A network security situation awareness prediction method and device based on knowledge graph

Abstract

The present invention relates to the technical field of network security, and in particular to a network security situation awareness prediction method and device based on a knowledge graph, the method comprising: integrating network topology, asset importance, security flaws, and traffic pattern information to generate a network basic state graph containing initial nodes and edges. This application will construct a knowledge graph structure based on the network topology, and then incorporate multimodal information such as network asset importance, security flaws, and traffic patterns to form a network basic state graph model; then, relying on the inherent pattern of network attacks, the basic state graph model will be mapped into a network attack path graph structure, a probability model will be introduced, and the security situation of nodes in the network will be quantitatively calculated to form a network security situation static graph; finally, high-risk nodes, high-risk attack paths, and the overall network security situation will be quantitatively predicted.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security situation awareness prediction method and device based on knowledge graph. Background Art

[0002] As network structures become increasingly complex, the perception and prediction of local network security situations become increasingly important. At the same time, the accuracy of perception and prediction results is a prerequisite for intelligent defense and tracing of network attacks, and has important practical value.

[0003] To address this situation, a common approach is to use network terminal vulnerability scanning tools or security inspection tools to scan and analyze security vulnerabilities and suspected attack behaviors faced by nodes in the network; and to review suspicious traffic at local network entrances and other content through intrusion detection systems such as IPS and IDS. The ultimate goal is to integrate and display the discovered suspicious attack behaviors to assist network security managers in reviewing the network security situation, and to conduct a holistic assessment of the network security situation by mechanically stacking all scan results. The shortcomings of existing solutions include the fragmented organization and analysis of information related to the network security situation, the lack of systematic and organic integration of information, the lack of comprehensiveness and depth of network security situation awareness, the lack of highly reliable and explainable precise quantification capabilities, and the lack of fine-grained prediction capabilities of network security situations, such as high-risk attack paths.

[0004] At present, there are some network security situation awareness platforms on the Internet that can detect some attack risks faced by the network, but they are not a systematic and mechanism-based solution and face the problem of insufficient intelligence. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a network security situation awareness prediction method and device based on knowledge graph.

[0006] In a first aspect, an embodiment of the present invention provides a network security situation awareness prediction method based on a knowledge graph, the method comprising:

[0007] Integrate network topology, asset importance, security vulnerabilities, and traffic pattern information to generate a basic network state graph containing initial nodes and edges;

[0008] Based on the network basic state graph and the designated attack entry node, combined with the hop count and node security attributes, a one-way edge is constructed to represent the atomic attack path, forming an attack path graph;

[0009] Based on the attack path map, the global absolute probability of each node being attacked is calculated through the local conditional probability model and the chain rule, generating a static map of the network security situation.

[0010] Generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node;

[0011] When a node is detected to be under attack, the security probability of the relevant nodes is updated through Bayesian backward update and forward chain rule, and the high-risk nodes, paths and overall security risks are re-evaluated.

[0012] In combination with the first aspect, based on the network basic state graph and the designated attack entry node, the steps of constructing a unidirectional edge to represent the atomic attack path and forming an attack path graph include:

[0013] Specify multiple attack entry nodes from the network basic state graph to obtain a specified attack entry node set;

[0014] For each designated attack entry node, an attack subgraph with the attack entry node as the root node is constructed based on the network basic state graph;

[0015] Combine all attack subgraphs to construct an attack path graph.

[0016] In combination with the first aspect, based on the attack path map, the global absolute probability of each node being attacked is calculated using a local conditional probability model and the chain rule to generate a static map of the network security situation, including the following steps:

[0017] Traverse the attack path with the designated attack entry node as the root node, assign unidirectionality to the edges in the attack path according to the directional rule, and calculate the attack success rate;

[0018] For each node in the attack path graph, the potential security loss of the node is calculated based on the probability of successful attack and the actual value of the node.

[0019] The local conditional probability matrix of the node is calculated based on the state combination of the parent node set corresponding to the node, and the global absolute probability is recursively calculated through the chain rule.

[0020] In conjunction with the first aspect, the node includes: a plurality of designated attack entry nodes and associated nodes corresponding to the designated attack entry nodes;

[0021] The step of calculating the local conditional probability of a node according to the state combination of the parent node set corresponding to the node includes:

[0022] Get the number of successfully attacked parent nodes among multiple parent nodes associated with the specified attack entry node;

[0023] Based on the number of parent nodes and the probability of successful attack on the designated attack entry node, the local conditional probability corresponding to the designated attack entry node is calculated; at the same time, the prior probability of each associated node is used as the local conditional probability of the associated node.

[0024] In combination with the first aspect, the steps of recursively calculating the global absolute probability by the chain rule include:

[0025] For each node, the node's prior probability is used as the probability of being captured by the designated attack entry node;

[0026] By using the chain rule, the global absolute probability of multiple associated nodes associated with the target node is calculated.

