A knowledge graph-based network attack path prediction method and system

Abstract

The application discloses a network attack path prediction method and system based on a knowledge graph, relates to the technical field of knowledge graphs, and comprises multi-source heterogeneous data processing, dynamic knowledge graph construction, attack path prediction, high-confidence attack path acquisition and information feedback. The multi-source heterogeneous data is processed, the spatiotemporal datum alignment is guaranteed, the dynamic knowledge graph is constructed to update entity attributes in real time, the double storage mode is adopted, the storage efficiency is improved, the graph attention mechanism and the attack path prediction model are further constructed, the attack path is predicted, the precision of attack path detection and prediction is improved, the limitation problem existing in the current network attack path prediction process is solved, the threat level of the high-confidence attack path is analyzed and obtained, information feedback is performed, the dynamic graph is updated, and the accuracy, reliability and authenticity of the network attack path prediction result are guaranteed.

Description

Technical Field

[0001] The present application relates to the field of knowledge graph technology, and specifically to a network attack path prediction method and system based on knowledge graph. Background Art

[0002] With the development of science and technology and the popularization of the Internet, it is very important to prevent the network from being attacked in a timely manner, among which network attack path prediction is the core and focus.

[0003] Existing technologies, such as the invention application patent with announcement number CN117278302A, disclose a dynamic anomaly detection method for edge devices based on attack chain knowledge graph technology, which includes the following steps: 1) analyzing the attack path of the distribution Internet of Things and constructing an Internet of Things attack chain model; 2) based on the constructed Internet of Things attack chain model, establishing a hierarchical network security knowledge extraction model to achieve bottom-up network security knowledge extraction; 3) based on the established network security knowledge extraction model, automatically constructing a knowledge graph and instantiating the attack chain-based network security knowledge graph; 4) realizing dynamic anomaly detection of edge devices based on the constructed knowledge graph.

[0004] Regarding the above solution, the inventors of this application found that the above technology has at least the following technical problems: 1. There is currently no solution to the problem of entity relationship redundancy caused by data heterogeneity in traditional knowledge graphs in the field of network security. There is no real-time feedback of the dynamic attenuation function based on the threat level, and it is impossible to form a closed-loop control with the path entropy weight adjustment of the graph attention mechanism, resulting in a decrease in the accuracy of attack path prediction.

[0005] 2. Currently, the dual storage mode of adjacency matrix and attribute tensor is not used, which cannot reduce the storage space occupied and cannot improve the multi-hop query speed. At the same time, there is no dynamic attribute update to enable the knowledge graph to reflect the real-time changes in the network status, and adjustments cannot be updated in real time. Summary of the Invention

[0006] In response to the above-mentioned technical deficiencies, the purpose of this application is to provide a network attack path prediction method and system based on knowledge graph.

[0007] In order to solve the above technical problems, the present application adopts the following technical solutions: In the first aspect, the present application provides a network attack path prediction method based on knowledge graph, which includes the following steps: Step 1, multi-source heterogeneous data processing: collect network traffic data, vulnerability scanning logs and host process data, align the data with time and space benchmarks, and then obtain a standardized attack metadata set.

[0008] Step 2: Build a dynamic knowledge graph: Use the standardized attack metadata dataset to build a four-layer graph structure, and then obtain the topological relationship and entity attributes between nodes, and then update the entity attributes through the dynamic decay function to obtain a dynamic knowledge graph.

[0009] Step 3: Attack path prediction: Build a graph attention mechanism and attack path prediction model based on the dynamic knowledge graph to obtain attack path data.

[0010] Step 4: Obtain high-confidence attack paths: The path risk value of the attack path is passed into the training set as an adversarial attack path sample, and then analyzed to obtain a high-confidence attack path.

[0011] Step 5: Information Feedback: Analyze and determine the threat level of high-confidence attack paths, provide information feedback, and then update the dynamic map.

