of "asset importance", "business relevance" and "data sensitivity" in pairs, build a judgment matrix, and calculate their respective weights. At the same time, collect historical data and use the entropy weight method to calculate the weights of these three secondary indicators. Then, modify the weights obtained by the two methods according to the correlation of the indicators, and establish a dynamic adjustment mechanism for the weights. For example, the weights can be adjusted according to the results of the quarterly security situation assessment.

[0098] Then, construct the risk level classification standard and score calculation rules. Decompose the risk score into direct loss impact score, indirect loss impact score, reputation impact score and compliance impact score. For example, the risk level can be divided into four levels: low, medium, high and very high, and each is assigned 1-4 points. The direct loss impact score can be evaluated based on the possible economic loss, the indirect loss impact score can be evaluated based on the possible business interruption time, the reputation impact score can be evaluated based on the possible public negative evaluation, and the compliance impact score can be evaluated based on the possible violation of laws and regulations.

[0099] After that, calculate the scores for each item. First, calculate the asset-based risk score. For example, evaluate the risk of the asset itself based on the importance of the asset, business relevance, data sensitivity, and historical security incident records. Then evaluate the threat impact score. For example, analyze the attack method and target of potential threats and evaluate the damage they may cause. Next, quantify the vulnerability severity score. For example, evaluate the severity of the vulnerability based on factors such as the type, exploitability, and scope of impact. Finally, measure the protection capability score. For example, evaluate the effectiveness, response, and recovery capabilities of existing security measures.

[0100] Finally, each score is weighted with the corresponding weight to obtain the final weighted risk score. For example, the asset-based risk score, threat impact score, vulnerability severity score, and protection capability score are multiplied by their corresponding weights, and then the four results are added together to obtain the final risk score.

[0101] For example, the evaluation data of a server is as follows: the asset importance score is 9 (out of 10), the business relevance score is 8, and the data sensitivity score is 7; the technical threshold score is 3 (out of 10, the lower the score, the lower the technical threshold), the required resources score is 6, and the exploitation condition score is 4; the attack frequency score is 8, the duration score is 5, and the attack intensity score is 7; the security measures effectiveness score is 6, the response ability score is 7, and the recovery ability score is 8. Assume that after calculation and correction by the hierarchical analysis method and the entropy weight method, the weights of the first-level indicators are: asset value impact 0.3, vulnerability exploitation possibility 0.2, threat event frequency 0.3, and security protection capability 0.2. The weights of the second-level indicators are evenly divided. Then the asset value impact score is (9+8+7) / 3*0.3=2.4. The calculation method of other indicators is similar. The final risk score is obtained by weighted summation of the scores of each indicator.

[0102] The beneficial effects of this method can be summarized in the following three aspects: 1. Improve the accuracy of risk assessment: The multi-level indicator system and scientific weight calculation method can assess risks more comprehensively and accurately, avoiding the deviation caused by subjective judgment.

[0103] 2. Improve the efficiency of risk management: By quantifying risks, resources can be allocated more effectively, high-risk items can be prioritized, and the efficiency of risk management can be improved.

[0104] 3. Enhance risk response capabilities: The dynamic adjustment mechanism can adapt to the ever-changing threat environment, making risk assessment results closer to the actual situation, thereby enhancing risk response capabilities.

[0105] Figure 2 FIG. 1 is a schematic diagram of the structure of a network attack risk mapping and assessment system according to an embodiment of the present invention. Figure 2 As shown, the system comprises: The first unit is used to collect network traffic data packets, extract a multi-dimensional attack feature vector from the network traffic data packets, and the multi-dimensional attack feature vector includes attack time feature, attack source address feature, attack target feature, attack traffic feature and attack protocol feature; input the multi-dimensional attack feature vector into a pre-trained deep neural network for feature learning, and the deep neural network outputs an attack type recognition result and an attack intensity evaluation value; and construct an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value; The second unit is used to determine an asset weight coefficient according to the attack type identification result, the asset weight coefficient is calculated based on the business impact and data sensitivity; determine the vulnerability hazard level according to the attack intensity assessment value, the vulnerability hazard level is divided using a vulnerability scoring system; determine the vulnerability exploitation difficulty coefficient based on the attack type identification result; input the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain an asset vulnerability assessment score; The third unit is used to monitor real-time network traffic using the attack feature standard model to generate real-time attack feature data; perform correlation analysis on the real-time attack feature data and the asset vulnerability assessment score to construct a risk mapping matrix, wherein the horizontal axis of the risk mapping matrix represents the attack threat level and the vertical axis represents the asset vulnerability level; calculate a comprehensive risk score based on the risk mapping matrix; generate risk warning information based on the comprehensive risk score, and send the risk warning information to a network security management device.