[0027] In conjunction with the first aspect, based on the global absolute probability and asset value of the node, the steps of determining the highest potential risk path in the attack path and the optimal attack path for the high-risk node include:

[0028] Calculate the potential security loss of the node based on the node's global absolute probability and asset value;

[0029] Nodes with potential security losses greater than a preset threshold are identified as high-risk nodes;

[0030] For each attack path in the attack path graph, traverse the potential security loss of each node in the attack path and calculate the total path loss;

[0031] Combined with the total loss of all paths, the highest potential risk path and the optimal attack path for high-risk nodes are determined.

[0032] In combination with the first aspect, the steps to update the safety probability of relevant nodes through Bayesian backward updating and forward chain rule, and re-evaluate high-risk nodes, paths, and overall security risks include:

[0033] Get the parent node set to be updated backward and the child node set to be updated forward;

[0034] For each parent node in the parent node set, calculate the posterior probability corresponding to the parent node to update the global probability of the parent node;

[0035] For each child node in the child node set, the global probability of the child node is calculated based on the global probability of the parent node corresponding to the child node;

[0036] Based on the updated global probability of the parent node and the global probability of the child node, the high-risk node list, high-risk attack path and overall security risk are updated.

[0037] In a second aspect, an embodiment of the present invention further provides a network security situation awareness and prediction method based on a knowledge graph, the device comprising:

[0038] The first building block is used to integrate network topology, node asset importance, security vulnerabilities, and traffic pattern information to generate a basic network state graph containing initial nodes and edges;

[0039] The second construction module is used to construct a one-way edge to represent the atomic attack path based on the network basic state graph and the specified attack entry node, combined with the hop count and node security attributes, to form an attack path graph;

[0040] The third building block is used to calculate the global absolute probability of each node being attacked based on the attack path map through the local conditional probability model and the chain rule, and generate a static map of the network security situation;

[0041] The fourth building block is used to generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node;

[0042] The update building module is used to update the security probability of related nodes through Bayesian backward update and forward chain rule when a node is detected to be attacked, and re-evaluate high-risk nodes, paths and overall security risks.

[0043] In a third aspect, the present application provides an electronic device, which includes a memory and a processor. The memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the above method.

[0044] In a fourth aspect, the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the above-mentioned method is executed.

[0045] The embodiments of the present invention bring the following beneficial effects: The present application provides a network security situation awareness and prediction method and device based on a knowledge graph, the method comprising: integrating network topology, asset importance, security defects and traffic pattern information to generate a network basic state graph containing initial nodes and edges; based on the network basic state graph and designated attack entry nodes, combined with the number of hops and node security attributes, constructing a one-way edge to represent the atomic attack path to form an attack path graph; according to the attack path graph, the global absolute probability of each node being attacked is calculated through a local conditional probability model and the chain rule to generate a static network security situation graph; based on the global absolute probability and asset value of the target node, the highest potential risk path and the optimal attack path for high-risk nodes are generated; when a node is detected to be attacked, the security probability of the relevant nodes is updated through Bayesian backward update and forward chain rule, and the high-risk nodes, paths and overall security risks are re-evaluated.

[0046] This application will construct a knowledge graph structure based on the network topology structure, and then incorporate multimodal information such as the importance of network assets, security defects, traffic patterns, etc. to form a network basic state graph model; then, relying on the inherent pattern of network attacks, the basic state graph model will be mapped into a network attack path graph structure, and a probability model will be introduced to quantitatively calculate the security status of nodes in the network to form a static graph of network security status; finally, quantitative predictions will be made on high-risk nodes, high-risk attack paths, and the overall network security status in the network.

[0047] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the present invention. The purposes and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0048] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 The process intention of the knowledge graph-based network security situation awareness prediction method provided by the embodiment of the present invention;

[0051] Figure 2 A schematic diagram of a basic network status map provided by an embodiment of the present invention;

[0052] Figure 3 A schematic diagram of an attack path map provided by an embodiment of the present invention;

[0053] Figure 4 A schematic diagram of a node local conditional probability matrix provided by an embodiment of the present invention;

[0054] Figure 5 A schematic diagram of the global absolute probability of a node provided by an embodiment of the present invention;

[0055] Figure 6 A schematic diagram of a network risk situation after backward updating provided by an embodiment of the present invention;

[0056] Figure 7 A schematic diagram of a network risk situation after forward updating provided by an embodiment of the present invention;

[0057] Figure 8 A schematic diagram of the structure of a network security situation awareness and prediction device based on a knowledge graph provided by an embodiment of the present invention;

[0058] Figure 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0059] Reference numerals:

[0060] 10-first building module, 20-second building module, 30-third building module, 40-fourth building module, 50-updated building module;

[0061] 130 - processor, 131 - memory, 132 - bus, 133 - communication interface. DETAILED DESCRIPTION

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work shall fall within the scope of protection of the present invention.

[0063] To facilitate understanding of this embodiment, the following is a brief introduction to the technical terms used in this application.

