Security situation awareness response platform and method in credential environment

Abstract

The invention provides a security situation awareness response platform and method in a credential environment, and relates to the technical field of network security, and the platform comprises a building module which is used for building a comprehensive risk observation data set; the source node creating module is used for creating a source node set; the hierarchical clustering module is used for establishing multi-level adjacent nodes; the complexity analysis module is used for establishing a multi-hop path attack behavior; the permission analysis module is used for establishing a permission upgrading behavior; and the identification module is used for executing backtracking aggregation of the multi-level adjacent nodes, carrying out attack risk identification by utilizing a backtracking aggregation result, a multi-hop path attack behavior and a permission upgrading behavior, and reporting risk early warning. Through the method and the device, the technical problem that threats cannot be early warned or effectively defended in time due to the fact that attack paths and behavior modes are difficult to comprehensively capture in the prior art can be solved, accurate identification and efficient early warning of attack risks are realized, and the technical effect of improving the accuracy of security risk identification and early warning is achieved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security situation awareness and response platform and method in a trusted computing environment. Background Art

[0002] With the development of information technology, network security issues have gradually become one of the core challenges of the digital age. In a complex information and innovation environment, the sources of security risks are diverse, including external attacks, internal violations, and system vulnerability exploits. How to effectively perceive and respond to these risks has become a focus of the industry.

[0003] Traditional security situation awareness systems usually rely on a single data source or predefined rules to discover potential threats. This approach is difficult to cope with the hiddenness and diversity of complex attack behaviors such as advanced persistent threats, making it difficult for traditional systems to fully capture attack paths and behavior patterns, resulting in the inability to timely warn or effectively defend against threats. Summary of the invention

[0004] The purpose of this application is to provide a security situation awareness and response platform and method in a trusted computing environment, so as to solve the technical problem in the prior art that it is difficult to fully capture attack paths and behavior patterns, resulting in the inability to timely warn or effectively defend against threats.

[0005] In view of the above problems, this application provides a security situation awareness and response platform and method in a trusted computing environment.

[0006] On the first aspect, the present application also provides a security situation awareness response platform in a trusted innovation environment, including: a construction module for establishing a comprehensive risk observation data set; a source node creation module for performing source node identification of the comprehensive risk observation data set after time series identification, and creating a source node set; a hierarchical clustering module for performing hierarchical node search clustering with the source node set as the search center, and establishing multi-level adjacent nodes; a complexity analysis module for performing path complexity analysis on the multi-level adjacent nodes and establishing multi-hop path attack behavior; and a permission analysis module for performing a multi-level adjacent node search clustering based on the multi-level adjacent nodes. The multi-level adjacent nodes are used to perform cross-level permission association analysis and establish permission escalation behavior; an identification module is used to perform backtracking aggregation of the multi-level adjacent nodes, and use the backtracking aggregation results, the multi-hop path attack behavior, and the permission escalation behavior to identify attack risks and issue risk warnings. The backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and transferring it to the upper level, fusing the transfer result with the upper level, and performing centralized value aggregation iterative search until all nodes are aggregated. If the node attention analysis is triggered, the attention scores of the target node and the neighboring nodes are calculated to establish attention weights to complete the backtracking aggregation.

[0007] On the second aspect, the present application provides a security situation awareness and response method in a trusted computing environment, including: establishing a comprehensive risk observation data set; after time series identification of the comprehensive risk observation data set, performing source node identification of the comprehensive risk observation data set to create a source node set; using the source node set as the search center, performing hierarchical node search clustering to establish multi-level adjacent nodes; performing path complexity analysis on the multi-level adjacent nodes to establish multi-hop path attack behavior; performing cross-level authority association analysis based on the multi-level adjacent nodes to establish authority escalation behavior; performing backtracking aggregation of the multi-level adjacent nodes, using the backtracking aggregation results, the multi-hop path attack behavior, and the authority escalation behavior to identify attack risks, and reporting risk warnings. The backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and passing it to the next level. After fusing the passed results with the previous level, performing centralized value aggregation iterative search until all nodes are aggregated. If the node attention analysis is triggered, the attention scores of the target node and the neighboring nodes are calculated to establish attention weights to complete the backtracking aggregation.

[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages: By marking the time series of the comprehensive risk observation data set, we can accurately capture the dynamic changes of the data and efficiently identify the source nodes, build a source node set, perform hierarchical node search and clustering with the source node set as the center, and dynamically establish multi-level adjacent nodes. By performing path complexity analysis on multi-level adjacent nodes, we can model and evaluate multi-hop path attack behaviors, accurately capture key nodes on complex paths, and identify permission escalation behaviors based on cross-level permission association analysis of multi-level adjacent nodes. Finally, we can backtrack and aggregate the hierarchical adjacent nodes, combine multi-hop path attack behaviors and permission escalation behaviors, and accurately identify and efficiently warn of attack risks, thereby achieving the technical effect of improving the accuracy of security risk identification and warning.

[0009] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented according to the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are specifically cited below. It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easy to understand through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0011] Figure 1 This is a schematic diagram of the structure of the security situation awareness response platform in the trusted innovation environment of this application; Figure 2 This is a flowchart of the security situation awareness and response method in the trusted computing environment for this application.

[0012] Explanation of the accompanying drawings: construction module 11, source node creation module 12, hierarchical clustering module 13, complexity analysis module 14, authority analysis module 15, identification module 16. DETAILED DESCRIPTION

[0013] This application solves the technical problem in the prior art that it is difficult to fully capture attack paths and behavior patterns, resulting in the inability to timely warn or effectively defend against threats by providing a security situation awareness response platform and method in a trusted innovation environment. It achieves accurate identification and efficient warning of attack risks, and achieves the technical effect of improving the accuracy of security risk identification and warning.

