Network security situation awareness prediction method and device based on knowledge graph

Abstract

The invention relates to the technical field of network security, in particular to a network security situation awareness prediction method and device based on a knowledge graph, and the method comprises the steps: integrating a network topological structure, asset importance, security defects and traffic mode information, and generating a network basic state graph containing initial nodes and edges; according to the application, a knowledge graph structure is constructed on the basis of a network topology structure, and then multi-modal information such as network asset importance, security defects and traffic modes is incorporated to form a network basic state graph model; further, the basic state map model is mapped into a network attack path map structure based on a network attack inherent mode, a probability model is introduced, the security situation of nodes in the network is quantitatively calculated, and a network security situation static map is formed; and finally, carrying out quantitative prediction on high-risk nodes, high-risk attack paths and the overall situation of network security in the network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular, to a network security situation awareness and prediction method and device based on a knowledge graph. Background Art

[0002] With the increasing complexity of network structures, the awareness and prediction of the local network security situation have become increasingly important. At the same time, the accuracy of the awareness and prediction results is a prerequisite for intelligent defense against and tracing of network attacks, and has important practical value.

[0003] In response to this situation, the common practice is to scan and analyze the security defects and suspected attack behaviors faced by nodes in the network through network terminal vulnerability scanning tools or security inspection tools; to review suspicious traffic and other content at the local network entrance through intrusion detection systems such as IPS and IDS; its ultimate goal is to integrate and display the discovered suspicious attack behaviors to assist network security managers in reviewing the network security situation, and to conduct an overall assessment of the network security situation by mechanically stacking all scan results. The disadvantages faced by existing solutions are the fragmented organization and analysis of network security situation-related information, the lack of systematic and organic integration of information, the lack of comprehensiveness and in-depthness in network security situation awareness, the lack of high-trust and interpretable precise quantification capabilities, and at the same time, the lack of fine-grained prediction capabilities for network security situations, such as high-risk attack paths.

[0004] Currently, there are also some network security situation awareness platforms on the Internet that can discover some attack risks faced by the network, but they are not a systematic and mechanistic solution and face the problem of insufficient intelligence. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a network security situation awareness and prediction method and device based on a knowledge graph.

[0006] In a first aspect, an embodiment of the present invention provides a network security situation awareness and prediction method based on a knowledge graph, the method comprising: Integrate network topology structure, asset importance, security defects, and traffic pattern information to generate a network basic state graph containing initial nodes and edges; Based on the network basic state graph and a specified attack entry node, combine the hop count and node security attributes to construct unidirectional edges to represent atomic attack paths and form an attack path graph; According to the attack path graph, calculate the global absolute probability of each node being attacked through a local conditional probability model and the chain rule, and generate a network security situation static graph; Generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node; When a node is detected to be attacked, update the security probabilities of related nodes through Bayesian backward update and forward chaining rule, and re-evaluate high-risk nodes, paths, and the overall security risk.

[0007] Combined with the first aspect, the steps of constructing an attack path graph with one-way edges representing atomic attack paths based on the network basic state graph and the specified attack entry node include: Specify multiple attack entry nodes from the network basic state graph to obtain a set of specified attack entry nodes; For each specified attack entry node, construct an attack subgraph with the attack entry node as the root node based on the network basic state graph; Combine all the attack subgraphs to construct an attack path graph.

[0008] Combined with the first aspect, the steps of calculating the global absolute probability of each node being attacked and generating a static graph of network security situation through a local conditional probability model and the chain rule based on the attack path graph include: Traverse the attack paths with the specified attack entry node as the root node, assign the one-way nature of the edges in the attack paths according to the directionality rule and calculate the attack success rate; For each node in the attack path graph, calculate the potential security loss of the node based on the probability of the node being successfully attacked and the actual value of the node; Calculate the local conditional probability matrix of the node according to the state combination of the set of the node's corresponding parent nodes, and recursively calculate the global absolute probability through the chain rule.

[0009] Combined with the first aspect, the node includes: multiple specified attack entry nodes and associated nodes corresponding to the specified attack entry nodes; The steps of calculating the local conditional probability of the node according to the state combination of the set of the node's corresponding parent nodes include: Obtain the number of successfully attacked parent nodes among the multiple parent nodes associated with the specified attack entry node; Based on the number of parent nodes and the successful attack probability of the specified attack entry node, calculate the local conditional probability corresponding to the specified attack entry node; at the same time, take the prior probability of each associated node as the local conditional probability of the associated node.

[0010] Combined with the first aspect, the steps of recursively calculating the global absolute probability through the chain rule include: For each node, take the prior probability of the node as the probability of the specified attack entry node being captured; Through the chain rule, calculate the global absolute probabilities of multiple associated nodes associated with the target node.

