Network intrusion behavior identification method and system based on big data

Abstract

The invention relates to the technical field of network security, in particular to a network intrusion behavior recognition method and system based on big data, and the method comprises the steps that a data collection module collects network flow data, system logs, host information, network topology structure information and other original data from different data sources of a network system; the graph construction module constructs first graph data according to original data, determines nodes and edges of the first graph data and adds feature values. The graph preprocessing module carries out preprocessing operations such as data cleaning, standardization and feature engineering on the first graph data to obtain second graph data, and the graph neural network module analyzes and learns the second graph data and outputs a result. The attack traceability and analysis module determines network intrusion behavior data including an attack source, a propagation path and an influence range according to a specific traceability method according to a result output by the graph neural network, and finally the result display module displays the data in a graphical interface or report form, so that the network intrusion behavior is effectively identified.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion behavior identification method and system based on big data. Background Art

[0002] With the rapid development of information technology, the network plays a vital role in people's lives and work. However, the openness and complexity of the network make network security face unprecedented challenges, and the frequent occurrence of network intrusions has brought huge losses.

[0003] In the current network environment, network attack methods are becoming increasingly complex and diverse, including but not limited to the spread of malware, distributed denial of service attacks (DDoS), advanced persistent threats (APT), etc. These attacks are often hidden in normal network traffic and are difficult to be accurately identified by traditional network security protection technologies. Traditional network security protection methods are mainly based on rules and feature matching, which requires manual pre-definition of attack patterns and features, and are often powerless against new network attacks.

[0004] In addition, the continuous expansion of network scale and the explosive growth of data volume make network security analysis face the challenge of big data processing. The massive data generated in the network, such as network traffic data, system logs, host information, and network topology information, contains complex information. The diversity, high speed, and massiveness of these data have brought great difficulties to the identification of network intrusion behaviors.

[0005] Some existing network intrusion detection technologies have many limitations when dealing with these problems. For example, some detection methods based on a single data source cannot fully reflect the true state of the network and are prone to false positives and false negatives. Moreover, the lack of effective data fusion and analysis mechanisms makes it difficult to extract valuable information from complex network data for accurate identification of network intrusion behaviors.

[0006] Therefore, a method and system that can effectively process big data, integrate multi-source information, and adaptively identify new network intrusion behaviors is needed to cope with the increasingly severe network security situation. The present invention is proposed based on this background and aims to achieve efficient and accurate identification and analysis of network intrusion behaviors through innovative technical means. Summary of the invention

[0007] The purpose of the present invention is to provide a network intrusion behavior identification method based on big data, aiming to effectively deal with the problem of intrusion behavior identification in complex network environments and improve network security protection capabilities.

[0008] To achieve the above object, on the one hand, the present invention provides a network intrusion behavior identification method based on big data, comprising the following steps:

[0009] The data collection module collects raw data related to the network attack, and the graph construction module constructs first graph data reflecting the network attack scenario according to the raw data, and determines the nodes and edges of the first graph data and the node feature values;

[0010] The graph preprocessing module performs a preprocessing operation on the first graph data to obtain second graph data, and the graph neural network module classifies the nodes and edges of the second graph data to obtain node classification results and edge classification results;

[0011] The attack tracing and analysis module performs tracing and analysis based on the node classification results and edge classification results to determine the network intrusion behavior data;

[0012] The raw data includes network traffic data, system logs, host information and network topology information;

[0013] The preprocessing operations include data cleaning, data standardization and feature engineering;

[0014] The network intrusion behavior data includes the source of the attack, the propagation path and the impact range.

[0015] Furthermore, when collecting network traffic data, the data acquisition module analyzes the source address, destination address, protocol type, traffic size, and transmission time parameters of the data packet, obtains the traffic threshold, and determines abnormal traffic based on the comparison result between the traffic threshold and the preset traffic threshold.

[0016] Furthermore, when constructing the first graph data, the graph construction module uses two nodes i and j, and the feature vectors of the two nodes i and j. and Calculate the similarity s ij , when the similarity s ij When the threshold t is exceeded, two nodes are connected to form an edge.