[0014] Below, the technical solutions in the present application will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments of the present application. It should be understood that the present application is not limited to the example embodiments described herein. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. It should also be noted that, for the convenience of description, only the parts related to the present application are shown in the accompanying drawings, rather than all of them.

[0015] For example, please refer to the attached Figure 1 The present application provides a security situation awareness and response platform in a trusted innovation environment, and the security situation awareness and response platform in the trusted innovation environment includes: The construction module 11 is used to establish a comprehensive risk observation data set.

[0016] Specifically, the establishment of a comprehensive risk observation data set is to comprehensively reflect the potential threats and abnormal activities in the information innovation environment by collecting multi-source data. Data collection involves three aspects: security equipment, business systems, and external threat intelligence sources. Security equipment includes firewalls, intrusion detection systems (IDS), vulnerability scanners, etc. These devices monitor network traffic in real time, detect attack behaviors, and record related logs. For example, the abnormal traffic logs obtained through the intrusion detection system can provide key data such as the attacker's IP, access time, and trigger rules; the data source of the business system is mainly the operation logs and user behavior records generated by various business applications, such as the number of failed logins, the frequency of important interface calls, etc. These data help capture internal violations or abnormal behaviors; external threat intelligence sources provide intelligence about known threats, such as malicious IP, botnet activities, APT (advanced persistent threat) attack feature libraries, etc., which enhances the early warning capability of unknown threats.

[0017] In the actual construction process, firstly, data from different sources are structured and organized through multi-channel data collection technology. For example, the ELK (Elasticsearch, Logstash, Kibana) architecture is used to process log data, convert the original log into a queryable index format, and mark the data with timestamps for subsequent analysis. Secondly, redundant or erroneous records are removed through data cleaning algorithms, such as eliminating traffic data that is not related to the business or repairing fields with inconsistent formats. Finally, multi-dimensional data is integrated to form a comprehensive data set, namely a comprehensive risk observation data set. For example, the user behavior data of the business system is matched with the malicious IP list in the external threat intelligence source to generate a comprehensive risk observation data set.

[0018] The source node creation module 12 is used to identify the source nodes of the comprehensive risk observation data set after performing time series identification on the comprehensive risk observation data set, and to create a source node set.

[0019] Specifically, when analyzing the comprehensive risk observation data set, time series identification is a key step. By giving an accurate timestamp to each data record in the comprehensive risk observation data set, the time dimension association of the event is constructed, which can capture the dynamic evolution of threat behavior. After completing the time series identification, the source node identification operation will be performed. The source node is the starting point of the risk activity. By identifying the key elements in the data set, a source node set is created. The source node set includes the source IP node, source user node, source device node, and source request path node.

[0020] Among them, the source IP node represents the initiating IP address of all access requests. Specifically, by parsing the source IP field in the comprehensive risk observation data set, the potential source of attack can be revealed. The source user node refers to the user identity that triggers the operation. By matching the user login log and access record in the comprehensive risk observation data set, the user identity that triggers the operation can be obtained. The source device node refers to the terminal device of the access request in the comprehensive risk observation data set. The terminal device can be identified by analyzing the device fingerprint. The source request path node covers the path information of all resource accesses. These paths are usually recorded in the form of URLs. The corresponding records are extracted in the comprehensive risk observation data set to identify the path.

[0021] In the process of creating the source node set, based on the feature value extraction and deduplication operations of the above categories, the uniqueness of the node set is formed, and these nodes are stored using a graph database (such as Neo4j), and the initial connection relationship is established based on the time series, which can significantly improve the efficiency of subsequent analysis. For example, 300,000 data related to source nodes were extracted from the comprehensive risk observation data set containing 10 million comprehensive risk logs. Through time series clustering analysis, 500 abnormal source nodes were finally identified. These nodes provide important input for subsequent hierarchical clustering and path complexity analysis, further revealing the root cause of complex attack behaviors.

[0022] The hierarchical clustering module 13 is used to perform hierarchical node search clustering with the source node set as the search center to establish multi-level adjacent nodes.

[0023] Specifically, with the source node set as the search center, multi-level adjacent nodes are constructed through hierarchical node search clustering technology, aiming to reveal the association level and potential propagation path between the source node and other nodes, structure and visualize complex network threat behaviors, and provide a basis for in-depth analysis and early warning. First, the starting point of the hierarchical node search is the source node set, including the source IP node, source user node, source device node and source request path node. The search is based on the graph structure and uses the interactive information between nodes for recursive expansion. For example, starting from the source IP node, the user identity, device and request path associated with the IP are searched. By setting a depth limit, the recursive search is prevented from falling into irrelevant nodes. The specific depth limit conditions can be set by technicians in this field in combination with actual conditions. For example, the accuracy of risk warnings at different search depths can be analyzed based on historical security data to determine the search depth with the highest accuracy. For example, for a malicious IP (192.168.1.10), 3 associated user nodes and 5 device nodes were found in the first layer, and these devices were associated with 15 request path nodes when further expanded, forming a clear hierarchical structure.

