Attack behavior association reasoning method and system based on Bayesian network diagram

Abstract

The invention discloses an attack behavior association reasoning method and system based on a Bayesian network graph, and a data processing technology. The method comprises the following steps: obtaining network flow data; extracting key feature information of possible attack behaviors in the network attack traffic data based on the acquired network traffic data; constructing a Bayesian network attack graph according to the extracted key feature information of the attack behavior; and for unknown network flow data, on the basis of the constructed Bayesian network attack graph, carrying out attack behavior detection and correlation analysis by adopting a taint propagation algorithm. According to the method, the key elements of the attack behavior are extracted and serve as the node elements, the Bayesian network attack graph is constructed based on the Bayesian network, and detection of the attack behavior is achieved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an attack behavior association reasoning method and system based on a Bayesian network graph. Background Art

[0002] With the continuous development of Internet technology, more and more network applications use a lot of encryption technology for protection and disguise in the communication process, so as to avoid harassment and destruction by malicious programs and maintain the security of communication between normal network applications. As the proportion of encrypted traffic data in the overall network traffic data increases, how to effectively complete attack detection on a large amount of traffic data in the network has become a major problem.

[0003] Traditional traffic data detection methods are mainly based on machine learning, and the process mainly relies on feature extraction of traffic data and the use of labeling technology to complete the detection of unknown traffic data. However, this type of method is difficult to apply to scenarios with massive traffic data, and therefore it is difficult to be widely used in most traffic data detection scenarios.

[0004] In recent years, the means of network attack behaviors have become more and more complicated. The existing network attack detection technology is mainly based on machine learning, including clustering algorithms, decision trees, and support vector machines. However, machine learning still has certain defects in the analysis and reasoning of network attack behaviors, mainly including the following two aspects: First, most of the training data of machine learning models belong to the category of public data sets, and their data cannot well reflect the real characteristics of today's network attack traffic data and cannot meet the detection needs in actual application processes; second, most of the existing machine learning models are trained for specific data sets, and the features contained in different traffic data sets are somewhat different. Therefore, machine learning models trained based on existing public data sets are difficult to be widely used in actual network attack detection tasks. Summary of the invention

[0005] The embodiment of the present application provides an attack behavior association reasoning method and system based on a Bayesian network graph, which extracts the key elements of the attack behavior and uses them as node elements to construct a Bayesian network attack graph based on the Bayesian network to detect the attack behavior.

[0006] The present application embodiment provides an attack behavior association reasoning method based on a Bayesian network diagram, including:

[0007] Get network traffic data;

[0008] Based on the acquired network traffic data, key feature information of possible attack behaviors in the network attack traffic data is extracted;

[0009] Construct a Bayesian network attack graph based on the extracted key feature information of the attack behavior;

[0010] For unknown network traffic data, based on the constructed Bayesian network attack graph, the taint propagation algorithm is used to detect and analyze attack behaviors.

[0011] Optionally, based on the acquired network traffic data, possible attack behavior feature data extracted from the network attack traffic data includes:

[0012] Analyze network traffic data using traffic analysis tools;

[0013] Key feature information is determined from the log file generated by the analysis result, and the key feature information includes source IP address, destination IP address, domain name, protocol, and port.

[0014] Optionally, constructing a Bayesian network attack graph based on the extracted key feature information of the attack behavior includes:

[0015] Using the key information of the extracted attack traffic data as attack nodes, a Bayesian network attack graph is constructed, wherein any two attack nodes in the Bayesian network attack graph have an associated relationship, and there is an edge between the any two attack nodes;

[0016] Set a weight for each edge in the Bayesian network attack graph, and the stronger the relationship between any two attack nodes, the greater the weight;

[0017] Traverse each attack node to complete the construction of the Bayesian network attack graph.

[0018] Optionally, constructing a Bayesian network attack graph based on the extracted key feature information of the attack behavior also includes:

[0019] Deducing the possible direct relationship between any two attack nodes in the Bayesian network attack graph according to the log file generated by the analysis result; and,

[0020] By calculating the Jaccard value between the two domain names contained in the log file, the Jaccard value indicates a stronger correlation, and if the calculated Jaccard value is greater than a preset threshold, it is determined that there is an indirect relationship between the two domain names;

[0021] According to the determined direct and indirect relationships, edge relationships are established at corresponding nodes.

