Visual mapping method and system for network space elements and network attack and defense elements

Abstract

The invention discloses a visualized mapping method and system for network space elements and network attack and defense elements, and belongs to the technical field of network target ranges, and the method comprises the following steps: determining a reference attack mode and a reference defense mode, setting a corresponding attack mapping mode, a defense mapping mode and a visual mapping rule according to the reference attack mode and the reference defense mode; establishing an attack and defense mapping module according to the attack mapping mode, the defense mapping mode and the visual mapping rule; setting an acquisition module according to the reference attack mode and the reference defense mode, wherein the acquisition module is used for acquiring corresponding attack and defense data in real time; corresponding attack and defense data are collected in real time through a collection module, the attack and defense data are sent to an attack and defense mapping module, and the attack and defense mapping module carries out attack and defense mapping display according to the attack and defense data; when the user has an individual attack and defense demand, identifying individual demand data; and determining a personalized attack and defense mode according to the personalized demand data, and performing attack and defense mapping display based on the personalized attack and defense mode.

Description

Technical Field

[0001] The present invention belongs to the technical field of network target ranges, and specifically relates to a method and system for visual mapping of cyberspace elements and network attack and defense elements. Background Art

[0002] With the rapid development of network technology, the security issues of cyberspace have become increasingly prominent. As an important part of the field of network security, the complexity and dynamism of network attack and defense have brought huge challenges to network security analysis and defense. Traditional network security analysis methods often rely on manual experience and static data, which makes it difficult to fully and accurately reflect the actual situation of network attack and defense.

[0003] In order to meet this challenge, a variety of network attack and defense visualization technologies have emerged in recent years. These technologies use graphical means to display various elements and relationships in the network attack and defense process, helping network security personnel to better understand and analyze network attack and defense patterns. However, existing visualization technologies still have some shortcomings, such as insufficient intuitive visualization effects, insufficient interactivity, and low flexibility.

[0004] Therefore, the present invention proposes a method and system for visual mapping of cyberspace elements and network attack and defense elements. Summary of the invention

[0005] In order to solve the problems existing in the above scheme, the present invention provides a method and system for visual mapping of cyberspace elements and network attack and defense elements.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A visual mapping method for cyberspace elements and network attack and defense elements, the method comprising:

[0008] Step 1: Determine a baseline attack mode and a baseline defense mode, wherein the baseline attack mode includes a CAPEC attack mode and an ATT&CK attack mode, and the baseline defense mode is a D3FEND defense mode; set corresponding attack mapping methods, defense mapping methods, and visualization mapping rules according to the baseline attack mode and the baseline defense mode;

[0009] Furthermore, the attack mapping method may include:

[0010] Obtaining benchmark attack feature information of the benchmark attack mode, classifying according to the benchmark attack feature information, obtaining the base point classification, and setting corresponding visualization primitives according to the base point classification;

[0011] Identify the multi-dimensional attributes corresponding to the benchmark attack feature information, and associate the multi-dimensional attributes with parameters of corresponding visualization primitives; and construct a visualization mapping method of the attack process, which is marked as an attack mapping method.

[0012] Furthermore, the method for setting the defense mapping mode includes:

[0013] Obtaining baseline defense feature information of a baseline defense mode, classifying the defense function of the baseline defense mode according to the baseline defense feature information to obtain the function classification; and associating the function classification with a corresponding visualization representation;

[0014] In the visual presentation, the defense nodes and attack nodes are integrated into the same scene, and the defense mapping method is set.

[0015] Step 2: Establish an attack and defense mapping module according to the attack mapping method, the defense mapping method and the visualization mapping rule, and the attack and defense mapping module is used to perform attack and defense mapping display;

[0016] Step 3: Setting a collection module according to the baseline attack mode and the baseline defense mode, wherein the collection module is used to collect corresponding attack and defense data in real time, wherein the attack and defense data includes attack collection data and defense collection data;

[0017] Step 4: The corresponding attack and defense data are collected in real time by the collection module, and the attack and defense data are sent to the attack and defense mapping module, and the attack and defense mapping module performs attack and defense mapping display according to the attack and defense data.