[0011] In combination with the first aspect, the steps of determining the highest potential risk path and the optimal attack path for high-risk nodes in the attack path based on the global absolute probability of nodes and asset values include: Calculate the potential security loss of nodes based on the global absolute probability of nodes and asset values; Determine nodes with potential security losses greater than a preset threshold as high-risk nodes; For each attack path in the attack path graph, traverse the potential security losses of each node in the attack path and calculate the total path loss; Combine all the total path losses to determine the highest potential risk path and the optimal attack path for high-risk nodes.

[0012] In combination with the first aspect, the steps of updating the security probabilities of relevant nodes through Bayesian backward update and forward chaining rule and re-evaluating high-risk nodes, paths and overall security risks include: Obtain the set of parent nodes to be updated backward and the set of child nodes to be updated forward; For each parent node in the set of parent nodes, calculate the posterior probability corresponding to the parent node to update the global probability of the parent node; For each child node in the set of child nodes, calculate the global probability of the child node based on the global probability of the corresponding parent node of the child node; Update the high-risk node list, high-risk attack paths and overall security risks according to the updated global probabilities of the parent nodes and child nodes.

[0013] In the second aspect, an embodiment of the present invention further provides a method for network security situation awareness and prediction based on a knowledge graph. The device includes: A first construction module for integrating network topology structure, node asset importance, security defects and traffic pattern information to generate a network basic state graph including initial nodes and edges; A second construction module for constructing atomic attack paths represented by one-way edges based on the network basic state graph and a specified attack entry node, and combining the hop count and node security attributes to form an attack path graph; A third construction module for calculating the global absolute probability of each node being attacked through a local conditional probability model and a chain rule according to the attack path graph, and generating a static network security situation graph; A fourth construction module for generating the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node; An update construction module for updating the security probabilities of relevant nodes through Bayesian backward update and forward chaining rule and re-evaluating high-risk nodes, paths and overall security risks when it is detected that a node is attacked.

[0014] In a third aspect, the present application provides an electronic device, which includes a memory and a processor. The memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above-mentioned method.

[0015] In a fourth aspect, the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and run by a processor, the above-mentioned method is executed.

[0016] The embodiments of the present invention bring the following beneficial effects: A network security situation awareness prediction method and device based on a knowledge graph provided by the present application, the method includes: integrating network topology structure, asset importance, security defects and traffic pattern information to generate a network basic state graph including initial nodes and edges; based on the network basic state graph and a specified attack entry node, combining the hop count and node security attributes, constructing a unidirectional edge to represent an atomic attack path to form an attack path graph; according to the attack path graph, calculating the global absolute probability of each node being attacked through a local conditional probability model and a chain rule to generate a network security situation static graph; based on the global absolute probability of the target node and the asset value, generating the highest potential risk path and the optimal attack path for high-risk nodes; when detecting that a node is attacked, updating the security probability of relevant nodes through Bayesian backward update and forward chain rule, and re-evaluating high-risk nodes, paths and overall security risks.

[0017] The present application constructs a knowledge graph structure based on the network topology structure, and then incorporates multi-modal information such as network asset importance, security defects, and traffic patterns to form a network basic state graph model; furthermore, relying on the inherent mode of network attacks, maps the basic state graph model to a network attack path graph structure, introduces a probability model, quantitatively calculates the security situation of nodes in the network, and forms a network security situation static graph; finally, quantitatively predicts high-risk nodes, high-risk attack paths, and the overall network security situation in the network.

[0018] Other features and advantages of the present invention will be described in the following specification, and, in part, will be obvious from the specification, or will be understood by implementing the present invention. The objectives and other advantages of the present invention are realized and obtained by the structures specifically pointed out in the specification, claims and drawings.

[0019] To make the above objectives, features and advantages of the present invention more obvious and understandable, the following preferred embodiments are specifically given below, and detailed descriptions are made in conjunction with the accompanying drawings as follows. Description of the Drawings

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those skilled in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0021] Figure 1 It is the flowchart intention of the network security situation awareness prediction method based on the knowledge graph provided by the embodiment of the present invention; Figure 2 It is the schematic diagram of the network basic status graph provided by the embodiment of the present invention; Figure 3 It is the schematic diagram of the attack path graph provided by the embodiment of the present invention; Figure 4 It is the schematic diagram of the node local conditional probability matrix provided by the embodiment of the present invention; Figure 5 It is the schematic diagram of the node global absolute probability provided by the embodiment of the present invention; Figure 6 It is the schematic diagram of the network risk situation after backward update provided by the embodiment of the present invention; Figure 7 It is the schematic diagram of the network risk situation after forward update provided by the embodiment of the present invention; Figure 8 It is the schematic diagram of the structure of the network security situation awareness prediction device based on the knowledge graph provided by the embodiment of the present invention; Figure 9 It is the schematic diagram of the electronic device structure provided by the embodiment of the present invention.

[0022] Reference numerals: 10 - First construction module, 20 - Second construction module, 30 - Third construction module, 40 - Fourth construction module, 50 - Update construction module; 130 - Processor, 131 - Memory, 132 - Bus, 133 - Communication interface. Specific embodiments

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions of the present invention with reference to the drawings. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the scope of protection of the present invention.