[0012] Preferably, the use of a standardized attack metadata set to construct a four-layer graph structure, and then obtaining the topological relationship and entity attributes between nodes, includes: A1, inputting a standardized attack metadata set, mapping the fields of the standardized attack metadata set to a four-layer graph structure, wherein the four-layer graph structure includes a physical layer, a logical layer, a vulnerability layer and a behavioral layer, wherein the physical layer includes an IP address, a MAC address and a device type; the logical layer includes a service port, an API call chain and a data flow direction; the vulnerability layer includes a CVE number, a CVSS score and an affected service; and the behavioral layer includes an attack mode TTP, a session frequency and a load characteristic.

[0013] A2. Use the dual storage mode of adjacency matrix and attribute tensor to store the topological relationship between nodes and entity attributes. The adjacency matrix is ​​used to store the topological relationship between nodes, and the attribute tensor is used to record entity attributes.

[0014] Preferably, the updating of entity attributes by a dynamic attenuation function comprises: Get entity attribute values ,in Represents the initial value of the entity attribute, Expressed as a natural constant, Expressed as the number of testing days, Expressed as the number of days of initial detection, Expressed as the natural attenuation coefficient, is the defense event impact coefficient; Expressed as the The impact of defense events that occurred in the detection days is , is a natural integer greater than or equal to 1, Expressed as the total number of detection days; Expressed as the The impact of defense events on attributes is detected for a certain number of days.

[0015] According to the calculation formula The defense event impact coefficient is obtained , wherein is the current threat level, is the number of defense strategies stored in the database, is an impact attenuation factor, which is dynamically adjusted according to system load.

[0016] Preferably, the graph attention mechanism is constructed according to the dynamic knowledge graph, and the attack path prediction model is further obtained, including: B1, taking the dynamic knowledge graph as the node feature of the attack path prediction model, wherein the attack path prediction model includes a graph attention layer, an LSTM time sequence layer, and a risk rating layer.

[0017] B2, using the graph attention layer, adjusting the attention distribution through the path entropy weight, outputting the effective path entropy weight, and injecting the effective path entropy weight into the LSTM gate through Hadamard product; further obtaining the time sequence correlation degree through the LSTM time sequence layer; thereby calculating the path risk value through the risk rating layer , wherein the path risk value is calculated according to the calculation formula , wherein and respectively represent the weight factor of the CVSS score and the weight factor of the time sequence correlation degree, thereby predicting the attack path and obtaining the path risk value of the attack path.

[0018] B3, arranging the obtained attack path risk value in descending order, thereby obtaining the attack path sequence, and recording the attack path, the attack path risk value, and the attack path sequence as attack path data.

[0019] Preferably, the graph attention layer is used to adjust the attention distribution through the path entropy weight, output the effective path entropy weight, and inject the effective path entropy weight into the LSTM gate through Hadamard product, including: C1, taking two entity nodes in the knowledge graph as and , wherein represents the associated path between the two entity nodes, and the path is recorded as , and the entropy value of the path is recorded as , thereby mapping the path entropy to the path entropy weight ∈(0,1) through the Sigmoid function, according to the calculation formula , the path entropy weight is obtained, wherein is a natural constant.

[0020] C2. First, perform feature concatenation to convert the LSTM time series features and the input features at the current time point Splice to , through the weight matrix of the input gate Perform linear mapping and input gated path entropy weight and the attention weight distribution matrix Perform Hadamard product operation to generate attention modulation signal, then add the linear transformation result to the attention signal, and finally pass the Sigmoid function Generate input gating value to complete gating generation; record the input gate control value of LSTM as , and the calculation formula is obtained ,in =1,2,......z, It represents each time point, z represents the total number of time points, and z is an integer greater than or equal to 1; thus, the effective path entropy value weight is obtained.