[0018] Step 5: When the user has a personalized attack and defense requirement, the requirement data of the personalized attack and defense requirement is identified and marked as personalized requirement data; a personalized attack and defense mode is determined according to the personalized requirement data, and an attack and defense mapping display is performed based on the personalized attack and defense mode.

[0019] Furthermore, the method for determining the personalized attack and defense mode according to the personalized demand data includes:

[0020] The platform presets several alternative modes, which are composed of corresponding alternative attack modes and alternative defense modes;

[0021] Determining an alternative attack and defense mode according to the alternative mode;

[0022] Adjusting the attack and defense mapping module according to the alternative attack and defense mode; and establishing an alternative mode library according to the alternative attack and defense mode;

[0023] The individual demand data is identified, a corresponding alternative attack and defense mode is matched from the alternative mode library according to the individual demand data, and the matched alternative attack and defense mode is marked as an individual attack and defense mode.

[0024] Furthermore, the alternative modes preset by the platform are analyzed in real time to determine the alternative recommended mode, and the alternative recommended mode is displayed to the management personnel.

[0025] Furthermore, the method for performing real-time additional analysis on the alternative modes preset by the platform includes:

[0026] Acquire demand feedback data of each user in real time, identify the feedback mode corresponding to the demand feedback data, and generate record data of the feedback mode;

[0027] Preset unit duration, classify the recorded data of the feedback mode according to the unit duration, and obtain a plurality of unit recorded data; calculate the recorded value corresponding to the unit recorded data, and generate a feedback recorded curve according to the recorded value;

[0028] Fit the feedback record curve to obtain the feedback record function, and mark the feedback record function as F(x), where x is the horizontal axis independent variable;

[0029] Calculate the corresponding evaluation value according to the evaluation formula, which is:

[0030] ;

[0031] Where: PG is the evaluation value; A is the preset value;

[0032] It is determined whether the feedback mode meets the candidate recommendation requirement according to the evaluation value, and the feedback mode that meets the candidate recommendation requirement is marked as the candidate recommendation mode.

[0033] Furthermore, the method for calculating the record value corresponding to the unit record data includes:

[0034] The identification unit records each feedback record corresponding to the data, identifies the user corresponding to the feedback record, matches the corresponding cumulative feedback value according to the user, and the cumulative feedback value is the cumulative number of feedbacks of the corresponding user on the feedback mode; the cumulative feedback value is marked as LP i , i=1, 2, ..., n, n is the number of feedback records in the corresponding unit record data;

[0035] The platform sets the reduction coefficient, which is marked as τ and has a value range of (0, 1];

[0036] The record value corresponding to the unit record data is calculated according to the record value formula, and the record formula is:

[0037] ;

[0038] Where: KG is the recorded value; LP i ≥1.

[0039] Furthermore, when there is no alternative attack and defense mode corresponding to the individual demand data in the alternative mode library, compatible mapping is performed according to the individual demand data.

[0040] A visual mapping system for cyberspace elements and network attack and defense elements, including a mapping analysis module, a collection module, and an attack and defense mapping module;

[0041] The mapping analysis module is used to set corresponding attack mapping mode, defense mapping mode and visualization mapping rules according to the benchmark attack mode and the benchmark defense mode.

[0042] The acquisition module is used to collect corresponding attack and defense data in real time;

[0043] The attack and defense mapping module is used to set a benchmark mapping method according to the attack mapping method, the defense mapping method and the visualization mapping rules. The benchmark mapping method is set according to the above-mentioned attack and defense mapping method and is used for attack and defense mapping; the attack and defense mapping is displayed according to the benchmark mapping method and the attack and defense data.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention makes the training environment of the network range more intuitive and clear by visually mapping the elements of cyberspace and network attack and defense elements. Trainers can quickly understand the network architecture, attack path and defense strategy, thereby shortening the training cycle and improving training efficiency. At the same time, by displaying the attack and defense dynamics in real time, trainers can more accurately evaluate the training effect, adjust the training strategy in time, and further improve the training quality. Through visual mapping, it provides strong support for the innovation and research and development of network attack and defense technology. Researchers can intuitively analyze the key nodes and weak links in the network attack and defense process, so as to propose new attack methods or defense strategies. In addition, the system also supports the collection and analysis of attack and defense data, providing a rich data foundation for in-depth research on network attack and defense technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0048] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] like Figure 1 As shown, a visualization mapping method of cyberspace elements and network attack and defense elements includes:

