Attack scenario processing method and device for power monitoring system based on attack chain matching

Abstract

The application discloses an attack scene processing method and device for a power monitoring system based on attack chain matching. The method comprises the following steps: obtaining target attack chain data of a power monitoring system; processing the target attack chain data to obtain target attack chain features; searching for at least one similar attack chain feature based on the target attack chain features; and processing attack scene information corresponding to the similar attack chain features and the target attack chain features by using a large language model to obtain disposal suggestion information corresponding to the target attack chain data. The present scheme can more accurately identify network attacks on the power monitoring system in combination with the target attack chain data, especially can accurately identify complex attack scenes such as advanced persistent threats (APTs), and can timely formulate reasonable disposal suggestion information through the large language model, thereby effectively improving the security of the power monitoring system.

Description

Technical Field

[0001] This application relates to the field of system protection technology, and in particular to a method and apparatus for handling attack scenarios in power monitoring systems based on attack chain matching. Background Technology

[0002] With the rapid development of smart grid technology, the security of power monitoring systems is facing increasing challenges. Traditional security solutions mainly rely on single-point protection and static rule matching, which proves inadequate in the face of modern, complex cyberattacks. Especially when dealing with complex attack scenarios such as Advanced Persistent Threats (APTs), traditional methods cannot effectively identify the evolution path of the attack chain, nor can they provide timely and effective response suggestions.

[0003] Therefore, how to promptly identify and provide corresponding solutions when a power monitoring system is subjected to cyberattacks has become an urgent problem to be solved. Summary of the Invention

[0004] Therefore, this application discloses the following technical solution:

[0005] The first aspect of this application provides a method for handling attack scenarios in power monitoring systems based on attack chain matching, including:

[0006] Obtain target attack chain data from the power monitoring system;

[0007] Processing the target attack chain data yields the target attack chain characteristics;

[0008] At least one similar attack chain feature is obtained based on the target attack chain feature;

[0009] By using a large language model to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features, handling suggestion information corresponding to the target attack chain data is obtained.

[0010] Optional, also includes:

[0011] A target attack chain graph is generated based on the proposed handling information and the target attack chain data. The target attack chain graph is output together with the proposed handling information.

[0012] Optionally, generating the target attack chain map based on the handling suggestion information and the target attack chain data includes:

[0013] Identify entities in the proposed handling information and the target attack chain data, wherein the entities include at least one of device entities, attack technology entities, security event entities, and protective measure entities;

[0014] Extract the relationships between the entities, wherein the relationships include at least one of attack relationships, defense relationships, and dependency relationships;

[0015] Generate a target attack chain graph based on the entities and relationships.

[0016] Optionally, obtaining the target attack chain data of the power monitoring system includes:

[0017] Real-time detection of security events in the power monitoring system;

[0018] When a starting security event, which characterizes the beginning of an attack chain, and an ending security event, which characterizes the end of an attack chain, are detected, a set of multiple security events detected from the starting security event to the ending security event is obtained as the target attack chain data of the power monitoring system.

[0019] Optionally, processing the target attack chain data to obtain target attack chain features includes:

[0020] The target attack chain data is preprocessed to obtain preprocessed target attack chain data;

[0021] Extract the temporal features, attack behavior features, and impact range features of each security event from the preprocessed target attack chain data;

[0022] The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics, and scope of impact characteristics of each security event.

[0023] Optionally, obtaining at least one similar attack chain feature based on the target attack chain features includes:

[0024] For each candidate attack chain feature in the preset feature library, calculate the comprehensive similarity between the target attack chain feature and the candidate attack chain feature;

[0025] Based on the similarity, multiple similar attack chain features are determined from among the multiple candidate attack chain features in the feature library.

[0026] Optionally, calculating the comprehensive similarity between the target attack chain features and the candidate attack chain features includes:

[0027] Calculate the temporal similarity, behavioral similarity, and impact similarity between the target attack chain features and the candidate attack chain features;

[0028] The time similarity, behavior similarity, and impact similarity are fused according to the weight parameters to obtain the comprehensive similarity between the target attack chain features and the candidate attack chain features.

[0029] Optionally, the method for calculating the behavioral similarity includes:

[0030] The similarity of the behaviors is calculated based on the degree of harm caused by different attack techniques.

[0031] Optional, also includes:

[0032] The feasibility of the proposed treatment information is assessed using the large language model to obtain the assessment results.

[0033] If the evaluation results do not meet the target conditions, the disposal suggestion information is optimized using the large language model to obtain optimized disposal suggestion information.

[0034] The second aspect of this application provides a power monitoring system attack scenario processing device based on attack chain matching, comprising:

[0035] The acquisition unit is used to acquire target attack chain data of the power monitoring system.

[0036] The processing unit is used to process the target attack chain data to obtain target attack chain features;

[0037] A retrieval unit is used to retrieve at least one similar attack chain feature based on the target attack chain feature;

[0038] The processing unit is used to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features using a large language model to obtain processing suggestion information corresponding to the target attack chain data.

[0039] The beneficial effects of this solution are as follows: This solution can more accurately identify network attacks on power monitoring systems by combining target attack chain data, especially in accurately identifying complex attack scenarios such as advanced persistent threats (APTs), and can formulate reasonable handling suggestions in a timely manner through large language models, thereby effectively improving the security of power monitoring systems. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 This is a flowchart of a power monitoring system attack scenario processing method based on attack chain matching provided in an embodiment of this application;

[0042] Figure 2This is a schematic diagram of an attack scenario processing system for a power monitoring system based on attack chain matching, provided in an embodiment of this application.

[0043] Figure 3 This is a schematic diagram illustrating the calculation of the comprehensive similarity between the features of a target attack chain and the features of alternative attack chains, provided in an embodiment of this application.

