Power monitoring system attack scene processing method and device based on attack chain matching

Abstract

The invention discloses a power monitoring system attack scene processing method and device based on attack chain matching. The method comprises the steps of obtaining target attack chain data of a power monitoring system; processing the target attack chain data to obtain target attack chain features; retrieving based on the target attack chain feature to obtain at least one similar attack chain feature; and processing the attack scene information corresponding to the similar attack chain features and the target attack chain features by using a large language model to obtain processing suggestion information corresponding to the target attack chain data. According to the scheme, the network attack suffered by the power monitoring system can be more accurately identified in combination with the target attack chain data, particularly, complex attack scenes such as advanced persistent threat (APT) and the like can be accurately identified, and reasonable disposal suggestion information can be timely formulated through the large language model, so that the security of the power monitoring system is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of system protection technology, and in particular to a method and device for processing attack scenarios of a power monitoring system based on attack chain matching. Background Art

[0002] With the rapid development of smart grid technology, the security protection of power monitoring systems faces increasing challenges. Traditional security protection solutions mainly rely on single-point protection and static rule matching, which is inadequate in the face of modern complex network attacks. Especially when dealing with complex attack scenarios such as advanced persistent threats (APT), traditional methods cannot effectively identify the evolution path of the attack chain, and it is difficult to provide timely and effective disposal suggestions.

[0003] Therefore, how to promptly identify and provide corresponding disposal methods when the power monitoring system is attacked by a network attack has become an urgent problem to be solved. Summary of the invention

[0004] To this end, this application discloses the following technical solutions:

[0005] The first aspect of the present application provides a method for processing attack scenarios of a power monitoring system based on attack chain matching, comprising:

[0006] Obtain target attack chain data of power monitoring system;

[0007] Processing the target attack chain data to obtain target attack chain features;

[0008] Retrieving and obtaining at least one similar attack chain feature based on the target attack chain feature;

[0009] The attack scenario information corresponding to the similar attack chain features and the target attack chain features are processed using a large language model to obtain disposal suggestion information corresponding to the target attack chain data.

[0010] Optionally, also include:

[0011] A target attack chain map is generated according to the disposal suggestion information and the target attack chain data, and the target attack chain map is used to be output together with the disposal suggestion information.

[0012] Optionally, generating a target attack chain graph according to the disposal suggestion information and the target attack chain data includes:

[0013] Identify entities in the treatment suggestion information and the target attack chain data, the entities comprising at least one of a device entity, an attack technology entity, a security event entity, and a protective measure entity;

[0014] Extracting the relationship between the entities, wherein the relationship includes at least one of an attack relationship, a protection relationship, and a dependency relationship;

[0015] A target attack chain graph is generated according to the entities and the relationships.

[0016] Optionally, obtaining target attack chain data of the power monitoring system includes:

[0017] Real-time detection of security events in power monitoring systems;

[0018] When a starting security event representing the beginning of an attack chain and an ending security event representing the end of an attack chain are detected, a set of multiple security events detected from the starting security event to the ending security event is obtained as target attack chain data of the power monitoring system.

[0019] Optionally, the processing the target attack chain data to obtain target attack chain features includes:

[0020] Performing data preprocessing on the target attack chain data to obtain preprocessed target attack chain data;

[0021] Extracting the time characteristics, attack behavior characteristics and impact range characteristics of each security event in the pre-processed target attack chain data;

[0022] The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics and impact range characteristics of each security event.

[0023] Optionally, the retrieving at least one similar attack chain feature based on the target attack chain feature includes:

[0024] For each candidate attack chain feature in the preset feature library, calculating the comprehensive similarity between the target attack chain feature and the candidate attack chain feature;

[0025] A plurality of similar attack chain features are determined from a plurality of candidate attack chain features in the feature library according to the similarity.

[0026] Optionally, the calculating the comprehensive similarity between the target attack chain feature and the candidate attack chain feature includes:

[0027] Calculating the time similarity, behavior similarity, and impact similarity of the target attack chain feature and the candidate attack chain feature;

[0028] The time similarity, the behavior similarity and the impact similarity are fused according to a weight parameter to obtain a comprehensive similarity between the target attack chain feature and the alternative attack chain feature.

[0029] Optionally, the method for calculating the behavior similarity includes:

[0030] The behavior similarity is calculated according to the degree of harm of different attack techniques.

[0031] Optionally, also include:

[0032] Using the large language model to perform a feasibility assessment on the treatment suggestion information to obtain an assessment result;

[0033] When the evaluation result does not meet the target condition, the large language model is used to optimize the disposal suggestion information to obtain optimized disposal suggestion information.

[0034] A second aspect of the present application provides an attack scenario processing device for a power monitoring system based on attack chain matching, comprising:

[0035] An acquisition unit, used for acquiring target attack chain data of a power monitoring system;

[0036] A processing unit, configured to process the target attack chain data to obtain target attack chain features;

[0037] A retrieval unit, configured to retrieve at least one similar attack chain feature based on the target attack chain feature;

[0038] The handling unit is used to use a large language model to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features to obtain handling suggestion information corresponding to the target attack chain data.