[0050] Step 1: Determine the baseline attack mode and baseline defense mode. The baseline attack mode includes the CAPEC attack mode and the ATT&CK attack mode. The baseline defense mode is the D3FEND defense mode. Set the corresponding attack mapping method, defense mapping method, and visualization mapping rules according to the baseline attack mode and baseline defense mode.

[0051] The attack mapping method is to perform a visual attack display based on the real-time collected attack data during the application process.

[0052] The defense mapping method is to integrate the defense nodes and attack nodes into the same scene through defense mapping according to the defense data collected in real time during the application process, so as to intuitively display the dynamic logic and mutual relationship of attack and defense confrontation, and help users understand how defense measures target and respond to attacks.

[0053] Visual mapping rules are set based on expert knowledge and user needs, and can be adjusted through parameterized configuration to ensure the flexibility and adaptability of the system in different application scenarios.

[0054] In one embodiment, the attack mapping method, defense mapping method and visualization mapping rules can be set based on the existing technology in the existing network target range technology field, or the existing attack mapping method, defense mapping method and visualization mapping rules corresponding to the baseline attack mode and the baseline defense mode can be directly applied.

[0055] In one embodiment, the attack mapping mode and the defense mapping mode may be set in the following manner, such as:

[0056] The baseline attack feature information of the baseline attack mode is obtained, including its corresponding essential characteristics, behavioral logic, multi-dimensional attributes and other related information, and the baseline attack feature information is classified to obtain the classification of each base point, and the corresponding visualization primitives are set according to the classification of each base point, such as points, lines, surfaces, and bodies, which can form various complex visualization graphics through different combinations and arrangements; the multi-dimensional attributes are associated with the parameters of the corresponding visualization primitives according to the baseline attack feature information; that is, by analyzing the multi-dimensional attributes of each attack mode (such as attack means, targets, impacts, etc.) in detail, these attributes are accurately associated with the parameters of the visualization elements (such as shape, color, size, etc.), so as to realize the mapping from abstract mode to concrete visualization.

[0057] Set up a visual mapping method for the attack process; that is, use graph theory principles to construct a directed graph in three-dimensional space, with attack patterns as nodes, and their execution order and dependencies as edges. The hierarchical structure of the attack process is represented by the position and height information of the nodes in three-dimensional space, so as to fully present the spatiotemporal evolution of the attack process, forming a visual mapping method for the attack process, which is marked as the attack mapping method.

[0058] Obtain baseline defense feature information of the baseline defense mode. The baseline defense feature information mainly includes the defense mechanism principle and functional characteristics of the baseline defense mode. Classify the defense functions of the baseline defense mode according to the baseline defense feature information, obtain each functional classification, and associate each functional classification with the corresponding visualization representation. In the visualization presentation, integrate the defense nodes and attack nodes into the same scene to intuitively display the dynamic logic and mutual relationship of the attack and defense confrontation; display the dynamic logic of the attack and defense confrontation through visualization means to help users understand how defense measures target and respond to attacks; integrate and set the defense mapping method.

[0059] For example, in CAPEC, attack patterns can be classified as follows:

[0060] Classification by attack target:

[0061] Privilege escalation: An attacker attempts to gain higher privileges than the current user in order to access more system resources or perform more operations.

[0062] Data theft: Attackers attempt to steal valuable data or information from a target system.

[0063] Denial of service: The attacker makes the target system unable to provide normal services by sending a large number of requests or consuming system resources.

[0064] Malware distribution: Attackers spread malware to infect target systems and then take control of or damage them.

[0065] Classification by attack strategy:

[0066] Exploiting vulnerabilities: Attackers take advantage of known or unknown vulnerabilities in the target system to launch attacks.