[0022] Optionally, for unknown network traffic data, based on the constructed Bayesian network attack graph, the taint propagation algorithm is used to detect and analyze attack behaviors, including:

[0023] Let the malicious value of the attacking node x be E(x), and the i+1th iteration of E(x) satisfies:

[0024]

[0025] In the formula, E 0 (x)∈[0,1] represents the initial maliciousness of node x. If x is known to be a malicious node, then E 0 (x)=1, otherwise E 0 (x) = 0.5, Indicates E 0 (x), N(x) represents the set of neighboring nodes of node x, and W xy Represents the influence weight of node x on node y;

[0026] Using the taint propagation algorithm, all potential malicious nodes are calculated based on the relevant weights and node malicious values ​​completed iteratively.

[0027] Optionally, a taint propagation algorithm is used to calculate all potential malicious nodes based on the relevant weights and node malicious values ​​iteratively completed, where the weight iteration satisfies:

[0028]

[0029] Where k is a factor that limits the impact of the initial correlation weight on the iterative weight.

[0030] An embodiment of the present application also proposes an attack behavior association reasoning system based on a Bayesian network diagram, including a processor and a memory, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the steps of the attack behavior association reasoning method based on the Bayesian network diagram as described above are implemented.

[0031] The embodiment of the present application extracts the key elements of the attack behavior and uses them as node elements, constructs a Bayesian network attack graph based on the Bayesian network, realizes the detection of attack behavior, discovers potential malicious nodes and attack paths, and analyzes the corresponding attack behavior through associated reasoning.

[0032] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0034] Figure 1 The following is a schematic diagram of the basic process of the attack behavior association reasoning method based on the Bayesian network diagram according to the embodiment of the present application;

[0035] Figure 2 This is a schematic diagram of the network attack traffic data parsing process of the attack behavior association reasoning method based on the Bayesian network diagram in an embodiment of the present application;

[0036] Figure 3 The following is a schematic diagram of the Bayesian network attack graph construction process of the attack behavior association reasoning method based on the Bayesian network graph in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0038] The embodiment of the present application provides an attack behavior association reasoning method based on a Bayesian network graph. The present application uses a Bayesian network-based graphical model to vividly describe various attack behavior states in the network, using this as an attack node and forming a network attack graph. The attack behavior detection algorithm is used to implement detection and association analysis of attack behaviors to discover more potential malicious nodes and attack paths, and finally reason and analyze all possible attack behaviors, such as Figure 1 As shown, the method of the embodiment of the present application includes the following steps:

[0039] In step S101, network traffic data is obtained.

[0040] In step S102, based on the acquired network traffic data, key feature information of possible attack behaviors in the network attack traffic data is extracted. In a specific example, attack node extraction mainly extracts key feature elements in the discovered network attack behaviors as key nodes for constructing a Bayesian network attack graph.

[0041] In step S103, a Bayesian network attack graph is constructed based on the extracted key feature information of the attack behavior. The Bayesian network attack graph is constructed mainly based on the extracted key feature elements of the attack behavior.

[0042] In step S104, for unknown network traffic data, based on the constructed Bayesian network attack graph, a taint propagation algorithm is used to perform attack behavior detection and correlation analysis.

[0043] The embodiment of the present application extracts the key elements of the attack behavior and uses them as node elements, constructs a Bayesian network attack graph based on the Bayesian network, realizes the detection of attack behavior, discovers potential malicious nodes and attack paths, and analyzes the corresponding attack behavior through associated reasoning.