[0064] Prior probability, in network security situation assessment, refers to an estimate of the likelihood of a cyberattack occurring based on prior knowledge or historical data. It does not rely on specific observational data but is derived through experience, background information, or statistical patterns. In this paper, prior probability is used to initialize the node's security status. After combining it with real-time traffic and behavioral data, it is further updated into posterior probability through a Bayesian model, achieving a more accurate quantitative assessment of security situation.

[0065] After introducing the technical terms involved in this application, the application scenarios and design concepts of the embodiments of this application are briefly introduced.

[0066] As information networks continue to penetrate our lives and production, cyberspace has become the fifth dimension of space, joining land, sea, air, and space. Perceiving and predicting network security trends is a crucial prerequisite for maintaining cyberspace security. However, using mathematical models to map physical networks into quantitative simulated network structures, dynamically assess their security trends, and ultimately predict high-risk nodes and attack paths in real time, thereby gauging the overall network security posture, presents significant technical challenges.

[0067] Based on this, an embodiment of the present application provides a network security situation awareness prediction method and device based on knowledge graph.

[0068] Example 1

[0069] This application provides a network security situation awareness prediction method based on knowledge graph, combined with Figure 1 As shown, the method includes:

[0070] S110 integrates network topology, node asset importance, security flaws, and traffic pattern information to generate a network basic state graph containing initial nodes and edges.

[0071] S120, based on the network basic state graph and the designated attack entry node, combined with the hop count and node security attributes, constructs a unidirectional edge to represent the atomic attack path, forming an attack path graph.

[0072] S130, based on the attack path map, the global absolute probability of each node being attacked is calculated through the local conditional probability model and the chain rule to generate a static map of the network security situation.

[0073] S140, based on the global absolute probability and asset value of the target node, generate the highest potential risk path and the optimal attack path for the high-risk node.

[0074] S150, when a node is detected to be attacked, the security probability of the relevant nodes is updated through Bayesian backward update and forward chain rule, and the high-risk nodes, paths and overall security risks are re-evaluated.

[0075] The approach of the present invention is to first construct a knowledge graph structure based on the network topology structure, and then incorporate multimodal information such as the importance of network assets, security defects, and traffic patterns to form a network basic state graph model; then, relying on the inherent pattern of network attacks, the basic state graph model is mapped into a network attack path graph structure, and a probability model is introduced to quantitatively calculate the security status of nodes in the network to form a static graph of network security status; finally, a quantitative prediction of high-risk nodes, high-risk attack paths, and the overall network security status is made. The technical solution of the present invention significantly improves the accuracy of network security situation assessment, dynamic response capability, and defense decision-making efficiency through multimodal data fusion and probabilistic modeling.

[0076] In combination with the first aspect, step S110 includes:

[0077] Collect the initial nodes in the network topology through SNMP, NetFlow or network scanning tools (such as Nmap), and record the set of initial nodes as ;in, is the first initial node, is the second initial node, is the Nth initial node; each initial node includes two identifiers: node name and inherent security attribute. The node name of each initial node is unique in the entire network. The inherent security attribute of the initial node ranges from [0,1]. The larger the value of the security attribute, the more security defects the node has and the more vulnerable it is to network attacks. The inherent security attribute can be used to assign an importance weight to each initial node based on business impact, data sensitivity, service level agreement (SLA), etc. The importance weight of the i-th initial node is recorded as Val( ), the weight of core assets (such as database servers) approaches 1, and the weight of edge devices approaches 0.

[0078] At the same time, the initial nodes are interconnected through the edges of the network. A pair of initial nodes connected by the network edge indicates that the nodes can communicate directly, which is a prerequisite for launching a single-step network attack from a node. In this invention, the attack behavior between two interconnected points is called an atomic attack, and the obtained edge set is recorded as ,in, is the initial node i and the The edges between the initial nodes.

[0079] Capture the protocol type, bandwidth utilization, and session frequency of the initial inter-node communication using traffic analysis tools (such as Wireshark and Zeek) to analyze the edge nodes. Additional traffic attributes (such as Indicates bandwidth usage).

[0080] Based on the network topology architecture, a basic knowledge graph framework is established, integrating multi-dimensional data such as network asset value weights, system vulnerability characteristics, and traffic behavior patterns to build a knowledge graph model that represents the basic operating status of the network. This breaks through the limitations of traditional single-dimensional evaluation, realizes the dynamic association of network elements and situation analysis from a global perspective, improves the comprehensiveness and accuracy of the evaluation results, and constructs a basic network status graph, such as Figure 2 As shown in the figure, letters A, B, C...Z are nodes, and numbers such as 0.5, 0.6, etc. are the prior probabilities corresponding to the nodes.

[0081] In combination with the first aspect, step S120 includes:

[0082] S121, specify multiple attack entry nodes from the network basic state map to obtain an attack entry node set.