[0044] Figure 4 This is a flowchart illustrating the generation of a target attack chain graph, provided in an embodiment of this application.

[0045] Figure 5 This is a schematic diagram of the structure of a power monitoring system attack scenario processing device based on attack chain matching provided in an embodiment of this application. Detailed Implementation

[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] The method provided in this embodiment can be used... Figure 2 The system implementation is shown. The system adopts a hierarchical architecture design, divided into four main functional layers from bottom to top: input layer, analysis layer, knowledge layer, and output layer. This layered design not only ensures the modularity and scalability of the system, but also facilitates the independent optimization and upgrade of each functional module.

[0048] The input layer is primarily responsible for collecting and preprocessing raw data. For example... Figure 2 As shown, the input layer can collect attack chain data through a standardized data interface, perform data preprocessing on the collected attack chain data (including but not limited to data cleaning, format conversion, etc.), and then construct feature vectors on the preprocessed attack chain data to extract the vector representation of the attack chain data in the high-dimensional feature space, that is, to obtain the attack chain features of the attack chain data, thereby providing standardized input for subsequent analysis.

[0049] The analysis layer is the core computing unit of the system, containing an attack chain matching module and a retrieval enhancement module. For example... Figure 2As shown, the attack chain matching module can determine the matching results corresponding to the collected attack chain data based on a multi-dimensional similarity calculation method. This matching result indicates which attack chain features in the feature library are similar to the currently collected attack chain data, thus achieving accurate identification of attack scenarios. The retrieval enhancement module, by integrating knowledge retrieval and large model generation technologies, achieves intelligent generation of handling solutions. Specifically, the retrieval enhancement module can obtain attack scenario information corresponding to similar attack chain features from the case library, and input the attack scenario information and the currently obtained attack chain features into the large language model. This allows the large language model to generate handling suggestions corresponding to the currently obtained attack chain features based on contextual fusion (i.e., fusing attack scenario information and the currently obtained attack chain features). The collaborative work of these two modules ensures the accuracy and practicality of the system's analysis results.

[0050] The knowledge layer, serving as the system's knowledge management center, primarily includes two functions: constructing an attack chain graph and updating the knowledge base. This knowledge base can comprise two parts: a feature library and a case library. The feature library stores multiple pre-collected attack chain features, while the case library stores attack scenario information corresponding to each attack chain feature in the feature library. In this embodiment, each attack chain feature can correspond to an actual network attack process occurring in the power monitoring system. The attack scenario information corresponding to the attack chain feature can include the devices subjected to the network attack, as well as the operating environment and parameters of each device at the time of the attack. The knowledge base update module mainly includes two parts: feature library maintenance and case library expansion. Specifically, feature library maintenance involves adding the attack chain features obtained from the input layer to the feature library each time a network attack occurs. Case library expansion involves adding the attack scenario information at the time of the network attack to the case library. Through feature library maintenance and case library expansion, the system can continuously learn and adapt to new attack scenarios.

[0051] The attack chain graph construction function is mainly responsible for transforming the handling suggestions and other analysis results input from the analysis layer into an intuitive attack chain graph, thereby realizing the visualization of the attack scenario.

[0052] The output layer is responsible for displaying and interacting with the analysis results. Through visualization technology, it transforms the handling recommendations and other possible analysis results output by the analysis layer into intuitive graphical displays, provides interactive query and operation interfaces, and visualizes the attack chain graph input from the knowledge layer. This layer is also responsible for generating standardized handling recommendation reports to provide decision support for security operations personnel.

[0053] Data exchange and function calls between different layers are facilitated through standardized interfaces. For example, the input layer transmits processed data to the analysis layer via a feature vector interface, the analysis layer submits analysis results to the knowledge layer via a knowledge graph interface, and the knowledge layer provides the knowledge network to the output layer via a visualization interface. This standardized interface design not only ensures loose coupling between different parts of the system but also facilitates future functional expansion and upgrades.

[0054] Furthermore, the system implements a feedback mechanism between modules. Interactive operations at the output layer can trigger updates at the knowledge layer, which in turn influences the processing logic at the analysis layer, forming a closed-loop optimization process. This feedback mechanism enables the system to continuously learn and evolve, improving the accuracy and usability of the analysis results.

[0055] Each functional module of the system adopts a pluggable design concept, supporting flexible replacement of different algorithms and models. For example, the similarity calculation module in the analysis layer can select different algorithms to implement according to specific application scenarios, and the graph construction module in the knowledge layer can also adopt different visualization schemes. This flexible design enables the system to adapt to the needs of different scenarios and to be continuously optimized and upgraded as technology advances.

[0056] Based on the above system, this application provides a method for handling attack scenarios in a power monitoring system based on attack chain matching. Please refer to [link to relevant documentation]. Figure 1 The method may include the following steps.

[0057] S101, obtain target attack chain data of the power monitoring system.

[0058] The target attack chain data can be a set of attack chain data detected by the above input layer at the current moment. Each set of attack chain data corresponds to one attack chain. An attack chain is equivalent to a combination of a series of interrelated attack behaviors taken by the power monitoring system to achieve a specific purpose.

[0059] S102, Process the target attack chain data to obtain the target attack chain characteristics.

[0060] S103, obtain at least one similar attack chain feature based on the target attack chain feature retrieval.

[0061] S104. Utilize a large language model to process attack scenario information and target attack chain features corresponding to similar attack chain features, and obtain handling suggestion information corresponding to the target attack chain data.

[0062] The beneficial effects of this solution are as follows: This solution can more accurately identify network attacks on power monitoring systems by combining target attack chain data, especially in accurately identifying complex attack scenarios such as advanced persistent threats (APTs), and can formulate reasonable handling suggestions in a timely manner through large language models, thereby effectively improving the security of power monitoring systems.