[0017] Furthermore, the graph construction module calculates the similarity s using the following formula: ij

[0018]

[0019] Furthermore, the graph preprocessing module uses a minimum-maximum normalization method to determine the node characteristic value during the data cleaning process, and determines the data processing method according to the node characteristic value;

[0020] If it deviates from the characteristic values ​​of other nodes and does not conform to the logic of network attack, it is judged as noise data and removed, and duplicate data is directly deleted;

[0021] If it deviates from the characteristic values ​​of other nodes and does not conform to the network attack logic, it is judged as abnormal data. In the judgment of the abnormal data;

[0022] If it is a collection error, correct or delete it;

[0023] Keep if it is caused by a potential attack.

[0024] Furthermore, when the graph preprocessing module normalizes the data, the node feature value is recorded as x morm , the calculation formula is:

[0025]

[0026] Where x is the original data, x min is the minimum value, x max is the maximum value.

[0027] Furthermore, the graph neural network module uses a graph attention network to perform node classification and edge classification, where the attention coefficient calculation formula is:

[0028]

[0029]

[0030] The calculation formula of the new feature vector of the node is:

[0031]

[0032] in is the learnable parameter vector, W is the weight matrix, is the node feature vector, N i is the set of neighbor nodes of node i, a ij is the attention coefficient, is the new feature vector of the node, and σ is the activation function.

[0033] Furthermore, when tracing the source, the attack tracing and analysis module uses the classification results output by the graph neural network module as a basis, adopts depth-first search (DFS), takes the node in the graph that is determined to be a possible attack source as the starting point, and traverses the graph to determine the attack propagation path and impact range.

[0034] Furthermore, when using the depth-first search (DFS) algorithm, the attack propagation path and impact range are determined through the following steps:

[0035] Step 1: Push the node that is determined to be a possible attack source into the stack and mark it as visited;

[0036] Step 2: When the stack is not empty, pop the top node of the stack, check all its unvisited neighbor nodes, push these neighbor nodes into the stack, and mark them as visited; for each visited neighbor node, record the edge between it and the currently popped node as part of the attack propagation path;

[0037] Step 3: Repeat step 2 until the stack is empty. The recorded edges and nodes constitute the attack propagation path, and all visited nodes constitute the impact range of the attack.

[0038] In this process, each node uses a Boolean marker variable to record whether it has been visited. The initial value is unvisited. During the traversal process, the neighbor nodes are determined by the connection relationship between nodes stored in the graph data structure.

[0039] On the other hand, the present invention provides a network intrusion behavior identification system based on big data, comprising:

[0040] The data collection module is used as the information entry of the entire system and is responsible for collecting raw data related to network attacks from different data sources of the network system, including network traffic data, system logs, host information, and network topology information;

[0041] a graph construction module, connected to the data acquisition module, and configured to construct first graph data based on the original data acquired from the data acquisition module;

[0042] A graph preprocessing module, which is connected to the graph construction module and is used to perform preprocessing operations on the first graph data received from the graph construction module, and these operations include data cleaning, data standardization and feature engineering; a graph neural network module, which is connected to the graph preprocessing module and is used to perform in-depth analysis and learning on the second graph data transmitted from the graph preprocessing module;

[0043] An attack tracing and analysis module, which is connected to the graph preprocessing module and is used to trace and analyze the output results of the graph neural network module to determine the network intrusion behavior data, including the source of the attack, the propagation path and the scope of influence;

[0044] The result display module is connected to the attack tracing and analysis module and is used to display the received network intrusion behavior data to the user in the form of a graphical interface or report.

[0045] In summary, the beneficial technical effects of this application are:

[0046] Improve identification accuracy: By integrating multi-source data and applying a variety of advanced data processing and analysis technologies (such as graph construction, graph neural networks, etc.), we can comprehensively and deeply analyze the network status, more accurately identify network intrusion behaviors, and reduce false positives and missed positives.

[0047] Effective response to complex attacks: It can adaptively handle new and complex network attack methods, especially those hidden in normal network traffic. The application of graph neural network enables it to learn complex attack patterns and improve its ability to identify unknown attacks.

[0048] Improve tracing capabilities: Use algorithms such as depth-first search or breadth-first search combined with the output of graph neural networks to accurately trace the source and propagation path of the attack, providing network security protection personnel with a clear picture of the attack and facilitating the formulation of targeted defense strategies.

[0049] Optimize data processing: Use reasonable data processing methods such as data cleaning, standardization, and feature engineering in data collection and preprocessing to improve data quality and availability, while optimizing the efficiency and effectiveness of graph neural network processing of data.