[0021] Preferably, the analysis to obtain a high confidence attack path includes: D1, recording the variance of the path risk value of the attack path as , the prediction variance formula calculated by Bayesian uncertainty estimation Deriving the attack path The variance of the path risk value ,in Represented as an attack path The path risk value.

[0022] D2. Attack path The variance of the path risk value Compared with the path risk value variance threshold, when the attack path The variance of the path risk value When the path risk value is greater than the variance threshold, the attack path is judged as a low confidence prediction and deleted, otherwise the attack path is judged as a high confidence prediction and the attack path Recorded as high-confidence attack path, thus obtaining the high-confidence attack path.

[0023] Preferably, the threat level of the high-confidence attack path is analyzed, including: comparing the path risk value variance of the high-confidence attack path with the threat threshold interval of each path risk value variance; when the path risk value variance of the high-confidence attack path belongs to a certain path risk value variance threat threshold interval, the threat level corresponding to the path risk value variance threat threshold interval is used as the threat level of the high-confidence attack path.

[0024] Preferably, the information feedback and subsequent updating of the dynamic map include: according to the threat level of the high-confidence attack path, the high-confidence attack path and the attack plan and defense strategy corresponding to the high-confidence attack path are fed back as event shocks to the dynamic attenuation function, thereby updating the dynamic map.

[0025] In the second aspect, the present application provides a network attack path prediction system based on a knowledge graph, including: a multi-source heterogeneous data processing module for collecting network traffic data, vulnerability scanning logs and host process data, aligning the data with time and space benchmarks, and then obtaining a standardized attack metadata set.

[0026] A dynamic knowledge graph module is constructed to build a four-layer graph structure using a standardized attack metadata dataset, thereby obtaining the topological relationships and entity attributes between nodes, and updating the entity attributes through a dynamic decay function, thereby obtaining a dynamic knowledge graph.

[0027] The attack path prediction module is used to build a graph attention mechanism and attack path prediction model based on the dynamic knowledge graph to obtain attack path data.

[0028] The high-confidence attack path acquisition module is used to pass the path risk value of the attack path as an adversarial attack path sample into the training set, and then analyze and obtain the high-confidence attack path.

[0029] The information feedback module is used to analyze and determine the threat level of high-confidence attack paths, provide information feedback, and then update the dynamic map.

[0030] The beneficial effects of the present application are: 1. The present application provides a network attack path prediction method and system based on knowledge graph, which ensures the temporal and spatial benchmark alignment of data by processing multi-source heterogeneous data, constructs a dynamic knowledge graph to update entity attributes in real time, adopts a dual storage mode, improves storage efficiency, and then constructs a graph attention mechanism and an attack path prediction model to complete the prediction of the attack path, improves the accuracy of attack path detection and prediction, solves the limitations of the current network attack path prediction process, analyzes the threat level of high-confidence attack paths, and provides information feedback to complete the update of the dynamic graph, ensuring the accuracy, reliability and authenticity of the network attack path prediction results.

[0031] 2. This application solves the entity relationship redundancy problem caused by data heterogeneity in traditional knowledge graphs in the field of network security through hierarchical modeling of a four-layer graph structure; the dynamic attenuation function is based on real-time feedback of the threat level, such as the defense event impact coefficient in the formula , and the path entropy weight adjustment of the graph attention mechanism forms a closed-loop control, enabling the LSTM timing layer to dynamically capture the hidden evolution characteristics of the attack path, such as the latent behavior of APT attacks. Compared with the traditional static knowledge graph method, the attack path prediction accuracy is greatly improved.

[0032] 3. This application uses a dual storage mode of adjacency matrix and attribute tensor, which reduces storage space usage and improves multi-hop query speed compared to traditional Neo4j graph databases. At the same time, dynamic attribute updates enable the knowledge graph to reflect real-time changes in network status. For example, the exploitability of vulnerabilities decreases over time, and service dependencies change with topology adjustments, so that adjustments can be updated in real time. At the same time, the impact of defense events is dynamically associated with the system operation status, breaking through the traditional static attenuation model to solve the overfitting problem of attribute updates in multi-source heterogeneous data scenarios.