[0106] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0107] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0108] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network attack risk mapping assessment method, characterized in that: include: Collecting network traffic data packets, and extracting a multidimensional attack feature vector from the network traffic data packets, wherein the multidimensional attack feature vector includes an attack time feature, an attack source address feature, an attack target feature, an attack traffic feature, and an attack protocol feature; Inputting the multi-dimensional attack feature vector into a pre-trained deep neural network for feature learning, the deep neural network outputting an attack type recognition result and an attack intensity evaluation value; constructing an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value; Determining an asset weight coefficient according to the attack type identification result, wherein the asset weight coefficient is calculated based on business impact and data sensitivity; Determine the vulnerability hazard level according to the attack intensity assessment value, and the vulnerability hazard level is divided using a vulnerability scoring system; determine the vulnerability exploitation difficulty coefficient based on the attack type identification result; input the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain an asset vulnerability assessment score; The attack feature standard model is used to monitor real-time network traffic to generate real-time attack feature data; the real-time attack feature data is correlated with the asset vulnerability assessment score to construct a risk mapping matrix, wherein the horizontal axis of the risk mapping matrix represents the attack threat level and the vertical axis represents the asset vulnerability level; calculating a comprehensive risk score based on the risk mapping matrix; Generate risk warning information based on the comprehensive risk score, and send the risk warning information to the network security management device.

2. The method according to claim 1, characterized in that Inputting the multi-dimensional attack feature vector into a pre-trained deep neural network for feature learning, the deep neural network outputting an attack type recognition result and an attack intensity evaluation value: constructing an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value includes: Performing minimum-maximum normalization processing on the multidimensional attack feature vector to obtain a standardized feature vector, wherein the multidimensional attack feature vector includes an attack time feature, an attack source address feature, an attack target feature, an attack traffic feature, and an attack protocol feature; Inputting the standardized feature vector into a one-dimensional convolutional neural network, the one-dimensional convolutional neural network comprises a plurality of parallel convolution branches, each of which has a convolution kernel size of 3 and a step size of 1, and each of which is connected to a batch normalization layer and a rectified linear unit activation function to obtain a local temporal feature; Inputting the local temporal features into a bidirectional gated recurrent unit network, wherein the bidirectional gated recurrent unit network comprises a forward gated recurrent unit and a reverse gated recurrent unit, and obtaining a fused hidden state by concatenating a forward hidden state output by the forward gated recurrent unit and a reverse hidden state output by the reverse gated recurrent unit; The fused hidden state is input into a self-attention mechanism network, the self-attention mechanism network calculates an attention score by linear transformation of a query vector, a key vector, and a value vector, and the attention score is normalized by a normalized exponential function and weighted with the value vector to obtain an attention output feature; Input the attention output feature into a multi-task learning framework, wherein the multi-task learning framework includes a shared encoder and two task decoders, wherein the shared encoder is a multi-layer perceptron structure with a dropout layer set between layers, and the two task decoders are a normalized exponential function classifier and a sigmoid regressor respectively; The multi-task learning framework is trained using a weighted loss function, wherein the weighted loss function is composed of a classification loss calculated by a cross entropy loss function and a regression loss calculated by a mean square error loss function, and a weight ratio of the classification loss to the regression loss is adjusted by a balancing factor; The attack type identification result output by the normalized exponential function classifier is stored in an attack type feature library, and the attack type feature library calculates the feature matching degree based on cosine similarity; the attack strength evaluation value output by the sigmoid regressor is input into an attack strength evaluation engine, and the attack strength evaluation engine calculates the comprehensive strength score based on fuzzy reasoning; An attack feature standard model is constructed based on the attack type feature library and the attack intensity assessment engine, and the attack feature standard model is updated through regular retraining and online fine-tuning.