[0083] When constructing an attack path map, the first step is to specify the initiation point of the network attack, i.e., the network attack entry point. It is worth noting that for the same network basic state map, specifying different attack entry points will generate different network attack path maps, and the network security situation will also face significant differences. In actual deployed networks, the attack entry point is often a network device exposed to the public network. In this case, attackers can easily launch remote attacks against it, and the attack cost is relatively low. Targeting different networks.

[0084] In step S121, based on the network basic state map generated in step S110, possible attack entrances are specified based on manual experience or automated rules (such as devices exposed to the public network and historical attack records). Assuming that the network contains m possible attack entrances, a set of m specified attack entrance nodes is obtained, namely, the specified attack entrance node set, which is denoted as ,in, is the first designated attack entry node, is the second designated attack entry node, Designate the mth attack entry node.

[0085] Considering the differences of each designated attack entry node, the attack probability it faces is different, and the probability distribution of the designated attack entry node also needs to be allocated. The attack probability faced by each designated attack entry node in (i.e., prior attack probability) is recorded as ,in, is the attack probability faced by the first designated attack entry node, is the attack probability faced by the second designated attack entry node, is the attack probability faced by the mth designated attack entry node.

[0086] S122: For each designated attack entry node, construct an attack subgraph with the attack entry node as the root node based on the network basic state graph.

[0087] Combine Figure 3 As shown, in step S110, if the network basic state graph has been generated and the attack entry node is designated as node A, then based on the topological relationships of the network basic state graph, its reachable adjacent nodes and connecting edges are extracted to construct an attack subgraph with the designated attack entry node as the root node. This process preserves the multimodal attributes of the nodes in the subgraph (such as vulnerability scores and asset values) and the communication relationships of the edges (such as protocol types and access rights).

[0088] The above method is consistent with the attacker's actual attack mode, that is, the attacker always starts from the attack entrance and launches a penetration attack from near to far. At the same time, for the next-hop attack node, the attacker prioritizes attacking nodes with greater security flaws.

[0089] Step S123: Combine all attack subgraphs to construct an attack path graph.

[0090] It is understandable that there are multiple designated attack entry nodes, multiple designated attack entry nodes and multiple attack sub Figure 1 There is a one-to-one correspondence, but there are some overlapping nodes between the attack subgraphs. By fusing these multiple attack subgraphs, a complete attack path graph containing multiple specified attack entry nodes can be constructed.

[0091] In combination with the first aspect, step S130 includes:

[0092] S131, traverse the attack path with the designated attack entry node as the root node, assign unidirectionality to the edges in the attack path according to the directionality rule and calculate the attack success rate.

[0093] Traverse all possible paths corresponding to each designated attack entry node as the root node; then for each path edge , calculate the probability of attack success according to the directional rule, combined with the number of hops and node security attributes , to characterize the security situation of different nodes in the network.

[0094] In the attack path graph, each edge is unidirectional. The choice of direction needs to take into account the side The corresponding initial node With the initial node The number of hops from the specified attack entry node (combined with node A in the above example), and the initial node With the initial node The inherent security properties of . Among them, the initial node It may be a designated attack entry node or a non-designated attack entry node.

[0095] Specifically, the attack path extends from the designated attack entry node to the target node in one direction, reflecting the attacker's penetration logic, and one side of the attack path Indicates that from the initial node To the initial node Perform a single-step attack. Attack success rate The number of hops and node security flaws indicate that the fewer the hops from the designated attack entry node (node ​​A in the above example), the higher the attack probability (e.g., directly connected nodes are prioritized); the larger the node security flaw value and the more vulnerabilities it has, the easier it is to attack; understandably, the success probability is also affected by the traffic pattern. A high-traffic edge may hide attack behavior (e.g., a data leakage path).

[0096] S132, for each node in the attack path graph, calculate the potential security loss of the node based on the probability of successful attack corresponding to the node and the actual value of the node.

[0097] In this application, the calculation is performed using the following formula:

[0098] ;

[0099] in, For the Potential security loss of nodes, For the The probability that a node is successfully attacked is For the The actual value of a node.

[0100] S322, calculating the local conditional probability of the target node according to the state combination of the parent node set corresponding to the node, and recursively calculating the global absolute probability through the chain rule.

[0101] For each node, in order to calculate First, we need to calculate the value of the node Local conditional probability of being successfully attacked , its physical meaning is that at a given node Assuming the parent node status, the node The probability of being successfully attacked, this indicator can reflect the different security situations of the surrounding nodes. Then, based on the local conditional probability, we can further calculate the chain rule in probability theory. The global absolute attack probability is used to characterize the absolute security situation of the node in the existing network state.

[0102] In combination with the first aspect, the node includes multiple designated attack entry nodes and associated nodes corresponding to the designated attack entry nodes.

[0103] In step S322, the local conditional probability of the node is calculated based on the state combination of the parent node set corresponding to the node, specifically including:

[0104] S3221, obtaining the number of successfully attacked parent nodes among multiple parent nodes associated with the designated attack entry node.