[0033] 4. This application uses entropy weight filtering to suppress interference from low-probability paths and focus attention on high-risk paths; through joint spatiotemporal modeling, the graph structure captures the topological dependencies of vulnerability exploits; combined with LSTM to capture the timing characteristics of the attack path, such as the interval between lateral movement steps, to improve the credibility of the predicted path; LSTM is used to learn attacker behavior patterns, such as a 30% increase in nighttime activity; at the same time, hardware acceleration is used, and CUDA kernel functions achieve real-time evaluation of tens of thousands of paths per second, meeting the timeliness requirements of attack path detection, thereby improving the accuracy of attack path detection prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0035] Figure 1 The figure is a flowchart of the steps for implementing the application method.

[0036] Figure 2 This is a schematic diagram of the system structure connection for this application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0038] See also Figure 1 As shown, the present application provides a network attack path prediction method based on knowledge graph in the first aspect, including: step one, multi-source heterogeneous data processing: collecting network traffic data, vulnerability scanning logs and host process data, aligning the data with time and space benchmarks, and then obtaining a standardized attack metadata set.

[0039] It should be noted that network traffic data is collected through distributed probes, where the distributed deployment of traffic probe arrays has a sampling frequency greater than or equal to 1KHz; vulnerability scan logs are collected through vulnerability log collectors, and CVE vulnerability features are parsed in real time. CVE stands for Common Vulnerabilities & Exposures; host process data is collected through host process detection, and the host process data includes process creation events, termination events, and resource usage, etc.

[0040] In a specific example, the data is aligned with a time-space reference to obtain a standardized attack metadata set, including: translating, rotating and scaling the original coordinates of the network traffic data, vulnerability scanning logs and host process data, and then aligning the network traffic data, vulnerability scanning logs and host process data in a unified coordinate system, thereby using the aligned network traffic data, vulnerability scanning logs and host process data as the standardized attack metadata set.

[0041] Step 2: Build a dynamic knowledge graph: Use the standardized attack metadata dataset to build a four-layer graph structure, and then obtain the topological relationship and entity attributes between nodes, and then update the entity attributes through the dynamic decay function to obtain a dynamic knowledge graph.

[0042] In a specific example, the use of a standardized attack metadata set to construct a four-layer graph structure and then obtain topological relationships and entity attributes between nodes includes: A1, inputting a standardized attack metadata set, mapping the fields of the standardized attack metadata set to a four-layer graph structure, wherein the four-layer graph structure includes a physical layer, a logical layer, a vulnerability layer, and a behavioral layer, wherein the physical layer includes an IP address, a MAC address, and a device type; the logical layer includes a service port, an API call chain, and a data flow direction; the vulnerability layer includes a CVE number, a CVSS score, and an affected service; and the behavioral layer includes an attack mode TTP, a session frequency, and load characteristics.

[0043] It should be noted that when implementing layered modeling operations, the physical layer provides infrastructure topology, the logical layer displays service dependency weaknesses, the vulnerability layer quantifies the attack surface, and the behavioral layer detects abnormal activities.

[0044] It should be noted that CVSS is the abbreviation of Common Vulnerability Scoring System, which is an existing technology. CVSS provides a method to obtain the main characteristics of a vulnerability and generate a numerical score reflecting its severity. The score ranges from [0,10]. Higher values ​​indicate more severe vulnerabilities.

[0045] A2. Use the dual storage mode of adjacency matrix and attribute tensor to store the topological relationship between nodes and entity attributes. The adjacency matrix is ​​used to store the topological relationship between nodes, and the attribute tensor is used to record entity attributes.

[0046] It should be noted that the topological relationships between nodes include host connections and service dependencies; entity attributes include vulnerability exploitability and service status.