[0039] The beneficial effects of this scheme are that it can combine the target attack chain data to more accurately identify the network attacks on the power monitoring system, especially it can accurately identify complex attack scenarios such as advanced persistent threats (APT), and can timely formulate reasonable disposal suggestion information through a large language model, thereby effectively improving the security of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0041] Figure 1 It is a flow chart of a method for processing attack scenarios of a power monitoring system based on attack chain matching provided in an embodiment of the present application;

[0042] Figure 2It is a schematic diagram of an attack scenario processing system for a power monitoring system based on attack chain matching provided in an embodiment of the present application;

[0043] Figure 3 It is a schematic diagram of calculating the comprehensive similarity between target attack chain features and alternative attack chain features provided by an embodiment of the present application;

[0044] Figure 4 This is a flow chart of generating a target attack chain map provided by an embodiment of the present application;

[0045] Figure 5 It is a structural diagram of an attack scenario processing device for a power monitoring system based on attack chain matching provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] The method provided in this embodiment can be Figure 2 The system is implemented as shown. The overall system adopts a hierarchical architecture design, which is divided into four main functional layers from bottom to top: input layer, analysis layer, knowledge layer and output layer. This hierarchical design not only ensures the modularity and scalability of the system, but also facilitates the independent optimization and upgrade of each functional module.

[0048] The input layer is mainly responsible for the collection and preprocessing of raw data. Figure 2 As shown, the input layer can collect attack chain data through a standardized data interface, perform data preprocessing on the collected attack chain data (including but not limited to data cleaning, format conversion, etc.), and then construct feature vectors for the preprocessed attack chain data to extract the vector representation of the attack chain data in the high-dimensional feature space, that is, to obtain the attack chain features of the attack chain data, thereby providing standardized input for subsequent analysis.

[0049] The analysis layer is the core computing unit of the system, which includes the attack chain matching module and the retrieval enhancement module. Figure 2As shown in the figure, the attack chain matching module can determine the matching results corresponding to the collected attack chain data based on the multi-dimensional similarity calculation method. The matching results indicate which attack chain features pre-stored in the feature library are similar to the currently collected attack chain data, thereby realizing accurate identification of the attack scenario. The retrieval enhancement module realizes intelligent disposal plan generation by integrating knowledge retrieval and large model generation technology. Specifically, the retrieval enhancement module can obtain the attack scenario information corresponding to similar attack chain features from the case library, and input the attack scenario information and the currently obtained attack chain features into the large language model, so that the large language model can generate disposal suggestion information corresponding to the currently obtained attack chain features based on context fusion (i.e., fusion of attack scenario information and currently obtained attack chain features). The collaborative work of these two modules ensures the accuracy and practicality of the system analysis results.

[0050] The knowledge layer serves as the knowledge management center of the system, and mainly includes two functions: building an attack chain map and updating the knowledge base. The knowledge base here can include a feature library and a case library. The feature library stores multiple attack chain features collected in advance, and the case library stores the attack scenario information corresponding to each attack chain feature in the feature library. In this embodiment, each attack chain feature can correspond to a network attack process that actually occurred in the power monitoring system. The attack scenario information corresponding to the attack chain feature can include the equipment that is attacked by the network, as well as the operating environment of each device when it is attacked by the network, equipment parameters and other information. The knowledge base update module mainly includes two parts: feature library maintenance and case library expansion. Specifically, feature library maintenance mainly adds the attack chain features obtained by the input layer to the feature library each time it is attacked by the network, and case library expansion adds the attack scenario information when it is attacked by the network to the case library. Feature library maintenance and case library expansion can ensure that the system can continuously learn and adapt to new attack scenarios.

[0051] The attack chain map construction function is mainly responsible for converting the disposal suggestion information and other analysis results input by the analysis layer into an intuitive attack chain map to achieve a visual expression of the attack scenario.

[0052] The output layer is responsible for the display and interaction of analysis results. Through visualization technology, the disposal suggestion information and other possible analysis results output by the analysis layer are converted into intuitive graphical displays, and interactive query and operation interfaces are provided, as well as the attack chain map input by the knowledge layer is visualized. This layer is also responsible for generating standardized disposal suggestion reports to provide decision support for security operation and maintenance personnel.

[0053] Each layer exchanges data and calls functions through standardized interfaces. For example, the input layer passes processed data to the analysis layer through the feature vector interface, the analysis layer submits analysis results to the knowledge layer through the knowledge graph interface, and the knowledge layer provides the knowledge network to the output layer through the visualization interface. This standardized interface design not only ensures the loose coupling of various parts of the system, but also facilitates future functional expansion and upgrades.

[0054] In addition, the system also implements a feedback mechanism between modules. The interactive operation of the output layer can trigger the update of the knowledge layer, which in turn affects the processing logic of the analysis layer, forming a closed-loop optimization process. This feedback mechanism enables the system to continuously learn and evolve, improving the accuracy and practicality of the analysis results.

[0055] Each functional module of the system adopts a pluggable design concept, supporting flexible replacement of different algorithms and models. For example, the similarity calculation module of the analysis layer can choose different algorithms to implement according to the specific application scenario, and the graph construction module of the knowledge layer can also adopt different visualization schemes. This flexible design enables the system to adapt to the needs of different scenarios and continuously optimize and upgrade with the development of technology.

[0056] Based on the above system, the embodiment of the present application provides a method for processing attack scenarios of a power monitoring system based on attack chain matching. Figure 1 , the method may include the following steps.

[0057] S101, obtaining target attack chain data of the power monitoring system.

[0058] The target attack chain data may be a set of attack chain data detected by the input layer at the current moment. Each set of attack chain data corresponds to an attack chain. An attack chain is equivalent to a combination of a series of interrelated attack behaviors taken by the power monitoring system to achieve a specific purpose.

[0059] S102, processing the target attack chain data to obtain the target attack chain features.

[0060] S103: Retrieve at least one similar attack chain feature based on the target attack chain feature.

[0061] S104, using the large language model to process the attack scenario information and the target attack chain features corresponding to the similar attack chain features, and obtain the disposal suggestion information corresponding to the target attack chain data.