3. The method according to claim 1, characterized in that Determine an asset weight coefficient according to the attack type identification result, and the asset weight coefficient is calculated based on the business impact and data sensitivity; determine the vulnerability hazard level according to the attack intensity assessment value, and the vulnerability hazard level is divided using a vulnerability scoring system; Determining the vulnerability exploitation difficulty coefficient based on the attack type identification result includes: Determine the scope and type of affected assets based on the attack type identification results, and construct a business impact scoring matrix and a data sensitivity scoring matrix based on the affected assets. The business impact scoring matrix includes a business interruption duration score, a revenue loss degree score, and a user impact range score. The data sensitivity scoring matrix includes a personal privacy data score, a transaction business data score, and an operation and maintenance management data score. Multiplying the business impact scoring matrix by a first adjustment factor to obtain a business impact score, multiplying the data sensitivity scoring matrix by a second adjustment factor to obtain a data sensitivity score, and adding the business impact score to the data sensitivity score to obtain an asset weight coefficient; A vulnerability scoring index system is constructed based on the attack intensity assessment value, wherein the vulnerability scoring index system includes basic assessment indicators, time dimension indicators, and environment dimension indicators. The basic assessment indicators include permission requirements, user interactions, and impact scope. The time dimension indicators include vulnerability exploit code maturity, patch repair status, and vulnerability disclosure time. The environment dimension indicators include security requirement level, deployment environment, and existing protection measures. Calculate the vulnerability hazard level according to the vulnerability scoring indicator system, and the vulnerability hazard level is divided based on the general vulnerability scoring system; Building a vulnerability exploitation difficulty assessment system based on the attack type identification result, wherein the vulnerability exploitation difficulty assessment system includes attack chain complexity, technical requirements, and defense bypass difficulty; Multiply the attack chain complexity by the first weight coefficient to obtain an attack chain complexity score, multiply the technical requirements by the second weight coefficient to obtain a technical requirement score, multiply the protection bypass difficulty by the third weight coefficient to obtain a protection bypass difficulty score, and add the attack chain complexity score, the technical requirement score, and the protection bypass difficulty score to obtain a vulnerability exploitation difficulty coefficient.

4. The method according to claim 1, characterized in that: Inputting the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain the asset vulnerability assessment score includes: The hierarchical structure of the asset vulnerability assessment model is constructed by using the hierarchical analysis method. The hierarchical structure includes top-level indicators, middle-level indicators, and bottom-level indicators. The top-level indicator is a comprehensive vulnerability assessment score. The middle-level indicators include asset weight dimension, vulnerability hazard dimension, and difficulty of use dimension. The bottom-level indicators include specific assessment parameters of each dimension. Perform minimum-maximum normalization processing on the asset weight coefficient, the vulnerability hazard level, and the vulnerability exploitation difficulty coefficient, and map the normalized values ​​to the [0,1] interval; Based on the expert scoring method, a judgment matrix is ​​constructed, wherein the judgment matrix includes the relative importance of asset weight and vulnerability hazard, the relative importance of vulnerability hazard and difficulty of exploitation, and the relative importance of asset weight and difficulty of exploitation. The maximum eigenvalue of the judgment matrix is ​​calculated and the corresponding eigenvector is solved. The eigenvector is normalized to obtain a weight vector. Establishing an evaluation factor set and an evaluation level set, wherein the evaluation factor set includes an asset weight dimension, a vulnerability hazard dimension, and an exploitation difficulty dimension, and the evaluation level set includes a high risk level, a medium risk level, and a low risk level; Determine a single factor evaluation matrix based on the evaluation factor set and the evaluation level set, and perform fuzzy synthesis operation on the weight vector and the single factor evaluation matrix to obtain a comprehensive evaluation result; The asset weight coefficient is multiplied by the asset weight dimension weight to obtain the asset weight score, the vulnerability hazard level is multiplied by the vulnerability hazard dimension weight to obtain the vulnerability hazard score, and the vulnerability exploitation difficulty coefficient is multiplied by the exploitation difficulty dimension weight to obtain the exploitation difficulty score; A Sigmoid function is used to perform nonlinear mapping on the asset weight score, the vulnerability hazard score, and the exploit difficulty score to obtain a mapped standardized score; The mapped asset weight score is multiplied by the first weight coefficient, the mapped vulnerability hazard score is multiplied by the second weight coefficient, and the mapped utilization difficulty score is multiplied by the third weight coefficient, and the three are added together to obtain the asset vulnerability assessment score.

