Network attack tracing method and device based on internal and external network topology node analysis and storage medium

Abstract

A network attack tracing method and device based on internal and external network topology node analysis, wherein the method comprises: acquiring connection relationships and behavior characteristics of internal network nodes and external network nodes, an internal network topology graph comprising the internal network nodes and an external network topology graph comprising the external network nodes; associating the internal network topology graph and the external network topology graph according to the connection relationships and the behavior characteristics to obtain a topology structure model; calculating an association weight of the network nodes based on the topology structure model and the behavior characteristics, and constructing a behavior association network of the network nodes based on the association weight, the behavior association network being used to represent behavior relationships between the network nodes; and based on the association weight, starting from a target node, which is an attacked network node, to obtain an attack path by reverse deduction, so as to determine an attack source. The application can improve the accuracy of network attack tracing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network attack tracing, and in particular to a network attack tracing method and device based on internal and external network topology node analysis. BACKGROUND

[0002] With the rapid development of information technology and the popularity of the Internet, the network has become a key infrastructure for social, economic and political activities. However, the resulting network security problem is also increasingly serious, and the frequency and complexity of network attacks are rising, posing a huge security risk to organizations, enterprises and individuals worldwide. Network attacks not only include common attack types such as data breaches, network intrusions, malware spread, denial-of-service attacks (DDoS), but also involve complex and long-term attack behaviors such as advanced persistent threats (APTs). In the face of these attacks, timely and effective attack tracing has become one of the core issues of network security.

[0003] In related technologies, network attack tracing methods mostly focus on the analysis of single network topology structures, such as relying only on internal network topology graphs or external network topology graphs to determine the attack source. When network attack tracing is based on a single network topology structure, the network topology structure is relatively simple, and the analysis process is not complex. To some extent, it improves the efficiency of network attack tracing.

[0004] However, a single network topology (whether it is an internal network topology graph or an external network topology graph) can usually only show part of the connection relationships or attack paths in the network, and cannot fully reflect the complex attack patterns that may exist in the entire network. In a complex multi-level network environment, attacks can be made through multiple nodes with multiple jumps and disguises, which makes it difficult to accurately track through a single topology structure, reducing the accuracy of network attack tracing. SUMMARY

[0005] The present application provides a network attack tracing method and device based on internal and external network topology node analysis, which is used to improve the accuracy of network attack tracing.

[0006] In a first aspect of the present application, a network attack tracing method based on internal and external network topology node analysis is provided, which is applied in a server, and the method comprises:

[0007] Obtaining a connection relationship and a behavior characteristic of an inner network node and an outer network node, an inner network topology graph including the inner network node, and an outer network topology graph including the outer network node; associating the inner network topology graph and the outer network topology graph according to the connection relationship and the behavior characteristic to obtain a topology structure model; calculating an association weight of the network node based on the topology structure model and the behavior characteristic, and constructing a behavior association network of the network node based on the association weight, the behavior association network being used to represent a behavior relationship between the network nodes; and deducing an attack path from a target node to determine an attack source, the target node being an attacked network node.

[0008] Optionally, the associating the inner network topology graph and the outer network topology graph according to the connection relationship and the behavior characteristic to obtain a topology structure model specifically includes:

[0009] Based on the connection relationship and the behavior characteristic, a time-series-based dependency matrix is constructed to analyze a dependency relationship between the inner network node and the outer network node, the dependency relationship including direct connection dependency and multi-hop connection dependency; an association topology graph of the network node is generated according to the dependency relationship; and the topology structure model is constructed by a preset multi-level modeling method based on the association topology graph.

[0010] Optionally, the calculating an association weight of the network node based on the topology structure model and the behavior characteristic, and the constructing a behavior association network of the network node based on the association weight specifically includes:

[0011] An association feature of the network node is extracted from the topology structure model; a behavior mode of the network node is obtained by a preset analysis model based on the association feature, the behavior mode including at least normal communication behavior, abnormal communication behavior and dependency relationship behavior; the association weight is calculated according to the association feature and the behavior mode, the association weight including direct association weight, indirect association weight and dynamic adjustment weight; and a behavior association network is constructed based on the association weight, in which a node represents the network node, an edge represents the connection relationship, and a weight of the edge represents an association strength of the connection relationship.

[0012] Optionally, the calculating the association weight according to the association feature and the behavior mode specifically includes:

[0013] The association weight is calculated by a first calculation formula; the first formula is:

[0014]

[0015] wherein, W final(i,j,t) is the association weight of network node i and network node j at time t, W d (i,j) is the direct association weight of network node i and network node j, is the indirect association weight of network node i and network node j, P(i,j) is a set representing intermediate network nodes in all possible paths between network node i and network node j, W d (i,k) and W d (k,j) is the direct association weight of each intermediate node k, L(i,j) is the path length between network node i and network node j, ΔB k (k) is the observed behavior characteristic value of intermediate network node k, ΔB(i,j,t) is the dynamic behavior deviation of network node i and network node j at time t, (1+δ·ΔB(i,j,t) is a dynamic behavior adjustment factor, λ1 is a fusion coefficient of direct association weight, λ2 is a fusion coefficient of indirect association weight, and δ is a dynamic adjustment factor.

[0016] Optionally, based on the association weight, an attack path is deduced reversely from the target node to determine the attack source, specifically comprising:

[0017] In the behavior association network, a first network node directly associated with the target node and a second network node indirectly associated with the target node are determined according to the association weight; time sequence characteristics of the target node, the first network node and the second network node are obtained; in the behavior association network, an upstream propagation relationship of the first network node and the second network node is identified based on the time sequence characteristics, and an association propagation network of the target node is constructed; in the association propagation network, a priority score of each first network node and each second network node is calculated through a preset priority score algorithm; based on the priority score, a plurality of candidate attack paths are generated through a preset heuristic search strategy; a credibility score of all the candidate attack paths is calculated, and the candidate attack path with the highest credibility score is determined as the attack path to determine the attack source.

[0018] Optionally, in the behavior association network, the upstream propagation relationship of the first network node and the second network node is identified based on the time sequence characteristics, and the association propagation network of the target node is constructed, specifically comprising:

[0019] determine a first timing relationship between the target node and the first network node and a second timing relationship between the first network node and the second network node based on the timing characteristics; determine an upstream propagation relationship of the target node according to the first timing relationship and the second timing relationship; and construct an associated propagation network of the target node based on the upstream propagation relationship and the associated weights.

[0020] Optionally, after the attack path is determined based on the associated weights in the associated propagation network of the target node, the method further comprises:

[0021] obtaining behavior data of the attack source, extracting attack source behavior characteristics from the behavior data, matching the attack source behavior characteristics with a preset attack mode library through a behavior matching algorithm to obtain a matching value, determining that the attack source is a real attack source if the matching value is greater than or equal to a preset matching threshold, and re-determining the attack path based on the credibility score to re-determine the attack source if the matching value is less than the preset matching threshold.