[0062] The beneficial effects of this scheme are that it can combine the target attack chain data to more accurately identify the network attacks on the power monitoring system, especially it can accurately identify complex attack scenarios such as advanced persistent threats (APT), and can timely formulate reasonable disposal suggestion information through a large language model, thereby effectively improving the security of the power monitoring system.

[0063] Step S101 can be performed by Figure 2 The input layer shown is implemented.

[0064] In this embodiment, the target attack chain data of the power monitoring system may be obtained by:

[0065] A1, real-time detection of security events in the power monitoring system;

[0066] A2, when a starting security event representing the beginning of an attack chain and an ending security event representing the end of an attack chain are detected, a set of multiple security events detected from the starting security event to the ending security event is obtained as target attack chain data of the power monitoring system.

[0067] In step A1, the input layer can monitor the network attack behavior in the power monitoring system in real time. Every time a network attack behavior (such as DOS attack, Trojan attack, etc.) is detected, a security event corresponding to the network attack behavior is generated, thereby realizing real-time detection of security events in the power monitoring system.

[0068] Security incidents may include information related to the corresponding network attack behavior, including but not limited to the network attack technology used in the network attack behavior, when it occurred, which programs (or files) of which device were attacked, the duration of the attack, and other information.

[0069] At present, in order to achieve the purpose of attack (such as stealing information, destroying the system, etc.), the attacker usually carries out multiple consecutive and interrelated network attacks on the power monitoring system. The entire network attack process composed of these consecutive network attacks is an attack chain.

[0070] In step A2, each time the input layer detects a security event, it can use deep learning technology, neural network technology or other related technologies to analyze the security event to determine whether the security event is a starting security event or an ending security event. Based on this, after identifying a starting security event and then identifying an ending security event some time after the starting security event is identified, the input layer can use the set of multiple security events detected from the starting security event to the ending security event as the target attack chain data of the power monitoring system.

[0071] As an example, suppose the input layer detects 15 security events in succession, which are recorded as security event 1 to security event 15. After analysis, it is found that security event 3 is a starting security event and security event 11 is an ending security event. Then, a copy of attack chain data corresponding to an attack chain can be obtained. The attack chain data includes security event 3, security event 4, security event 5...security event 10 and security event 11, totaling 9 security events.

[0072] Among them, the starting security event means that the attack behavior corresponding to the security event is the first attack behavior in an attack chain, and the ending security event means that the attack behavior corresponding to the security event is the last attack behavior in an attack chain.

[0073] The method of identifying the start security event and the end security event can be found in the relevant technology, which will not be described in detail in this embodiment.

[0074] In step S102, the input layer can systematically adopt an improved sequence encoding algorithm to convert the attack chain into a vector representation in a high-dimensional feature space. The algorithm not only considers the temporal relationship of the attack steps, but also integrates the characteristics of the attack technology, and can effectively capture the essential characteristics of the attack chain.

[0075] At the technical implementation level, the input layer processes the target attack chain data to obtain the target attack chain features in the following ways:

[0076] Performing data preprocessing on the target attack chain data to obtain the preprocessed target attack chain data;

[0077] Extract the time characteristics, attack behavior characteristics and impact range characteristics of each security event in the pre-processed target attack chain data;

[0078] The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics and impact range characteristics of each security event.

[0079] The preprocessing method of the target attack chain data can refer to the relevant prior art, and will not be described in detail. The preprocessed target attack chain data is also composed of multiple security events.

[0080] See also Figure 3 After obtaining the pre-processed target attack chain data, for any security event (remembered as the i-th security event), the time characteristics t of the security event can be obtained as follows: i , attack behavior characteristics a i and impact range characteristics i .

[0081] When obtaining the time feature, the time sequence relationship and duration of the security event are mainly considered. Specifically, the time feature t of the i-th security eventi It can be expressed as the following formula (1).

[0082]

[0083] Where, ΔT i It represents the normalized time interval between the security event and the previous security event, which can be calculated using the following formula (2).

[0084]

[0085] T i Indicates the timestamp of the ith security event, that is, the ith security event occurred at T i The moment is detected, T i-1 Indicates the timestamp of the previous security event, that is, the i-1th security event, that is, the i-1th security event at T i-1 The moment is detected, T max Indicates the maximum attack chain duration of all attack chains. Here, all attack chains refer to all attack chains detected so far. Each attack chain has an attack chain duration, which represents how long the attack chain lasts. As an example, assuming that 20 attack chains have been detected so far, there are 20 attack chain durations. The maximum value among them is T max .

[0086] d i represents the duration of the i-th security event after logarithmic normalization, which can be calculated using the following formula (3).

[0087]

[0088] Among them, log means taking the logarithm with base 10, duration i Indicates the actual duration of the ith security event, in seconds. For example, if the input layer detects that the ith security event lasts for 10 seconds, then duration i Equals 10.

[0089] p i It represents the relative position of the ith security event in the attack chain to which it belongs, and can be expressed by the following formula (4).

[0090]

[0091] i means that the security event ranks ith in the attack chain to which it belongs, and N is the total number of security events contained in the attack chain. Combined with the previous example, for an attack chain consisting of security events 3 to 11, the third security event is security event 5, and the total number of security events contained in the attack chain is 9, so p3 is equal to 1 / 3.

[0092] The attack behavior feature a of the i-th security event i It can be expressed as the following formula (5).

[0093]

[0094] Among them, f ki Indicates the degree of existence (also called weight) of the kth attack technique in the ith security incident. The degree of existence of the attack technique can be defined based on the MITRE ATT&CK framework. The MITRE ATT&CK framework is an existing universally accessible and continuously updated knowledge base for simulating, detecting, preventing and combating network security threats based on known adversarial behaviors of network attacks. m is the dimension of the feature vector corresponding to the predefined attack technique. In this embodiment, it is possible to pre-analyze which attack techniques are commonly used to attack the power monitoring system, and determine the total number of these attack techniques as m. For example, if it is analyzed that there are 10 attack techniques commonly used to attack the power monitoring system, then m is determined to be equal to 10.