[0063] Step S101 can be performed by Figure 2 The input layer shown is executed.

[0064] In this embodiment, the method for obtaining the target attack chain data of the power monitoring system can be:

[0065] A1, Real-time detection of security events in the power monitoring system;

[0066] A2, upon detecting a start security event that represents the beginning of an attack chain and a finish security event that represents the end of an attack chain, obtains a set of multiple security events detected from the start security event to the finish security event as the target attack chain data of the power monitoring system.

[0067] In step A1, the input layer can monitor network attack behavior in the power monitoring system in real time. Each time a network attack behavior (such as a DOS attack, Trojan attack, etc.) is detected, a security event corresponding to the network attack behavior is generated, thereby realizing the real-time detection of security events in the power monitoring system.

[0068] Security incidents can include information related to the corresponding cyberattacks, including but not limited to the type of cyberattack technique used, the time of the attack, the target devices and programs (or files) targeted, and the duration of the attack.

[0069] Currently, in order to achieve their attack objectives (such as stealing information or damaging systems), attackers typically launch multiple interconnected cyberattacks against power monitoring systems. The entire cyberattack process, consisting of these consecutive cyberattacks, is an attack chain.

[0070] In step A2, for each security event detected by the input layer, deep learning technology, neural network technology, or other related technologies can be used to analyze the security event to determine whether it is a starting security event or a ending security event. Based on this, if a starting security event is identified, and an ending security event is identified after a period of time, the input layer can use the set of multiple security events detected from the starting security event to the ending security event as the target attack chain data of the power monitoring system.

[0071] As an example, suppose the input layer detects 15 security events in succession, which are recorded as security event 1 to security event 15. After analysis, it is found that security event 3 is a starting security event and security event 11 is an ending security event. Then, a set of attack chain data corresponding to one attack chain can be obtained. This attack chain data includes security event 3, security event 4, security event 5... security event 10 and security event 11, a total of 9 security events.

[0072] The initiating security event refers to the attack behavior corresponding to the security event that is the first attack behavior in an attack chain, while the ending security event refers to the attack behavior corresponding to the security event that is the last attack behavior in an attack chain.

[0073] Methods for identifying the initiation and termination of security events can be found in related technologies, and will not be elaborated upon in this embodiment.

[0074] In step S102, the input layer can systematically employ an improved sequence coding algorithm to transform the attack chain into a vector representation in a high-dimensional feature space. This algorithm not only considers the temporal relationship of the attack steps but also incorporates the characteristics of the attack techniques, effectively capturing the essential features of the attack chain.

[0075] At the technical implementation level, the input layer can process the target attack chain data to obtain the target attack chain features in the following ways:

[0076] Perform data preprocessing on the target attack chain data to obtain preprocessed target attack chain data;

[0077] Extract the temporal characteristics, attack behavior characteristics, and impact scope characteristics of each security event in the preprocessed target attack chain data;

[0078] The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics, and scope of impact characteristics of each security event.

[0079] The preprocessing methods for target attack chain data can be found in relevant existing technologies and will not be elaborated here. Even after preprocessing, the target attack chain data still consists of multiple security events.

[0080] Please see Figure 3 After obtaining the preprocessed target attack chain data, for any security event (let's call it the i-th security event), the time feature t of that security event can be obtained as follows: i Attack behavior characteristics a i and the characteristics of the scope of influence e i .

[0081] When obtaining time characteristics, the main considerations are the temporal sequence and duration of the security event. Specifically, the time characteristic t of the i-th security event...i It can be represented by the following formula (1).

[0082]

[0083] Where, ΔT i This represents the time interval between the security event and the previous security event after normalization, which can be calculated using the following formula (2).

[0084]

[0085] T i This represents the timestamp of the i-th security event, that is, the timestamp of the i-th security event in time T. i T is detected at all times. i-1 This represents the timestamp of the previous security event, which is the (i-1)th security event, i.e., the timestamp of the (i-1)th security event in time T. i-1 T is detected at all times. max This represents the maximum duration of all attack chains. "All attack chains" refers to all attack chains detected so far. Each attack chain has a duration, indicating how long the attack chain lasted. For example, assuming 20 attack chains have been detected so far, corresponding to 20 attack chain durations, the maximum value among them is T. max .

[0086] d i The duration of the i-th security event after logarithmic normalization can be calculated using the following formula (3).

[0087]

[0088] Where log represents the logarithm to base 10, duration i This represents the actual duration of the i-th security event, in seconds. For example, if the input layer detects that the i-th security event lasted 10 seconds, then `duration`... i It equals 10.

[0089] p i The relative position of the i-th security event in its attack chain can be represented by the following formula (4).

[0090]

[0091] i represents the position of the security event in the attack chain, and N is the total number of security events in the attack chain. Combining with the previous example, for an attack chain consisting of security events 3 to 11, the third security event is security event 5, and the total number of security events in the attack chain is 9, so p3 equals 1 / 3.

[0092] The attack behavior characteristics of the i-th security event, a i It can be represented by the following formula (5).

[0093]

[0094] Among them, f ki This represents the degree of presence (also known as weight) of the k-th attack technique in the i-th security event. The degree of presence of the attack technique can be defined based on the MITRE ATT&CK framework. The MITRE ATT&CK framework is an existing, universally accessible, and continuously updated knowledge base used to simulate, detect, prevent, and combat cybersecurity threats based on known adversarial behaviors of network attacks. m is the dimension of the feature vector corresponding to the predefined attack technique. In this embodiment, we can pre-analyze which attack techniques are commonly used to attack power monitoring systems, and determine the total number of these attack techniques as m. For example, if we analyze that there are 10 attack techniques commonly used to attack power monitoring systems, then we determine that m equals 10.