[0024] To facilitate the understanding of this embodiment, the following will first briefly introduce the technical terms designed in this application.

[0025] Prior probability. In network security situation assessment, prior probability refers to the estimation of the possibility of an event occurring before a network attack, based on existing knowledge or historical data. It does not depend on specific observed data, but is obtained through experience, background information or statistical laws. In the present invention, prior probability is used to initialize the security state of nodes. After combining real-time traffic and behavior data, it is further updated to posterior probability through a Bayesian model, so as to achieve a more accurate quantitative assessment of the security situation.

[0026] After introducing the technical terms involved in this application, next, the application scenarios and design concepts of the embodiments of this application will be briefly introduced.

[0027] As the information network continues to penetrate into our life and production fields, the cyberspace has become the fifth dimension space after land, sea, air and space. The perception and prediction of network security situation are important prerequisites for maintaining cyberspace security. However, how to map the physical network into a quantitative simulation network structure based on a mathematical model, dynamically quantitatively evaluate its security situation, and then real-time predict high-risk nodes, high-risk attack paths and obtain the overall network security situation faces huge technical challenges.

[0028] Based on this, the embodiments of this application provide a method and device for network security situation perception and prediction based on a knowledge graph.

[0029] Embodiment 1 This application provides a method for network security situation perception and prediction based on a knowledge graph, combined with Figure 1 As shown in the figure, the method includes: S110, integrating network topology structure, node asset importance, security defects and traffic pattern information to generate a network basic state graph containing initial nodes and edges.

[0030] S120, based on the network basic state graph and the specified attack entry node, combining the hop count and node security attributes, constructing one-way edges to represent atomic attack paths, and forming an attack path graph.

[0031] S130, according to the attack path graph, through a local conditional probability model and the chain rule, calculating the global absolute probability of each node being attacked, and generating a network security situation static graph.

[0032] S140, based on the global absolute probability and asset value of the target node, generating the highest potential risk path and the optimal attack path for high-risk nodes.

[0033] S150. When a node is detected to be attacked, update the security probabilities of relevant nodes through Bayesian backward update and forward chaining, and re-evaluate high-risk nodes, paths, and overall security risks.

[0034] The method of the present invention is to first construct a knowledge graph structure based on the network topology structure, and then incorporate multi-modal information such as network asset importance, security defects, and traffic patterns to form a network basic state graph model. Furthermore, relying on the inherent pattern of network attacks, map the basic state graph model to a network attack path graph structure, introduce a probability model, quantitatively calculate the security situation of nodes in the network, and form a static graph of network security situation. Finally, quantitatively predict high-risk nodes, high-risk attack paths, and overall network security situation in the network. The technical solution of the present invention significantly improves the accuracy, dynamic response ability, and defense decision-making efficiency of network security situation assessment through multi-modal data fusion and probability modeling.

[0035] In combination with the first aspect, step S110 includes: Collect each initial node in the network topology structure through SNMP, NetFlow, or a network scanning tool (such as Nmap), and denote the set of each initial node as ; where is the first initial node, is the second initial node, is the Nth initial node; each initial node includes two identifiers, namely a node name and an inherent security attribute. Among them, the node name of each initial node is unique within the entire network, and the value range of the inherent security attribute of the initial node is [0, 1]. The larger the value of the security attribute, the more security defects the node has and the more vulnerable it is to network attacks. Among them, the inherent security attribute can assign importance weights to each initial node based on business impact, data sensitivity, service level agreement (SLA), etc. The importance weight of the ith initial node is denoted as Val( ), and the weight of core assets (such as database servers) approaches 1, while the weight of edge devices approaches 0.

[0036] At the same time, the initial nodes are interconnected through the edges of the network. A pair of initial nodes connected through a network edge indicates that the nodes can communicate directly, which is a prerequisite for launching a single-step network attack from one node. In the present invention, the attack behavior between two connected points is called an atomic attack, and the obtained edge set is denoted as where is the edge between the ith initial node and the th initial node.

[0037] Capture the protocol type, bandwidth utilization, and session frequency of the initial communication between nodes through traffic analysis tools (such as Wireshark and Zeek) for the edge Attach traffic attributes (such as indicating the bandwidth ratio).

[0038] Based on the network topology architecture, establish a basic knowledge graph framework, integrate multi-dimensional data such as network asset value weights, system vulnerability characteristics, and traffic behavior patterns, construct a knowledge graph model representing the basic operating state of the network, break through the limitations of traditional single-dimensional evaluation, realize the dynamic association of network elements and the situation analysis from a global perspective, improve the comprehensiveness and accuracy of the evaluation results, and construct a network basic state graph, such as Figure 2 As shown, the letters A, B, C... Z in the figure are nodes respectively, and the numbers such as 0.5, 0.6, etc. in the figure are the prior probabilities corresponding to the nodes.

[0039] Combined with the first aspect, step S120 includes: S121, specify multiple attack entry nodes from the network basic state graph to obtain an attack entry node set.