[0095] Exemplary, common attack techniques include, but are not limited to, security vulnerability attacks, Trojan attacks, node attacks, network monitoring attacks, denial of service (DoS) attacks, etc.

[0096] f ki The table can be calculated using the TF-IDF method using the following formula (6).

[0097]

[0098] TF-IDF (term frequency–inverse document frequency) is a commonly used weighting technique for information retrieval and data mining. TF stands for term frequency, and IDF stands for inverse document frequency.

[0099] Among them, tf ki represents the frequency of the kth attack technique in the ith security event, which can be calculated using the following formula (7).

[0100]

[0101] n ki represents the number of occurrences of the kth attack technique in the ith security event. The denominator ∑ b n ibIt represents the total number of occurrences of all m attack techniques in the i-th security event, that is, the sum of the number of occurrences of m attack techniques in the i-th security event.

[0102] df k It represents the total number of security events that contain the kth attack technique in the attack chain. For example, if there are 7 security events that contain the kth attack technique in the attack chain to which the i-th security event belongs, then df k Equals 7.

[0103] N represents the total number of attack behavior instances in the attack behavior set. In other words, N represents the total number of security events included in the attack chain.

[0104] The impact range characteristics of the i-th security event e i It can be expressed as the following formula (8).

[0105]

[0106] Among them, c i Indicates the impact of the i-th security event on confidentiality, i i represents the impact of the ith security event on integrity, q i Indicates the degree of impact of the ith security event on availability. The value range of each of the above impact degrees can be a real number from 0 to 1. The above impact degrees can be obtained by analyzing the ith security event using deep learning, neural networks or other related technologies. The specific acquisition method can refer to the relevant existing technology and will not be repeated here.

[0107] After obtaining the above three characteristics of each security event, the improved sequence coding algorithm can be used to extract the target attack chain characteristics of the target attack chain data.

[0108] First, the target attack chain data can be represented by the time series shown in formula (9).

[0109]

[0110] S represents the target attack chain data, s i represents the i-th security event contained in the target attack chain data, and N represents the total number of security events contained.

[0111] For the ith security event, the time feature, attack behavior feature, and impact range feature of the ith security event can be combined into the security event feature v as shown in formula (10): i .

[0112]

[0113] Then, the security event features of N security events can be fused according to formula (11) to obtain the target attack chain feature V.

[0114]

[0115] w i It represents the importance weight of the preset i-th security event, which can be determined according to the position of the i-th security event in the entire attack chain. Generally, the security events close to the two ends of the attack chain, that is, close to the beginning and the end, can be set with a larger importance weight, and the security events in the middle of the attack chain can be set with a smaller importance weight. The specific value can be set by the relevant users according to the actual situation and is not limited.

[0116] In step S103, at least one similar attack chain feature similar to the target attack chain feature may be retrieved from a preset feature library, and the retrieval method may be:

[0117] For each candidate attack chain feature in the preset feature library, calculate the comprehensive similarity between the target attack chain feature and the candidate attack chain feature;

[0118] A plurality of similar attack chain features are determined from a plurality of candidate attack chain features in the feature library according to the similarity.

[0119] See also Figure 3 ,For any candidate attack chain feature, the method of calculating the comprehensive similarity between the target attack chain feature and the candidate attack chain feature can be:

[0120] Calculate the time similarity, behavior similarity, and impact similarity of the target attack chain features and the alternative attack chain features;

[0121] The time similarity, behavior similarity and impact similarity are fused according to the weight parameters to obtain the comprehensive similarity of the target attack chain characteristics and the alternative attack chain characteristics.

[0122] The temporal similarity Sim between the target attack chain features and the alternative attack chain features seq (X, Y) can be expressed by the following formula (12).

[0123]

[0124] X represents the target attack chain feature, Y represents the alternative attack chain feature, x1 i The time characteristics of the i-th security event representing the target attack chain characteristics, y1 i represents the time characteristic of the i-th security event of the alternative attack chain feature, n represents the smaller of the total number of security events contained in the target attack chain and the total number of security events contained in the alternative attack chain, and w iIt represents the importance weight of the i-th event corresponding to the target attack chain feature, or represents the importance weight of the i-th event corresponding to the alternative attack chain feature.

[0125] match(x1 i , y1 i ) represents x1 i and y1 i The cosine similarity between .

[0126] Among them, the target attack chain refers to the attack chain corresponding to the target attack chain feature, and the alternative attack chain refers to the attack chain corresponding to the alternative attack chain feature. If the total number of security events contained in the target attack chain feature is greater than the total number of security events contained in the alternative attack chain feature, then n is equal to the total number of security events contained in the alternative attack chain feature, and w i represents the importance weight of the i-th event corresponding to the alternative attack chain feature; if the total number of security events contained in the target attack chain feature is less than or equal to the total number of security events contained in the alternative attack chain feature, then n is equal to the total number of security events contained in the target attack chain feature, and w i Represents the importance weight of the i-th event corresponding to the target attack chain feature.

[0127] The behavior similarity can be calculated as follows:

[0128] Calculate the behavior similarity based on the degree of harm of different attack techniques.

[0129] Specifically, behavioral similarity sim beh (X, Y) can be calculated using the following formula (13).