[0050] Improve user experience: Through a variety of result display methods (graphical interface and reports), complex analysis results are presented to users in an intuitive and easy-to-understand form to meet the needs of different users and facilitate users to quickly understand and respond to network attacks.

[0051] Enhance system adaptability and scalability: The system architecture and method design have good adaptability and scalability, which can easily cope with the growing amount of data, the changing network environment and the evolving attack methods, which is conducive to long-term network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a system module connection diagram of a network intrusion behavior identification system based on big data in the present invention. DETAILED DESCRIPTION

[0053] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0054] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0055] In the embodiments of the present application, the same reference numerals represent the same components, and for the sake of brevity, detailed descriptions of the same components are omitted in different embodiments. It should be understood that the thickness, length, width and other dimensions of various components in the embodiments of the present application shown in the drawings, as well as the overall thickness, length, width and other dimensions of the integrated device are only exemplary descriptions and should not constitute any limitation to the present application.

[0056] On the one hand, the present invention provides a network intrusion behavior identification method based on big data, comprising the following steps:

[0057] The data collection module collects raw data related to the network attack, and the graph construction module constructs first graph data reflecting the network attack scenario based on the raw data, and determines the nodes and edges of the first graph data and the node feature values;

[0058] The graph preprocessing module performs a preprocessing operation on the first graph data to obtain the second graph data, and the graph neural network module classifies the nodes and edges of the second graph data to obtain node classification results and edge classification results;

[0059] The attack tracing and analysis module performs tracing and analysis based on the node classification results and edge classification results to determine the network intrusion behavior data;

[0060] The original data includes network traffic data, system logs, host information, and network topology information;

[0061] Preprocessing operations include data cleaning, data standardization, and feature engineering;

[0062] Network intrusion behavior data includes the source of the attack, the propagation path, and the scope of impact.

[0063] Specifically, when collecting network traffic data, the data acquisition module analyzes the source address, destination address, protocol type, traffic size, and transmission time parameters of the data packet, obtains the traffic threshold, and determines abnormal traffic based on the comparison result between the traffic threshold and the preset traffic threshold.

[0064] Specifically, when constructing the first graph data, the graph construction module uses two nodes i and j, and the feature vectors of the two nodes i and j. and Calculate the similarity s ij , when the similarity s ij When the threshold t is exceeded, two nodes are connected to form an edge.

[0065] Specifically, the graph construction module uses the following formula to calculate the similarity s ij

[0066]

[0067] Specifically, during the data cleaning process, the graph preprocessing module uses the minimum-maximum normalization method to determine the node eigenvalues ​​and determines the data processing method based on the node eigenvalues;

[0068] If it deviates from the characteristic values ​​of other nodes and does not conform to the logic of network attack, it is judged as noise data and removed, and duplicate data is directly deleted;

[0069] If it deviates from the characteristic values ​​of other nodes and does not conform to the network attack logic, it is judged as abnormal data. In the judgment of abnormal data;

[0070] If it is a collection error, correct or delete it;

[0071] Keep if it is caused by a potential attack.

[0072] Specifically, how to judge abnormal data and how to determine whether it is a collection error or a potential attack are things that those skilled in the art should know.

[0073] Specifically, by comprehensively applying the following methods, it is possible to more accurately determine whether abnormal data is a collection error or a potential attack, so as to take appropriate processing measures and improve the accuracy and reliability of the network intrusion behavior identification system.

[0074] Specifically, the overall idea of ​​judging abnormal data is that during the data cleaning process of the graph preprocessing module, when it is found that the node feature value deviates from the feature value of other nodes and does not conform to the network attack logic, it is judged as abnormal data. The judgment of the nature of abnormal data (whether it is a collection error or a potential attack) requires comprehensive analysis of multiple factors.

[0075] Specifically, methods for determining collection errors based on data sources and related system information include:

[0076] 1. Check data acquisition equipment and system status

[0077] Check the running status logs of the hardware devices involved in the data collection module (such as network traffic monitoring tools, log collection servers, etc.). If you find that the device has fault records (such as network interface card errors, storage failures, etc.), or the device has restarted or abnormal interruptions during the data collection period, it may be a collection error. For example, the network traffic monitoring tool may have abnormal records of some traffic data due to temporary memory overflow. In this case, the abnormal data collected may be a collection error.