[0044] The collected network attack traffic data is processed to extract the possible attack behavior feature elements or correlations between the features, thereby providing support for the construction of the Bayesian network attack graph. Specifically, an open source traffic analyzer based on the Bro framework is used to parse the network attack traffic data and generate related log files. In some embodiments, based on the acquired network traffic data, extracting possible attack behavior feature data from the network attack traffic data includes:

[0045] Use traffic analysis tools to analyze network traffic data. Figure 2 As shown in the figure, the traffic analysis tool Bro is mainly used to complete the analysis task of attack traffic data. Bro can implement the analysis function of traffic data packet PCAP file in offline state. Under normal circumstances, the analysis result is presented in the form of log file. Specifically, there are four types of log files, namely Conn.log, Dns.log, Http.log, and Files.log. Among them, the Conn.log file is mainly used to describe the connection records of protocols such as TCP, UDP or ICMP; the Dns.log file is mainly used for the query records of the DNS protocol; the Http.log file is mainly used to describe the HTTP request and response records; the Files.log file is mainly used to describe the file transfer records and other information.

[0046] Determine key feature information from the log files generated by the analysis results, the key feature information includes source IP address, destination IP address, domain name, protocol, port. According to the analysis results, the four types of log files generated above are processed to find key feature information, such as source IP address, destination IP address, domain name, protocol, port and other key information.

[0047] We further utilize the key feature information extracted in the early stage and combine the correlation between all feature information to construct a Bayesian network attack graph, with each attack feature element as the attack node of the Bayesian network attack graph, and the correlation between each attack element as the edge of the Bayesian network attack graph. Figure 3As shown, in some embodiments, constructing a Bayesian network attack graph based on the extracted key feature information of the attack behavior includes:

[0048] The key information of the extracted attack traffic data is used as the attack node to construct a Bayesian network attack graph, wherein any two attack nodes in the Bayesian network attack graph have an associated relationship, and there is an edge between the any two attack nodes.

[0049] Set a weight W (W∈[0,1]) for each edge in the Bayesian network attack graph, and the stronger and closer the relationship between any two attack nodes, the greater the weight W;

[0050] Traverse each attack node to complete the construction of the Bayesian network attack graph.

[0051] Regarding the processing method of the relationship between nodes in the process of constructing the Bayesian network graph, the present application proposes two node relationship processing methods, namely direct relationship processing and indirect relationship processing. In some embodiments, constructing the Bayesian network attack graph based on the extracted key feature information of the attack behavior also includes:

[0052] The log file generated by the analysis result is used to deduce the possible direct relationship between any two attack nodes in the Bayesian network attack graph. For example, the direct relationship between two node IPs can be derived based on the TCP connection status in the Conn.log file.

[0053] By calculating the Jaccard value between the two domain names included in the log file, the stronger the association, and if the calculated Jaccard value is greater than a preset threshold, it is determined that there is an indirect relationship between the two domain names. For example, by calculating the Jaccard value between the two domain names, comparing the result with a preset threshold, if the value is greater than the threshold, it is determined that there is an indirect relationship between the two domain names.

[0054] According to the determined direct and indirect relationships, edge relationships are established at corresponding nodes.

[0055] After completing the construction of the Bayesian network attack graph, the next step will be to carry out attack behavior detection and correlation analysis reasoning based on the Bayesian network attack graph, and timely find and discover potential malicious nodes and attack paths. In some embodiments, for unknown network traffic data, based on the constructed Bayesian network attack graph, a taint propagation algorithm is used to detect and analyze attack behaviors. The taint propagation algorithm is a semi-supervised static algorithm based on a directed graph. It mainly uses the correlation between nodes, and gradually infers the true malicious value of each node by continuously iterating the initial edge weights and the set initial malicious values, and finally finds and discovers potential malicious nodes and attack paths. In the embodiment of the present application, the use of the taint propagation algorithm for attack behavior detection and correlation analysis includes:

[0056] Let the malicious value of the attacking node x be E(x), and the i+1th iteration of E(x) satisfies:

[0057]

[0058] In the formula, E 0 (x)∈[0,1] represents the initial maliciousness of node x. If x is known to be a malicious node, then E 0 (x)=1, otherwise E 0 (x) = 0.5, Indicates E 0 (x), N(x) represents the set of neighboring nodes of node x, and W xy Represents the influence weight of node x on node y;

[0059] Using the taint propagation algorithm, all potential malicious nodes are calculated based on the relevant weights and node malicious values ​​completed iteratively.

[0060] In some embodiments, a taint propagation algorithm is used to calculate all potential malicious nodes based on iterative completion of relevant weights and node malicious values, where the weight iteration satisfies:

[0061]

[0062] Where k is a factor that limits the impact of the initial correlation weight on the iterative weight.