[0024] Next, perform hierarchical node clustering operations. The goal of clustering is to group nodes according to the intensity, frequency, and type of interaction between them. Existing algorithms include hierarchical clustering algorithms based on adjacency matrices. By calculating the similarity measure between nodes, closely connected nodes are grouped together. For example, in a certain data analysis, it was found that a user node was associated with multiple highly sensitive request paths at the same time and interacted frequently with multiple source IPs. These nodes were clustered into a high-risk behavior cluster. The construction of multi-level adjacent nodes stores the results in the form of a graph, where each level represents a different interaction depth, and the edge weights between nodes reflect the interaction characteristics, such as access frequency, request response time, or permission level. This structured model of multi-level adjacent nodes significantly improves the ability to describe complex threat behaviors. For example, when detecting a certain attack path, cluster analysis found a complete path from source IP to user identity to high-privilege device. Combined with the path characteristics, the source of the attack and the scope of influence were further located. This hierarchical clustering analysis provides key input for subsequent complexity analysis and permission association, and enhances situational awareness.

[0025] The complexity analysis module 14 is used to perform path complexity analysis on the multi-level adjacent nodes and establish multi-hop path attack behavior.

[0026] Specifically, path complexity analysis aims to reveal potential attack paths in the network, attackers' routes of action and their complexity. By performing path complexity analysis on multi-level adjacent nodes, multi-hop path attack behaviors can be effectively identified, thereby improving the detection capabilities of complex attacks such as advanced persistent threats. Path complexity analysis includes analysis of multiple dimensions, such as path length complexity, node importance complexity, node path weight, path branching complexity, etc. Among them, path length complexity focuses on the number of node hops in each attack path, that is, the number of intermediate nodes passed in the path from the source node to the final target node; node importance complexity analysis considers the role and influence of each node in the path. On an attack path, the authority, resource sensitivity and access frequency of each node will affect its importance; path weight complexity analysis involves the weight of each path, that is, the connection strength between nodes on the path. The connection strength can be measured by the interaction frequency, data traffic or request response time between nodes. Path branching complexity involves the number of node branches in the path, that is, the different paths that the attacker may take.

[0027] The establishment of multi-hop path attack behavior is actually to build a comprehensive attack path model by combining the above-mentioned complexity analyses. Through comprehensive analysis of multiple dimensions such as path length, node importance, path weight, and path branching, it reveals the attacker's possible penetration behavior through multiple nodes and multiple levels. For example, it was found that the attacker started from the source IP node, passed through 3 different user nodes, and then passed through 2 device nodes, and finally reached the database server. The total complexity of this path is high, and there are multiple privilege escalation and resource request behaviors in the path, indicating that this is a typical multi-hop path attack behavior.

[0028] The authority analysis module 15 is used to perform cross-level authority association analysis based on the multi-level adjacent nodes and establish authority escalation behavior.

[0029] Specifically, the core of cross-level permission association analysis is to use the structure of multi-level adjacent nodes to identify the paths and behaviors of attackers to achieve permission escalation through permission associations between different nodes. Permission escalation behavior is a typical strategy for attackers to gradually obtain higher permissions from low permissions, such as from ordinary user permissions to administrator permissions, or even to gain full control of the core system. By analyzing the permission relationship between multi-level adjacent nodes, permission escalation behavior can be established to assist in timely identification of potential threats.

[0030] The analysis of privilege escalation can include the following aspects: First, in multi-level adjacent nodes, each node contains certain privilege attributes, such as access rights, execution rights or management rights. Privilege escalation behavior is usually based on privilege inheritance or cross-node privilege propagation. For example, an attacker may use a low-privilege device (such as an ordinary user's workstation) to launch an attack and obtain high-privilege resources (such as database servers or file sharing systems) through privilege association. For example, an analysis of a multi-level adjacent node graph found that about 30% of the privilege association node chains involved privilege inheritance behavior, which is used as privilege escalation behavior. Second, the attacker gradually collects more privilege information by moving between nodes in the same privilege level, that is, horizontal expansion. In layman's terms, these horizontal expansion paths are analyzed using the connection relationship of multi-level adjacent nodes. For example, an attacker may collect login credentials or sensitive information by accessing nodes of multiple ordinary user accounts to provide conditions for subsequent privilege escalation. For example, the attack path shows that an ordinary user node has accessed multiple devices with the same privilege in a short period of time. Through analysis, these access anomalies are found and marked as potential horizontal expansion behaviors as privilege escalation behaviors. Third, attackers gradually break through permissions and move from low-privilege nodes to high-privilege nodes, which is called vertical permission escalation. By using cross-level association analysis, the path from ordinary user nodes to high-privilege administrator nodes is identified. Vertical escalation is usually accompanied by vulnerability exploitation or credential theft. For example, by extracting the permission relationship in a multi-level graph, attackers can gain access to administrator devices from ordinary user device nodes by exploiting privilege vulnerabilities. This vertical association path is a permission escalation behavior.

[0031] Through cross-level permission correlation analysis, we can accurately capture the path and characteristics of permission escalation behavior, improve the detection capabilities of complex attacks, provide important protection for preventing permission abuse and system intrusions, and significantly reduce security risks.

[0032] The identification module 16 is used to perform backtracking aggregation of the multi-level adjacent nodes, use the backtracking aggregation results, the multi-hop path attack behavior, and the authority escalation behavior to identify attack risks, and issue risk warnings. The backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and transferring it to the upper level, fusing the transfer result with the upper level, and performing centralized value aggregation iterative search until all nodes are aggregated. If the node attention analysis is triggered, the attention scores of the target node and the neighboring nodes are calculated to establish attention weights to complete the backtracking aggregation.