[0022] In a second aspect of the present application, a network attack tracing system based on internal and external network topology node analysis is provided, comprising: an obtaining module configured to obtain connection relationships and behavior characteristics of internal network nodes and external network nodes, wherein an internal network topology graph comprises the internal network nodes and an external network topology graph comprises the external network nodes;

[0023] an associating module configured to associate the internal network topology graph and the external network topology graph according to the connection relationships and the behavior characteristics to obtain a topology structure model;

[0024] a constructing module configured to calculate associated weights of the network nodes based on the topology structure model and the behavior characteristics, and construct an associated propagation network of the network nodes based on the associated weights, wherein the associated propagation network is used to represent behavior relationships between the network nodes;

[0025] a reverse module configured to determine an attack source by reversely deducing an attack path from a target node based on the associated weights, wherein the target node is an attacked network node.

[0026] In a third aspect of the present application, an electronic device is provided, comprising a processor, a memory, a user interface and a network interface, the memory is configured to store instructions, the user interface and the network interface are both configured to communicate with other devices, and the processor is configured to execute the instructions stored in the memory to enable the electronic device to perform the method described in any one of the above aspects.

[0027] In a fourth aspect of the present application, a computer-readable storage medium is provided, which stores instructions that, when executed, perform the method of any of the above.

[0028] In summary, the one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0029] 1. By associating the topology of internal and external networks, the limitations of a single network perspective can be avoided, and the internal and external network nodes in the attack propagation path and the behavior characteristics of the internal and external network nodes are integrated into a unified model. Based on the calculation of the association weight, the behavior association strength between nodes can be quantified, and the importance of different nodes in attack propagation can be distinguished, so that possible attack paths can be effectively screened out. And by reverse deduction of the attack path in the behavior association network, the association weight and behavior characteristics in the multi-hop propagation path are integrated to identify the path that best fits the attack mode and locate the real attack source. This scheme not only can comprehensively integrate the connection relationship of internal and external networks and reveal the hidden propagation path in a complex network environment, but also can trace the network attack through quantitative analysis and reverse deduction of the association weight, thereby improving the accuracy of network attack tracing.

[0030] 2. By analyzing the dependency relationship of internal and external network nodes based on the time sequence dependency matrix, the problem of inaccurate association modeling caused by the complexity of multi-hop connection between nodes and dynamic time sequence characteristics in traditional network topology analysis is solved. By distinguishing direct connection dependency and multi-hop connection dependency, a more comprehensive network node association topology graph is generated, and a topology structure model is constructed using a preset multi-level modeling method, thereby realizing accurate association of internal and external network topology in a complex network environment. The accuracy of network node dependency relationship analysis and the expression ability of topology structure model are improved, which provides a high-quality data basis for subsequent association weight calculation and attack path identification in attack tracing, thereby enhancing the comprehensiveness and reliability of network security threat analysis.

[0031] 3. By extracting the correlation characteristics of network nodes from the topology model, and combining the preset analysis model to determine the behavior mode of the network nodes (including normal communication behavior, abnormal communication behavior and dependency relationship behavior), the problem of inaccurate weight calculation caused by the diversity of node behavior and the dynamic change of correlation in complex networks is solved. By designing a correlation weight calculation formula combining direct correlation weight, indirect correlation weight and dynamic adjustment weight, the direct connection between network nodes, the influence of intermediate nodes in the path and the dynamic behavior deviation are comprehensively considered, and the multi-dimensional quantification of the correlation strength between nodes is realized. The further constructed behavior correlation network represents the behavior relationship strength and dynamic change between network nodes with nodes, edges and edge weights, which improves the accurate modeling ability and dynamic correlation analysis ability of complex network behavior. This method provides accurate correlation weight basis for attack path identification and attack source positioning, and enhances the comprehensiveness and real-time of network attack tracing. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is a flowchart of a network attack tracing method based on internal and external network topology node analysis in the embodiments of the present application;

[0033] Figure 2 is a structural schematic diagram of a network attack tracing system based on internal and external network topology node analysis in the embodiments of the present application;

[0034] Figure 3 is a structural schematic diagram of an electronic device in the embodiments of the present application.

[0035] BRIEF DESCRIPTION OF DRAWINGS: 201, acquisition module; 202, correlation module; 203, construction module; 204, inversion module; 205, verification module; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0036] In order for those skilled in the art to better understand the technical solutions in the specification, the technical solutions in the embodiments of the specification will be described clearly and completely in conjunction with the drawings in the embodiments of the specification. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments.

[0037] In the description of the embodiments of the present application, the words such as "for example" or "for instance" are used to represent examples, illustrations or descriptions. Any embodiment or design scheme described as "for example" or "for instance" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. On the contrary, the use of words such as "for example" or "for instance" is intended to present the relevant concept in a specific way.

[0038] In the description of the embodiments of the present application, the term "a plurality of" means two or more. For example, a plurality of systems means two or more systems, and a plurality of screen terminals means two or more screen terminals. In addition, the terms "first", "second", etc. are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. The terms "include", "contain", "have" and their variants mean "include but are not limited to", unless otherwise specifically emphasized.

[0039] Figure 1 is a flowchart of a network attack tracing method based on internal and external network topology node analysis in the embodiments of the present application.

[0040] Please refer to Figure 1 The network attack tracing method based on internal and external network topology node analysis in the embodiments of the present application is applied to a server, and the method comprises:

[0041] S101, obtaining the connection relationship and behavior characteristics of internal network nodes and external network nodes, the internal network topology graph comprising the internal network nodes, and the external network topology graph comprising the external network nodes;

[0042] The internal network topology graph describes the physical or logical connection relationship of the internal network nodes, which is an abstraction of the device distribution and communication path in the internal network. For example, a certain internal network topology graph shows that node 192.168.1.10 is a core switch connected with multiple terminal devices, and server node 192.168.1.100 communicates with other nodes through the switch. The external network topology graph reflects the interaction structure between the internal network nodes and the external network nodes, and the possible association relationship between the external nodes. For example, the external network topology graph shows that external nodes 8.8.8.8 and 203.0.113.5 both establish communication with internal network node 192.168.1.50, and 203.0.113.5 also has association with other external nodes.

[0043] The connection relationship between the internal network node and the external network node is the interactive information of the actual communication between the internal network node and the external network node, including the direction, frequency, protocol type, port number, and traffic characteristics of the communication. These information describes which internal network nodes and which external nodes establish a connection between them, and the communication characteristics between them. The system can capture the communication data packets between the internal and external networks through network monitoring tools (such as Wireshark, Tcpdump) or traffic analysis devices (such as firewalls, intrusion detection systems IDS), and extract the IP addresses, port numbers, protocol types (such as TCP, UDP, HTTP, HTTPS), and timestamps of the communication parties. For example, through packet capture analysis, it is found that the internal network node 192.168.1.10 and the external network node 8.8.8.8 frequently establish HTTPS sessions within a certain time period.

[0044] The behavior characteristics of the internal network node and the external network node are the behavior patterns of the internal network node and the external network node in the communication process, including the communication frequency of the nodes, the data flow direction, the protocol usage, the access target, and the traffic characteristics. These behavior characteristics are important basis for analyzing the association between nodes, identifying abnormal behavior, and tracing attack paths. For the internal network node, its behavior characteristics can be obtained by analyzing the communication mode in the network traffic, such as the interaction frequency between nodes, the number of sent and received data packets, the used communication protocols (such as TCP, UDP, HTTP, HTTPS, etc.), and the accessed specific target address or port number. At the same time, the node behavior can also be extracted through the log records of network devices (such as firewalls, switches, routers), such as login events, file access records, or abnormal operation behaviors. For the external network node, its behavior characteristics are mainly identified through internal and external traffic interaction data analysis, including the access frequency of the external node, the data packet characteristics (such as packet size, time interval), the distribution of target ports, and whether there are data anomalies or attack behaviors (such as frequent scanning or probing operations).