[0095] For example, common attack techniques include, but are not limited to, security vulnerability attacks, Trojan attacks, node attacks, network eavesdropping attacks, and denial-of-service (DoS) attacks.

[0096] f ki The table can be calculated using the TF-IDF method, as shown in the following formula (6).

[0097]

[0098] TF-IDF (term frequency–inverse document frequency) is a commonly used weighting technique for information retrieval and data mining. TF stands for Term Frequency, and IDF stands for Inverse Document Frequency.

[0099] Among them, tf ki The frequency of the k-th attack technique in the i-th security event can be calculated using the following formula (7).

[0100]

[0101] n ki The denominator of formula (7) is ∑, which represents the number of times the k-th attack technique appears in the i-th security event. b n ibThis represents the total number of occurrences of all m attack techniques in the i-th security event, which is the sum of the number of occurrences of all m attack techniques in the i-th security event.

[0102] df k This represents the total number of security events in an attack chain that contain the k-th attack technique. For example, if the attack chain to which the i-th security event belongs contains 7 security events that contain the k-th attack technique, then df k It equals 7.

[0103] N represents the total number of attack instances in the attack behavior set; in other words, N represents the total number of security events contained in the attack chain.

[0104] The impact range characteristic of the i-th security event is e i It can be represented by the following formula (8).

[0105]

[0106] Among them, c i Indicates the degree of impact of the i-th security incident on confidentiality, i i q represents the degree of impact of the i-th security event on integrity. i This represents the degree of impact of the i-th security event on availability. The values ​​for each degree of impact can be real numbers between 0 and 1. Each degree of impact can be obtained by analyzing the i-th security event using deep learning, neural networks, or other related technologies. Specific methods for obtaining these values ​​can be found in existing technologies and will not be elaborated upon here.

[0107] After obtaining the above three characteristics of each security event, the improved sequence coding algorithm can be used to extract the target attack chain characteristics of the target attack chain data.

[0108] First, the target attack chain data can be represented by the time series shown in formula (9).

[0109]

[0110] S represents the target attack chain data, s i Let N represent the i-th security event contained in the target attack chain data, and let N represent the total number of security events contained therein.

[0111] For the i-th security event, the time characteristics, attack behavior characteristics, and impact scope characteristics of the i-th security event can be combined to form the security event characteristics v as shown in formula (10). i .

[0112]

[0113] Then, the security event features of N security events can be fused according to formula (11) to obtain the target attack chain feature V.

[0114]

[0115] w i This represents the preset importance weight of the i-th security event. It can be determined based on the position of the i-th security event in the entire attack chain. Generally, security events closer to the ends of the attack chain, that is, closer to the beginning and end, can be assigned a larger importance weight, while security events located in the middle of the attack chain can be assigned a smaller importance weight. The specific value can be set by the relevant user according to the actual situation and is not limited.

[0116] In step S103, at least one similar attack chain feature that is similar to the target attack chain feature can be retrieved from a preset feature library. The retrieval method can be:

[0117] For each candidate attack chain feature in the preset feature library, calculate the comprehensive similarity between the target attack chain feature and the candidate attack chain feature;

[0118] Based on similarity, multiple similar attack chain features are identified from multiple candidate attack chain features in the feature library.

[0119] Please see Figure 3 For any candidate attack chain feature, the method to calculate the comprehensive similarity between the target attack chain feature and the candidate attack chain feature can be:

[0120] Calculate the temporal similarity, behavioral similarity, and impact similarity between the target attack chain features and the candidate attack chain features;

[0121] By fusing time similarity, behavioral similarity, and impact similarity based on weight parameters, a comprehensive similarity between the target attack chain features and the alternative attack chain features is obtained.

[0122] Temporal similarity between target attack chain features and alternative attack chain features (Sim) seq (X, Y) can be represented by the following formula (12).

[0123]

[0124] X represents the target attack chain characteristics, Y represents the alternative attack chain characteristics, x1 i y1 represents the temporal feature of the i-th security event in the target attack chain. i Let w represent the temporal characteristics of the i-th security event in the candidate attack chain, n represent the smaller of the total number of security events in the target attack chain and the total number of security events in the candidate attack chain, and w represent the temporal characteristics of the i-th security event in the candidate attack chain. iThis represents the importance weight of the i-th event corresponding to the target attack chain feature, or the importance weight of the i-th event corresponding to the candidate attack chain feature.

[0125] match(x1) i y1 i ) represents x1 i and y1 i Cosine similarity between them.

[0126] Wherein, the target attack chain refers to the attack chain corresponding to the target attack chain feature, and the alternative attack chain refers to the attack chain corresponding to the alternative attack chain feature. If the total number of security events contained in the target attack chain feature is greater than the total number of security events contained in the alternative attack chain feature, then n is equal to the total number of security events contained in the alternative attack chain feature, and w i This represents the importance weight of the i-th event corresponding to the candidate attack chain feature; if the total number of security events contained in the target attack chain feature is less than or equal to the total number of security events contained in the candidate attack chain feature, then n equals the total number of security events contained in the target attack chain feature, and w i This represents the importance weight of the i-th event corresponding to the characteristics of the target attack chain.

[0127] Behavioral similarity can be calculated in the following ways:

[0128] Behavioral similarity is calculated based on the degree of harm caused by different attack techniques.

[0129] Specifically, behavioral similarity sim beh (X, Y) can be calculated using the following formula (13).