[0033] Specifically, backtracking aggregation is a bottom-up analysis method that aggregates the interactive information of multi-level nodes to the source node based on the backtracking of the farthest node layer by layer. This process includes the following key steps: First, locate the farthest node from the multi-level adjacent nodes. These nodes are usually the end of the attack path. For each farthest node, calculate its centralized value aggregation result to quantify the risk carried by the node. When all the nodes at all levels are aggregated, a comprehensive backtracking aggregation result is formed. During the backtracking aggregation process, the attention level is located by setting aggregation constraints (based on real-time computing resources, the number of nodes between layers, and the self-check results of the trusted innovation environment), and the near-level interval is established based on the attention level. When the near-level interval is triggered by the execution of the aggregation iterative search, the node attention analysis is triggered. At this time, the node attention analysis in the near-level interval is performed, and the backtracking aggregation is completed based on the node attention analysis results. After the backtracking aggregation results are combined with the multi-hop path attack behavior and the privilege escalation behavior, the attack path is comprehensively evaluated, the risk level is identified, and the risk warning is carried out, thereby improving the situational awareness capability in the trusted innovation environment and effectively preventing the occurrence of major security incidents.

[0034] Furthermore, the identification module 16 in the security situation awareness response platform under the trusted innovation environment is also used to: obtain the farthest level of the multi-level adjacent nodes, perform centralized value aggregation on the farthest level, establish a centralized value aggregation result, and pass the centralized value aggregation result to the next level; after fusing the transferred result with the previous level, perform centralized value aggregation iterative search; when all multi-level understanding nodes are fully aggregated, complete the backtracking aggregation.

[0035] Specifically, the nodes at the farthest level are usually the target nodes of the attack path, such as core databases, administrator accounts or other high-value resources. First, the farthest level is identified from the multi-level adjacent node graph. The farthest level includes all the farthest nodes. The farthest level is concentrated and aggregated. Concentrated value aggregation refers to the aggregation of risk levels. In layman's terms, multi-level adjacent nodes start from the source node and include adjacent nodes. The farther away from the source node, the lower its own risk level. The specific configuration can be made by technical personnel in this field based on historical experience. Then, the risk levels of the nodes in the farthest level are concentrated and calculated, such as calculating the average child. The concentrated value aggregation results of the farthest level are then passed to the upper level layer by layer. Each time the aggregation is passed, the aggregation value is adjusted and fused to reflect the correlation between the levels and the characteristics of risk propagation. For example, when an intermediate-level node is connected to multiple farthest nodes at the same time, its comprehensive aggregation value will increase significantly due to the superposition of risks. Therefore, the centralized value aggregation result of the previous layer can be calculated and superimposed with the centralized value aggregation result of the farthest layer. The centralized value aggregation iterative search goes back layer by layer to the source node, and the risk information of all levels is integrated into the overall back-tracing aggregation result. Finally, the aggregation value of the source node represents the comprehensive risk level of the entire attack path. When the aggregation process of all multi-level adjacent nodes is completed, the final back-tracing aggregation result is generated. The result not only includes the comprehensive risk score of the source node, but also includes the detailed aggregation value of each node in the path. Through this mechanism of layer-by-layer aggregation and back-tracing analysis, the attack path and its risk propagation law can be fully revealed, providing high-value intelligence support for defense and response.

[0036] Furthermore, the identification module 16 in the security situation awareness and response platform under the trusted innovation environment is also used to: obtain real-time computing resources, and configure a first aggregation constraint based on the real-time computing resources; self-check the current trusted innovation environment, and configure a second aggregation constraint based on the self-check results; obtain the number of hierarchical nodes of the multi-level adjacent nodes, and generate a third aggregation constraint based on the number of hierarchical nodes; use the first aggregation constraint, the second aggregation constraint, and the third aggregation constraint to locate the focus level, and establish a near-level interval based on the focus level; when executing an aggregation iterative search to trigger the near-level interval, perform node attention analysis within the near-level interval, and complete backtracking aggregation based on the node attention analysis results.

[0037] Specifically, in the process of performing retrospective aggregation, by configuring multiple aggregation constraints and combining near-level interval analysis, the aggregation accuracy and computing efficiency can be significantly improved. Real-time computing resources are the computing resources of the computing device that performs the aggregation task, including computing power (such as CPU, GPU resources), memory usage, I / O bandwidth, etc. According to the currently available computing resources, the first aggregation constraint is dynamically configured to reasonably allocate task loads and optimize aggregation efficiency. For example, when computing resources are tight, the depth of aggregation is limited or the aggregation results of low-level nodes are approximated. For example, in a certain analysis, it was detected that the computing resource utilization rate reached 80%, so by adjusting the first aggregation constraint, the aggregation depth was limited to 5 layers, thereby ensuring that the analysis of the critical path is guaranteed.

[0038] The self-inspection process of the trusted innovation environment is mainly used to evaluate the security status and configuration integrity of the current system. For example, by checking the system's vulnerability status, configuration consistency, patch installation status, etc., potential risk points or abnormal situations can be identified. Based on the self-inspection results, the second aggregation constraint is generated to dynamically adjust the aggregation parameters, focusing on analyzing hierarchical nodes that may have vulnerabilities or risks. For example, in a self-inspection, it was found that the vulnerability patch of a high-authority node was not updated in time, and the node was connected to multiple external sources. Based on this, the second aggregation constraint marks the node and its associated paths as high priority to ensure that they are processed in depth in the aggregation analysis.

[0039] The number of nodes in a hierarchy directly determines the scale and complexity of the aggregation task. When a certain hierarchy contains too many nodes, it may face a high computational load. Therefore, by counting the number of nodes in each hierarchy, a third aggregation constraint is generated to allocate resources and optimize the aggregation strategy. For example, when a certain hierarchy has a large number of nodes and a low risk, you can choose to merge the aggregation results of some nodes to reduce the computational complexity. Example: In a multi-level node graph, a middle level contains more than 1,000 nodes, but 90% of the nodes have a low risk. The low-risk nodes are grouped and merged, and only the independent analysis results of the high-risk nodes are retained as the third aggregation constraint, which effectively reduces the computational time.