[0047] It should be noted that the adjacency matrix uses the compressed sparse row CSR format to store the topological relationship between nodes, and the attribute tensor stores entity attributes in a three-dimensional structure of entity ID plus timestamp plus attribute value.

[0048] It should be noted that the real-time update of dynamic knowledge graphs uses data collection interfaces such as Kafka stream processing and update trigger conditions such as scheduled tasks or event-driven.

[0049] This application solves the entity relationship redundancy problem caused by data heterogeneity in the traditional knowledge graph in the field of network security through hierarchical modeling of a four-layer graph structure; the dynamic attenuation function is based on real-time feedback of the threat level, such as the defense event impact coefficient in the formula , and the path entropy weight adjustment of the graph attention mechanism forms a closed-loop control, enabling the LSTM timing layer to dynamically capture the hidden evolution characteristics of the attack path, such as the latent behavior of APT attacks. Compared with the traditional static knowledge graph method, the attack path prediction accuracy is greatly improved.

[0050] In a specific example, updating the entity attribute by a dynamic decay function includes: Get entity attribute values ,in Represents the initial value of the entity attribute, Expressed as a natural constant, Expressed as the number of testing days, Expressed as the number of days of initial detection, Expressed as the natural attenuation coefficient, is the defense event impact coefficient; Expressed as The impact of defense events that occurred in the detection days is , is a natural integer greater than or equal to 1, Expressed as the total number of detection days; Expressed as the The number of detection days prevents the impact of events on attributes.

[0051] According to the calculation formula Determine the impact coefficient of defense events ,in is the current threat level, is the number of defense strategies stored in the database, is the shock attenuation factor, which is adjusted dynamically according to the system load.

[0052] It should be noted that the current threat level is obtained through feedback from the information feedback module.

[0053] It should be noted that the natural attenuation coefficient Calculated based on the frequency of historical attack events, the calculation formula is: ,in Represented as the total number of attack events detected in the previous 30 days.

[0054] It should be noted that according to the calculation formula , complete the shock attenuation factor Dynamic adjustment of system load.

[0055] It should be noted that, for example, when the initial vulnerability attribute It means the CVSS score is 8.5. The half-life is 45 days. A patch deployment event is detected when , the amount of impact applied , ; Update entity attributes through dynamic decay function , thus obtaining the updated entity attributes .

[0056] This application uses a dual storage mode of adjacency matrix and attribute tensor, which reduces storage space usage and improves multi-hop query speed compared to traditional Neo4j graph databases; at the same time, dynamic attribute updates enable the knowledge graph to reflect real-time changes in network status, such as the exploitability of vulnerabilities decreasing over time, and service dependencies changing with topology adjustments, so that adjustments can be updated in real time; at the same time, the impact of defense events is dynamically associated with the system operation status, breaking through the traditional static attenuation model to solve the overfitting problem of attribute updates in multi-source heterogeneous data scenarios.

[0057] Step three, attack path prediction: constructing a graph attention mechanism and an attack path prediction model according to a dynamic knowledge graph, and then obtaining attack path data.

[0058] In one specific example, the constructing a graph attention mechanism and an attack path prediction model according to a dynamic knowledge graph, and then obtaining attack path data, comprises: B1, taking the dynamic knowledge graph as the node feature of the attack path prediction model, wherein the attack path prediction model comprises a graph attention layer, an LSTM time sequence layer and a risk rating layer.

[0059] B2, using the graph attention layer, adjusting the attention distribution through the path entropy weight system, outputting the effective path entropy value weight, and injecting the effective path entropy value weight into the LSTM gate through the Hadamard product; then obtaining the time sequence correlation degree through the LSTM time sequence layer; and calculating the path risk value through the risk rating layer. wherein the path risk value is calculated by the formula wherein and respectively represent the weight factor of the CVSS score and the weight factor of the time sequence correlation degree, thereby predicting the attack path and obtaining the path risk value of the attack path.