[0040] In the process of constructing the attack path graph, it is first necessary to specify the starting point of the network attack, that is, the network attack entry. It should be noted that for the same network basic state graph, when different attack entries are specified, different network attack path graphs will be generated, and the network security situation will also be very different. In an actual deployed network, the attack entry is usually a network device exposed to the public network. At this time, the attacker can easily launch a remote attack on it, and the attack cost is relatively low. For different networks.

[0041] In step S121, from the network basic state graph generated in step S110, based on artificial experience or automation rules (such as devices exposed to the public network, historical attack records), specify possible attack entries. Assuming that the network contains m possible attack entries, a set containing m specified attack entry nodes is obtained, that is, the specified attack entry node set, which is denoted as , where is the first specified attack entry node, is the second specified attack entry node, is the mth specified attack entry node.

[0042] Considering the differences of each specified attack entry node, the attack probabilities they face are different, and the probability distribution of the specified attack entry nodes also needs to be assigned. Denote the attack probability (i.e., the prior attack probability) faced by each specified attack entry node in the specified attack entry node set as , where is the attack probability faced by the first specified attack entry node, is the attack probability faced by the second specified attack entry node, is the attack probability faced by the m-th specified attack entry node.

[0043] S122. For each specified attack entry node, construct an attack subgraph with the attack entry node as the root node based on the network basic state graph.

[0044] Combined with Figure 3 As shown, when the network basic state graph generated in step S110 and the specified attack entry node is node A, based on the topological relationship of the network basic state graph, extract its reachable adjacent nodes and connection edges to construct an attack subgraph with this specified attack entry node as the root node. In this process, the multimodal attributes of the nodes in the subgraph (such as vulnerability scores, asset values) and the communication relationships of the edges (such as protocol types, access permissions) can be retained.

[0045] The above method is consistent with the actual attack mode of the attacker, that is, the attacker always starts from the attack entry and launches a penetration attack from near to far. At the same time, for the next-hop attack node, the node with a larger security defect is preferentially selected for attack.

[0046] Step S123. Combine all the attack subgraphs to construct an attack path graph.

[0047] It can be understood that there are multiple specified attack entry nodes, and multiple specified attack entry nodes correspond one-to-one with multiple attack sub- Figure 1 graphs, but there are partially overlapping nodes between the attack subgraphs. By fusing these multiple attack subgraphs, a complete attack path graph including multiple specified attack entry nodes can be constructed.

[0048] Combined with the first aspect, step S130 includes: S131. Traverse the attack paths with the specified attack entry node as the root node, assign unidirectionality to the edges in the attack paths according to the directionality rule, and calculate the attack success rate.

[0049] Traverse all possible paths corresponding to each specified attack entry node as the root node; then for each edge of each path , calculate the probability of successful attack according to the directionality rule, combined with the hop count and the node security attribute , to characterize the security postures of different nodes in the network.

[0050] In the attack path graph, each edge has unidirectionality, and the selection of the direction of each edge needs to comprehensively consider the initial node corresponding to this edge From the initial node The number of hops from the specified attack entry node (node A in the above example), and the initial node From the initial node And its inherent security attributes. Among them, the initial node May be a specified attack entry node or a non-specified attack entry node.

[0051] Specifically, the attack path direction extends unidirectionally from the specified attack entry node to the target node, reflecting the attacker's penetration logic, and one side in the attack path Represents a single-step attack from the initial node To the initial node The success rate of this side Of the attack Is determined by the number of hops and node security defects. Among them, the fewer the number of hops from the specified attack entry node (node A in the above example), the higher the attack probability (e.g., directly connected nodes are preferred); the larger the node security defect value and the more vulnerabilities, the easier it is to be attacked; it can be understood that this success probability is also affected by the traffic pattern. Determining the traffic pattern as a high-traffic edge may hide attack behaviors (such as data leakage paths).

[0052] S132. For each node in the attack path graph, calculate the potential security loss of the node based on the probability of the node being successfully attacked and the actual value of the node.

[0053] In this application, it is calculated by the following formula: ; Wherein, Is the potential security loss of the th node, Is the probability of the th node being successfully attacked, Is the actual value of the th node.

[0054] S322. Calculate the local conditional probability of the target node according to the state combination of the set of parent nodes corresponding to the node, and recursively calculate the global absolute probability through the chain rule.

[0055] For each node, in order to calculate the Value, first, it is necessary to calculate the local conditional probability Of the node being successfully attacked, Whose physical meaning is that, on the premise that the given node Is in the state of the parent node, the probability of the node Being successfully attacked. This indicator can reflect the probability of the node Under different security situations of surrounding nodes.The relative security situation. Furthermore, based on the local conditional probabilities, the global absolute attack probability of is calculated through the chain rule in probability theory to characterize the absolute security situation of the node under the existing network state.

[0056] Combined with the first aspect, the node includes multiple specified attack entry nodes and associated nodes corresponding to the specified attack entry nodes.