[0105] S3222, based on the number of parent nodes and the probability of successful attack on the designated attack entry node, calculate the local conditional probability matrix corresponding to the designated attack entry node; at the same time, use the prior probability of each associated node as the local conditional probability matrix of the associated node.

[0106] Specifically, in the invention, it is assumed that different parent nodes For the same child node The attack behaviors of the nodes are independent of each other, and the child nodes The probability of being successfully attacked is At this time, When some of the parent nodes of are successfully attacked, the node The probability of being successfully controlled by the attacker is calculated as follows:

[0107] ;

[0108] Where n is The number of attacked parent nodes in The number of nodes that have been successfully attacked among all corresponding parent nodes. The probability that the node cannot be successfully attacked, that is, the node cannot be successfully attacked through neighboring nodes. Probability of:

[0109] .

[0110] Obviously, the above two indicators are conditional probabilities, which represent the node Its own security in the case of different parent node states.

[0111] like Figure 4 As shown, except for the designated attack entry node A, any node in the attack path graph (i.e., the target node that is not the designated attack entry node) There is a local conditional probability matrix, which reflects the node The probability of being captured under different conditions, depending on the situation of the node's parent node set, the size of the conditional probability matrix is ​​also different. Figure 4 As shown in Figure 1, taking node C as an example, the parent node set Pa(C) of this node is {A, B}. Depending on whether nodes A and B are captured by the attacker, it can be divided into four cases, namely {A=Y, B=Y}, {A=Y, B=N}, {A=N, B=Y}, and {A=N, B=N}. In its conditional probability matrix, the red-marked row indicates that when parent nodes A and B are captured at the same time, the probability of node C being captured is , the probability that node C is not captured by the attacker is 1-0.91=0.09. Through the above calculation method, a conditional probability matrix can be constructed for each non-specified attack entry node (i.e., target node) in the attack path map. It is worth noting that the local security situation of a designated attack entry node (such as node A) cannot be represented by conditional probability, but needs to be represented by prior probability, and the value of the prior probability needs to be specified through manual experience. For example, in Figure 3 In , node A is the designated attack entry node, and the prior probability of the node being captured is assigned to 0.5.

[0112] Through the above steps, for each node in the network, the construction of the local conditional probability matrix can only characterize the security status of the node under local conditions, laying the foundation for the calculation of the security status of the node under global conditions.

[0113] Combined with the first aspect, the recursive calculation of the global absolute probability by the chain rule specifically includes:

[0114] S3223: For each designated attack entry node, the prior probability of the designated attack entry node is used as the probability of the designated attack entry node being captured.

[0115] S3224, calculates the global absolute probability of multiple associated nodes associated with the specified attack entry node through the chain rule.

[0116] S3225, combines the local conditional probability matrix and global absolute probability of all nodes to construct a static map of network security situation.

[0117] Based on the local conditional probability matrix of each node in the attack path map calculated in steps S3221-S3222, the global absolute probability of each node in the network being captured can be calculated. This map is called the static map of network security situation. Figure 4 Taking the attack path diagram in [1] as an example, we introduce a method for calculating the global absolute probability of each node being captured, forming a static network security situation diagram. First, the probability P(A) of a particular node A being captured can be obtained from the prior probability, that is, P(A) = 0.5. Then, using the chain rule, the probability of node B being captured can be calculated as:

[0118] P(B)=P(A)P(B|A)=0.5×0.8=0.4.

[0119] Similarly, the probability of node C being captured can be calculated as:

[0120] P(C)=P(ABC)+P(A(-B)C)

[0121] =P(A)×P(B|A)×P(C|AB)+P(A)×P((-B)|A)×P(C|A(-B))

[0122] =0.5×0.8×0.91+0.5×0.2×0.7

[0123] =0.434.

[0124] Furthermore, the probability of node D being captured can be calculated as:

[0125] P(D)=P(ABCD)+P(A(-B)CD)+P(AB(-C)D)=0.43424.

[0126] Through the above algorithm, we can finally get the probability of all nodes being captured, that is, the global probability of the node security situation. The calculation results are as follows: Figure 6 As shown, combining the local conditional probability matrix of all nodes and the global absolute probability, a static network security situation map is constructed. Observation shows that the probability of node D being captured is 43.424%. In the static network security situation map, the global absolute probability of a network node's security situation has a clear physical meaning: the probability of a successful attack on that node under the existing network conditions. A higher probability indicates a higher probability of a successful attack, reflecting the node's security attributes in the actual network.

[0127] In combination with the first aspect, step S140 includes:

[0128] S141, calculates the potential security loss of the node based on the global absolute probability and asset value of the node.

[0129] Specifically, it is calculated as follows:

[0130] ;

[0131] in, For the Potential security loss of nodes, For the The probability that a node is successfully attacked is For the The actual value of a node.

[0132] S142: Determine nodes whose potential security loss is greater than a preset threshold as high-risk nodes.

[0133] It can be understood that as the Loss() value increases, the node becomes more susceptible to attack and can produce a greater attack effect, making it a preferred target for attack.