[0067] Social engineering: Attackers use deception, inducement, and other means to make target users perform unsafe behaviors or disclose sensitive information.

[0068] Physical access: The attacker gains access to the target system through physical means, such as theft, destruction, etc.

[0069] Classification by attack technique:

[0070] Injection attacks: such as SQL injection and command injection, attackers manipulate the behavior of the target system by inputting malicious data.

[0071] Cross-site scripting (XSS): The attacker injects malicious scripts in the target system so that it will be executed when the user browses.

[0072] Session fixation: An attacker can track or hijack a user's session by fixing the user's session identifier.

[0073] Clickjacking: Attackers use visual deception to make users perform malicious actions without their knowledge.

[0074] In addition, CAPEC also considers the application of attack patterns in different fields, such as software, hardware, communications, supply chain, and social engineering, further enriching its classification system.

[0075] In ATT&CK, attack patterns can be categorized as follows:

[0076] Classification by behavioral stage:

[0077] Reconnaissance: The attacker gathers information about the target system in preparation for a subsequent attack.

[0078] Resource development: Attackers create or obtain resources used for attacks, such as malware, phishing emails, etc.

[0079] Initial access: The attacker gains access to the target system by exploiting vulnerabilities or social engineering.

[0080] Execution: The attacker executes malicious code or commands in the target system.

[0081] Persistence: The attacker takes steps to ensure a persistent presence on the target system.

[0082] Privilege escalation: An attacker attempts to gain higher privileges to access more system resources.

[0083] Defense Bypass: Attackers avoid or bypass security controls.

[0084] Credentialed access: An attacker obtains, uses, or steals credentials to gain access to a target system.

[0085] Discovery: The attacker explores the target system, looking for valuable assets or information.

[0086] Lateral movement: The attacker moves from one system or account to another within the target system.

[0087] Collect: The attacker gathers valuable information or data.

[0088] Command and Control: Communication and control between the attacker and the attacked system.

[0089] Data theft: The attacker steals data from the target system.

[0090] Harm: The attacker causes damage or loss to the target system.

[0091] Classification by technical means:

[0092] Malware: Attackers use malware to infect target systems and take control of or damage them.

[0093] Vulnerability Exploitation: Attackers take advantage of known or unknown vulnerabilities in the target system to launch an attack.

[0094] Phishing: Attackers send fake emails or messages to trick the target user into clicking on a malicious link or downloading a malicious attachment.

[0095] Credential theft: Attackers gain access to target systems by stealing or cracking credentials.

[0096] Social Engineering: Attackers exploit human psychology and social behavior to deceive or trick target users into performing unsafe actions.

[0097] Specific classification adjustments can be made according to actual needs, and the obtained classifications can be marked as base point classifications.

[0098] Step 2: Establish an attack and defense mapping module according to the attack mapping method, defense mapping method and visualization mapping rules, that is, subsequently input the corresponding attack and defense data into the attack and defense mapping module, and perform attack and defense visualization through the attack and defense mapping module, that is, the attack and defense mapping module is used for attack and defense mapping display.

[0099] Step 3: Setting a collection module according to the baseline attack mode and the baseline defense mode, wherein the collection module is used to collect corresponding attack and defense data in real time, wherein the attack and defense data includes attack collection data and defense collection data;

[0100] For example, it can parse CAPEC, ATT&CK and D3FEND framework data and convert them into structured data objects. It also has a real-time update mechanism to adapt to new mode data, that is, the collection module can collect data under other attack modes and defense modes. It can also realize subsequent attack and defense data collection. The attack and defense data are data that have undergone corresponding data processing and can be applied by the attack and defense mapping module.

[0101] Step 4: When conducting attack and defense drills, tests and other scenarios, the acquisition module collects the corresponding attack and defense data in real time, and sends the attack and defense data to the attack and defense mapping module. The attack and defense mapping module displays the attack and defense mapping based on the attack and defense data.