[0045] After obtaining the connection relationship and behavior characteristics of the internal network node and the external network node, these data need to be integrated and stored. The integration process includes mapping the connection relationship of the internal and external network nodes, associating the internal network topology graph with the external network topology graph, and combining the behavior characteristics of each node to form a complete network data set; data storage requires selecting appropriate storage methods, such as using a relational database to store structured connection data, or using a graph database (such as Neo4j) to store network topology graphs and node characteristics.

[0046] S102, according to the connection relationship and the behavior characteristics, associating the internal network topology graph with the external network topology graph to obtain a topology structure model;

[0047] Specifically, a time-series-based dependency matrix is constructed based on the connection relationship and behavior characteristics to analyze the dependency relationship between the internal network nodes and the external network nodes, and the dependency relationship includes direct connection dependency and multi-hop connection dependency; an associated topology graph of the network nodes is generated according to the dependency relationship; and a topology structure model is constructed based on the associated topology graph through a preset multi-level modeling method.

[0048] In the formula, the time-series-based dependency matrix is constructed to quantify the dependency relationship between the internal network nodes and the external network nodes and dynamically analyze these relationships. Specifically, the dependency matrix takes nodes as row and column indexes, and the element value of the matrix represents the dependency strength of one node to another node. The dependency relationship is divided into two categories: direct connection dependency and multi-hop connection dependency. The direct connection dependency represents that there is direct communication between nodes (for example, there is a direct TCP / UDP session between the internal network node A and the external network node B); and the multi-hop connection dependency refers to that there is no direct connection between nodes but indirect communication through other nodes (for example, node A is indirectly connected to node B through node C). The time-series-based dependency matrix also needs to combine time series information, for example, according to the time stamp of communication, the dependency strength change in a period of time is counted. For example, if the external network node X frequently and high-frequency accesses a specific port of the internal network node Y, and the node Y forwards data to the internal network node Z, then the multi-hop dependency of node X to node Z and the direct dependency of node X to node Y can be recorded in the dependency matrix.

[0049] Through the constructed dependency matrix, the dependency relationship between the internal network nodes and the external network nodes can be further analyzed, and the interaction degree and communication mode between them are quantified. Such analysis helps to identify key nodes and potential attack paths. For the direct connection dependency, for example, if there is direct high-frequency communication between the external node M and the internal node N, it can be inferred that node M has a strong dependency relationship with node N, which may be normal access behavior (such as service request) or potential attack behavior (such as DDoS attack). For the multi-hop connection dependency, through the analysis of the multi-hop path in the dependency matrix, indirect dependency relationship can be identified. For example, the external node A has no direct connection with the internal node B, but communicates through the internal node C, which indicates that node A may use node C as a stepping stone to interact with node B, and this mode may be a sign of internal horizontal movement attack. Through the analysis of the dependency relationship, key relay nodes, abnormal dependency relationships, and even potential paths of attack chains in the network can be identified.

[0050] After the dependency analysis is completed, it can be mapped into the associated topology graph of the network nodes to intuitively represent the dependency relationship and communication path between the nodes. The associated topology graph is an enhanced version of the network topology graph, which not only shows the connection structure of the internal and external network nodes, but also annotates the weight between the nodes according to the strength of the dependency relationship (for example, communication frequency, traffic size, etc.). Specifically: the nodes in the topology graph include internal network nodes and external network nodes, and the attributes of the nodes can reflect their behavior characteristics (such as high-traffic nodes, abnormal nodes). The edges between the nodes represent the dependency relationship, and the weight of the edge reflects the strength of the dependency, such as the frequency of direct connection, the transmission strength of multi-hop path, etc. For example, in the associated topology graph, assuming that external node A realizes the dependency on internal node D through internal nodes B and C, the edges A→B, B→C, and C→D can be annotated with weights, respectively, indicating the degree of indirect dependency of A on D. If the communication behavior of A is abnormal (such as high-frequency access), the associated topology graph can help identify its possible attack path.

[0051] After generating the associated topology graph, it is necessary to construct a topology structure model through a preset multi-level modeling method, so as to analyze the relationship between network nodes from different levels and granularities. The multi-level modeling method usually includes a node behavior layer, a node association layer, and a global topology layer. The node behavior layer analyzes the behavior characteristics of a single node (such as communication frequency, traffic size, protocol type, etc.); the node association layer analyzes the direct or indirect dependency relationship between nodes, and adjusts the weight of the edge in the topology structure based on the dependency strength; the global topology layer analyzes the overall structure of the internal and external networks from a global perspective, and identifies key nodes (such as communication hubs, bottleneck nodes) and key paths (such as possible attack paths).

[0052] S103, extracting the associated features of the network nodes from the topology structure model;

[0053] The associated features refer to the direct or indirect association attributes between the network nodes in the topology structure model, which usually include communication frequency, data traffic, protocol type, path dependency, and multi-hop association, etc. Specifically, the process of extracting the associated features needs to combine the information of nodes and edges in the topology structure model to analyze the interaction strength, communication mode, and dependency relationship between nodes. For example, in the topology model, if there is high-frequency direct communication between node A and node B (such as 1000 connections per day), the direct association features of node A and node B can be extracted, including communication frequency and traffic size; at the same time, if node A communicates with node D indirectly through node C, the multi-hop dependency relationship features of node A and node D can be extracted.

[0054] S104, obtaining the behavior mode of the network nodes through a preset analysis model based on the associated features, the behavior mode at least including normal communication behavior, abnormal communication behavior, and dependency relationship behavior;

[0055] In step S104, based on the extracted network node association features, the communication behavior of the node is classified and identified through a preset behavior analysis model, thereby obtaining the behavior pattern of the network node. The construction of the preset analysis model is the basis for identifying the behavior pattern of the network node, which can combine rule matching, statistical analysis and machine learning algorithms to accurately classify node behavior. Through the rule matching model, it can quickly detect whether the node behavior conforms to the normal mode according to the predefined communication rules (such as access frequency threshold or port whitelist); with the aid of the statistical analysis model, it can identify abnormal behavior deviating from the normal range by calculating the mean and deviation value of communication frequency, traffic and other features; at the same time, the use of machine learning models (such as classification models or clustering models) can more efficiently classify complex node behavior patterns, such as distinguishing between normal access and potential malicious behavior.

[0056] In the analysis process, normal communication behavior refers to the network node behavior that conforms to the expected and follows the conventional communication rules, which is usually manifested as stable communication mode and reasonable traffic characteristics. For example, internal network nodes regularly access external servers to synchronize data, or work terminals access external resources through HTTP, HTTPS and other common protocols, which all belong to normal communication behavior. By classifying normal communication behavior through the analysis model, not only can the false positive rate be reduced, but also a baseline can be established for the detection of abnormal behavior. For example, node A accesses external servers 50 times a day through the HTTPS protocol and the traffic is evenly distributed, which is a behavior feature conforming to the normal mode, and therefore can be classified as normal communication behavior.