[0078] Analyze the status of the software system related to data collection. If the collection software has error information, version compatibility issues, or configuration parameter errors (such as improper collection frequency settings, incorrect filtering rules, etc.), then the related abnormal data is more likely to be a collection error. For example, due to incorrect filtering rules, some normal traffic is mistakenly identified as abnormal traffic and recorded.

[0079] 2. Data consistency and correlation analysis

[0080] Check the consistency of abnormal data with other related data in the same data source. For example, in the system log, if a record shows that a host performed an abnormal operation at a certain time, but other related logs at the same time (such as other service logs running on the host, network connection logs, etc.) do not have corresponding associated records, then this abnormal record may be a collection error.

[0081] Analyze the correlation between abnormal data and data from other different data sources. If the network traffic data shows that a node has a large amount of abnormal traffic, but the host information shows that the application on the node has no data transmission requirements within the corresponding time (such as the application is idle), and the system log does not record related abnormal operations, then the abnormal traffic data may be a collection error.

[0082] Specifically, methods for identifying potential attacks based on attack characteristics and behavior patterns include:

[0083] 1. Attack signature matching

[0084] Maintain a knowledge base of known network attack features and compare abnormal data with the attack features in the knowledge base. For example, if the traffic pattern in the abnormal data meets the characteristics of a distributed denial of service attack (DDoS) (such as a large number of requests from different source IPs rushing to the target IP, and the request frequency is increasing exponentially), it may be a potential attack. For abnormal records in system logs, if a pattern similar to brute force login is found (such as a large number of failed login attempts in a short period of time), it can also be judged as a potential attack.

[0085] 2. Behavioral pattern analysis

[0086] Analyze the network behavior patterns reflected by abnormal data. If the abnormal node frequently communicates with some known malicious IP addresses or suspicious domain names in the external network, or the communication behavior of the abnormal node in the network does not conform to the normal business process (such as frequent communication with specific external nodes during non-working hours, and the communication content is suspected to contain malicious code after encryption analysis), it is more likely to be judged as a potential attack.

[0087] Observe the propagation pattern of abnormal data in the graph structure. If the propagation of abnormal data in the graph shows an organized and targeted path (such as gradually penetrating from edge nodes to core server nodes), similar to the common advanced persistent threat (APT) attack pattern, it can be judged as a potential attack.

[0088] 3. Historical data and trend analysis

[0089] Refer to similar anomalies in historical data. If similar abnormal data patterns have appeared in past cyberattacks and have been confirmed to be attacks, then the current abnormal data is more likely to be a potential attack.

[0090] Analyze the time trend of abnormal data. If the abnormal data is not a one-time isolated event, but appears continuously over a period of time and shows a certain growth or evolution trend (such as the scale of abnormal traffic gradually increases, the frequency of abnormal behavior gradually increases), it is more likely to be a potential attack.

[0091] Specifically, when the graph preprocessing module normalizes the data, the node feature value is recorded as x morm , the calculation formula is:

[0092]

[0093] Where x is the original data, x min is the minimum value, x max is the maximum value.

[0094] Specifically, the graph neural network module uses a graph attention network for node classification and edge classification, where the attention coefficient calculation formula is:

[0095]

[0096]

[0097] The calculation formula of the new feature vector of the node is:

[0098]

[0099] in is the learnable parameter vector, W is the weight matrix, is the node feature vector, N i is the set of neighbor nodes of node i, a ij is the attention coefficient, is the new feature vector of the node, and σ is the activation function.

[0100] Specifically, when tracing the source, the attack tracing and analysis module uses the classification results output by the graph neural network module as the basis, adopts depth-first search (DFS), takes the nodes in the graph that are judged to be possible attack sources as the starting point, and traverses the graph to determine the attack propagation path and impact range.

[0101] Specifically, when using the depth-first search (DFS) algorithm, the attack propagation path and impact range are determined through the following steps:

[0102] Step 1: Push the node that is determined to be a possible attack source into the stack and mark it as visited;

[0103] Step 2: When the stack is not empty, pop the top node of the stack, check all its unvisited neighbor nodes, push these neighbor nodes into the stack, and mark them as visited; for each visited neighbor node, record the edge between it and the currently popped node as part of the attack propagation path;

[0104] Step 3: Repeat step 2 until the stack is empty. The recorded edges and nodes constitute the attack propagation path, and all visited nodes constitute the impact range of the attack.