[0057] In step S322, calculating the local conditional probability of the node according to the state combination of the set of parent nodes corresponding to the node specifically includes: S3221, obtaining the number of parent nodes that have been successfully attacked among the multiple parent nodes associated with the specified attack entry node.

[0058] S3222, based on the number of parent nodes and the successful attack probability of the specified attack entry node, calculating the local conditional probability matrix corresponding to the specified attack entry node; meanwhile, taking the prior probability of each associated node as the local conditional probability matrix of the associated node.

[0059] Specifically, in the invention, it is assumed that the attack behaviors of different parent nodes on the same child node are independent of each other, and the probability that the child node is successfully attacked is . At this time, when some of the parent nodes of have been successfully attacked, the probability that the node is successfully controlled by the attacker is calculated as follows: ; where n is the number of attacked parent nodes in , that is, the number of nodes that have been successfully attacked among all the parent nodes corresponding to . On the contrary, the probability that the node cannot be successfully attacked can be further calculated, that is, the probability that the neighbor nodes cannot successfully attack : .

[0060] Obviously, the above two indicators are both conditional probabilities, characterizing the security of the node under different parent node states.

[0061] As Figure 4 shown, except for the specified attack entry node A, any node in the attack path graph (i.e., the target node that is not the specified attack entry node) has a local conditional probability matrix, and this matrix reflects the node The probability of being captured under different conditions varies according to the set of the node's parent nodes, and the size of the conditional probability matrix also differs. Combining Figure 4 As shown, taking node C as an example, the set of its parent nodes Pa(C) = {A, B}. According to whether nodes A and B are captured by the attacker, it can be divided into four cases, namely {A = Y, B = Y}, {A = Y, B = N}, {A = N, B = Y}, and {A = N, B = N}. In its conditional probability matrix, the red-marked row indicates that when the parent nodes A and B are captured simultaneously, the probability of node C being captured is , and the probability of node C not being captured by the attacker is 1 - 0.91 = 0.09. Through the above calculation method, a conditional probability matrix can be constructed for each non-specified attack entry node (i.e., the target node) in the attack path graph. It should be noted that the local security situation of the specified attack entry node (such as node A) cannot be characterized by conditional probability, but needs to be characterized by prior probability, and the value of the prior probability needs to be specified through artificial experience. For example, in Figure 3 , node A is the specified attack entry node, and the prior probability of this node being captured is assigned a value of 0.5.

[0062] Through the above steps, for each node in the network, the construction of the local conditional probability matrix can only characterize the security state of the node under local conditions, laying a foundation for the calculation of the security state of the node under global conditions.

[0063] Combined with the first aspect, recursively calculating the global absolute probability through the chain rule specifically includes: S3223, for each specified attack entry node, take the prior probability of the specified attack entry node as the probability of the specified attack entry node being captured.

[0064] S3224, through the chain rule, calculate the global absolute probability of multiple associated nodes associated with the specified attack entry node.

[0065] S3225, combining the local conditional probability matrices and the global absolute probabilities of all nodes, construct a static graph of the network security situation.

[0066] Based on the local conditional probability matrices of each node in the attack path graph calculated in steps S3221 - S3222, the global absolute probability of each node in the network being captured can be calculated, and this graph is called a static graph of the network security situation. Taking the attack path graph in Figure 4 as an example, the calculation method of the global absolute probability of each node being captured is introduced to form a static graph of the network security situation. First, the probability P(A) of a certain node A being captured can be obtained from the prior probability, that is, P(A) = 0.5. Furthermore, through the chain rule, the probability of node B being captured can be calculated as: P(B) = P(A)P(B|A) = 0.5 × 0.8 = 0.4.

[0067] Similarly, the probability that node C is captured can be calculated as: P(C) = P(ABC) + P(A(-B)C) = P(A) × P(B|A) × P(C|AB) + P(A) × P((-B)|A) × P(C|A(-B)) = 0.5 × 0.8 × 0.91 + 0.5 × 0.2 × 0.7 = 0.434.

[0068] Furthermore, the probability that node D is captured can be calculated as: P(D) = P(ABCD) + P(A(-B)CD) + P(AB(-C)D) = 0.43424.

[0069] Through the above algorithm, the probabilities that all nodes are captured can finally be obtained, that is, the global probabilities of the node security postures. The calculation results are as Figure 6 shown, so as to construct a static map of the network security posture by combining the local conditional probability matrices and global absolute probabilities of all nodes. It can be seen through observation that the probability that node D is captured is 43.424%. In the static map of the network security posture, the global absolute probability of the network node security posture has a clear physical meaning, that is, under the existing entire network conditions, the probability that this node is successfully attacked by an attacker. The greater the probability, the greater the probability that this node is successfully attacked, reflecting the security attribute of this node in the actual network.

[0070] Combined with the first aspect, step S140 includes: S141, calculating the potential security loss of the node based on the global absolute probability and asset value of the node.