[0057] Abnormal communication behavior refers to behavior deviating from the normal communication mode, which is usually manifested as high-frequency communication, abnormal port access, data traffic surge or communication in non-normal time period. The preset analysis model can quickly locate these abnormal behaviors by comparing with the normal behavior characteristics, combining rule thresholds and statistical deviations. For example, a node initiates connection attempts to a large number of external IP addresses on port 22 (SSH) in a short period of time, which may indicate a brute force attack; or the communication frequency of a node suddenly increases from 50 times a day to 1000 times, and occurs in the midnight period, which may indicate that the node has been controlled and participates in malicious activities.

[0058] In addition to normal and abnormal communication behaviors, dependency behaviors between nodes also need to be identified through the analysis model. Dependency behaviors describe direct or indirect communication dependencies between nodes, such as multi-hop communication paths established through intermediate nodes, or the dependency of some nodes on key service nodes. By analyzing the paths and interactions between nodes in the topology model, these dependency characteristics can be extracted. For example, node A communicates with external node D through intermediate node B, forming a multi-hop dependency relationship A→B→D; or node B is a communication hub in the network, connecting multiple internal and external nodes, indicating that node B has high importance in the network.

[0059] S105, according to the association characteristics and behavior patterns, calculating the association weight, the association weight includes direct association weight, indirect association weight and dynamic adjustment weight;

[0060] Specifically, the association weight is calculated by the first calculation formula; the first formula is:

[0061]

[0062] Wherein, W final (i,j,t) is the association weight of network node i and network node j at time t, W d (i,j) is the direct association weight of network node i and network node j, is the indirect association weight of network node i and network node j, P(i,j) is a set of intermediate network nodes between network node i and network node j, W d (i,k) and W d (k,j) are the direct association weights of each intermediate node k, L(i,j) is the path length between network node i and network node j, ΔB k (k) is the observed behavior feature value of intermediate network node k, ΔB(i,j,t) is the dynamic behavior deviation of network node i and network node j at time t, (1+δ·ΔB(i,j,t) is the dynamic behavior adjustment factor, λ1 is the fusion coefficient of direct association weight, λ2 is the fusion coefficient of indirect association weight, and δ is the dynamic adjustment factor.

[0063] Wherein, W d (i,j) represents the direct association weight of network node i and network node j, which is calculated based on the communication characteristics and behavior characteristics of the two network nodes, and the formula is W d (i,j) = α·C f (i,j) + β·T f (i,j) + γ·R f (i,j) + θ·S(B(i),B(j)), wherein C f(i,j) is the communication frequency between network node i and network node j, T f (i,j) is the data flow between network node i and network node j, R f (i,j) is the response time delay between network node i and network node j, represents the behavior feature similarity between network node i and network node j, α, β, γ, θ are weight coefficients, and satisfy α+β+γ+θ=1.

[0064] For direct association weight, the direct association between network nodes refers to the strength of the connection between two network nodes, such as the communication frequency, interaction times or weight between them. This part of the weight directly reflects the connection tightness between two network nodes, and is the basis part of the final result. In order to control the importance of direct association in the overall calculation, the influence can be adjusted by a regulating parameter. In this way, the priority of direct association can be determined according to the application scenario, for example, increasing its weight in a network with direct interaction.

[0065] For indirect association weight, in real networks, there may be no direct connection between two network nodes, but there may be indirect association through other nodes. For example, network node A and network node B may have no direct connection, but have established an indirect relationship through network node C. This part of the calculation needs to consider path weight, path length and node stability.

[0066] The relationship between network nodes is not fixed, but will be dynamically adjusted with the passage of time and changes in behavior. For example, the interaction frequency between two network nodes may increase or decrease over time, and the behavior characteristics of network nodes may fluctuate abnormally. These changes will affect the association strength between network nodes. By analyzing the behavior changes of two network nodes at a certain time, the association weight between network nodes can be dynamically adjusted, so that the calculation result is more in line with the actual situation.

[0067] S106, constructing a behavior association network based on the association weight, in the behavior association network, the node represents the network node, the edge represents the connection relationship, and the weight of the edge represents the association strength of the connection relationship;

[0068] In the behavior correlation network, nodes represent specific entities in the network, such as servers, terminal devices, external hosts, or intermediate routers in the internal network, and edges represent the communication or interaction relationship between these entities. Each edge not only represents a simple connection relationship, but also quantifies the strength of the relationship through a weight value, making the behavior correlation network more intuitive to reflect the interaction characteristics between nodes. For example, the edge between internal node A (192.168.1.10) and external node B (8.8.8.8) represents a communication relationship between the two, and the weight of the edge is determined according to factors such as communication frequency, traffic, and protocol, reflecting the closeness of the relationship.

[0069] The edge weight in the behavior correlation network is derived from the extraction of correlation characteristics and the identification of behavior patterns, including direct correlation weight, indirect correlation weight, and dynamic adjustment weight. The direct correlation weight is calculated based on the frequency, traffic size, and protocol type of direct communication between nodes, reflecting the strength of direct interaction between two nodes; the indirect correlation weight is calculated by analyzing the dependency on multi-hop paths, used to quantify the indirect interaction relationship between nodes; and the dynamic adjustment weight captures dynamic behavior characteristics by analyzing the changes in the correlation relationship between nodes over time. By integrating these weights, the actual strength of node connection relationships can be more comprehensively reflected. For example, the direct correlation weight between node A and node B is 0.8, and the multi-hop dependency weight is 0.6. If the communication frequency increases significantly in a certain time period, the dynamic adjustment weight may further increase the total weight of the two nodes.

[0070] In the behavior correlation network, the weight of the edge directly affects the results of network analysis, where high-weight edges represent frequent communication and strong dependency between nodes, and are usually the key paths or core interaction links of business operation; while low-weight edges represent weak or occasional interaction between nodes, and may have less impact on the overall network. By analyzing the edge weight, key interaction relationships in the network and paths that need to be protected can be identified. For example, the edge weight between node A and node B is 0.9, indicating that the communication between the two is frequent and is a core business path; while the edge weight between node C and node D is only 0.2, indicating that the interaction between them is occasional and has less impact on the overall network.

[0071] The introduction of the dynamically adjusted weight enables the behavior correlation network to timely reflect the change of the correlation between the nodes in the network, and especially greatly enhances the ability to capture abnormal behaviors and emergencies. When the communication frequency between certain nodes suddenly rises, the traffic surges, or the access port is abnormal, the dynamically adjusted weight will increase the weight of the edge to highlight these abnormal behaviors. For example, the communication frequency between node A and node B is 50 times per day, but suddenly rises to 1000 times on a certain day, and occurs in a non-working time period. At this time, the dynamically adjusted weight will increase the weight of the edge from 0.8 to 1.0, thereby prompting the network manager to pay attention to the abnormal behavior.