[0063] The embodiment of the present application proposes an attack behavior association reasoning method based on a Bayesian network graph, which is used for association analysis and reasoning identification of malicious behaviors such as network attacks. The present application first uses a graphic model based on a Bayesian network to vividly describe the various attack behavior states in the network, using this as an attack node and forming a network attack graph, and uses an attack behavior detection algorithm to realize the detection and association analysis of attack behaviors, so as to discover more potential malicious nodes and attack paths, and reason and analyze all possible attack behaviors.

[0064] An embodiment of the present application also proposes an attack behavior association reasoning system based on a Bayesian network diagram, including a processor and a memory, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the steps of the attack behavior association reasoning method based on the Bayesian network diagram as described above are implemented.

[0065] It should be noted that in the various embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0066] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0067] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0068] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for inferring the association of attack behaviors based on a Bayesian network graph, characterized in that: include: Get network traffic data; Based on the acquired network traffic data, key feature information of possible attack behaviors in the network attack traffic data is extracted; Construct a Bayesian network attack graph based on the extracted key feature information of the attack behavior; For unknown network traffic data, based on the constructed Bayesian network attack graph, the taint propagation algorithm is used to detect and analyze attack behaviors.

2. The attack behavior association reasoning method based on Bayesian network diagram according to claim 1 is characterized in that: Based on the acquired network traffic data, possible attack behavior feature data extracted from the network attack traffic data includes: Analyze network traffic data using traffic analysis tools; Key feature information is determined from the log file generated by the analysis result, and the key feature information includes source IP address, destination IP address, domain name, protocol, and port.

3. The attack behavior association reasoning method based on Bayesian network diagram as claimed in claim 2, characterized in that: The Bayesian network attack graph is constructed based on the extracted key feature information of the attack behavior, including: Using the key information of the extracted attack traffic data as attack nodes, a Bayesian network attack graph is constructed, wherein any two attack nodes in the Bayesian network attack graph have an associated relationship, and there is an edge between the any two attack nodes; Set a weight for each edge in the Bayesian network attack graph, and the stronger the association between any two attack nodes, the greater the weight; Traverse each attack node to complete the construction of the Bayesian network attack graph.

4. The attack behavior association reasoning method based on Bayesian network diagram as claimed in claim 3, characterized in that: The construction of the Bayesian network attack graph based on the extracted key feature information of the attack behavior also includes: Deducing the possible direct relationship between any two attack nodes in the Bayesian network attack graph according to the log file generated by the analysis result; and, By calculating the Jaccard value between the two domain names contained in the log file, the Jaccard value indicates a stronger correlation, and if the calculated Jaccard value is greater than a preset threshold, it is determined that there is an indirect relationship between the two domain names; According to the determined direct and indirect relationships, edge relationships are established at corresponding nodes.

5. The attack behavior association reasoning method based on Bayesian network diagram as claimed in claim 4, characterized in that: For unknown network traffic data, based on the constructed Bayesian network attack graph, the taint propagation algorithm is used to detect and analyze attack behaviors, including: Let the malicious value of the attacking node x be E(x), and the i+1th iteration of E(x) satisfies: In the formula, E 0 (x)∈[0,1] represents the initial maliciousness of node x. If x is known to be a malicious node, then E 0 (x)=1, otherwise E 0 (x) = 0.5, C E0(x) ∈[0,1] represents E 0 (x), N(x) represents the set of neighboring nodes of node x, and W xy Represents the influence weight of node x on node y; Using the taint propagation algorithm, all potential malicious nodes are calculated based on the relevant weights and node malicious values ​​completed iteratively.

6. The attack behavior association reasoning method based on Bayesian network diagram according to claim 5 is characterized in that: Using the taint propagation algorithm, all potential malicious nodes are calculated based on the relevant weights and node malicious values ​​iteratively completed, where the weight iteration satisfies: Where k is a factor that limits the impact of the initial correlation weight on the iterative weight.

7. An attack behavior association reasoning system based on Bayesian network graph, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the attack behavior association reasoning method based on the Bayesian network diagram as described in any one of claims 1 to 6 are implemented.

Images