[0071] Specifically, it is calculated with the following formula: ; where is the potential security loss of the th node, is the probability that the th node is successfully attacked, is the actual value of the th node.

[0072] S142, determining the nodes with potential security losses greater than the preset threshold as high-risk nodes.

[0073] It is understandable that as the value of Loss() increases, the vulnerability of the node to attack increases, and a greater attack effect can be produced, making it an optimal target for attack.

[0074] By observing the static graph of the network security situation, the probability of each node in the network being captured can be obtained. , further analysis reveals that, generally, the closer a network node is to the attack entry point, the higher the probability of its being captured, while for network nodes far from the attack entry point, the probability of their being captured is lower. At the same time, in the network, nodes far from the attack entry point usually have high practical value, such as data storage nodes, identity authentication nodes, etc. Therefore, even if the probability of a node being captured is small, but when its value is extremely high, the node will be determined as a high-risk node.

[0075] S143. For each attack path in the attack path graph, traverse the potential security losses of each node in the attack path and calculate the total path loss.

[0076] S144. Combining all the total path losses, determine the highest potential risk path and the optimal attack path for high-risk nodes.

[0077] In the static graph of the network security situation, each node has potential security losses. At this time, the network attack paths formed by different network nodes also face security losses, and the security loss of a path is the sum of the security losses of the nodes covered by the path. This application defines the path with the largest security loss as the path with the highest potential security loss. In order to accurately locate the path with the highest potential security loss, given the network attack entry, all attack paths in the network can be traversed according to the depth-first search algorithm. For each attack path , calculate the overall path loss as: , and then take the path with the highest potential loss as the prediction result of the high-risk network attack path.

[0078] Based on the prediction of high-risk network nodes, locating high-risk network attack paths in the network is of great significance for constructing and optimizing the network defense mechanism. It can strengthen the key positions in the path and cut off the attack path in a short time at a low cost to achieve the purpose of protecting the core assets of the network. This invention defines the path with the highest potential risk loss and the optimal attack path for high-risk network nodes as two types of high-risk network paths.

[0079] Subsequently, considering the diversity of network attacks, a single high-risk network path is difficult to characterize the potential path risks. This invention further designs an optimal attack path generation method for high-risk network nodes, starting from the specified attack entry node, generating a shortest path tree through an algorithm, and using it as the high-risk attack path.

[0080] To ensure that the generated path tree best conforms to the attacker's attack tendency, we assume that the attacker will preferentially attack nodes that are more vulnerable to attack. Therefore, we tend to ensure that among the paths reaching a certain node a, the path with more high-risk nodes is selected. At this time, all dangerous edges can be saved, and these dangerous edges can be connected to form a path tree that connects all high-risk nodes.

[0081] First, model the optimal attack path. Define the optimal attack path as the path with the largest number of high-risk nodes passed when reaching a certain high-risk node n starting from the specified attack entry node. This path is an edge set of a static network security situation map. , where is the first edge in the optimal attack path from the specified attack entry node to a certain high-risk node n. is the second edge in the optimal attack path from the specified attack entry node to a certain high-risk node n. is the k-th edge in the optimal attack path from the specified attack entry node to a certain high-risk node n.

[0082] Subsequently, the present invention defines the global optimal attack path Tree of high-risk nodes as the union of the optimal attack paths of all high-risk network nodes, and calculates the optimal attack path of node n with the following formula: ; where G is the total number of high-risk nodes, n is a constant less than G, is the path with the largest number of high-risk nodes passed when reaching a certain high-risk node n.

[0083] After step S150 of the present application, the following is further included: S160, calculate the sum of the potential security losses of each high-risk node in the optimal attack path of high-risk nodes to obtain the previous risk assessment result.

[0084] The present application calculates the risk assessment result through step S160. This risk assessment result can help network security administrators grasp the overall network security situation and contribute to formulating macroscopic network security defense strategies. Specifically: ; where is the risk assessment result, is the optimal attack path of high-risk nodes. It can be understood that the larger the value, the higher the overall network security risk.

[0085] Combined with the first aspect, step S150 includes: S151, obtain the set of parent nodes to be updated backward and the set of child nodes to be updated forward.

[0086] S152. For each parent node in the set of parent nodes, calculate the posterior probability corresponding to the parent node to update the global probability of the parent node.

[0087] S153. For each child node in the set of child nodes, calculate the global probability of the child node based on the global probability of the parent node corresponding to the child node.

[0088] S154. According to the updated global probabilities of the parent nodes and the global probabilities of the child nodes, update the list of high-risk nodes, high-risk attack paths, and the overall security risk.

[0089] In an actual network, when an abnormal network situation is detected through received information and it is confirmed manually as a network attack event, it is necessary to dynamically evaluate the security risks of network nodes and the overall security situation of the network.

[0090] Obviously, if an attack event occurs on a certain node in the network, the security situation of the entire network will change, including the situation of each network node, the situation of network attack paths, and the overall security situation of the network, etc.