[0134] By observing the static graph of network security situation, we can get the probability of each node in the network being captured. Further analysis reveals that, in general, the closer a network node is to the attack entry, the greater its probability of being captured, while the farther away from the attack entry, the smaller its probability of being captured. Furthermore, in the network, nodes far from the attack entry point usually have higher actual value, such as data storage nodes and identity authentication nodes. Therefore, even if a node has a low probability of being captured, if its value is extremely high, it will be judged as a high-risk node.

[0135] S143, for each attack path in the attack path graph, traverse the potential security loss of each node in the attack path and calculate the total path loss.

[0136] S144, combining all the total losses of all paths, determining the highest potential risk path and the optimal attack path for the high-risk node.

[0137] In the static map of network security situation, each node has potential security loss. At this time, the network attack path formed by different network nodes also faces security loss. The security loss of a path is the sum of the security losses of the nodes covered by the path. This application defines the path with the largest security loss as the path with the highest potential security loss. In order to accurately locate the path with the highest potential security loss, given the network attack entrance, all attack paths in the network can be traversed according to the deep search algorithm. For each attack path, , calculate the overall path loss as:

[0138] ,Then the path with the highest potential loss is used as the high-risk network attack path prediction result.

[0139] Based on the prediction of high-risk network nodes, locating high-risk network attack paths within the network is crucial for building and optimizing network defense mechanisms. By strengthening key locations along these paths, attack paths can be quickly and cost-effectively cut off, thereby protecting core network assets. This paper defines two types of high-risk network paths: the path with the highest potential loss risk and the optimal attack path for high-risk network nodes.

[0140] Subsequently, considering the diversity of network attacks, a single high-risk network path is difficult to represent the potential path risk. The present invention further designs an optimal attack path generation method for high-risk network nodes. Taking the designated attack entry node as the starting point, the shortest path tree is generated through the algorithm and used as the high-risk attack path.

[0141] To ensure that the generated path tree best matches the attacker's attack tendency, we assume that the attacker will prioritize attacking nodes that are more vulnerable to attack. Therefore, we tend to ensure that the path to a certain node a contains more high-risk nodes. At this time, all dangerous edges can be preserved. These dangerous edges can be connected to form a path tree connecting all high-risk nodes.

[0142] First, the optimal attack path is modeled. The optimal attack path is defined as the path with the most high-risk nodes when starting from the designated attack entry node to reach a certain high-risk node n. The optimal attack path of node n is the edge set of a network security static graph. ,in, is the first edge in the optimal attack path from a certain attack entry node to a certain high-risk node n, is the second edge in the optimal attack path from a certain attack entry node to a certain high-risk node n, is the kth edge in the optimal attack path from a certain attack entry node to a certain high-risk node n.

[0143] Subsequently, the present invention defines the global high-risk node optimal attack path Tree as the union of the optimal attack paths of all high-risk network nodes, and calculates the optimal attack path of node n using the following formula:

[0144] ; Where G is the total number of high-risk nodes, n is a constant less than G, is the path with the maximum number of high-risk nodes passed through when reaching a certain high-risk node n.

[0145] After step S150 of the present application, the following steps are also included:

[0146] S160, calculating the sum of potential security losses of each high-risk node in the optimal attack path of the high-risk node to obtain a previous risk assessment result.

[0147] This application calculates the risk assessment results in step S160, which can help network security administrators understand the overall security situation of the network and help formulate macro network security defense strategies. Specifically:

[0148] ;

[0149] in, The risk assessment results are: It is the optimal attack path for high-risk nodes. The larger the value, the higher the overall network security risk.

[0150] In combination with the first aspect, step S150 includes:

[0151] S151, obtaining a parent node set to be updated backward and a child node set to be updated forward.

[0152] S152 , for each parent node in the parent node set, calculating the posterior probability corresponding to the parent node to update the global probability of the parent node.

[0153] S153 : For each child node in the child node set, calculate the global probability of the child node based on the global probability of the parent node corresponding to the child node.

[0154] S154: Update the high-risk node list, high-risk attack path, and overall security risk based on the updated global probability of the parent node and the global probability of the child node.

[0155] In an actual network, when an abnormal network situation is detected and manually confirmed as a network attack incident, it is necessary to dynamically evaluate the security risks of network nodes and the overall security situation of the network.

[0156] Obviously, if an attack occurs at a node in the network, the security situation of the entire network will change, including the situation of each network node, the situation of the network attack path, and the overall security situation of the network.

[0157] Specifically, in the process of updating node security, this project mainly adopts the backward and forward update methods. Assuming that the network contains nodes, whose security situation corresponds to a set of random variables . Further assume that an attack is found in P nodes in the real network, and the set of attacked nodes is recorded as ,At this time, the attack risk faced by each node in the network needs to be updated.

[0158] according to Midpoint and The relative relationship between the nodes in the set is divided into a set of backward updated nodes and forward update node set , where the nodes in are the actual network attack behavior antecedent factors found, The nodes in the are the post-processing results of the actual network attack behaviors discovered.