[0130]

[0131] imp(f k ) represents the characteristic importance weight of the kth attack technology among the aforementioned m attack technologies, and its value can be determined based on the degree of harm of the ith attack technology. The determination method can be referred to the relevant existing technology and will not be repeated here.

[0132] X represents the target attack chain feature, Y represents the alternative attack chain feature, x2 k It represents the value corresponding to the k-th attack technology in the target attack chain characteristics, that is, the sum of the product of the existence degree of the k-th attack technology in all security events of the target attack chain and the importance weight of each security event. It can be specifically expressed by the following formula (14).

[0133]

[0134] N represents the total number of security events contained in the target attack chain. The meanings of other parameters refer to formulas (5) and (11) and are not repeated here.

[0135] y2 k It represents the value corresponding to the k-th attack technology in the alternative attack chain characteristics, that is, the sum of the products of the existence degree of the k-th attack technology in all security events of the alternative attack chain and the importance weight of each security event. The calculation method can be seen in formula (14). It only needs to replace the parameters with the parameters corresponding to the alternative attack chain. No further details are given.

[0136] The impact similarity can be calculated using the weighted Jaccard coefficient. Specifically, the impact similarity Sim between the target attack chain feature and the alternative attack chain feature is imp (X, Y) can be calculated using the following formula (15).

[0137]

[0138] Among them, impw i They represent the weights of the three dimensions of confidentiality, integrity, and availability, respectively. The specific values ​​can be set by the relevant users as needed without limitation. Generally, these three weights can be set equal.

[0139] x3 i Represents the value corresponding to the i-th dimension in the target attack chain feature, where the first dimension is confidentiality, the second dimension is integrity, and the third dimension is availability. Specifically, x3 i It can be equal to the sum of the products of the data corresponding to the i-th dimension in the impact range characteristics of all security events in the target attack chain and the importance weights of all security events. As an example, x31 can be expressed by the following formula (16).

[0140]

[0141] N represents the total number of security events contained in the target attack chain. The meanings of other parameters refer to formulas (8) and (11) and are not repeated here. i Replace with i i Then use this formula to calculate that x33 can be used to convert the c in formula (16) into i Replace with q i Then use this formula to calculate it.

[0142] y3 i Represents the value corresponding to the i-th dimension in the alternative attack chain feature. Specifically, y3 iIt can be equal to the sum of the products of the data corresponding to the i-th dimension in the impact range characteristics of all security events in the alternative attack chain and the importance weights of all security events. The calculation method of y31 to y33 can refer to x31 to x33. It only requires replacing the parameters of the corresponding target attack chain with the parameters of the corresponding alternative attack chain. No further details are given.

[0143] The method of integrating the above three similarities to obtain the comprehensive similarity between the target attack chain characteristics and the alternative attack chain characteristics can be seen in the following formula (17).

[0144]

[0145] Sim t (X, Y) represents the comprehensive similarity between the target attack chain features and the alternative attack chain features. The aforementioned weight parameters include a similarity weight of 0.3 for time similarity, a similarity weight of 0.4 for behavior similarity, and a similarity weight of 0.3 for impact similarity.

[0146] The above weight parameters are set based on the following considerations:

[0147] The similarity weight of behavioral similarity is the highest (0.4), because it directly reflects the essential characteristics of the attack. The similarity weight of temporal similarity is equivalent to the similarity weight of impact similarity, both of which are 0.3, and together they complement each other in describing the attack scenario.

[0148] The advantage of calculating the comprehensive similarity according to the above method is that it comprehensively considers multiple feature dimensions of the attack scenario, adopts reasonable weight distribution, highlights the importance of key features, and improves the accuracy and robustness of matching through the fusion of multiple similarity algorithms. The calculation method is intuitive and easy to implement, and has good practicality.

[0149] Through the above-mentioned feature construction and comprehensive similarity calculation method, the system can accurately identify similar attack chain features and provide a reliable basis for the subsequent generation of disposal suggestions.

[0150] After the comprehensive similarity between each candidate attack chain feature and the target attack chain feature is determined, similar attack chain features can be retrieved from the knowledge base based on these comprehensive similarities using a dense retrieval model. Specifically, a method for determining multiple similar attack chain features can be to sort all candidate attack chain features from high to low according to the comprehensive similarity, and select the first K candidate attack chain features as similar attack chain features, that is, select the K candidate attack chain features with the highest comprehensive similarity as similar attack chain features. The set r of selected similar attack chain features can be expressed as r=topk(sim(A, B i ), K).

[0151] Among them, A represents the target attack chain characteristics, Bi represents the feature of the i-th candidate attack chain, sim(A, B i ) represents the comprehensive similarity between the two, topk(sim(A, B i ), K) represents selecting K candidate attack chain features with the highest comprehensive similarity.

[0152] In step S104, after obtaining K similar attack chain features, the large model input information C shown in the following formula (18) can be obtained, and then the large-scale language model (abbreviated as large language model) is used to process the input information to obtain the corresponding disposal suggestion information M of the target attack chain data, that is, M=LLM(C), where LLM represents the reasoning process of the large-scale language model. For the specific reasoning process, please refer to the working principle of the existing large language model.

[0153]

[0154] Among them, q represents the target attack chain characteristics, R k Represents the attack scenario information corresponding to the kth similar attack chain feature, which can be obtained from the case library maintained by the knowledge layer. The attack scenario information corresponding to the similar attack chain feature can include the equipment, operating environment and other optional information related to the attack chain in the power monitoring system when the attack chain corresponding to the similar attack chain feature occurs, such as which equipment in the attack chain is attacked, the operating environment of the equipment when attacked, and various equipment parameters, etc. k is an integer from 1 to K, that is, k∈[1, K].