[0130]

[0131] imp(f) k ) represents the feature importance weight of the kth attack technique among the aforementioned m attack techniques. Its value can be determined based on the degree of harm of the ith attack technique. The determination method can be found in relevant existing technologies, which will not be elaborated here.

[0132] X represents the target attack chain characteristics, Y represents the alternative attack chain characteristics, and x2 k The value corresponding to the kth attack technique in the target attack chain features is the sum of the product of the degree of existence of the kth attack technique in all security events of the target attack chain and the importance weight of each security event. Specifically, it can be represented by the following formula (14).

[0133]

[0134] N represents the total number of security events contained in the target attack chain. The meanings of other parameters are given in formulas (5) and (11), and will not be repeated here.

[0135] y2 k This represents the value corresponding to the kth attack technique in the features of the candidate attack chain. It is the sum of the products of the presence degree of the kth attack technique in all security events of the candidate attack chain and the importance weight of each security event. The calculation method can be found in formula (14). You only need to replace the parameters in it with the parameters corresponding to the candidate attack chain. It will not be elaborated further.

[0136] The similarity can be calculated using a weighted Jaccard coefficient, specifically, the similarity between the target attack chain features and the candidate attack chain features. imp (X, Y) can be calculated using the following formula (15).

[0137]

[0138] Among them, impw i These represent the weights of the three dimensions: confidentiality, integrity, and availability. The specific values ​​can be set by the relevant users as needed, without any limitation. Generally, these three weights can be set to be equal.

[0139] x3 i This represents the value corresponding to the i-th dimension in the target attack chain characteristics, where the first dimension is confidentiality, the second is integrity, and the third is availability. Specifically, x3 i It can be equal to the sum of the products of the data corresponding to the i-th dimension in the influence range feature of all security events in the target attack chain and the importance weight of all security events. As an example, x31 can be represented by the following formula (16).

[0140]

[0141] N represents the total number of security events contained in the target attack chain. The meanings of other parameters are given in formulas (8) and (11), and will not be elaborated further. x32 can be used to represent c in formula (16). i Replace with i i Then, using this formula, we can calculate that x33 can convert c in formula (16) into x33. i Replace with q i The result was then calculated using this formula.

[0142] y3 i This represents the value corresponding to the i-th dimension in the candidate attack chain features; specifically, y3 iIt can be equal to the sum of the products of the data corresponding to the i-th dimension of the influence range feature of all security events in the candidate attack chain and the importance weight of all security events. The calculation method of y31 to y33 can be found in x31 to x33. Just replace the parameters of the corresponding target attack chain with the parameters of the corresponding candidate attack chain. It will not be elaborated here.

[0143] The method for combining the above three similarities to obtain the comprehensive similarity between the target attack chain features and the alternative attack chain features can be found in the following formula (17).

[0144]

[0145] Sim t (X, Y) represents the combined similarity between the target attack chain features and the alternative attack chain features. The aforementioned weight parameters include a similarity weight of 0.3 for time similarity, a similarity weight of 0.4 for behavioral similarity, and a similarity weight of 0.3 for influence similarity.

[0146] The above weighting parameters are set based on the following considerations:

[0147] Behavioral similarity has the highest similarity weight (0.4) because it directly reflects the essential characteristics of the attack. Temporal similarity has a similarity weight of 0.3, which together complement each other in characterizing the attack scenario.

[0148] The advantage of calculating the comprehensive similarity using the above method is that it comprehensively considers multiple feature dimensions of the attack scenario, adopts reasonable weight allocation, highlights the importance of key features, and improves the accuracy and robustness of matching through the fusion of multiple similarity algorithms. The calculation method is intuitive and easy to implement, and has good practicality.

[0149] By constructing and calculating the comprehensive similarity based on the aforementioned features, the system can accurately identify similar attack chain features, providing a reliable basis for generating subsequent handling suggestions.

[0150] After calculating the combined similarity between each candidate attack chain feature and the target attack chain feature, a dense retrieval model can be used to retrieve similar attack chain features from the knowledge base based on these combined similarities. Specifically, one way to determine multiple similar attack chain features is to sort all candidate attack chain features from highest to lowest combined similarity, and select the top K candidate attack chain features as similar attack chain features. That is, select the K candidate attack chain features with the highest combined similarity as similar attack chain features. The set r of selected similar attack chain features can be represented as r = topk(sim(A, B)). i ), K).

[0151] Where A represents the target attack chain characteristics, Bi Let sim(A, B) represent the features of the i-th alternative attack chain. i The sum of the similarities between the two is denoted as topk(sim(A, B)). i K) represents selecting the K candidate attack chain features with the highest overall similarity.

[0152] In step S104, after obtaining K similar attack chain features, the large model input information C shown in the following formula (18) can be obtained. Then, the large-scale language model (hereinafter referred to as the large language model) is used to process the input information to obtain the corresponding disposal suggestion information M of the target attack chain data, that is, M=LLM(C), where LLM represents the reasoning process of the large-scale language model. For the specific reasoning process, please refer to the working principle of the existing large language model.

[0153]

[0154] Where q represents the target attack chain characteristics, R k This represents the attack scenario information corresponding to the k-th similar attack chain feature. This attack scenario information can be obtained from the case library maintained by the knowledge layer. The attack scenario information corresponding to the similar attack chain feature may include the equipment, operating environment and other optional information related to the attack chain in the power monitoring system when the attack chain corresponding to the similar attack chain feature occurs. For example, which equipment in the attack chain is attacked, the operating environment of the equipment when it is attacked and various equipment parameters, etc. k is an integer from 1 to K, that is, k∈[1,K].

[0155] In some optional embodiments, the information input into the large language model when generating disposal suggestion information may also include attack scenario information corresponding to the target attack chain data, and may also include the target attack chain data.