[0105] In this process, each node uses a Boolean marker variable to record whether it has been visited. The initial value is unvisited. During the traversal process, the neighbor nodes are determined by the connection relationship between nodes stored in the graph data structure.

[0106] Please refer to Figure 1 As shown, Figure 1 A system module connection relationship diagram of a network intrusion behavior identification system based on big data provided by an embodiment of the present invention.

[0107] On the other hand, the present invention provides a network intrusion behavior identification system based on big data, comprising:

[0108] The data collection module is used as the information entry of the entire system and is responsible for collecting raw data related to network attacks from different data sources of the network system, including network traffic data, system logs, host information, and network topology information;

[0109] A graph construction module, connected to the data acquisition module, for constructing first graph data based on the original data acquired from the data acquisition module;

[0110] A graph preprocessing module, which is connected to the graph construction module and is used to perform preprocessing operations on the first graph data received from the graph construction module, and these operations include data cleaning, data standardization and feature engineering;

[0111] A graph neural network module, which is connected to the graph preprocessing module and is used to perform in-depth analysis and learning on the second graph data transmitted from the graph preprocessing module;

[0112] The attack tracing and analysis module is connected to the graph preprocessing module and is used to trace and analyze the output results of the graph neural network module to determine the network intrusion behavior data, including the source of the attack, the propagation path, and the scope of influence;

[0113] The result display module is connected to the attack tracing and analysis module and is used to display the received network intrusion behavior data to the user in the form of a graphical interface or report.

[0114] Example: Network intrusion behavior identification in enterprise network security protection

[0115] 1. Scene Setting

[0116] A large enterprise has a complex network architecture, including office area networks of multiple departments, server groups (such as file servers, database servers, etc.), firewalls connected to external networks, and various network devices (routers, switches, etc.). The enterprise needs to effectively identify and analyze intrusion behaviors in the network to ensure the normal operation of the business and data security.

[0117] 2. Network Intrusion Behavior Identification Process

[0118] 1. Data Collection

[0119] The data collection module in the enterprise network starts working, collecting raw data related to network attacks from multiple data sources. For network traffic data, the traffic monitoring function is configured on the core switch of the enterprise network. The data collection module analyzes the source address of each data packet (such as IP addresses from different department office areas), the destination address (which may be the internal server of the enterprise or the external network address), the protocol type (such as HTTP, HTTPS, SMTP and other common protocols), the traffic size (in bytes) and the transmission time (accurate to seconds). For example, in daily monitoring, it is found that in a certain period of time, the traffic sent from a specific IP segment of a certain R&D department to an unknown IP outside the enterprise suddenly increases. At the same time, the data collection module collects system logs from the enterprise's servers (such as mail servers and application servers) to record user logins, file operations, application access and other behaviors; obtains the operating system type (such as Windows Server 2019, Ubuntu, etc.), the installed software list (including office software, business software, etc.) and the open ports (such as port 8080 for internal business applications) of each terminal and server from the host information system; and obtains the connection relationship and network architecture information of network devices from the network topology management system.

[0120] 2. Graph Construction

[0121] The graph construction module receives the raw data from the data collection module and constructs the first graph data reflecting the network attack scenario. The IP address of each host, server and network device in the enterprise network is regarded as a node. For example, the office computers, file servers, and routers connecting the internal and external networks of the R&D department are all regarded as nodes. When there is network traffic interaction between two nodes, the connection relationship between them is considered. For two nodes i and j, it is assumed that node i represents a computer in the R&D department, and its feature vector contains operating system information, installed software, etc., and node j represents a file server, and its feature vector contains server type, storage capacity, etc. Their similarity is calculated by a specific formula. It is assumed that the similarity calculation formula is: cosine similarity (the specific formula is set according to the actual situation). When the calculated similarity exceeds the set threshold t (such as t = 0.7), an edge is connected between the two nodes, and features are assigned to the edge based on the network traffic data, such as communication frequency (number of connections per hour) and data transmission volume (number of bytes transmitted in the past day).