[0040] By combining the above three aggregation constraints, the attention levels that need to be focused on can be accurately located. These levels are usually key nodes in the path or the core links of the privilege escalation behavior. After locating the attention level, the near-level interval is further established, that is, the target level and its directly associated adjacent levels are included in the analysis scope. This method can not only retain the refined analysis of the attention level, but also take into account its relevance to the upper and lower levels. For example, in a certain analysis, the attention level is located as the 4th level (including high-risk core nodes), and its near-level interval includes the 3rd and 5th level nodes, which are used for in-depth analysis. Node attention analysis is a refined modeling of the interaction relationship between nodes in the near-level interval. By calculating the attention score of each node (such as based on the graph attention network, GAT), the platform can identify key nodes and their risk contributions. The attention score result will be used to update the node's aggregation value, thereby generating the final retrospective aggregation result, which is used to generate risk warnings to help administrators respond quickly to potential threats.

[0041] Furthermore, the identification module 16 in the security situation awareness response platform under the information innovation environment is also used to: calculate the attention score through a formula, establish the attention weight based on the attention score, and use the attention weight as the node attention analysis result, as follows: ; ;in, Characterizing the target node and neighbor nodes The attention score, and Represent the target nodes separately and neighbor nodes Features, W is the feature transformation matrix, is the attention vector, LeakyReLU is the activation function, T Represents the transpose operation, Characterized by the target node Point to neighbor node The attention weight, Characterizing the target node The set of neighbor nodes in the near-level interval of Characterization Any node in Characterizing the target node and neighbor nodes Attention score.

[0042] Specifically, in the analysis of multi-level adjacent nodes, attention scores and weight calculations are the core steps to identify key nodes. This process is based on the Graph Attention Network (GAT) method, which dynamically calculates the weight of the target node through the feature relationship of neighbor nodes, thereby revealing the importance of the node in the entire network. is the node in the farthest level, the neighbor node The target node Adjacent nodes. Feature transformation matrix, used to linearly transform node features to adapt them to specific analysis tasks. Attention vector, used to calculate the importance of features between nodes.

[0043] The final attention weight reflects the target node Point to neighbor node Attention weights are used to adjust the contribution of node features in the aggregation analysis. For example, neighbor nodes with high weights will have a greater impact on the feature aggregation of the target node. This weight information is used to highlight key nodes in the final retrospective aggregation, helping the platform to quickly lock high-risk paths and generate warnings.

[0044] Furthermore, the complexity analysis module 14 in the security situation awareness response platform under the trusted innovation environment is also used to: perform node hop count analysis on each node of the multi-level adjacent nodes to establish path length complexity; perform node authority, risk level, and access feature analysis on the multi-level adjacent nodes to establish node importance complexity; perform node path weight analysis on the multi-level adjacent nodes to generate path weight complexity; obtain the number of forked nodes of the multi-level adjacent nodes, and generate path branching complexity based on the number of forked nodes; complete path complexity analysis based on the path length complexity, the node importance complexity, the path weight complexity, and the path branching complexity.

[0045] Specifically, when performing complexity analysis on multi-level adjacent nodes, each node is analyzed in detail through different dimensions, gradually revealing potential attack paths and risks in the network. Path complexity analysis not only helps identify the complexity of attack behavior, but also provides strong support for blocking attack paths. The specific analysis includes path length complexity, node importance complexity, path weight complexity, and path branching complexity. Each complexity dimension is to accurately depict potential attack behavior and enhance the ability to respond to complex attacks.

[0046] The path length complexity analysis first evaluates the number of hops of each node in the multi-level adjacent nodes. The number of node hops refers to the number of intermediate nodes in the path from the source node to a certain target node. A longer path usually means that the attacker needs to traverse more defense layers, which increases the difficulty of attack detection and may also show the persistence and depth of the attack behavior. For example, when an attacker gradually penetrates from the external network to the internal network through multiple hops, each hop node in the path may represent a different attack behavior (such as lateral movement, privilege escalation, etc.). The longer the attack path, the more concealed the attack behavior and the stronger the ability to bypass the protection mechanism. Assuming that a certain attack path contains 7 hops, this path is significantly higher than the average hops of most other paths (about 3 to 4 steps), indicating that the path is complex and has a high potential risk. Specifically, those skilled in the art can use historical data to establish samples of different node hops and corresponding path length complexity samples, and analyze the node hops based on existing machine learning models, such as regression learning, neural networks, etc. to train path length complexity analysis models to generate path length complexity.

[0047] Permissions usually refer to the access control level of a node to resources in a system or network. In a security system, different nodes (such as users, devices, services, etc.) will have different access rights, which determine the operations they can perform and the resources they can access. The types of permissions include but are not limited to user permissions, device permissions, and service permissions. For example, ordinary users may only be able to access ordinary files, while administrators can modify system settings or delete sensitive data. The risk level is an assessment of the security hazards that a node or path may bring. Specifically, professional technicians in this field will conduct successful attack simulations on the node in advance to determine the corresponding hazard level, that is, the risk level. Access characteristics describe the interaction pattern between nodes, including but not limited to the frequency, time, and method of access. By analyzing access characteristics, the difference between regular access and abnormal behavior can be identified, helping to discover potential attack behaviors. In a comprehensive analysis, permissions, risk levels, and access characteristics are interrelated. For example, if a node has high permissions but abnormal access characteristics (such as frequent access to sensitive data or a large number of requests during non-working hours) and a high risk level, it indicates that it may become an attacker's target or has been compromised. Specifically, technical personnel in this field can use historical data to establish feature samples and corresponding importance complexity samples including node permissions, risk levels, and access characteristics, and based on existing machine learning models, such as regression learning, neural networks, etc., train importance complexity analysis models to analyze the node permissions, risk levels, and access characteristics of nodes in multi-level adjacent nodes to generate node importance complexity.