[0155] In some optional embodiments, the information input into the large language model when generating the disposal suggestion information may also include the attack scenario information corresponding to the target attack chain data, and may also include the target attack chain data.

[0156] The disposal suggestion information M corresponding to the target attack chain data may include one or more disposal measures that should be performed on the target attack chain data, such as updating the firewall of a specific device, deleting or adding specific permissions, updating a blacklist, deleting or adding specific programs or codes, etc., without limitation.

[0157] Optionally, after obtaining the disposal suggestion information, the disposal suggestion information may be first standardized to ensure the integrity and operability of the suggestion, and then the standardized disposal suggestion information may be output.

[0158] The beneficial effects of the above scheme are that, first, the representation method based on multidimensional features can fully capture the characteristics of the attack chain; second, the comprehensive similarity calculation method provides reliable scene matching capabilities; finally, the above scheme introduces a generation mechanism based on retrieval enhancement, that is, retrieving similar attack chain features and analyzing the attack scene information corresponding to similar attack chain features to obtain disposal suggestion information, which can provide high-quality disposal suggestions based on historical experience. Through the organic combination of these technologies, the system realizes a complete closed loop from attack identification to the generation of disposal suggestion information.

[0159] Optionally, the method of this embodiment may further include the following steps:

[0160] Use a large language model to conduct a feasibility assessment on the disposal suggestion information and obtain an assessment result;

[0161] When the evaluation result does not meet the target condition, the large language model is used to optimize the disposal suggestion information to obtain the optimized disposal suggestion information.

[0162] In the above embodiment, the attack scenario information corresponding to the target attack chain data can be obtained, that is, information such as the attacked equipment, the operating environment and equipment parameters of the equipment in the power monitoring system during the attack chain corresponding to the target attack chain data. These attack scenario information and the above-mentioned disposal suggestion information are input into the large language model to perform a feasibility assessment on the disposal suggestion information.

[0163] The evaluation result obtained may be a numerical value representing the feasibility of the disposal suggestion information. The higher the numerical value, the higher the feasibility. The target condition may be that the evaluation result is greater than a certain preset threshold.

[0164] When the evaluation result is not greater than the preset threshold, the attack scenario information and the above-mentioned handling suggestion information can be input into the large language model again, and the large language model can be used to optimize the handling suggestion information generated for the first time to obtain the optimized handling suggestion information.

[0165] Among them, when conducting a feasibility assessment, you can input the prompt words corresponding to the feasibility assessment task, so that the large language model can perform the feasibility assessment task and obtain the assessment results. When performing optimization, you can input the prompt words corresponding to the optimization task, so that the large language model can perform the task of optimizing the disposal suggestion information.

[0166] The working principle of the large language model can be found in the related prior art and will not be described in detail. The specific content of the above prompt words can be set by relevant personnel as needed and is not limited.

[0167] In some optional embodiments, such as Figure 2 As shown, the knowledge layer can also perform the following steps:

[0168] Generate a target attack chain map based on disposal suggestion information and target attack chain data;

[0169] The generated target attack chain map can be used to output together with the disposal suggestion information. Specifically, it can be Figure 2 The output layer outputs the target attack chain map and disposal suggestion information together.

[0170] Optional, see Figure 4 , the method of generating a target attack chain map according to the disposal suggestion information and the target attack chain data can be:

[0171] Identify entities in the disposal recommendation information and the target attack chain data, the entities including at least one of a device entity, an attack technique entity, a security event entity, and a protective measure entity;

[0172] Extracting the relationship between entities, where the relationship includes at least one of an attack relationship, a protection relationship, and a dependency relationship;

[0173] Generate a target attack chain graph based on entities and relationships.

[0174] In the above embodiment, the knowledge layer can identify the device involved in the security incident (that is, the device attacked in the attack chain) in the attack chain corresponding to the target attack chain data, and use the identified device as the above device entity;

[0175] The knowledge layer can identify which of the aforementioned m attack techniques appear in each security event of the target attack chain data, and create a corresponding attack technique entity for each attack technique that appears;

[0176] The knowledge layer can identify each security incident in the target attack chain data and each protective measure in the disposal recommendation information, and create corresponding security incident entities and protective measure entities.

[0177] Furthermore, the knowledge layer can extract the relationships between the above entities. For example, the corresponding relationships can be extracted based on the correlations between different entities.

[0178] For example, if a security event occurs on a device and a certain attack technique appears in the security event, it can be determined that there is an attack relationship between the security event entity corresponding to the security event, the device entity corresponding to the device, and the attack technique entity corresponding to the attack technique;

[0179] If a protective measure can be used to protect against an attack of an attack technology, and the handling suggestion information indicates that the protective measure should be applied to a certain device, it can be determined that there is a protective relationship between the protective measure entity corresponding to the protective measure, the attack technology entity corresponding to the attack technology, and the device entity corresponding to the device;

[0180] In addition, the relationship between entities can also be extracted according to the attack process of the attack chain. For example, if one security event occurs after another security event ends, and both are identified as being related to the same program of the same device, it can be determined that there is a dependency relationship between the security event entities corresponding to the two security events.

[0181] After obtaining the above entities and relationships, the knowledge layer can create a node of the target attack chain graph for each entity, and then for every two entities, if there is at least one of the above relationships between the two entities, an edge connecting the two nodes corresponding to the two entities can be created. In this way, a target attack chain graph composed of nodes and edges can be obtained, and then the target attack chain graph can be displayed by the output layer.

[0182] By displaying the target attack chain map, this solution can realize the visual display of the currently obtained target attack chain data.