[0091] Specifically, in the process of updating the node security, this project mainly adopts backward and forward update methods. Assume that the network contains nodes, and their security situations correspond to the set of random variables . Further assume that in the real network, attack behaviors are found in P nodes, and the set of attacked nodes is denoted as . At this time, the attack risks faced by each node in the network need to be updated. According to the relative relationship between the nodes in and the nodes in and the forward update node set , where the nodes in are the preconditions of the actual network attack behaviors found, the nodes in are the post-results of the actual network attack behaviors found.

[0092] Combined with Figure 3 in the attack path graph, if node C is under a network attack, then , , , at the same time, , considering the front-back relationship between nodes, the update process for the nodes in is the dynamic update of backward network security risks, and for The update process of the middle nodes is the dynamic update of forward network security risks. In the actual update process, the dynamic update process of backward network security risks is the prerequisite for the dynamic update of forward network security risks and needs to be processed first.

[0093] The dynamic update method of backward network security situation is mainly designed based on the Bayesian probability formula, that is, the original security situation value of the node is updated to , where . Obviously, . The physical meaning of is the actual security attribute of node when the node in is attacked. Specifically, it can be calculated by the following formula: ; where . Taking the network security situation graph in Figure 5 as an example, assuming that network security administrators find that node C has been successfully network attacked, the backward update process of network security situation needs to calculate and .

[0094]

[0095]

[0096] At this time, the backward updated network risk situation is as shown in Figure 6 . By observing the backward update results of network security situation in Figure 6 , it can be found that compared with the original network security situation of the node, the captured probability of the updated node has increased to a certain extent, and this result is consistent with the actual situation.

[0097] Subsequently, on the basis of backward dynamic update, the forward dynamic update method is mainly updated based on the chain rule, and its calculation method is similar to the global absolute probability calculation method. Taking Figure 5 as an example, the forward dynamic update process of network security risks needs to calculate the probability that node is captured, and the calculation method is: ; Subsequently, forward update is performed, and the obtained network risk situation is as shown in Figure 7 . By analyzing Figure 7 , it can be found that through the above dynamic update process of network security situation, the captured probability of all nodes in the network is corrected, which can reflect the impact of actual network attacks on network security situation.

[0098] Based on the new network security situation map, this project will re-evaluate the high-risk network nodes, high-risk network attack paths, and the overall network security situation in the network through the methods proposed in the previous chapter, so as to achieve dynamic evaluation of the network security situation.

[0099] In addition to network abnormal traffic analysis, network security administrators will also monitor the status of network nodes through various methods, including intrusion detection systems, etc., which will not be elaborated here.

[0100] Secondly, the embodiment of the present invention also provides a method for network security situation awareness and prediction based on a knowledge graph, combined with Figure 8 As shown, the device includes: a first construction module 10, a second construction module 20, a third construction module 30, a fourth construction module 40, and an update construction module 50.

[0101] The first construction module 10 is used to integrate network topology structure, node asset importance, security defects, and traffic pattern information to generate a network basic status map containing initial nodes and edges.

[0102] The second construction module 20 is used to construct atomic attack paths represented by one-way edges based on the network basic status map and the specified attack entry node, combined with the hop count and node security attributes, to form an attack path map.

[0103] The third construction module 30 is used to calculate the global absolute probability of each node being attacked through a local conditional probability model and a chain rule according to the attack path map, and generate a static network security situation map.

[0104] The fourth construction module 40 is used to generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node.

[0105] The update construction module 50 is used to update the security probability of relevant nodes through Bayesian backward update and forward chain rule when a node is detected to be attacked, and re-evaluate high-risk nodes, paths, and overall security risks.

[0106] Thirdly, the embodiment of the present application provides an electronic device, combined with Figure 9 As shown, the electronic device includes a memory 131 and a processor 130. The memory 131 is used to store a computer program, and the processor 130 runs the computer program to enable the electronic device to execute the above method.

[0107] Furthermore, the electronic device combined with Figure 9 As shown also includes a bus 132 and a communication interface 133. The processor 130, the communication interface 133, and the memory 131 are connected through the bus 132.

[0108] Among them, the memory 131 may include high-speed random access memory (RAM), and may also include non-volatile memory, such as at least one disk memory. The communication connection between this system network element and at least one other network element is realized through at least one communication interface 133 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 132 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, Figure 9 only a bidirectional arrow is used in Figure 9 , but it does not mean that there is only one bus or one type of bus.

[0109] The processor 130 may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the above method can be completed by the integrated logic circuit in the hardware of the processor 130 or instructions in software form. The above-mentioned processor 130 can be a general-purpose processor, including a central processing unit (CPU for short), a network processor (NP for short), etc.; it can also be a digital signal processor (DSP for short), an application specific integrated circuit (ASIC for short), a field-programmable gate array (FPGA for short) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present invention can be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the art such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register, etc. This storage medium is located in the memory 131, and the processor 130 reads the information in the memory 131 and combines its hardware to complete the steps of the method in the foregoing embodiments.