[0048] Node path weight analysis involves the connection strength between each path node in multi-level adjacent nodes, which is closely related to the interaction frequency, data transmission volume or access response time between nodes. Nodes with higher path weights usually indicate that the attacker interacts more frequently with the node, or that the resource access involved in the node has higher value. For example, in a certain attack, it was found that a certain device node frequently received a large number of requests, and the request response time was long, indicating that the node may be a key node for the attacker to infiltrate. Similarly, by collecting data samples containing interaction frequency, data transmission volume or access response time and the corresponding weight complexity samples through historical data, a weight complexity analysis model is constructed based on the existing machine learning model to generate path weight complexity.

[0049] Path branching complexity analysis focuses on the number of fork nodes in the path. The more fork nodes there are, the higher the path branching complexity is. Specifically, professional and technical personnel in this field can construct a mapping relationship between the number of fork nodes and the path branching complexity based on historical data to identify the path branching complexity.

[0050] Finally, according to the path length complexity, the node importance complexity, the path weight complexity, and the path branching complexity, the paths of nodes with any complexity exceeding a preset threshold are identified, and multi-hop path attack behavior is established.

[0051] In summary, through the comprehensive analysis of path length complexity, node importance complexity, path weight complexity, and path branching complexity, we can comprehensively evaluate the complexity and potential risks of nodes, reveal potential attack paths, and conduct in-depth analysis and intervention, thereby helping operation and maintenance personnel to respond to and prevent advanced persistent threats in a timely manner.

[0052] Furthermore, the identification module 16 in the security situation awareness response platform under the trusted innovation environment is also used to: configure a preset risk warning level; perform a trigger analysis of the preset risk warning level based on the attack risk identification result, and establish a trigger analysis result; configure a warning plan based on the trigger analysis result, and complete the risk warning alarm.

[0053] Specifically, the risk warning level is a quantitative assessment of the potential threat of attack behavior, which is usually divided into multiple levels (such as low, medium, high, and severe), and each level corresponds to different response measures. The preset risk warning level is the trigger threshold of the warning, which is set by technical personnel in the field. Trigger analysis is the process of dynamically evaluating whether the preset warning level is triggered based on the attack risk identification results. By comparing the risk identification results (comprehensive risk level) with the preset warning level, the severity of the current threat is determined, and the trigger analysis results are generated. According to the trigger analysis results, the corresponding warning plan is generated, and the defense measures and response strategies are clarified. The warning plan includes target node isolation, real-time alarm notification, etc. Finally, a risk warning report is generated according to the warning plan and reported to the security operation center or administrator. Through this complete set of processes from trigger analysis to warning plan generation, it is possible to quickly capture attack threats and generate accurate warning information, providing administrators with real-time and actionable security protection suggestions. This mechanism significantly improves the security situation awareness and response efficiency in the information innovation environment.

[0054] Furthermore, the security situation awareness and response platform in the information innovation environment also includes: a migration warning module, which is used to construct a continuous monitoring window according to the warning plan and the response plan, and the continuous monitoring window includes a time window and a node window. Continuous monitoring is performed in the continuous monitoring window, and a comprehensive risk observation data set is used as the source data set, and the continuous monitoring data set is used as the incremental data to perform migration warning analysis to generate a migration warning.

[0055] Specifically, the time window refers to the time range covered by the analysis data, which is usually dynamically updated through sliding window technology to capture behavioral patterns in different time periods. For example, a time window of the past 15 minutes can be set, sliding every 5 minutes to update the monitoring results in real time. The node window refers to the set of nodes that need to be monitored, including the key nodes that trigger the warning and their directly or indirectly associated nodes. For example, if an attack path involves source IP nodes, intermediate-level nodes, and target database nodes, these nodes constitute the scope of the node window. Assume that a system detects multiple abnormal access requests within a 15-minute time window, involving 5 nodes (source IP, ordinary user nodes, high-authority device nodes, etc.). According to the triggered high-risk warning, a continuous monitoring window is constructed, which includes all relevant interaction records within these 15 minutes, as well as the near-level associated nodes of these nodes. In continuous monitoring, the comprehensive risk observation dataset is used as the source dataset, and the continuous monitoring dataset is generated in real time as incremental data for migration warning analysis, aiming to identify the trend of threats extending from one node or path to other nodes or paths. By analyzing the data in the continuous monitoring window, the propagation pattern of the threat can be captured and migration warnings can be generated, providing an important basis for the optimization of multi-level defense strategies.

[0056] In summary, the security situation awareness and response platform in the trusted innovation environment provided by this application has the following technical effects: A construction module is used to establish a comprehensive risk observation data set; a source node creation module is used to identify the source nodes of the comprehensive risk observation data set after time series identification, and create a source node set; a hierarchical clustering module is used to use the source node set as the search center, perform hierarchical node search clustering, and establish multi-level adjacent nodes; a complexity analysis module is used to perform path complexity analysis on the multi-level adjacent nodes and establish multi-hop path attack behavior; a permission analysis module is used to perform cross-level permission association analysis based on the multi-level adjacent nodes and establish permission escalation behavior; an identification module is used to perform backtracking aggregation of the multi-level adjacent nodes, use the backtracking aggregation results, the multi-hop path attack behavior, and the permission escalation behavior to identify attack risks and issue risk warnings. Backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and transferring it to the upper level, fusing the transfer results with the upper level, and performing centralized value aggregation iterative search until all nodes are aggregated. If node attention analysis is triggered, the attention scores of the target node and the neighboring nodes are calculated to establish attention weights to complete backtracking aggregation. Realize accurate identification and efficient early warning of attack risks, and achieve the technical effect of improving the accuracy of security risk identification and early warning.