[0156] The handling recommendation information M corresponding to the target attack chain data may include one or more handling measures that should be taken for the target attack chain data, such as updating the firewall of a specific device, deleting or adding specific permissions, updating the blacklist, deleting or adding specific programs or code, etc., without limitation.

[0157] Optionally, after obtaining the disposal suggestion information, the disposal suggestion information can be standardized to ensure the completeness and operability of the suggestions before outputting the standardized disposal suggestion information.

[0158] The advantages of the above scheme are as follows: First, the multi-dimensional feature-based representation method can comprehensively capture the features of the attack chain; second, the comprehensive similarity calculation method provides reliable scene matching capabilities; and finally, the above scheme introduces a retrieval-enhanced generation mechanism, which retrieves similar attack chain features and analyzes the corresponding attack scene information to obtain handling suggestions. This approach can combine historical experience to provide high-quality handling suggestions. Through the organic combination of these technologies, the system achieves a complete closed loop from attack identification to handling suggestion information generation.

[0159] Optionally, the method in this embodiment may further include the following steps:

[0160] A large language model is used to conduct a feasibility assessment of the proposed solutions and obtain the assessment results.

[0161] If the evaluation results do not meet the target conditions, the disposal suggestion information is optimized using a large language model to obtain optimized disposal suggestion information.

[0162] In the above embodiments, attack scenario information corresponding to the target attack chain data can be obtained, that is, during the attack chain corresponding to the target attack chain data, information such as the attacked device, the device's operating environment, and device parameters in the power monitoring system. This attack scenario information and the above-mentioned handling suggestion information are input into the large language model to conduct a feasibility assessment of the handling suggestion information.

[0163] The obtained evaluation result can be a numerical value that characterizes the feasibility of the proposed treatment information. The higher the value, the higher the feasibility. The target condition can be that the evaluation result is greater than a certain preset threshold.

[0164] If the evaluation result is not greater than the preset threshold, the attack scenario information and the above-mentioned handling suggestions can be input into the large language model again. The large language model can then be used to optimize the handling suggestions generated in the first instance to obtain optimized handling suggestions.

[0165] When conducting a feasibility assessment, prompts corresponding to the feasibility assessment task can be entered, enabling the large language model to perform the feasibility assessment task and obtain the assessment results. When conducting optimization, prompts corresponding to the optimization task can be entered, enabling the large language model to perform the task of providing optimization suggestions.

[0166] The working principle of large language models can be found in existing technologies and will not be elaborated here. The specific content of the above prompt words can be set by relevant personnel as needed and is not limited.

[0167] In some alternative embodiments, such as Figure 2 As shown, the knowledge layer can also perform the following steps:

[0168] Generate a target attack chain map based on the handling recommendations and target attack chain data;

[0169] The generated target attack chain graph can be used to output along with disposal recommendations. Specifically, it can be generated by... Figure 2 The output layer outputs the target attack chain map and disposal suggestions together.

[0170] Optional, please see Figure 4 The method for generating a target attack chain map based on the handling recommendations and target attack chain data can be as follows:

[0171] Identify entities in the handling recommendations and target attack chain data, including at least one of the following entities: device entity, attack technology entity, security event entity, and protective measure entity;

[0172] Extract the relationships between entities, which include at least one of attack relationships, defense relationships, and dependency relationships;

[0173] Generate a target attack chain graph based on entities and relationships.

[0174] In the above embodiments, the knowledge layer can identify the devices involved in the security event (that is, the attacked devices in the attack chain) in the attack chain corresponding to the target attack chain data, and use the identified devices as the aforementioned device entities.

[0175] The knowledge layer can identify which of the aforementioned m attack techniques appeared in each security event of the target attack chain data, and create a corresponding attack technique entity for each attack technique that appears.

[0176] The knowledge layer can identify each security event in the target attack chain data and each protective measure in the handling recommendation information, and create corresponding security event entities and protective measure entities.

[0177] Furthermore, the knowledge layer can extract the relationships between the above entities. For example, it can extract the corresponding relationships based on the relevance of different entities.

[0178] For example, if a security incident occurs on a device and a certain attack technique is used in the security incident, then it can be determined that there is an attack relationship between the security event entity corresponding to the security incident, the device entity corresponding to the device, and the attack technique entity corresponding to the attack technique.

[0179] If a protective measure can be used to protect against an attack technique, and the handling suggestion information indicates that the protective measure should be applied to a certain device, then it can be determined that there is a protective relationship between the protective measure entity corresponding to the protective measure, the attack technique entity corresponding to the attack technique, and the device entity corresponding to the device.

[0180] Alternatively, the relationships between entities can be extracted according to the attack chain. For example, if a security event occurs after another security event has ended, and both are identified as being related to the same program on the same device, then it can be determined that there is a dependency relationship between the security event entities corresponding to these two security events.

[0181] After obtaining the above entities and relationships, the knowledge layer can create nodes for the target attack chain graph for each entity. Then, for every two entities, if there is at least one of the above relationships between the two entities, an edge connecting the two nodes can be created between the two nodes corresponding to the two entities. This will give us the target attack chain graph composed of nodes and edges, which can then be displayed by the output layer.

[0182] By displaying the target attack chain graph, this solution enables a visual representation of the currently obtained target attack chain data.

[0183] Furthermore, the output layer can also support dynamic updates and interactive queries of the graph, facilitating in-depth analysis by users. Specifically, users can click on any node in the target attack chain graph, and the output layer will respond to the click command by highlighting other nodes connected to that node by edges, and displaying detailed information about that node. For example, if the clicked node corresponds to a device entity, it can display detailed information about the corresponding device.