[0102] With the development of attack and defense technology and the changes and differences in user needs, users may have other attack and defense needs in some cases. For example, they may not use the attack mode under the baseline attack mode, but want to use other attack models for attack and defense drills. However, the flexibility of the current system does not meet the requirements, which leads to the failure to meet the user's attack and defense needs. Therefore, the following steps are also included. The attack and defense visualization mapping requirements under the baseline attack mode and the baseline defense mode are marked as baseline attack and defense requirements, and other non-benchmark attack and defense requirements are marked as personalized attack and defense requirements.

[0103] Step 5: When the user has personalized attack and defense needs, identify the demand data of the personalized attack and defense needs and mark it as personalized demand data, such as the attack mode, defense mode and other related information of the application; determine the personalized attack and defense mode according to the personalized demand data, and perform attack and defense mapping display based on the personalized attack and defense mode.

[0104] In one embodiment, the method for determining the personalized attack and defense mode according to the personalized demand data includes:

[0105] The platform party presets various alternative attack modes and alternative defense modes and integrates them into alternative modes; that is, the platform party selects corresponding attack modes and defense modes as alternative modes according to the usage of existing attack modes and defense modes and actual needs;

[0106] The alternative attack and defense modes are determined according to the alternative modes, that is, the mode combination corresponding to the non-benchmark attack mode and the benchmark defense mode is determined according to each alternative mode, the benchmark attack mode and the benchmark defense mode; which is equivalent to that the alternative attack and defense mode can be an attack and defense combination between the alternative modes, or an attack and defense combination between the alternative mode and the corresponding benchmark attack mode or benchmark defense mode; the attack and defense mode between the benchmark attack mode and the benchmark defense mode is marked as the benchmark attack and defense mode.

[0107] Determine the corresponding attack mapping method, defense mapping method and visual mapping rules according to each alternative attack and defense mode, and then adjust the attack and defense mapping module so that it can realize the attack and defense mapping display of the alternative attack and defense mode; integrate each alternative attack and defense mode to establish an alternative mode library;

[0108] Identify the individual demand data, match the corresponding alternative attack and defense mode from the alternative mode library according to the individual demand data, and mark the matched alternative attack and defense mode as the individual attack and defense mode.

[0109] In one embodiment, as the user's usage and needs change, the pre-selected alternative mode may not meet the demand changes, but the platform cannot make adjustments in time, affecting the user experience. Based on this, in this embodiment, the alternative mode is adjusted according to the user's demand feedback data; the adjustment process is as follows:

[0110] Acquire demand feedback data from each user in real time, including feedback from users on personalized attack and defense modes corresponding to alternative modes that they want to apply but do not have, mainly alternative modes that they want to add; identify the attack mode or defense mode corresponding to the demand feedback data, and mark it as a feedback mode; and generate record data for each feedback mode in real time, including the demand feedback data of users at the corresponding time corresponding to the feedback mode;

[0111] The platform presets a unit duration, which is used to count the number of records of each feedback mode, such as one day, one week, etc.; classifies the recorded data of the feedback mode according to the unit duration, and forms the recorded data of the time period corresponding to each unit duration, which is marked as unit recorded data; the unit recorded data consists of each feedback record of the feedback mode, that is, one feedback record corresponds to one demand feedback data for the feedback mode; calculates the record value corresponding to the unit recorded data, and generates the feedback record curve of the corresponding feedback mode according to each record value; the horizontal axis is the coordinate axis with the unit duration as the minimum coordinate segment, such as 1 represents one unit duration, 2 represents two unit durations, etc.; the vertical axis is the sum of the corresponding valid record times within the unit duration, marked as the record value ; If the unit duration is one day, it is the sum of the valid record times of the feedback mode in one day. Because some users will continuously feedback the same feedback mode, in order to increase the validity of the data, it is necessary to reduce the subsequent feedback. For example, if the first valid record number is 1, the second time is reduced, such as 0.5, and the third time is 0.25. It is reduced according to multiples of 0.5. It is set according to the needs of the platform. If no reduction is performed, the reduction coefficient is 1; illustratively, the reduction coefficient set by the platform is marked as τ, and the value range is (0, 1]; identify the user corresponding to the corresponding unit record data, identify the number of feedbacks of the user on the feedback mode, and mark it as the cumulative feedback value; mark the cumulative feedback value as LP i, i represents the feedback record corresponding to the corresponding unit record data, i=1, 2, ..., n, n is the number of feedback records in the corresponding unit record data; the record value corresponding to the unit record data is calculated according to the record value formula, and the record formula is:

[0112] ;

[0113] Where: KG is the recorded value.