[0183] Furthermore, the output layer can also support dynamic updating and interactive query of the graph, which is convenient for users to conduct in-depth analysis. Specifically, the user can click on any node of the target attack chain graph, and the output layer will respond to the click command, highlight other nodes connected to the node, and display the detailed information of the node. For example, if the node corresponding to the device entity is clicked, the detailed information of the corresponding device can be displayed.

[0184] As an example of an application scenario, the input layer can detect in real time whether the power monitoring system is under a network attack. Assuming that a series of network attack behaviors constituting an attack chain are detected within the last hour, the input layer can obtain the security events corresponding to these network attack behaviors according to step S101, and use the obtained multiple security events as the target attack chain data of S101. Then, the input layer executes S102 to obtain the target attack chain features corresponding to the target attack chain data and provide the target attack chain features to the analysis layer.

[0185] The analysis layer determines similar attack chain features in the feature library of the knowledge layer according to the method of S103, and then executes S104 to obtain the attack scenario information corresponding to these similar attack chain features from the case library of the knowledge layer, and fuses the attack scenario information corresponding to these similar attack chain features with the target attack chain features to obtain the input information of the large language model, and uses the large language model to process the input information to generate the disposal suggestion information corresponding to this attack chain.

[0186] The knowledge layer can then process the disposal suggestion information and target attack chain data to obtain the corresponding target attack chain map.

[0187] Finally, the output layer will provide the corresponding disposal suggestion information and the above-mentioned target attack chain map for the attack chain detected in the last hour, so that relevant users can take protective measures in time to reduce the losses caused by the attack chain.

[0188] In summary, the method of this embodiment can be divided into four parts:

[0189] The first is the feature vector construction module, which specifically includes converting the original attack chain data into a standardized feature vector (that is, the target attack chain feature). This part first performs temporal encoding on the attack step sequence, then fuses multi-dimensional feature information, and finally generates a high-quality feature vector through vector normalization processing, that is, the above-mentioned target attack chain feature.

[0190] The second is attack chain matching, which mainly realizes accurate matching of attack scenarios. Based on the improved multi-dimensional similarity calculation method, this part can achieve accurate matching of attack scenarios by integrating time similarity, behavior similarity and impact similarity. The system also uses threshold adaptive optimization technology to improve the reliability of matching results. Threshold adaptive optimization technology refers to selecting the top K candidate attack chain features with the highest comprehensive similarity from the candidate attack chain features as similar attack chain features.

[0191] The third part is retrieval enhancement generation, which mainly involves the generation of intelligent disposal solutions. This module first obtains the attack scenario information corresponding to the similar attack chain features in the case library based on the similar attack chain features determined in the attack chain matching, and then fuses the retrieved attack scenario information and the target attack chain features into the input information of the large language model, and uses the large language model to process the input information to obtain disposal suggestion information.

[0192] The fourth is the knowledge graph construction module, which mainly realizes the visual expression of attack scenarios. This part builds a complete knowledge network through entity recognition and relationship extraction, and improves the visualization effect through graph optimization. It also supports dynamic update and interactive query of the graph, which facilitates users to conduct in-depth analysis.

[0193] Combining the above methods, the implementation of this solution can bring the following effects:

[0194] In terms of recognition accuracy, through the combination of multi-dimensional feature matching and deep learning models, the attack scenario recognition accuracy of this solution in the simulation scenario test reached more than 85%. This high accuracy provides a reliable basis for the formulation of subsequent disposal plans;

[0195] In terms of disposal efficiency, the disposal suggestion information generated based on the retrieval enhancement method can quickly provide disposal solutions that meet the actual situation, which is 300% more efficient than the traditional manual analysis method. This not only reduces the workload of security operation and maintenance personnel, but also improves the timeliness of emergency response;

[0196] In terms of visualization, this solution uses the target attack chain map to intuitively display the relationship between attack paths and protection measures, helping decision makers to quickly understand and judge. This visualization method greatly reduces the difficulty of understanding security analysis results and improves decision-making efficiency;

[0197] From the perspective of system scalability, the modular design supports the dynamic expansion of new attack features and disposal solutions, and the system has strong adaptability. This design enables the system implementing this solution to continuously evolve and adapt to the ever-changing network security threats;

[0198] Most importantly, this solution provides an intelligent and automated solution for the security protection of the power monitoring system, realizing the transition from passive defense to active protection, which is of great significance to improving the overall security of the power monitoring system.

[0199] The present application embodiment provides a power monitoring system attack scenario processing device based on attack chain matching, see Figure 5 , the device may include the following units.

[0200] An obtaining unit 501 is used to obtain target attack chain data of a power monitoring system;

[0201] A processing unit 502 is used to process the target attack chain data to obtain target attack chain features;

[0202] A retrieval unit 503, configured to retrieve at least one similar attack chain feature based on the target attack chain feature;

[0203] The handling unit 504 is used to use the large language model to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features to obtain the handling suggestion information corresponding to the target attack chain data.

[0204] Optionally, the processing unit 504 is further configured to:

[0205] A target attack chain map is generated according to the disposal suggestion information and the target attack chain data, and the target attack chain map is used to be output together with the disposal suggestion information.

[0206] Optionally, when the handling unit 504 generates a target attack chain graph according to the handling suggestion information and the target attack chain data, it can be used to:

[0207] Identify entities in the disposal recommendation information and the target attack chain data, the entities including at least one of a device entity, an attack technique entity, a security event entity, and a protective measure entity;

[0208] Extracting the relationship between entities, where the relationship includes at least one of an attack relationship, a protection relationship, and a dependency relationship;

[0209] Generate a target attack chain graph based on entities and relationships.