[0122] 3. Image preprocessing

[0123] The graph preprocessing module processes the first graph data. During the data cleaning process, the minimum-maximum normalization method is used for the node characteristic values. For example, for the characteristic value of traffic size, if the traffic size value of a node deviates significantly from other nodes after normalization (such as the normalized value is greater than 0.9, while most other nodes are between 0.2-0.5) and does not conform to the normal network attack logic (such as the department where the node is located does not have a large amount of data transmission business), it is determined to be noise data and removed. Duplicate system log records (such as the same login operation is recorded multiple times due to a temporary system failure) are deleted directly. If it is found that the traffic data of a node is abnormally large and suspected to be abnormal data, further analysis is performed. If it is a collection error (such as a network equipment failure resulting in erroneous data recording), it is corrected or deleted; if it is suspected to be caused by a potential attack (such as the node frequently communicates with external suspicious IPs), it is retained. During the data standardization process, for other characteristic values ​​of the node (such as the number of open ports, etc.), the formula is used.

[0124] (where x is the number of original open ports, x max and x min The minimum and maximum number of open ports for all nodes in the enterprise network are standardized.

[0125] 4. Graph Neural Network Analysis

[0126] The graph neural network module receives the preprocessed second graph data. The graph attention network (GAT) is used to perform node classification and edge classification. For node classification, the attention coefficient is calculated. For example, for a node corresponding to an unknown device newly connected to the enterprise network, the formula Calculate the attention coefficient between it and the surrounding nodes, where is the learnable parameter vector learned from the training data, W is the weight matrix, and are the feature vectors of the unknown device node and the surrounding nodes respectively. Then, The attention coefficient is normalized to obtain the importance weight of each neighbor node to the unknown device node. Calculate the new feature vector of the node and classify the node based on the new feature vector to determine whether the node is likely to be an attack source or attacked. For edge classification, similarly analyze the features of the edge and the features of the nodes it connects to determine whether the edge represents an attack behavior.

[0127] 5. Attack tracing and analysis

[0128] The attack tracing and analysis module operates according to the node classification results and edge classification results output by the graph neural network module. Assuming that the newly connected unknown device node is found in the node classification and is determined to be a possible attack source, a depth-first search (DFS) is performed with this as the starting point. First, the node is pushed into the stack and marked as visited. Then, when the stack is not empty, the top node of the stack is popped out and all its unvisited neighbor nodes are checked. For example, if it is found that the unknown device node is connected to a key server node within the enterprise, these neighbor nodes are pushed into the stack and marked as visited, and the edges between the unknown device node and the key server node are recorded as part of the attack propagation path. Repeat this process until the stack is empty. Through such traversal, the attack propagation path (such as the path from the newly connected device to the core database server through multiple internal nodes) and the scope of influence (including all visited nodes, that is, hosts, servers, and network devices that may be affected by the attack) are determined.

[0129] 6. Results display

[0130] The result display module displays the network intrusion behavior data obtained by the attack tracing and analysis module to the enterprise's network security team. In the graphical interface, red marks are used to indicate nodes related to the attack source (such as newly connected unknown devices), yellow marks are used to indicate affected key server nodes, and bold red lines are used to indicate edges corresponding to the attack propagation path. At the same time, a detailed report is generated, listing the source of the attack (the IP address of the newly connected device), detailed information on the nodes and edges through which the attack propagates (including the device information corresponding to each node and the communication characteristics of the edges), and the names of the affected business systems and servers (such as the business applications and database systems involved). Based on this information, the network security team can quickly take measures, such as isolating suspicious devices and checking the security status of the affected systems, to ensure the enterprise's network security.

Claims

1. A network intrusion behavior identification method based on big data, comprising the following steps: The data collection module collects raw data related to the network attack, and the graph construction module constructs first graph data reflecting the network attack scenario according to the raw data, and determines the nodes and edges of the first graph data and the node feature values; The graph preprocessing module performs a preprocessing operation on the first graph data to obtain second graph data, and the graph neural network module classifies the nodes and edges of the second graph data to obtain node classification results and edge classification results; The attack tracing and analysis module performs tracing and analysis based on the node classification results and edge classification results to determine the network intrusion behavior data; The raw data includes network traffic data, system logs, host information and network topology information; The preprocessing operations include data cleaning, data standardization and feature engineering; The network intrusion behavior data includes the source of the attack, the propagation path and the impact range.