[0110] In a fourth aspect, an embodiment of the present application provides a readable storage medium, in which computer program instructions are stored, and when the computer program instructions are read and run by a processor, the above method is executed.

[0111] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems and devices described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0112] In addition, in the description of the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "install", "connect", and "couple" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, and it can be the communication inside two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific situations.

[0113] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs that can store program codes.

[0114] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation to the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0115] Finally, it should be noted that the above embodiments are only specific implementation manners of the present invention, used to illustrate the technical solutions of the present invention, rather than limiting it. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A network security situation awareness prediction method based on knowledge graph, characterized in that: The method comprises: Integrate network topology, asset importance, security flaws, and traffic pattern information to generate a basic network state graph containing initial nodes and edges; Based on the network basic state graph and the designated attack entry node, combined with the number of hops and node security attributes, a one-way edge is constructed to represent the atomic attack path, forming an attack path graph; According to the attack path map, the global absolute probability of each node being attacked is calculated through the local conditional probability model and the chain rule to generate a static map of network security situation; Generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node; When a node is detected to be attacked, the security probability of related nodes is updated through Bayesian backward update and forward chain rule, and high-risk nodes, paths and overall security risks are re-evaluated.

2. The method according to claim 1, characterized in that: Based on the network basic state graph and the designated attack entry node, a one-way edge is constructed to represent the atomic attack path, and the steps of forming the attack path graph include: Specify multiple attack entry nodes from the network basic state graph to obtain a specified attack entry node set; For each of the designated attack entry nodes, construct an attack subgraph with the attack entry node as a root node based on the network basic state graph; Combine all of the attack subgraphs to construct an attack path graph.

3. The method according to claim 1, characterized in that According to the attack path map, the global absolute probability of each node being attacked is calculated through the local conditional probability model and the chain rule, and the steps of generating a static map of network security situation include: Traversing the attack path with the designated attack entry node as the root node, assigning unidirectionality to the edges in the attack path according to the directional rule and calculating the attack success rate; For each node in the attack path graph, based on the probability of being successfully attacked corresponding to the node and the actual value of the node, calculate the potential security loss of the node; The local conditional probability matrix of the node is calculated according to the state combination of the parent node set corresponding to the node, and the global absolute probability is recursively calculated by the chain rule.

4. The method according to claim 3, characterized in that The nodes include: a plurality of designated attack entry nodes and associated nodes corresponding to the designated attack entry nodes; The step of calculating the local conditional probability of the node according to the state combination of the parent node set corresponding to the node includes: Obtaining the number of successfully attacked parent nodes among multiple parent nodes associated with the designated attack entry node; Based on the number of parent nodes and the probability of successful attack on the designated attack entry node, the local conditional probability corresponding to the designated attack entry node is calculated; at the same time, the prior probability of each associated node is used as the local conditional probability of the associated node.

5. The method according to claim 4, characterized in that The steps to recursively calculate the global absolute probability by the chain rule include: For each of the nodes, taking the prior probability of the node as the probability of the designated attack entry node being captured; The global absolute probabilities of multiple associated nodes associated with the target node are calculated by the chain rule.

6. The method according to claim 1, characterized in that The steps of determining the highest potential risk path in the attack path and the optimal attack path of the high-risk node based on the global absolute probability and asset value of the node include: Calculate the potential security loss of the node based on the global absolute probability and asset value of the node; Determine the node whose potential security loss is greater than a preset threshold as a high-risk node; For each attack path in the attack path graph, traverse the potential security loss of each node in the attack path and calculate the total path loss; Combined with the total loss of all paths, the highest potential risk path and the optimal attack path for high-risk nodes are determined.

7. The method according to claim 1, characterized in that The steps of updating the safety probability of related nodes through Bayesian backward updating and forward chain rule, and re-evaluating high-risk nodes, paths and overall safety risks include: Get the parent node set to be updated backward and the child node set to be updated forward; For each parent node in the parent node set, calculating the posterior probability corresponding to the parent node to update the global probability of the parent node; For each of the child nodes in the child node set, calculating the global probability of the child node based on the global probability of the parent node corresponding to the child node; According to the updated global probability of the parent node and the global probability of the child node, the high-risk node list, the high-risk attack path and the overall security risk are updated.

8. A network security situation awareness and prediction device based on knowledge graph, characterized in that: The device comprises: The first building block is used to integrate network topology, node asset importance, security flaws, and traffic pattern information to generate a basic network state graph containing initial nodes and edges; The second construction module is used to construct a one-way edge to represent the atomic attack path based on the network basic state graph and the specified attack entry node, combined with the hop count and node security attributes, to form an attack path graph; The third building module is used to calculate the global absolute probability of each node being attacked based on the attack path map, through the local conditional probability model and the chain rule, and generate a static map of network security situation; The fourth building block is used to generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node; The update building module is used to update the security probability of related nodes through Bayesian backward update and forward chain rule when a node is detected to be attacked, and re-evaluate high-risk nodes, paths and overall security risks.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images