[0072] The behavior correlation network provides structured support for network security analysis and optimization through the comprehensive display of nodes, edges and weights, and its application mainly embodies in abnormal detection, key path analysis and correlation mining. By analyzing the distribution and dynamic change of the edge weight, abnormal communication paths can be identified, for example, a sudden rise in the weight of an edge indicates the possible existence of malicious traffic. By identifying high-weight nodes and edges, key communication links or dependent nodes can be located, and the network structure can be optimized and protection strategies can be developed. Through correlation mining, multi-hop dependent paths between nodes can be revealed, and potential hidden communication links can be identified. For example, the behavior correlation network analysis finds that node A is a dependent hub of multiple terminals, and the edge weight of A is generally high, indicating that A is a key node that needs to be protected. For example, in a behavior correlation network, the edge weight between node A and node B is 0.9, indicating that the communication between A and B is very frequent and dependent; while the edge weight between node C and node D is 0.2, indicating that the interaction between them is weak or the occurrence is high. If the edge weight between node A and node B suddenly rises to 1.0 on a certain day, further analysis may be needed to determine whether there is abnormal behavior.

[0073] S107, based on the correlation weight, a reverse deduction is performed from the target node to obtain an attack path, so as to determine an attack source, the target node being a network node attacked;

[0074] Specifically, in the behavior correlation network, a first network node directly correlated with the target node and a second network node indirectly correlated with the target node are determined according to the correlation weight; time sequence features of the target node, the first network node and the second network node are obtained; in the behavior correlation network, an upstream propagation relationship between the first network node and the second network node is identified based on the time sequence features, and a correlation propagation network of the target node is constructed; in the correlation propagation network, a priority score of each first network node and each second network node is calculated through a preset priority score algorithm; based on the priority score, a plurality of candidate attack paths are generated through a preset heuristic search strategy; a credibility score of all candidate attack paths is calculated, and a candidate attack path with the highest credibility score is determined as the attack path, so as to determine the attack source.

[0075] In the behavior correlation network, according to the correlation weight, first, the first network node directly correlated with the target node and the second network node indirectly correlated with the target node through a multi-hop path are determined. The first network node directly correlated with the target node refers to the node having direct communication or interaction with the target node, usually connected through a high weight edge; the second network node indirectly correlated with the target node refers to the node having multi-hop dependence relationship with the target node through an intermediate node, and the size of the correlation weight reflects the strength of the indirect influence. For example, if the target node is server A (192.168.1.10), the first network node directly correlated with the target node can be client B (192.168.1.20), and the edge weight is 0.9; and the second network node indirectly correlated with the target node through intermediate node C (192.168.1.30) can be external host D (203.0.113.5), and the indirect correlation weight is 0.7.

[0076] After determining the directly correlated nodes and indirectly correlated nodes of the target node, the time sequence features of these nodes are further extracted for analyzing the propagation relationship therebetween. The time sequence feature refers to the time sequence of the communication behavior between the nodes, the change mode of the communication frequency with time, etc., which can reflect the propagation path of the attack behavior. For example, the attack behavior usually has a time sequence, which propagates from the attack source to the target node step by step. Assuming that the target node A starts to receive a large amount of malicious traffic at 10:00:00, the time sequence analysis shows that node B starts to communicate with A at 09:59:30, and node D first communicates with node B at 09:58:00, which indicates that the attack can be propagated from D to B, and then to A.

[0077] In the behavior correlation network, based on the time sequence features of the target node, the first network node and the second network node, the communication and propagation sequence between the nodes are analyzed, so as to identify the upstream propagation relationship of each node and construct the correlation propagation network of the target node.

[0078] Specifically, based on the time sequence features, the first time sequence relationship between the target node and the first network node and the second time sequence relationship between the first network node and the second network node are determined; the upstream propagation relationship of the target node is determined according to the first time sequence relationship and the second time sequence relationship; and the correlation propagation network of the target node is constructed based on the upstream propagation relationship and the correlation weight.

[0079] The first timing relationship between the target node and the first network node is extracted based on the time sequence of the communication behavior. The first timing relationship reflects whether the first network node has communicated with the target node before the target node receives data or traffic, as well as the time sequence and intensity of the communication. In a network attack scenario, the first network node is usually a node that directly interacts with the target node, and attack traffic may directly reach the target node through these nodes. By analyzing the communication time between the two nodes, it can be determined whether the first network node is a direct source of attack propagation. Assuming that the target node A is a server (192.168.1.10) and the first network node B is a client (192.168.1.20), the timing feature shows that node B establishes a connection with node A at 10:00:00 and sends a large amount of data to A subsequently, while node A starts abnormal behavior at 10:00:01. According to this timing analysis, it can be determined that node B has a first timing relationship with node A.

[0080] The second timing relationship between the first network node and the second network node is determined by analyzing whether the second network node initiates communication earlier in time than the first network node. The second timing relationship reflects whether the attack may propagate to the first network node through the second network node and then to the target node. By analyzing the time sequence of communication between these nodes, the upstream propagation chain of the attack can be further inferred. If the communication time of the second network node is earlier than that of the first network node, and there is a multi-hop association, it can be determined that there is a propagation relationship between the two. In the above scenario, the first network node B (192.168.1.20) receives a communication request from the second network node D (203.0.113.5) at 09:59:30, and the characteristics of this communication request (such as traffic, port, etc.) are highly similar to the subsequent communication behavior of B to the target node A. According to the time sequence, it is determined that node D has a second timing relationship with node B, i.e., the attack may propagate from D to B.

[0081] Based on the first timing relationship and the second timing relationship, the upstream propagation relationship of the target node is determined by comprehensively analyzing the time sequence, communication characteristics, and association weights between nodes. The upstream propagation relationship is used to describe the potential propagation path from the target node to the attack source, including direct propagation and indirect propagation. When calculating the propagation relationship, it is necessary to verify whether the timing characteristics meet the time sequence logic, and at the same time, evaluate the credibility of the propagation path in combination with the association weight. For example, if the timing characteristics of a certain path meet the logic and the association weight is high, then this path is more likely to be the actual propagation path. According to the first timing relationship (B→A) and the second timing relationship (D→B), it can be inferred that the upstream propagation relationship of the target node A is D→B→A, i.e., the attack may originate from node D and eventually propagate to the target node A through node B.

[0082] After determining the upstream propagation relationship of the target node, the associated propagation network of the target node is constructed in combination with the association weight in the behavior association network. The associated propagation network is a sub-network with the target node as the core, in which the weight of each edge represents the communication strength or dependency between nodes, and each node represents an entity participating in the propagation. By comprehensively considering the time sequence characteristics of the upstream propagation relationship and the association weight, the possible attack propagation path of the target node can be accurately drawn. The associated propagation network not only shows the possible direction of attack propagation, but also provides a basis for subsequent attack path analysis. When constructing the associated propagation network of the target node A, the association weight of node D→B is 0.8, the association weight of node B→A is 0.9, and the time sequence relationship is consistent, so nodes D, B and A are connected to form a propagation path D→B→A, in which the weight of each edge is 0.8 and 0.9 respectively. In addition, if node C has a direct propagation relationship with node A, and the association weight is 0.5, it can be added as another possible path to the associated propagation network.