[0159] Combine Figure 3 In the attack path graph in , if node C is attacked by the network, then , , ,at the same time, , considering the front-back relationship between nodes, The update process of the middle node is a dynamic update of the network security risk. The update process of the midpoint is the forward network security risk dynamic update. In the actual update process, the backward network security risk dynamic update process is the prerequisite for the forward network security risk dynamic update and needs to be processed first.

[0160] The backward network security situation dynamic update method is mainly designed based on the Bayesian probability formula. Original security posture value Updated to ,in, Obviously, The physical meaning is When a node in is attacked, the node The actual security attribute of . Specifically, it can be calculated using the following formula:

[0161] ;

[0162] in, .by Figure 5 As an example, if the network security situation graph in Figure 1 is used, and the network security manager finds that node C has been successfully attacked, the network security situation backward update process needs to calculate and .

[0163]

[0164]

[0165] At this point, the network risk situation after backward update is as follows: Figure 6 As shown, by observing Figure 6 From the backward update results of the network security situation in , we can find that compared with the original network security situation of the node, the probability of the updated node being captured has increased to a certain extent, which is consistent with the actual situation.

[0166] Subsequently, based on the backward dynamic update, the forward dynamic update method is mainly based on the chain rule. Its calculation method is similar to the global absolute probability calculation method. Figure 5 For example, the forward network security risk dynamic update process requires computing nodes The probability of being captured is calculated as:

[0167] ;

[0168] Then, forward update is performed and the network risk situation is obtained as follows: Figure 7 As shown. Figure 7Through analysis, it can be found that through the dynamic update process of the network security situation mentioned above, the probability of all nodes in the network being captured is corrected, which can reflect the impact of actual network attacks on the network security situation.

[0169] Based on the new network security situation map, this project will use the methods proposed in the previous chapter to re-evaluate high-risk network nodes, high-risk network attack paths, and the overall network security situation in the network to achieve a dynamic assessment of the network security situation.

[0170] In addition to abnormal network traffic analysis, network security administrators also monitor network node status through various methods, including intrusion detection systems, which will not be discussed here.

[0171] In the second aspect, the embodiment of the present invention also provides a network security situation awareness and prediction method based on knowledge graph, combined with Figure 8 As shown, the device includes: a first building module 10 , a second building module 20 , a third building module 30 , a fourth building module 40 , and an update building module 50 .

[0172] The first construction module 10 is used to integrate network topology, node asset importance, security flaws and traffic pattern information to generate a network basic state graph including initial nodes and edges.

[0173] The second construction module 20 is used to construct a unidirectional edge to represent the atomic attack path based on the network basic state graph and the specified attack entry node, combined with the hop count and node security attributes, to form an attack path graph.

[0174] The third building module 30 is used to calculate the global absolute probability of each node being attacked based on the attack path map through a local conditional probability model and the chain rule, and generate a static map of the network security situation.

[0175] The fourth building block 40 is used to generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node.

[0176] The update construction module 50 is used to update the security probability of related nodes through Bayesian backward update and forward chain rule when a node is detected to be attacked, and re-evaluate high-risk nodes, paths and overall security risks.

[0177] In a third aspect, the present application provides an electronic device, Figure 9 As shown, the electronic device includes a memory 131 and a processor 130. The memory 131 is used to store computer programs, and the processor 130 runs the computer programs to enable the electronic device to perform the above method.

[0178] Further, combined with Figure 9The electronic device shown further includes a bus 132 and a communication interface 133 , and the processor 130 , the communication interface 133 and the memory 131 are connected via the bus 132 .

[0179] The memory 131 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage. The communication connection between the system network element and at least one other network element is achieved through at least one communication interface 133 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used. The bus 132 may be an ISA bus, a PCI bus, or an EISA bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 9 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0180] The processor 130 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 130 or by software instructions. The processor 130 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present invention can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 131, and processor 130 reads information in memory 131 and, in conjunction with its hardware, completes the steps of the method of the aforementioned embodiment.

[0181] In a fourth aspect, an embodiment of the present application provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the above-mentioned method is executed.

[0182] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems and devices can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0183] In addition, in the description of the embodiments of the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; they may refer to mechanical connections or electrical connections; they may refer to direct connections or indirect connections through an intermediate medium; and they may refer to internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on the specific circumstances.