2. The network intrusion behavior identification method based on big data according to claim 1 is characterized in that: When collecting network traffic data, the data acquisition module analyzes the source address, destination address, protocol type, traffic size, and transmission time parameters of the data packet, obtains the traffic threshold, and determines abnormal traffic based on the comparison result between the traffic threshold and the preset traffic threshold.

3. The network intrusion behavior identification method based on big data according to claim 1 is characterized in that: When constructing the first graph data, the graph construction module uses two nodes i and j, and the feature vectors of the two nodes i and j. and Calculate the similarity s ij , when the similarity s ij When the threshold t is exceeded, two nodes are connected to form an edge.

4. The network intrusion behavior identification method based on big data according to claim 3 is characterized in that: The graph construction module calculates the similarity s using the following formula ij 5. The network intrusion behavior identification method based on big data according to claim 1 is characterized in that: The graph preprocessing module uses a minimum-maximum normalization method to determine the node characteristic value during data cleaning, and determines a data processing method according to the node characteristic value; If it deviates from the characteristic values ​​of other nodes and does not conform to the logic of network attack, it is judged as noise data and removed, and duplicate data is directly deleted; If it deviates from the characteristic values ​​of other nodes and does not conform to the network attack logic, it is judged as abnormal data. In the judgment of the abnormal data; If it is a collection error, correct or delete it; Keep if it is caused by a potential attack.

6. The network intrusion behavior identification method based on big data according to claim 5 is characterized in that: When the graph preprocessing module normalizes the data, the node feature value is recorded as x morm , the calculation formula is: Where x is the original data, x min is the minimum value, x max is the maximum value.

7. The network intrusion behavior identification method based on big data according to claim 1 is characterized in that: The graph neural network module uses a graph attention network for node classification and edge classification, where the attention coefficient calculation formula is: The calculation formula of the new feature vector of the node is: in is the learnable parameter vector, W is the weight matrix, is the node feature vector, N i is the set of neighbor nodes of node i, a ij is the attention coefficient, is the new feature vector of the node, and σ is the activation function.

8. The network intrusion behavior identification method based on big data according to claim 1 is characterized in that: When tracing the source, the attack tracing and analysis module uses the classification results output by the graph neural network module as the basis, adopts depth-first search (DFS), takes the nodes in the graph that are determined to be possible attack sources as the starting point, and traverses the graph to determine the attack propagation path and impact range.

9. The network intrusion behavior identification method based on big data according to claim 8 is characterized in that: When using the depth-first search (DFS) algorithm, the attack propagation path and impact range are determined through the following steps: Step 1: Push the node that is determined to be a possible attack source into the stack and mark it as visited; Step 2: When the stack is not empty, pop the top node of the stack, check all its unvisited neighbor nodes, push these neighbor nodes into the stack, and mark them as visited; for each visited neighbor node, record the edge between it and the currently popped node as part of the attack propagation path; Step 3: Repeat step 2 until the stack is empty. The recorded edges and nodes constitute the attack propagation path, and all visited nodes constitute the impact range of the attack. In this process, each node uses a Boolean marker variable to record whether it has been visited. The initial value is unvisited. During the traversal process, the neighbor nodes are determined by the connection relationship between nodes stored in the graph data structure.

10. A system for implementing the network intrusion behavior identification method based on big data according to claims 1-9, characterized in that: include: The data collection module is used as the information entry of the entire system and is responsible for collecting raw data related to network attacks from different data sources of the network system, including network traffic data, system logs, host information, and network topology information; a graph construction module, connected to the data acquisition module, and configured to construct first graph data based on the original data acquired from the data acquisition module; A graph preprocessing module is connected to the graph construction module and is used to perform preprocessing operations on the first graph data received from the graph construction module. These operations cover data cleaning, data standardization and feature engineering. A graph neural network module, which is connected to the graph preprocessing module and is used to perform in-depth analysis and learning on the second graph data transmitted by the graph preprocessing module; An attack tracing and analysis module, which is connected to the graph preprocessing module and is used to trace and analyze the output results of the graph neural network module to determine the network intrusion behavior data, including the source of the attack, the propagation path and the scope of influence; The result display module is connected to the attack tracing and analysis module and is used to display the received network intrusion behavior data to the user in the form of a graphical interface or report.

Images