5. The method according to claim 1, characterized in that Using the attack feature standard model to monitor real-time network traffic and generate real-time attack feature data; Correlation analysis is performed between the real-time attack feature data and the asset vulnerability assessment score to construct a risk mapping matrix, including: Extract traffic statistics features, protocol behavior features, connection mode features, and load content features from network traffic, wherein the traffic statistics features include data packet size distribution, traffic rate changes, and session duration, the protocol behavior features include protocol type distribution and protocol state transitions, the connection mode features include source and destination address distribution, port usage mode, and connection establishment method, and the load content features include load keywords, feature byte sequences, and abnormal instruction sequences; A hierarchical feature extraction strategy is used to extract packet-level features, session-level features, application-level features, and aggregation-level features. The packet-level features extract the basic attributes of a single packet, the session-level features analyze the behavioral characteristics of TCP / UDP sessions, the application-level features identify abnormal patterns of application-layer protocols, and the aggregation-level features calculate the statistical attributes of multi-dimensional features. Constructing an AC automaton to preprocess the pattern string, and using a sliding window technology to perform feature matching on the packet level features, the session level features, the application level features, and the aggregation level features; Establishing a normal behavior baseline model, calculating the behavior deviation degree of the feature matching result based on the normal behavior baseline model, and setting a dynamic detection threshold according to the behavior deviation degree; Converting the detected attack features into a standardized data format, wherein the standardized data format includes attack type identification, timestamp information, attack source features, attack target information, attack behavior description, and threat level assessment; Performing temporal correlation on the standardized data formats based on a time window, performing spatial correlation on the standardized data formats based on an attack target, and performing behavioral correlation on the standardized data formats based on an attack pattern; A multidimensional risk mapping matrix is ​​constructed, wherein the horizontal axis of the multidimensional risk mapping matrix is ​​the asset vulnerability assessment score range, the vertical axis of the multidimensional risk mapping matrix is ​​the real-time attack feature threat level, and the matrix elements of the multidimensional risk mapping matrix are comprehensive risk assessment values.

6. The method according to claim 1, characterized in that Calculating a comprehensive risk score based on the risk mapping matrix includes: Establish a multi-level risk quantification indicator system, which includes asset value impact, vulnerability exploitation possibility, threat event frequency, and security protection capability. The asset value impact includes asset importance, business relevance, and data sensitivity. The vulnerability exploitation possibility includes technical threshold, required resources, and exploitation conditions. The threat event frequency includes attack frequency, duration, and attack intensity. The security protection capability includes security measure effectiveness, response capability, and recovery capability. The weights of the asset value impact, the vulnerability exploitation possibility, the threat event frequency, and the security protection capability are calculated using the analytic hierarchy process and entropy weight method, and the weights are modified according to the indicator correlation to establish a dynamic adjustment mechanism for the weights; Establish risk level classification standards, design scoring calculation rules, and decompose risk scores into direct loss impact scores, indirect loss impact scores, reputation impact scores, and compliance impact scores; Calculate the asset-based risk score, evaluate the threat impact score, quantify the vulnerability severity score, and measure the protection capability score. Perform a weighted operation on the asset-based risk score, the threat impact score, the vulnerability severity score, the protection capability score, and the weight to obtain a weighted risk score.

7. A network attack risk mapping and assessment system, used to implement the method according to any one of claims 1 to 6, characterized in that: include: The first unit is used to collect network traffic data packets and extract a multi-dimensional attack feature vector from the network traffic data packets, wherein the multi-dimensional attack feature vector includes an attack time feature, an attack source address feature, an attack target feature, an attack traffic feature, and an attack protocol feature; Inputting the multi-dimensional attack feature vector into a pre-trained deep neural network for feature learning, the deep neural network outputting an attack type recognition result and an attack intensity evaluation value; constructing an attack feature standard model according to the attack type recognition result and the attack intensity evaluation value; A second unit is used to determine an asset weight coefficient according to the attack type identification result, where the asset weight coefficient is calculated based on business impact and data sensitivity; Determine the vulnerability hazard level according to the attack intensity assessment value, and the vulnerability hazard level is divided using a vulnerability scoring system; determine the vulnerability exploitation difficulty coefficient based on the attack type identification result; input the asset weight coefficient, the vulnerability hazard level and the vulnerability exploitation difficulty coefficient into the asset vulnerability assessment model to obtain an asset vulnerability assessment score; The third unit is used to monitor the real-time network traffic using the attack feature standard model to generate real-time attack feature data; Performing correlation analysis on the real-time attack feature data and the asset vulnerability assessment score to construct a risk mapping matrix, wherein the horizontal axis of the risk mapping matrix represents the attack threat level and the vertical axis represents the asset vulnerability level; calculating a comprehensive risk score based on the risk mapping matrix; Generate risk warning information based on the comprehensive risk score, and send the risk warning information to the network security management device.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images