[0184] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0185] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0186] Finally, it should be noted that the above embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A network security situation awareness prediction method based on knowledge graph, characterized in that: The method comprises: Integrate network topology, asset importance, security vulnerabilities, and traffic pattern information to generate a basic network state graph containing initial nodes and edges; Based on the network basic state graph and the designated attack entry node, combined with the hop count and node security attributes, a one-way edge is constructed to represent the atomic attack path, forming an attack path graph; Based on the attack path map, the global absolute probability of each node being attacked is calculated through the local conditional probability model and the chain rule, generating a static map of the network security situation. Generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node; When a node is detected to be under attack, the security probability of related nodes is updated through Bayesian backward update and forward chain rule, and high-risk nodes, paths and overall security risks are re-evaluated; The step of calculating the global absolute probability of each node being attacked based on the attack path map by using a local conditional probability model and the chain rule to generate a static map of the network security situation includes: Traversing the attack path with the designated attack entry node as the root node, assigning unidirectionality to the edges in the attack path according to the directional rule and calculating the attack success rate; For each node in the attack path graph, calculate the potential security loss of the node based on the probability of successful attack corresponding to the node and the actual value of the node; Calculate the local conditional probability matrix of the node according to the state combination of the parent node set corresponding to the node, and recursively calculate the global absolute probability by the chain rule; When a node is detected to be under attack, the steps of updating the security probability of related nodes through Bayesian backward updating and forward chain rule, and re-evaluating high-risk nodes, paths, and overall security risks include: Get the parent node set to be updated backward and the child node set to be updated forward; For each parent node in the parent node set, calculating the posterior probability corresponding to the parent node to update the global probability of the parent node; For each of the child nodes in the set of child nodes, calculating the global probability of the child node based on the global probability of the parent node corresponding to the child node; According to the updated global probability of the parent node and the global probability of the child node, the high-risk node list, the high-risk attack path and the overall security risk are updated.

2. The method according to claim 1, characterized in that Based on the network basic state graph and the designated attack entry node, the steps of constructing a one-way edge to represent the atomic attack path and forming the attack path graph include: Specifying multiple attack entry nodes from the network basic state graph to obtain a specified attack entry node set; For each designated attack entry node, construct an attack subgraph with the attack entry node as a root node based on the network basic state graph; Combine all the attack subgraphs to construct an attack path graph.

3. The method according to claim 1, characterized in that The nodes include: a plurality of designated attack entry nodes and associated nodes corresponding to the designated attack entry nodes; The step of calculating the local conditional probability of the node according to the state combination of the parent node set corresponding to the node includes: Obtaining the number of successfully attacked parent nodes among multiple parent nodes associated with the designated attack entry node; Based on the number of parent nodes and the probability of successful attack of the designated attack entry node, the local conditional probability corresponding to the designated attack entry node is calculated; at the same time, the prior probability of each associated node is used as the local conditional probability of the associated node.

4. The method according to claim 3, characterized in that The steps to recursively calculate the global absolute probability using the chain rule include: For each of the nodes, using the prior probability of the node as the probability of the designated attack entry node being captured; The global absolute probabilities of the multiple associated nodes associated with the target node are calculated by the chain rule.

5. The method according to claim 1, wherein The steps of determining the highest potential risk path in the attack path and the optimal attack path for the high-risk node based on the global absolute probability and asset value of the node include: Calculate the potential security loss of the node based on the global absolute probability and asset value of the node; Determine the node whose potential security loss is greater than a preset threshold as a high-risk node; For each attack path in the attack path graph, traverse the potential security loss of each node in the attack path and calculate the total path loss; Combined with the total loss of all paths, the highest potential risk path and the optimal attack path for high-risk nodes are determined.

6. A network security situation awareness and prediction device based on knowledge graph, characterized in that: The device comprises: The first building block is used to integrate network topology, node asset importance, security vulnerabilities, and traffic pattern information to generate a basic network state graph containing initial nodes and edges; The second construction module is used to construct a one-way edge to represent the atomic attack path based on the network basic state graph and the specified attack entry node, combined with the hop count and node security attributes, to form an attack path graph; The third building block is used to calculate the global absolute probability of each node being attacked based on the attack path map through the local conditional probability model and the chain rule, and generate a static map of the network security situation; The fourth building block is used to generate the highest potential risk path and the optimal attack path for high-risk nodes based on the global absolute probability and asset value of the target node; The update building module is used to update the security probability of related nodes through Bayesian backward update and forward chain rule when a node is detected to be under attack, and re-evaluate high-risk nodes, paths and overall security risks; The third construction module includes: traversing the attack path with the designated attack entry node as the root node, assigning unidirectionality to the edges in the attack path according to the directional rule and calculating the attack success rate; for each node in the attack path graph, calculating the potential security loss of the node based on the probability of successful attack corresponding to the node and the actual value of the node; calculating the local conditional probability matrix of the node based on the state combination of the parent node set corresponding to the node, and recursively calculating the global absolute probability through the chain rule; The update construction module includes: obtaining a set of parent nodes to be updated backward and a set of child nodes to be updated forward; for each parent node in the parent node set, calculating the posterior probability corresponding to the parent node to update the global probability of the parent node; for each child node in the child node set, calculating the global probability of the child node based on the global probability of the parent node corresponding to the child node; and updating the high-risk node list, high-risk attack path and the overall security risk based on the updated global probability of the parent node and the global probability of the child node.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the method according to any one of claims 1 to 5.

8. A storage medium, characterized in that: The storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 5 is executed.

Images