[0114] Fit the feedback record curve to obtain the feedback record function, and mark the feedback record function as F(x), where x is the horizontal axis independent variable;

[0115] Calculate the corresponding evaluation value according to the evaluation formula, which is:

[0116] ;

[0117] Where: PG is the evaluation value; A is the preset value, which is set by the platform according to the number of users and the requirements for adding alternative modes. For example, the number of users can be directly applied;

[0118] The above integral is used to calculate the cumulative record value. For the segments that cannot be integrated, other existing calculation methods are used for accumulation, such as directly applying the accumulation formula for accumulation.

[0119] The feedback mode with an evaluation value greater than a threshold is marked as an alternative recommendation mode, ie, it meets the alternative recommendation requirements; the threshold is set by technicians in this field according to actual conditions or obtained by simulating a large amount of data.

[0120] In one embodiment, when there is no alternative attack and defense mode corresponding to the individual demand data in the alternative mode library, but the user's attack and defense demand needs to be met, the individual attack and defense mode can be determined in the following manner, including:

[0121] Determine each reference attack and defense mode, the reference attack and defense mode may be a baseline attack and defense mode or a baseline attack and defense mode and an alternative attack and defense mode, and is specifically determined according to the actual attack and defense mode; for ease of representation, the attack mode and defense mode corresponding to the reference attack mode are marked as reference modes;

[0122] Identify the attack mode and defense mode corresponding to the individual demand data, and then determine the attack mode and defense mode of the non-alternative mode, the baseline attack mode, and the baseline defense mode according to the reference attack and defense mode, and mark them as the compatible mode;

[0123] Acquire attack or defense feature information corresponding to the to-be-compatible mode, mark it as compatible feature information, and mark attack or defense feature information corresponding to the reference mode as reference feature information;

[0124] According to the comparison and analysis between the compatible feature information and the reference feature information of each reference mode, the reference mode closest to the to-be-compatible mode framework, that is, the reference mode with the greatest similarity, is determined and marked as the base reference mode, the reference feature information of the base reference mode is marked as the base reference feature information, and the other reference feature information is marked as the additional reference feature information; according to the base reference mode, a replacement attack and defense mode is determined, the base reference mode is used to replace the to-be-compatible mode, and an existing reference attack and defense mode is formed with another reference mode, which is marked as the replacement attack and defense mode;

[0125] Classifying the compatible feature information, the benchmark reference feature information and the additional reference feature information respectively, obtaining corresponding base point classifications, and marking them as compatible base point classifications, benchmark base point classifications and additional base point classifications respectively;

[0126] The compatible mapping method of the mode to be compatible is set according to the compatible base point classification, benchmark base point classification and additional base point classification, and the corresponding compatible attack and defense mode is formed according to the compatible mapping method and the replacement attack and defense mode. The compatible attack and defense mode is subsequently applied for mapping. The corresponding users can make corresponding mapping adjustments to better meet user needs, and record them in the corresponding user data for the user's retrieval next time.

[0127] In one embodiment, the compatible mapping mode of the to-be-compatible mode is set according to the compatible base point classification, the reference base point classification and the additional base point classification, and the method is:

[0128] Identify the benchmark base point classifications that are identical or meet the requirements of similarity between compatible base point classifications and benchmark base point classifications, and then perform compatible mapping in combination with the benchmark base point classifications that meet the requirements, match other compatible base point classifications with additional base point classifications, determine the additional base point classifications that are identical or meet the similarity requirements, and finally, for the remaining compatible base point classifications, they can be matched from a preset database that stores various base point classifications; subsequently integrate them into a compatible mapping method; specifically, establish a compatible mapping analysis model based on a CNN network or a DNN network for analysis, and train through a set training set, the training set includes input data and output data, the input data is a compatible base point classification, a benchmark base point classification, an additional base point classification, and a database that stores various base point classifications; the output data is a compatible mapping method; and the analysis is performed through the compatible mapping analysis model after successful training.