[0184] As an example of an application scenario, the input layer can detect in real time whether the power monitoring system is under network attack. Suppose that a series of network attack behaviors that constitute an attack chain are detected in the last hour, the input layer can obtain the security events corresponding to these network attack behaviors according to step S101, use the multiple security events obtained as the target attack chain data of S101, and then the input layer executes S102 to obtain the target attack chain features corresponding to the target attack chain data and provide the target attack chain features to the analysis layer.

[0185] The analysis layer determines similar attack chain features in the feature library of the knowledge layer according to the method in S103, and then executes S104 to obtain the attack scenario information corresponding to these similar attack chain features from the case library of the knowledge layer. The attack scenario information corresponding to these similar attack chain features and the target attack chain features are fused to obtain the input information of the large language model. The large language model is used to process the input information to generate the disposal suggestion information corresponding to this attack chain.

[0186] Next, the knowledge layer can process the disposal suggestion information and target attack chain data to obtain the corresponding target attack chain graph.

[0187] Finally, the output layer provides the corresponding handling suggestions for this attack chain detected in the past hour, along with the aforementioned target attack chain graph, enabling relevant users to take timely protective measures to reduce the losses caused by this attack chain.

[0188] In summary, the method of this embodiment can be divided into four parts:

[0189] The first is the feature vector construction module, which specifically includes transforming the original attack chain data into standardized feature vectors (i.e., target attack chain features). This part first performs temporal encoding on the attack step sequence, then fuses multi-dimensional feature information, and finally generates high-quality feature vectors, i.e., the aforementioned target attack chain features, through vector standardization processing.

[0190] Secondly, there's attack chain matching, which primarily achieves precise matching of attack scenarios. This part leverages an improved multi-dimensional similarity calculation method, fusing temporal similarity, behavioral similarity, and impact similarity to achieve accurate matching of attack scenarios. The system also employs threshold adaptive optimization technology to improve the reliability of the matching results. Threshold adaptive optimization technology refers to selecting the top K candidate attack chain features with the highest comprehensive similarity from the candidate attack chain features as similar attack chain features.

[0191] Thirdly, there is the enhanced retrieval and generation, which mainly involves the generation of intelligent handling solutions. This module first obtains the attack scenario information corresponding to the similar attack chain features identified in the attack chain matching, from the case library. Then, it merges the retrieved attack scenario information and the target attack chain features into the input information of a large language model, and uses the large language model to process the input information to obtain handling suggestions.

[0192] Fourthly, there is the knowledge graph construction module, which primarily visualizes attack scenarios. This module constructs a complete knowledge network through entity recognition and relationship extraction, and enhances the visualization effect through graph optimization. It also supports dynamic updates and interactive queries of the graph, facilitating in-depth analysis by users.

[0193] Combining the above methods, the implementation of this solution can bring about the following results:

[0194] In terms of accuracy, by combining multi-dimensional feature matching and deep learning models, this solution achieved an attack scenario identification accuracy of over 85% in simulated scenario testing. This high accuracy provides a reliable foundation for the development of subsequent response plans.

[0195] In terms of handling efficiency, the retrieval-enhanced method generates handling suggestions, which can quickly provide handling solutions that match the actual situation, improving efficiency by 300% compared to traditional manual analysis methods. This not only reduces the workload of security operations and maintenance personnel, but also improves the timeliness of emergency response;

[0196] In terms of visualization, this solution visually presents the relationship between attack paths and protective measures through a target attack chain graph, helping decision-makers to quickly understand and make judgments. This visualization method greatly reduces the difficulty of understanding security analysis results and improves decision-making efficiency;

[0197] From a system scalability perspective, the modular design supports the dynamic expansion of new attack signatures and response strategies, resulting in strong system adaptability. This design enables systems implementing this solution to continuously evolve and adapt to ever-changing cybersecurity threats.

[0198] Most importantly, this solution provides an intelligent and automated solution for the security protection of power monitoring systems, realizing the transformation from passive defense to active protection, which is of great significance for improving the overall security of power monitoring systems.

[0199] This application provides an attack scenario processing device for a power monitoring system based on attack chain matching. Please refer to [link to relevant documentation]. Figure 5 The device may include the following units.

[0200] Unit 501 is used to obtain target attack chain data of the power monitoring system;

[0201] Processing unit 502 is used to process target attack chain data to obtain target attack chain features;

[0202] The retrieval unit 503 is used to retrieve at least one similar attack chain feature based on the target attack chain feature;

[0203] The processing unit 504 is used to process the attack scenario information and target attack chain features corresponding to similar attack chain features using a large language model, and obtain processing suggestion information corresponding to the target attack chain data.

[0204] Optionally, the processing unit 504 is also used for:

[0205] A target attack chain map is generated based on the handling recommendations and target attack chain data. The target attack chain map is output together with the handling recommendations.

[0206] Optionally, when the processing unit 504 generates the target attack chain map based on the processing suggestion information and the target attack chain data, it can be used for:

[0207] Identify entities in the handling recommendations and target attack chain data, including at least one of the following entities: device entity, attack technology entity, security event entity, and protective measure entity;

[0208] Extract the relationships between entities, which include at least one of attack relationships, defense relationships, and dependency relationships;

[0209] Generate a target attack chain graph based on entities and relationships.

[0210] Optionally, when obtaining the target attack chain data of the power monitoring system, the obtaining unit 501 can be used for:

[0211] Real-time detection of security events in the power monitoring system;

[0212] When a starting security event, which represents the beginning of an attack chain, and a ending security event, which represents the end of an attack chain, are detected, the set of multiple security events detected from the starting security event to the ending security event is obtained as the target attack chain data of the power monitoring system.