[0057] Embodiment 2, based on the same inventive concept as the security situation awareness response platform in the trust-based innovation environment in the previous embodiment, the present application also provides a security situation awareness response method in the trust-based innovation environment, wherein the security situation awareness response method in the trust-based innovation environment is applied to the security situation awareness response platform in the trust-based innovation environment, please refer to the attached Figure 2 The security situation awareness response method in the information innovation environment specifically includes the following steps: Build a comprehensive risk observation dataset.

[0058] After the time series of the comprehensive risk observation data set is marked, source node identification of the comprehensive risk observation data set is performed to create a source node set.

[0059] Taking the source node set as the search center, hierarchical node search clustering is performed to establish multi-level adjacent nodes.

[0060] Perform path complexity analysis on the multi-level adjacent nodes and establish multi-hop path attack behavior.

[0061] Based on the multi-level adjacent nodes, cross-level permission association analysis is performed to establish permission escalation behavior.

[0062] Perform backtracking aggregation of the multi-level adjacent nodes, use the backtracking aggregation results, the multi-hop path attack behavior, and the authority escalation behavior to identify attack risks, and issue risk warnings. The backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and transferring it to the upper level. After fusing the transferred results with the upper level, perform centralized value aggregation iterative search until all nodes are aggregated. If node attention analysis is triggered, the attention scores of the target node and the neighboring nodes are calculated to establish attention weights to complete the backtracking aggregation.

[0063] Furthermore, the security situation awareness and response method in the trusted innovation environment also includes: obtaining the farthest level of the multi-level adjacent nodes, performing centralized value aggregation on the farthest level, establishing a centralized value aggregation result, and transmitting the centralized value aggregation result to the next level; after fusing the transmitted result with the previous level, performing a centralized value aggregation iterative search; when all the multi-level understanding nodes are fully aggregated, completing the backtracking aggregation.

[0064] Furthermore, the security situation awareness and response method in the trusted innovation environment also includes: obtaining real-time computing resources, and configuring a first aggregation constraint based on the real-time computing resources; self-checking the current trusted innovation environment, and configuring a second aggregation constraint based on the self-check results; obtaining the number of level nodes of the multi-level adjacent nodes, and generating a third aggregation constraint based on the number of level nodes; using the first aggregation constraint, the second aggregation constraint, and the third aggregation constraint to locate the focus level, and establishing a near-level interval based on the focus level; when executing an aggregation iterative search to trigger the near-level interval, performing node attention analysis within the near-level interval, and completing backtracking aggregation based on the node attention analysis results.

[0065] Furthermore, the security situation awareness response method in the information innovation environment also includes: calculating the attention score by a formula, establishing the attention weight based on the attention score, and using the attention weight as the node attention analysis result, as follows: ; ;in, Characterizing the target node and neighbor nodes The attention score, and Represent the target nodes separately and neighbor nodes Features, W is the feature transformation matrix, is the attention vector, LeakyReLU is the activation function, T Represents the transpose operation, Characterized by target node Point to neighbor node The attention weight, Characterizing the target node The set of neighbor nodes in the near-level interval of Characterization Any node in Characterizing the target node and neighbor nodes Attention score.

[0066] Furthermore, the security situation awareness and response method in the trusted innovation environment also includes: performing node hop count analysis on each node of the multi-level adjacent nodes to establish path length complexity; performing node authority, risk level, and access feature analysis on the multi-level adjacent nodes to establish node importance complexity; performing node path weight analysis on the multi-level adjacent nodes to generate path weight complexity; obtaining the number of forked nodes of the multi-level adjacent nodes, and generating path branching complexity based on the number of forked nodes; completing path complexity analysis based on the path length complexity, the node importance complexity, the path weight complexity, and the path branching complexity.

[0067] Furthermore, the security situation awareness and response method in the information innovation environment also includes: configuring a preset risk warning level; performing a trigger analysis of the preset risk warning level based on the attack risk identification result, and establishing a trigger analysis result; configuring a warning plan based on the trigger analysis result, and completing the risk warning alarm.

[0068] Furthermore, the security situation awareness and response method in the information innovation environment also includes: constructing a continuous monitoring window according to the early warning plan and the response plan, the continuous monitoring window including a time window and a node window, performing continuous monitoring in the continuous monitoring window, and using a comprehensive risk observation data set as a source data set and a continuous monitoring data set as incremental data to perform migration early warning analysis and generate a migration warning.

[0069] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. Figure 1 The security situation awareness response method and specific examples in the trusted innovation environment in the first embodiment are also applicable to the security situation awareness response platform in the trusted innovation environment of this embodiment. Through the above detailed description of the security situation awareness response method in the trusted innovation environment, those skilled in the art can clearly know the security situation awareness response platform in the trusted innovation environment of this embodiment, so for the sake of brevity of the specification, it will not be described in detail here. For the method disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0070] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0071] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the present application and its equivalent technology, the present application is also intended to include these modifications and variations.