[0129] In one embodiment, the compatible mapping method of the to-be-compatible mode is set according to the compatible base point classification, the reference base point classification and the additional base point classification, and can be set based on other existing methods.

[0130] In one embodiment, when there is no alternative attack and defense mode corresponding to the individual demand data in the alternative mode library, compatible mapping is performed according to the individual demand data;

[0131] An intelligent attack-defense mapping model can be built based on machine learning, natural language processing and other technologies. The model can automatically generate a corresponding attack-defense mapping framework based on the attack mode information input by the user, including attack mode classification, defense mode classification and the mapping relationship between them.

[0132] For example, a large amount of attack and defense mode data is collected, including key information such as attack or defense means, targets, impacts, etc. The data is pre-processed such as cleaning, deduplication, and standardization to ensure data quality and consistency.

[0133] Using natural language processing technology, key features are extracted from attack pattern data, such as specific technical details of attack and defense methods, types of target systems, etc. These features are represented in vector form for subsequent processing by machine learning models.

[0134] According to the characteristics of the problem, select the appropriate machine learning model, such as classifier, clusterer, etc. Use the preprocessed data and extracted features to train and optimize the model. During the training process, adjust the parameters and structure of the model through cross-validation, grid search and other methods to improve the performance and accuracy of the model.

[0135] Based on the trained model, formulate attack-defense mapping rules. These rules should be able to automatically generate the corresponding attack-defense mapping framework based on the input attack mode information. In the process of rule formulation, factors such as the classification of attack modes, the classification of defense modes, and the mapping relationship between them need to be considered.

[0136] Integrate the trained model and the formulated rules into the intelligent generation system. Users can trigger the system to generate the corresponding attack and defense mapping framework by inputting attack mode information. The attack and defense mapping framework generated by the system can be displayed through a visual interface so that users can intuitively understand the attack and defense situation.

[0137] A visual mapping system for cyberspace elements and network attack and defense elements, including a mapping analysis module, a collection module, and an attack and defense mapping module;

[0138] The mapping analysis module is used to set corresponding attack mapping mode, defense mapping mode and visualization mapping rules according to the baseline attack mode and the baseline defense mode.

[0139] The acquisition module is used to collect corresponding attack and defense data in real time;

[0140] The attack and defense mapping module is used to set a benchmark mapping method according to the attack mapping method, the defense mapping method and the visualization mapping rules. The benchmark mapping method is set according to the above-mentioned attack and defense mapping method and is used for attack and defense mapping; the attack and defense mapping is displayed according to the benchmark mapping method and the attack and defense data.

[0141] The above formulas are all calculated by removing dimensions and taking numerical values. The formula is a formula that is closest to the actual situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained by simulating a large amount of data.

[0142] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A method for visual mapping of cyberspace elements and network attack and defense elements, characterized in that: Methods include: Step 1: Determine a baseline attack mode and a baseline defense mode, wherein the baseline attack mode includes a CAPEC attack mode and an ATT&CK attack mode, and the baseline defense mode is a D3FEND defense mode; set corresponding attack mapping methods, defense mapping methods, and visualization mapping rules according to the baseline attack mode and the baseline defense mode; Step 2: Establish an attack and defense mapping module according to the attack mapping method, the defense mapping method and the visualization mapping rule, and the attack and defense mapping module is used to perform attack and defense mapping display; Step 3: Setting a collection module according to the baseline attack mode and the baseline defense mode, wherein the collection module is used to collect corresponding attack and defense data in real time, wherein the attack and defense data includes attack collection data and defense collection data; Step 4: The corresponding attack and defense data are collected in real time by the collection module, and the attack and defense data are sent to the attack and defense mapping module, and the attack and defense mapping module performs attack and defense mapping display according to the attack and defense data; Step 5: When the user has a personalized attack and defense requirement, the requirement data of the personalized attack and defense requirement is identified and marked as personalized requirement data; a personalized attack and defense mode is determined according to the personalized requirement data, and an attack and defense mapping display is performed based on the personalized attack and defense mode.

2. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 1, characterized in that: The attack mapping method is as follows: Obtaining benchmark attack feature information of the benchmark attack mode, classifying according to the benchmark attack feature information, obtaining base point classification, and setting corresponding visualization primitives according to the base point classification; Identify the multi-dimensional attributes corresponding to the benchmark attack feature information, and associate the multi-dimensional attributes with parameters of corresponding visualization primitives; and construct a visualization mapping method of the attack process, which is marked as an attack mapping method.

3. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 2, characterized in that: The defense mapping mode settings include: Obtaining baseline defense feature information of a baseline defense mode, classifying defense functions of the baseline defense mode according to the baseline defense feature information to obtain a functional classification; and associating the functional classification with a corresponding visual representation; In the visual presentation, the defense nodes and attack nodes are integrated into the same scene, and the defense mapping method is set.

4. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 1, characterized in that: Methods for determining personalized attack and defense modes based on personalized demand data include: The platform presets several alternative modes, which are composed of corresponding alternative attack modes and alternative defense modes; Determining an alternative attack and defense mode according to the alternative mode; Adjusting the attack and defense mapping module according to the alternative attack and defense mode; and establishing an alternative mode library according to the alternative attack and defense mode; The individual demand data is identified, a corresponding alternative attack and defense mode is matched from the alternative mode library according to the individual demand data, and the matched alternative attack and defense mode is marked as an individual attack and defense mode.

5. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 4, characterized in that: Perform real-time additional analysis on the alternative modes preset by the platform, determine the alternative recommended mode, and display the alternative recommended mode to the management personnel.

6. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 5, characterized in that: Methods for real-time additional analysis of alternative modes preset by the platform include: Acquire demand feedback data of each user in real time, identify the feedback mode corresponding to the demand feedback data, and generate record data of the feedback mode; Preset unit duration, classify the recorded data of the feedback mode according to the unit duration, and obtain a plurality of unit recorded data; calculate the recorded value corresponding to the unit recorded data, and generate a feedback recorded curve according to the recorded value; Fit the feedback record curve to obtain the feedback record function, and mark the feedback record function as F(x), where x is the horizontal axis independent variable; Calculate the corresponding evaluation value according to the evaluation formula, which is: ； Where: PG is the evaluation value; A is the preset value; It is determined whether the feedback mode meets the candidate recommendation requirement according to the evaluation value, and the feedback mode that meets the candidate recommendation requirement is marked as the candidate recommendation mode.

7. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 6, characterized in that: The method for calculating the record value corresponding to the unit record data includes: The identification unit records each feedback record corresponding to the data, identifies the user corresponding to the feedback record, matches the corresponding cumulative feedback value according to the user, and the cumulative feedback value is the cumulative number of feedbacks of the corresponding user on the feedback mode; the cumulative feedback value is marked as LP i , i=1, 2, ..., n, n is the number of feedback records in the corresponding unit record data; The platform sets the reduction coefficient, which is marked as τ and has a value range of (0, 1]; The record value corresponding to the unit record data is calculated according to the record value formula, and the record formula is: ； Where: KG is the recorded value; LP i ≥1.

8. A method for visual mapping of cyberspace elements and network attack and defense elements according to claim 4, characterized in that: When there is no alternative attack and defense mode corresponding to the individual demand data in the alternative mode library, compatible mapping is performed according to the individual demand data.

9. A visual mapping system for cyberspace elements and network attack and defense elements, characterized in that: A method for visual mapping of cyberspace elements and network attack and defense elements according to any one of claims 1 to 8, comprising a mapping analysis module, a collection module and an attack and defense mapping module; The mapping analysis module is used to set corresponding attack mapping mode, defense mapping mode and visual mapping rules according to the baseline attack mode and the baseline defense mode; The acquisition module is used to collect corresponding attack and defense data in real time; The attack and defense mapping module is used to set a reference mapping method according to the attack mapping method, the defense mapping method and the visualization mapping rule, and to display the attack and defense mapping according to the reference mapping method and the attack and defense data.

Images