[0213] Optionally, when processing the target attack chain data to obtain the target attack chain features, the processing unit 502 can be used for:

[0214] Perform data preprocessing on the target attack chain data to obtain preprocessed target attack chain data;

[0215] Extract the temporal characteristics, attack behavior characteristics, and impact scope characteristics of each security event in the preprocessed target attack chain data;

[0216] The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics, and scope of impact characteristics of each security event.

[0217] Optionally, when the retrieval unit 503 obtains at least one similar attack chain feature based on the target attack chain feature, it can be used for:

[0218] For each candidate attack chain feature in the preset feature library, calculate the comprehensive similarity between the target attack chain feature and the candidate attack chain feature;

[0219] Based on the comprehensive similarity, multiple similar attack chain features are determined from multiple candidate attack chain features in the feature library.

[0220] Optionally, when calculating the comprehensive similarity between the target attack chain features and the candidate attack chain features, the retrieval unit 503 can be used for:

[0221] Calculate the temporal similarity, behavioral similarity, and impact similarity between the target attack chain features and the candidate attack chain features;

[0222] By fusing time similarity, behavioral similarity, and impact similarity based on weight parameters, a comprehensive similarity between the target attack chain features and the alternative attack chain features is obtained.

[0223] Optionally, the method by which retrieval unit 503 calculates behavioral similarity may be:

[0224] Behavioral similarity is calculated based on the degree of harm caused by different attack techniques.

[0225] Optionally, the processing unit 504 can also be used for:

[0226] A large language model is used to conduct a feasibility assessment of the proposed solutions and obtain the assessment results.

[0227] If the evaluation results do not meet the target conditions, the disposal suggestion information is optimized using a large language model to obtain optimized disposal suggestion information.

[0228] The working principle of the attack scenario processing device for power monitoring system based on attack chain matching in this embodiment can be found in the relevant steps of the attack scenario processing method for power monitoring system based on attack chain matching provided in the foregoing embodiment, and will not be repeated here.

[0229] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0230] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0231] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0232] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0233] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for handling attack scenarios in a power monitoring system based on attack chain matching, characterized in that, include: Obtain target attack chain data of the power monitoring system, the target attack chain data including multiple security events detected during the period from the initial security event characterizing the start of the attack chain to the final security event characterizing the end of the attack chain; The target attack chain data is preprocessed to obtain preprocessed target attack chain data; Extract the temporal features, attack behavior features, and impact range features of each security event from the preprocessed target attack chain data; The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics, and scope of impact characteristics of each security event; For each candidate attack chain feature in the preset feature library, calculate the time similarity, behavior similarity, and impact similarity between the target attack chain feature and the candidate attack chain feature. Then, fuse the time similarity, behavior similarity, and impact similarity according to the weight parameters to obtain the comprehensive similarity between the target attack chain feature and the candidate attack chain feature. Based on the comprehensive similarity, multiple similar attack chain features are determined from the multiple candidate attack chain features in the feature library; By using a large language model to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features, we can obtain the handling suggestion information corresponding to the target attack chain data. Identify entities in the proposed handling information and the target attack chain data, wherein the entities include at least one of device entities, attack technology entities, security event entities, and protective measure entities; Extract the relationships between the entities, wherein the relationships include at least one of attack relationships, defense relationships, and dependency relationships; A target attack chain graph is generated based on the entity and the relationship. The target attack chain graph is output together with the disposal suggestion information.

2. The method according to claim 1, characterized in that, The acquisition of target attack chain data for the power monitoring system includes: Real-time detection of security events in the power monitoring system; When a starting security event, which characterizes the beginning of an attack chain, and an ending security event, which characterizes the end of an attack chain, are detected, a set of multiple security events detected from the starting security event to the ending security event is obtained as the target attack chain data of the power monitoring system.

3. The method according to claim 1, characterized in that, The methods for calculating the behavioral similarity include: The similarity of the behaviors is calculated based on the degree of harm caused by different attack techniques.

4. The method according to claim 1, characterized in that, Also includes: The feasibility of the proposed treatment information is assessed using the large language model to obtain the assessment results. If the evaluation results do not meet the target conditions, the disposal suggestion information is optimized using the large language model to obtain optimized disposal suggestion information.

5. A power monitoring system attack scenario processing device based on attack chain matching, characterized in that, include: The acquisition unit is used to acquire target attack chain data of the power monitoring system. The target attack chain data includes multiple security events detected during the period from the initial security event representing the start of the attack chain to the final security event representing the end of the attack chain. Processing unit, used for: The target attack chain data is preprocessed to obtain preprocessed target attack chain data; Extract the temporal features, attack behavior features, and impact range features of each security event from the preprocessed target attack chain data; The target attack chain characteristics are obtained based on the time characteristics, attack behavior characteristics, and scope of impact characteristics of each security event; Retrieval unit, used for: For each candidate attack chain feature in the preset feature library, calculate the time similarity, behavior similarity, and impact similarity between the target attack chain feature and the candidate attack chain feature. Then, fuse the time similarity, behavior similarity, and impact similarity according to the weight parameters to obtain the comprehensive similarity between the target attack chain feature and the candidate attack chain feature. Based on the comprehensive similarity, multiple similar attack chain features are determined from the multiple candidate attack chain features in the feature library; Processing unit, used for: By using a large language model to process the attack scenario information corresponding to the similar attack chain features and the target attack chain features, we can obtain the handling suggestion information corresponding to the target attack chain data. Identify entities in the proposed handling information and the target attack chain data, wherein the entities include at least one of device entities, attack technology entities, security event entities, and protective measure entities; Extract the relationships between the entities, wherein the relationships include at least one of attack relationships, defense relationships, and dependency relationships; A target attack chain graph is generated based on the entity and the relationship. The target attack chain graph is output together with the disposal suggestion information.

Images