Claims

1. The security situation awareness and response platform in the information innovation environment is characterized by: The security situation awareness and response platform in the information innovation environment includes: Building blocks for building comprehensive risk observation datasets; Creating a source node module, used to identify the source nodes of the comprehensive risk observation data set after performing time series identification on the comprehensive risk observation data set, and create a source node set; A hierarchical clustering module, used to perform hierarchical node search and clustering with the source node set as the search center, and establish multi-level adjacent nodes; A complexity analysis module, used to perform path complexity analysis on the multi-level adjacent nodes and establish multi-hop path attack behavior; A permission analysis module, used to perform cross-level permission association analysis based on the multi-level adjacent nodes and establish permission escalation behavior; An identification module is used to perform backtracking aggregation of the multi-level adjacent nodes, identify attack risks using the backtracking aggregation results, the multi-hop path attack behavior, and the authority escalation behavior, and issue risk warnings. The backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and transferring it to the upper level. After fusing the transfer result with the upper level, a centralized value aggregation iterative search is performed until all nodes are aggregated. If node attention analysis is triggered, the attention scores of the target node and the neighboring nodes are calculated to establish attention weights to complete the backtracking aggregation.

2. The security situation awareness and response platform in the information innovation environment as claimed in claim 1 is characterized in that: The identification module is used for: Acquire the most distant level of the multi-level adjacent nodes, perform centralized value aggregation on the most distant level, establish a centralized value aggregation result, and transmit the centralized value aggregation result to an upper level; After fusing the transferred results with the previous level, perform a concentrated value aggregation iterative search; When all the multi-level understanding nodes are aggregated, the backtracking aggregation is completed.

3. The security situation awareness and response platform in the information innovation environment as described in claim 2 is characterized in that: The identification module is also used for: Acquire real-time computing resources, and configure a first aggregation constraint according to the real-time computing resources; Perform a self-check on the current trusted innovation environment and configure the second aggregation constraint based on the self-check results; Acquire the number of level nodes of the multi-level adjacent nodes, and generate a third aggregation constraint according to the number of level nodes; Locate a focus level by using the first aggregation constraint, the second aggregation constraint, and the third aggregation constraint, and establish a near-level interval based on the focus level; When the aggregation iterative search is executed to trigger the near-level interval, the node attention analysis within the near-level interval is performed, and the backtracking aggregation is completed based on the node attention analysis result.

4. The security situation awareness and response platform in the information innovation environment as described in claim 3 is characterized in that: The identification module is also used for: The attention score is calculated by the formula, and the attention weight is established based on the attention score, and the attention weight is used as the node attention analysis result, as follows: ； ； in, Characterizing the target node and neighbor nodes The attention score, and Represent the target nodes separately and neighbor nodes Features, W is the feature transformation matrix, is the attention vector, LeakyReLU is the activation function, T Represents the transpose operation, Characterized by target node Point to neighbor node The attention weight, Characterizing the target node The set of neighbor nodes in the near-level interval of Characterization Any node in Characterizing the target node and neighbor nodes Attention score.

5. The security situation awareness and response platform in the information innovation environment as claimed in claim 1 is characterized in that: The complexity analysis module is used to: Performing node hop count analysis on each node of the multi-level adjacent nodes to establish path length complexity; Perform node authority, risk level, and access feature analysis of the multi-level adjacent nodes to establish node importance complexity; Performing node path weight analysis on the multi-level adjacent nodes to generate path weight complexity; Obtaining the number of bifurcated nodes of the multi-level adjacent nodes, and generating path branching complexity according to the number of bifurcated nodes; The path complexity analysis is completed according to the path length complexity, the node importance complexity, the path weight complexity, and the path branching complexity.

6. The security situation awareness and response platform in the information innovation environment as claimed in claim 1 is characterized in that: The identification module is used for: Configure preset risk warning levels; Perform trigger analysis of the preset risk warning level according to the attack risk identification result, and establish a trigger analysis result; According to the trigger analysis results, an early warning plan is configured to complete the risk early warning alarm.

7. The security situation awareness and response platform in the information innovation environment as described in claim 6 is characterized in that: The security situation awareness and response platform in the information innovation environment also includes: The migration warning module is used to build a continuous monitoring window according to the warning plan and response plan. The continuous monitoring window includes a time window and a node window. Continuous monitoring is performed in the continuous monitoring window, and the comprehensive risk observation data set is used as the source data set, and the continuous monitoring data set is used as the incremental data to perform migration warning analysis to generate a migration warning.

8. The security situation awareness and response method in the information innovation environment is characterized by: The security situation awareness response method in the trusted innovation environment is executed by the security situation awareness response platform in any one of claims 1 to 7, and the security situation awareness response method in the trusted innovation environment includes: Establish a comprehensive risk observation dataset; After the time series of the comprehensive risk observation data set is marked, source node identification of the comprehensive risk observation data set is performed to create a source node set; Taking the source node set as the search center, performing hierarchical node search clustering to establish multi-level adjacent nodes; Performing path complexity analysis on the multi-level adjacent nodes to establish multi-hop path attack behavior; Perform cross-level permission association analysis based on the multi-level adjacent nodes to establish permission escalation behavior; Perform backtracking aggregation of the multi-level adjacent nodes, use the backtracking aggregation results, the multi-hop path attack behavior, and the authority escalation behavior to identify attack risks, and issue risk warnings. The backtracking aggregation includes obtaining the farthest level of the multi-level adjacent nodes for centralized value aggregation and transferring it to the upper level. After fusing the transfer result with the upper level, perform centralized value aggregation iterative search until all nodes are aggregated. If node attention analysis is triggered, calculate the attention scores of the target node and the neighboring nodes to establish attention weights to complete the backtracking aggregation.

Images