[0210] Optionally, when the obtaining unit 501 obtains the target attack chain data of the power monitoring system, it can be used to:

[0211] Real-time detection of security events in power monitoring systems;

[0212] When a starting security event representing the beginning of an attack chain and an ending security event representing the end of an attack chain are detected, a set of multiple security events detected from the starting security event to the ending security event is obtained as target attack chain data of the power monitoring system.

[0213] Optionally, when the processing unit 502 processes the target attack chain data to obtain the target attack chain features, it can be used to:

[0214] Performing data preprocessing on the target attack chain data to obtain the preprocessed target attack chain data;

[0215] Extract the time characteristics, attack behavior characteristics and impact range characteristics of each security event in the pre-processed target attack chain data;

[0216] The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics and impact range characteristics of each security event.

[0217] Optionally, when the retrieval unit 503 retrieves at least one similar attack chain feature based on the target attack chain feature, it can be used to:

[0218] For each candidate attack chain feature in the preset feature library, calculate the comprehensive similarity between the target attack chain feature and the candidate attack chain feature;

[0219] A plurality of similar attack chain features are determined from a plurality of candidate attack chain features in the feature library according to the comprehensive similarity.

[0220] Optionally, when the retrieval unit 503 calculates the comprehensive similarity between the target attack chain feature and the candidate attack chain feature, it can be used to:

[0221] Calculate the time similarity, behavior similarity, and impact similarity of the target attack chain features and the alternative attack chain features;

[0222] The time similarity, behavior similarity and impact similarity are fused according to the weight parameters to obtain the comprehensive similarity of the target attack chain characteristics and the alternative attack chain characteristics.

[0223] Optionally, the method for the retrieval unit 503 to calculate the behavior similarity may be:

[0224] Calculate the behavior similarity based on the degree of harm of different attack techniques.

[0225] Optionally, the processing unit 504 may also be used to:

[0226] Use a large language model to conduct a feasibility assessment on the disposal suggestion information and obtain an assessment result;

[0227] When the evaluation result does not meet the target condition, the large language model is used to optimize the disposal suggestion information to obtain the optimized disposal suggestion information.

[0228] The working principle of the attack scenario processing device for the power monitoring system based on attack chain matching in this embodiment can be referred to the relevant steps of the attack scenario processing method for the power monitoring system based on attack chain matching provided in the aforementioned embodiment, which will not be repeated here.

[0229] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0230] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0231] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0232] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0233] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing attack scenarios of a power monitoring system based on attack chain matching, characterized in that: include: Obtain target attack chain data of power monitoring system; Processing the target attack chain data to obtain target attack chain features; Retrieving and obtaining at least one similar attack chain feature based on the target attack chain feature; The attack scenario information corresponding to the similar attack chain features and the target attack chain features are processed using a large language model to obtain disposal suggestion information corresponding to the target attack chain data.

2. The method according to claim 1, characterized in that Also includes: A target attack chain map is generated according to the disposal suggestion information and the target attack chain data, and the target attack chain map is used to be output together with the disposal suggestion information.

3. The method according to claim 2, characterized in that The generating a target attack chain graph according to the disposal suggestion information and the target attack chain data includes: Identify entities in the treatment suggestion information and the target attack chain data, the entities comprising at least one of a device entity, an attack technology entity, a security event entity, and a protective measure entity; Extracting the relationship between the entities, wherein the relationship includes at least one of an attack relationship, a protection relationship, and a dependency relationship; A target attack chain graph is generated according to the entities and the relationships.

4. The method according to claim 1, characterized in that: The obtaining of target attack chain data of the power monitoring system includes: Real-time detection of security events in power monitoring systems; When a starting security event representing the beginning of an attack chain and an ending security event representing the end of an attack chain are detected, a set of multiple security events detected from the starting security event to the ending security event is obtained as target attack chain data of the power monitoring system.

5. The method according to claim 4, characterized in that The processing of the target attack chain data to obtain target attack chain features includes: Performing data preprocessing on the target attack chain data to obtain preprocessed target attack chain data; Extracting the time characteristics, attack behavior characteristics and impact range characteristics of each security event in the pre-processed target attack chain data; The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics and impact range characteristics of each security event.

6. The method according to claim 5, characterized in that The retrieving and obtaining at least one similar attack chain feature based on the target attack chain feature includes: For each candidate attack chain feature in the preset feature library, calculating the comprehensive similarity between the target attack chain feature and the candidate attack chain feature; A plurality of similar attack chain features are determined from the plurality of candidate attack chain features in the feature library according to the comprehensive similarity.

7. The method according to claim 6, characterized in that The calculating the comprehensive similarity between the target attack chain feature and the candidate attack chain feature includes: Calculating the time similarity, behavior similarity, and impact similarity of the target attack chain feature and the candidate attack chain feature; The time similarity, the behavior similarity and the impact similarity are fused according to a weight parameter to obtain a comprehensive similarity between the target attack chain feature and the alternative attack chain feature.

8. The method according to claim 7, characterized in that The method for calculating the behavior similarity includes: The behavior similarity is calculated according to the degree of harm of different attack techniques.

9. The method according to claim 1, characterized in that: Also includes: Using the large language model to perform a feasibility assessment on the treatment suggestion information to obtain an assessment result; When the evaluation result does not meet the target condition, the large language model is used to optimize the disposal suggestion information to obtain optimized disposal suggestion information.

10. A power monitoring system attack scenario processing device based on attack chain matching, characterized in that: include: An acquisition unit, used for acquiring target attack chain data of a power monitoring system; A processing unit, configured to process the target attack chain data to obtain target attack chain features; A retrieval unit, configured to retrieve at least one similar attack chain feature based on the target attack chain feature; The handling unit is used to use a large language model to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features to obtain handling suggestion information corresponding to the target attack chain data.

Images