[0083] The time sequence characteristics include the time of communication, the change pattern of communication strength over time, the order of communication, etc., which can help to infer the propagation path of the attack. By integrating the association weight and the time sequence, it can be judged whether the communication has the possibility of attack propagation, and the related nodes are connected to form a propagation chain. The associated propagation network is a subgraph with the target node as the core, which contains all possible upstream nodes and their propagation paths. Assuming that the target node A receives a large amount of malicious traffic at 10:00:00, the time sequence analysis shows that node B initiated communication with A at 09:59:30, and node D communicated with node B at 09:58:00, through this time sequence, it can be identified that D→B→A is a possible propagation path, and the associated propagation network constructed includes nodes A, B, D and their propagation paths.

[0084] In the association propagation network, the priority score of each first network node and second network node is scored by a preset priority scoring algorithm to evaluate the possibility of being an attack source. The preset priority scoring algorithm comprehensively considers the following factors: timing characteristics, association weight, behavior pattern, node reachability and propagation path complexity. Specifically, the timing characteristics are used to determine whether the node participates in communication earlier in the attack propagation chain; the association weight reflects the communication strength or dependency relationship between nodes, and the higher the weight, the more likely the node is an important node in the propagation chain; the behavior pattern analysis (based on the results of the preceding step S104) helps to evaluate whether the communication behavior of the node is abnormal, for example, whether there is abnormal traffic or non-normal port access; the reachability of the node is determined by analyzing the position of the node in the network topology to determine the possibility of being a propagation transit or attack hub; and the propagation path complexity is used to evaluate whether the association path of the node conforms to the propagation rule of the attack, for example, the priority of the short path may be higher. The priority score is usually calculated by a weighted formula, and its expression form is: priority score = a x timing characteristic score + y x behavior pattern score + d x node reachability score + e x propagation path complexity score, wherein a, y, d and e are weight parameters, which are adjusted according to the specific network environment or attack characteristics to ensure the rationality of the scoring results.

[0085] Based on the priority score of the node, a heuristic search strategy is used to generate candidate attack paths in the association propagation network. The heuristic search strategy combines node priority score, timing characteristics and association weight to generate a propagation chain that reversely deduces from the target node to the upstream node in a step-by-step exploration manner. The core of the heuristic search is to preferentially select high-priority nodes in the search process to quickly narrow the search range, while avoiding invalid exploration of low-priority nodes and unreasonable paths. Specifically, the target node is initialized as the search endpoint, and the path is expanded to the upstream node from the direct association node of the target node; in each step of search, candidate nodes are selected based on the priority score, and nodes with higher scores and their extended paths are preferentially explored; the rationality of each extended path is evaluated in real time, including the continuity of timing characteristics, the total association weight and the overall complexity of the path; the search depth or path hop limit is set to avoid generating too long paths and ensure search efficiency. Multiple candidate paths that meet the screening conditions are output, and each candidate path represents a possible attack propagation chain.

[0086] At the same time, the system dynamically evaluates the rationality of the candidate paths to ensure that the generated candidate paths are time-continuous, have moderate path length and high enough association weight. In addition, the heuristic search preferentially selects propagation chains with lower path complexity, i.e. paths with fewer hops and concentrated node priority scores.

[0087] Optionally, in Figure 1Step S107 of the illustrated embodiment can be followed by the following steps:

[0088] The behavior data of the attack source is obtained, and attack source behavior features are extracted from the behavior data. The attack source behavior features are matched with a preset attack pattern library through a behavior matching algorithm to obtain a matching value. If the matching value is greater than or equal to a preset matching threshold, the attack source is determined to be a real attack source. If the matching value is less than the preset matching threshold, the attack path is re-determined based on the credibility score to re-determine the attack source.

[0089] After determining the attack source, the behavior data of the attack source is first obtained. The behavior data refers to the communication behavior features of the attack source node in the network, including but not limited to communication frequency, traffic size, access port, used communication protocol, data packet content features, etc. These data can be collected through network traffic monitoring tools, log analysis systems or traffic packet capture tools. The acquisition of behavior data is the basis for subsequent analysis, which can help to identify the specific behavior features of the attack source. Assuming that node D is initially identified as an attack source, its behavior data includes a large number of request data packets sent to the internal server, the target port of the data packet is 3389 (remote desktop protocol port), the communication frequency suddenly increases in a short time, and the traffic contains abnormal encryption data features.

[0090] After obtaining the behavior data of the attack source, the behavior features of the attack source are extracted from it through a feature extraction algorithm. The behavior features refer to the key attributes that can reflect the attack behavior of the node, such as abnormal communication frequency, specific port number, abnormal traffic pattern, abnormal packet header information or data packet content features, etc. These features are usually significant signs of attack behavior, which can be matched with known attack patterns. Feature extraction can use statistical analysis, machine learning or deep learning methods.

[0091] The extracted attack source behavior features are matched with a preset attack pattern library using a behavior matching algorithm, and a matching value is calculated. The attack pattern library is a pre-constructed set of known attack behavior features, such as DDoS attack, horizontal movement, data leakage, etc. The behavior matching algorithm can use various methods, including rule-based matching algorithms (such as regular expression matching), similarity algorithms (such as cosine similarity, Euclidean distance) or machine learning classification algorithms. The matching value is a quantitative score of the similarity between the attack source behavior and a certain pattern in the attack pattern library, and the higher the matching value, the closer the attack source behavior is to the attack pattern.

[0092] According to the comparison of the matching value and the preset matching threshold, the authenticity of the attack source is determined. If the matching value is greater than or equal to the preset matching threshold (such as 0.9), it is determined that the attack source is a real attack source; if the matching value is less than the preset matching threshold, it indicates that the current determined attack source may be misjudged, and a new attack source needs to be determined by reanalyzing the attack path. Through this judgment mechanism, misjudgment can be effectively reduced, and the accuracy of attack source positioning can be improved.

[0093] When the matching value is less than the preset matching threshold, it indicates that the current attack source may be misjudged, and at this time the attack path needs to be reanalyzed and the attack source needs to be re-determined based on the credibility score. The process of reanalysis includes reevaluating the node priority score, timing characteristics and association weight in the association propagation network, generating a new candidate attack path, and calculating a new credibility score to determine a new attack path and attack source. This process can dynamically adjust the attack source positioning result to ensure the accuracy of the final result. For example, if the matching value of node D is 0.7, it is found that the credibility score of another candidate attack path E→C→A is higher after re-computing the credibility score, and the priority score and behavior characteristics of node E match the attack pattern library with a value of 0.92 (greater than the matching threshold). Therefore, the attack path is re-determined as E→C→A, and node E is determined as the new attack source.

[0094] Please refer to Figure 2 The structure diagram of the network attack source tracing system based on internal and external network topology node analysis provided by the embodiments of the present application, the network attack source tracing system 200 based on internal and external network topology node analysis specifically includes:

[0095] The acquisition module 201 is configured to acquire the connection relationship and behavior characteristics of internal network nodes and external network nodes, wherein the internal network topology graph includes the internal network nodes, and the external network topology graph includes the external network nodes;

[0096] The association module 202 is configured to associate the internal network topology graph and the external network topology graph according to the connection relationship and the behavior characteristics, and obtain a topology structure model;

[0097] The construction module 203 is configured to calculate the association weight of the network nodes based on the topology structure model and the behavior characteristics, and construct a behavior association network of the network nodes based on the association weight, wherein the behavior association network is configured to represent the behavior relationship between the network nodes;

[0098] The inversion module 204 is configured to obtain an attack path by reverse deduction from a target node based on the association weight, so as to determine an attack source, wherein the target node is an attacked network node.

[0099] Optionally, the association module 202 is specifically configured to:

[0100] Based on the connection relationship and the behavior characteristics, a time-based dependency matrix is constructed to analyze the dependency relationship between the internal network nodes and the external network nodes, the dependency relationship including direct connection dependency and multi-hop connection dependency; an association topology graph of the network nodes is generated according to the dependency relationship; and the topology structure model is constructed by a preset multi-level modeling method based on the association topology graph.

[0101] Optionally, the construction module 203 is specifically configured to:

[0102] extract association characteristics of the network nodes from the topology structure model; obtain behavior patterns of the network nodes by a preset analysis model based on the association characteristics, the behavior patterns including at least normal communication behavior, abnormal communication behavior and dependency relationship behavior; calculate the association weights based on the association characteristics and the behavior patterns, the association weights including direct association weight, indirect association weight and dynamic adjustment weight; and construct a behavior association network based on the association weights, in which nodes represent the network nodes, edges represent the connection relationship, and weights of the edges represent association strength of the connection relationship.

[0103] Optionally, the construction module 203 is further specifically configured to:

[0104] calculate the association weights by a first calculation formula; and the first formula is:

[0105]

[0106] wherein, W final (i,j,t) is the association weight of the network node i and the network node j at the time t, W d (i,j) is the direct association weight of the network node i and the network node j, is the indirect association weight of the network node i and the network node j, P(i,j) is a set of intermediate network nodes between the network node i and the network node j in all possible paths, W d (i,k) and W d (k,j) are direct association weights of each intermediate node k, L(i,j) is a path length between the network node i and the network node j, ΔB k (k) is an observed behavior characteristic value of the intermediate network node k, ΔB(i,j,t) is a dynamic behavior deviation of the network node i and the network node j at the time t, (1+δ·ΔB(i,j,t) is a dynamic behavior adjustment factor, λ1 is a fusion coefficient of the direct association weight, λ2 is a fusion coefficient of the indirect association weight, and δ is the dynamic adjustment factor.

[0107] Optionally, the inversion module 204 is specifically configured to:

[0108] determining, in the behavior correlation network, a first network node directly correlated with the target node and a second network node indirectly correlated with the target node according to the correlation weight; obtaining time sequence features of the target node, the first network node and the second network node; identifying, in the behavior correlation network, an upstream propagation relationship of the first network node and the second network node based on the time sequence features, and constructing a correlation propagation network of the target node; calculating, in the correlation propagation network, a priority score of each of the first network node and each of the second network node through a preset priority score algorithm; generating a plurality of candidate attack paths through a preset heuristic search strategy based on the priority score; calculating a credibility score of all the candidate attack paths, and determining the candidate attack path with the highest credibility score as the attack path, so as to determine the attack source.

[0109] Optionally, the inversion module 204 is further specifically configured to:

[0110] determining a first time sequence relationship between the target node and the first network node and a second time sequence relationship between the first network node and the second network node based on the time sequence features; determining an upstream propagation relationship of the target node according to the first time sequence relationship and the second time sequence relationship; and constructing a correlation propagation network of the target node based on the upstream propagation relationship and the correlation weight.

[0111] Optionally, the system further comprises a verification module 205, which is specifically configured to:

[0112] obtaining behavior data of the attack source, extracting attack source behavior features from the behavior data; matching the attack source behavior features with a preset attack mode library through a behavior matching algorithm to obtain a matching value; if the matching value is greater than or equal to a preset matching threshold, determining that the attack source is a real attack source; if the matching value is less than the preset matching threshold, re-determining an attack path based on the credibility score, so as to re-determine the attack source.

[0113] It should be noted that the apparatus provided in the above embodiments is only used as an example for dividing the above functional modules in realizing its functions, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the above described functions. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0114] The embodiment further discloses an electronic device, which refers to Figure 3The electronic device can include at least one processor 301, at least one communication bus 302, a user interface 303, a network interface 304, and at least one memory 305.

[0115] The communication bus 302 is configured to realize the connection and communication between the components.

[0116] The user interface 303 can include a display, a camera, and can further include a standard wired interface and a wireless interface.

[0117] The network interface 304 can include a standard wired interface and a wireless interface (e.g., a WI-FI interface).

[0118] The processor 301 can include one or more processing cores. The processor 301 is connected to various parts of the server through various interfaces and lines, and performs various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 301 can be integrated with a combination of one or more of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU is mainly used to process an operating system, a user interface, and an application program. The GPU is used to render and draw the content to be displayed on the display. The modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 301, but can be implemented by a separate chip.

[0119] The memory 305 can include a random access memory (RAM) and can also include a read-only memory (ROM). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets, or instruction sets. The memory 305 can include a program storage area and a data storage area, where the program storage area can store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing the various method embodiments described above, etc.; the data storage area can store data involved in the various method embodiments described above, etc. The memory 305 can also be at least one storage device located away from the aforementioned processor 301. As shown in Figure 3 The memory 305, as a computer storage medium, can include an operating system, a network communication module, a user interface module, and an application program of the network attack tracing method based on internal and external network topology node analysis.

[0120] In the electronic device shown in Figure 3 In the electronic device shown in, the user interface 303 is mainly used to provide an interface for user input and obtain data input by the user; and the processor 301 can be used to call the application program of the network attack tracing method based on internal and external network topology node analysis stored in the memory 305, and when executed by one or more processors 301, the electronic device performs the method of one or more of the above embodiments.

[0121] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the action sequence described, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions and modules involved are not necessarily necessary for the present application.

[0122] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0123] In several embodiments provided in the present application, it should be understood that the disclosed apparatus can be implemented in other manners. For example, the division of the apparatus embodiments is merely illustrative, and the division of units can be changed according to actual conditions, such as a combination or integration of some units, or a deletion of some features, or an addition of some features. In addition, the coupling or direct coupling or communication connection between the shown or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one place or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0125] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0126] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium 305. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium 305 and includes a number of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium 305 includes: a U disk, a mobile hard disk, a magnetic or optical disk, and various media that can store program codes.

[0127] The above are only exemplary embodiments of the present disclosure, and cannot limit the scope of the present disclosure. That is, any equivalent changes and modifications made in accordance with the teachings of the present disclosure are still within the scope of the present disclosure. Other embodiments of the present disclosure will be readily apparent to those skilled in the art upon consideration of the disclosure. The present application is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or conventional techniques in the art not described in the present disclosure. The scope and spirit of the present disclosure are defined by the claims. The specification and embodiments are merely exemplary, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A network attack tracing method based on internal and external network topology node analysis, characterized in that, Applied to a server, the method comprises: Obtaining the connection relationship and behavior characteristics of internal network nodes and external network nodes, the internal network topology graph comprising the internal network nodes, and the external network topology graph comprising the external network nodes; Associating the internal network topology graph and the external network topology graph according to the connection relationship and the behavior characteristics to obtain a topology structure model; Based on the topology structure model and the behavior characteristics, calculating the association weight between the internal network nodes and the external network nodes, and constructing a behavior association network between the internal network nodes and the external network nodes based on the association weight, the behavior association network being used to represent the behavior relationship between the internal network nodes and the external network nodes; Based on the association weight, an attack path is deduced in reverse from a target node to determine an attack source, the target node being an attacked network node; The association of the internal network topology graph and the external network topology graph according to the connection relationship and the behavior characteristics to obtain a topology structure model specifically comprises: Based on the connection relationship and the behavior characteristics, a time sequence-based dependency matrix is constructed to analyze the dependency relationship between the internal network nodes and the external network nodes, the dependency relationship comprising direct connection dependency and multi-hop connection dependency; An association topology graph between the internal network nodes and the external network nodes is generated according to the dependency relationship; Based on the association topology graph, the topology structure model is constructed by a pre-set multi-level modeling method; The calculation of the association weight between the internal network nodes and the external network nodes based on the topology structure model and the behavior characteristics, and the construction of a behavior association network between the internal network nodes and the external network nodes based on the association weight specifically comprises: From the topology structure model, association characteristics between the internal network nodes and the external network nodes are extracted; Based on the association characteristics, a behavior mode between the internal network nodes and the external network nodes is obtained by a pre-set analysis model, the behavior mode comprising at least normal communication behavior, abnormal communication behavior and dependency relationship behavior; According to the association characteristics and the behavior mode, the association weight is calculated, the association weight comprising direct association weight, indirect association weight and dynamic adjustment weight; Based on the association weight, a behavior association network is constructed, in which nodes represent the internal network nodes and the external network nodes, edges represent the connection relationship, and the weight of the edge represents the association strength of the connection relationship; The calculation of the association weight according to the association characteristics and the behavior mode specifically comprises: The association weight is calculated by a first calculation formula; The first calculation formula is: ; wherein, is the associated weight of the inner network node i and the outer network node j at time t, is the direct associated weight of the inner network node i and the outer network node j, is the indirect associated weight of the inner network node i and the outer network node j, is a set of intermediate network nodes k representing all possible paths between the inner network node i and the outer network node j, and is the direct associated weight of the intermediate network node k with the inner network node i and the outer network node j, respectively, is the path length between the inner network node i and the outer network node j, is the observed behavior feature value of the intermediate network node k, is the dynamic behavior deviation of the inner network node i and the outer network node j at time t, is the dynamic behavior adjustment factor, is the fusion coefficient of the direct associated weight, is the fusion coefficient of the indirect associated weight, is the dynamic adjustment weight.

2. The method of claim 1, wherein, Based on the association weight, an attack path is deduced in reverse from a target node to determine an attack source, specifically comprising: In the behavior association network, a first network node having a direct association with the target node and a second network node having an indirect association with the target node are determined according to the association weight; Time sequence characteristics of the target node, the first network node and the second network node are obtained; In the behavior association network, an upstream propagation relationship of the first network node and the second network node is identified based on the time sequence feature, and an associated propagation network of the target node is constructed; In the associated propagation network, a priority score of each first network node and each second network node is calculated through a preset priority score algorithm; Based on the priority score, a plurality of candidate attack paths are generated through a preset heuristic search strategy; The confidence score of all candidate attack paths is calculated, and the candidate attack path with the highest confidence score is determined as the attack path to determine the attack source.

3. The method of claim 2, wherein, In the behavior association network, an upstream propagation relationship of the first network node and the second network node is identified based on the time sequence feature, and an associated propagation network of the target node is constructed, specifically comprising: Based on the time sequence feature, a first time sequence relationship between the target node and the first network node, and a second time sequence relationship between the first network node and the second network node are determined; The upstream propagation relationship of the target node is determined according to the first time sequence relationship and the second time sequence relationship; Based on the upstream propagation relationship and the association weight, an associated propagation network of the target node is constructed.

4. The method of claim 2, wherein, After the attack path is derived from the target node based on the association weight to determine the attack source, the method further comprises: Obtain the behavior data of the attack source, and extract the attack source behavior feature from the behavior data; The attack source behavior feature is matched with a preset attack mode library through a behavior matching algorithm to obtain a matching value; If the matching value is greater than or equal to a preset matching threshold, the attack source is determined to be a real attack source; If the matching value is less than the preset matching threshold, the attack path is determined again based on the confidence score to determine the attack source.

5. A network attack tracing system based on internal and external network topology node analysis, characterized in that, Comprise: The acquisition module is used for acquiring the connection relationship and the behavior feature of the internal network node and the external network node, the internal network topology graph comprises the internal network node, and the external network topology graph comprises the external network node; The association module is used for associating the internal network topology graph and the external network topology graph according to the connection relationship and the behavior feature to obtain a topology structure model; The construction module is used for calculating the association weight between the internal network node and the external network node based on the topology structure model and the behavior feature, and constructing a behavior association network between the internal network node and the external network node based on the association weight, wherein the behavior association network is used for representing the behavior relationship between the internal network node and the external network node; The inversion module is used for deriving an attack path from a target node based on the association weight to determine an attack source, wherein the target node is an attacked network node; The association module is specifically used for constructing a time sequence-based dependency matrix based on the connection relationship and the behavior feature to analyze the dependency relationship between the internal network node and the external network node, wherein the dependency relationship comprises direct connection dependency and multi-hop connection dependency; generating an association topology graph between the internal network node and the external network node according to the dependency relationship; constructing the topology structure model by a preset multi-level modeling method based on the association topology graph; the constructing module is specifically configured to extract association features of the internal network node and the external network node from the topology structure model; obtaining a behavior mode between the internal network node and the external network node by a preset analysis model based on the association features, the behavior mode at least including normal communication behavior, abnormal communication behavior and dependency relationship behavior; calculating the association weight according to the association features and the behavior mode, the association weight including direct association weight, indirect association weight and dynamic adjustment weight; constructing a behavior association network based on the association weight, in the behavior association network, a node represents the internal network node and the external network node, an edge represents the connection relationship, and a weight of the edge represents an association strength of the connection relationship; the constructing module is also specifically configured to calculate the association weight by a first calculation formula; The first calculation formula is: ; wherein, is the associated weight of the inner network node i and the outer network node j at time t, is the direct associated weight of the inner network node i and the outer network node j, is the indirect associated weight of the inner network node i and the outer network node j, is a set of intermediate network nodes k representing all possible paths between the inner network node i and the outer network node j, and is the direct associated weight of the intermediate network node k with the inner network node i and the outer network node j, respectively, is the path length between the inner network node i and the outer network node j, is the observed behavior feature value of the intermediate network node k, is the dynamic behavior deviation of the inner network node i and the outer network node j at time t, is the dynamic behavior adjustment factor, is the fusion coefficient of the direct associated weight, is the fusion coefficient of the indirect associated weight, is the dynamic adjustment weight.

6. A network attack tracing device based on internal and external network topology node analysis, characterized in that, comprising: one or more processors and a memory; the memory is coupled with the one or more processors, and the memory is configured to store computer program codes, the computer program codes comprising computer instructions, and the one or more processors are configured to invoke the computer instructions to enable the network attack tracing device based on internal and external network topology node analysis to perform the method in any one of claims 1-4.

7. A computer-readable storage medium comprising instructions, characterized in that, when the instructions run on the network attack tracing device based on internal and external network topology node analysis, enable the network attack tracing device based on internal and external network topology node analysis to perform the method in any one of claims 1-4.

Images