[0060] It should be noted that , , + =1.

[0061] It should be noted that the time sequence correlation degree is obtained through the LSTM time sequence layer, which first captures the time interval feature between attack steps through the LSTM time sequence layer, processes the time interval sequence to generate a hidden state representation, and then maps the hidden state to the time sequence correlation degree.

[0062] B3, arranging the obtained attack path risk value in descending order, and then obtaining the attack path sequence, and recording the attack path, the attack path risk value and the attack path sequence as the attack path data.

[0063] In one specific example, the using the graph attention layer, adjusting the attention distribution through the path entropy weight system, outputting the effective path entropy value weight, and injecting the effective path weight into the LSTM gate through the Hadamard product comprises: C1, recording two entity nodes in the knowledge graph as and wherein represents the associated path between the two entity nodes, and then recording the path as and recording the entropy value of the path as , and thus the path entropy is converted to Mapping to path entropy weight ∈(0,1), according to the calculation formula Obtain path entropy weight ,in is a natural constant.

[0064] It should be noted that physical nodes such as hosts at the physical layer, services at the logical layer, CVE entries at the vulnerability layer, and attack patterns at the behavioral layer; Defined as Used to quantify path uncertainty.

[0065] It should be noted that the path entropy weight mechanism implements parallel computing through CUDA kernel functions, and the path entropy calculation block granularity is set to process 8 paths per thread; at the same time, the probability matrix of the path is cached in shared memory.

[0066] C2. First, perform feature concatenation to convert the LSTM time series features and the input features at the current time point Splice to , through the weight matrix of the input gate Perform linear mapping and input gated path entropy weight and the attention weight distribution matrix Perform Hadamard product operation to generate attention modulation signal, then add the linear transformation result to the attention signal, and finally pass the Sigmoid function Generate input gating value to complete gating generation; record the input gate control value of LSTM as , and the calculation formula is obtained ,in =1,2,......z, It represents each time point, z represents the total number of time points, and z is an integer greater than or equal to 1; thus, the effective path entropy value weight is obtained.

[0067] It should be noted that the Hadamard product is a prior art; It is expressed as building a cross-modal feature interaction channel.

[0068] The application uses entropy weight filtering to suppress low-probability path interference and focus attention on high-risk paths; through spatio-temporal joint modeling, the graph structure captures the topological dependence of exploit; combined with LSTM, the temporal characteristics of attack paths are captured, such as lateral movement step interval, to improve the credibility of the predicted path; using LSTM, the attacker behavior pattern is learned, such as nighttime activity, which is improved by 30%; at the same time, hardware acceleration is used, and CUDA kernel function is used to realize real-time evaluation of ten thousand paths per second, to meet the timeliness requirements of attack path detection, and thus improve the accuracy of attack path detection prediction.

[0069] Step four, high-confidence attack path acquisition: the path risk value of the attack path is transmitted into the training set as an adversarial attack path sample, and then a high-confidence attack path is analyzed and obtained.

[0070] It should be noted that the path risk value of the attack path is transmitted into the training set as an adversarial attack path sample, and the divide-and-conquer strategy is used to divide the attack path space, so that the time complexity of the adversarial sample generation algorithm is Control is .

[0071] In one specific example, the analysis obtains a high-confidence attack path, including: D1, the variance of the path risk value of the attack path is denoted as , and the prediction variance formula is calculated through the Bayesian uncertainty estimation to obtain the path risk value variance of the attack path , wherein represents the path risk value of the attack path .

[0072] D2, the path risk value variance of the attack path is compared with the path risk value variance threshold, when the path risk value variance of the attack path is greater than the path risk value variance threshold, the attack path is determined as a low-confidence prediction, and is deleted, otherwise the attack path is determined as a high-confidence prediction, and the attack path is recorded as a high-confidence attack path, thereby obtaining a high-confidence attack path.

[0073] It should be noted that , and the path risk value variance threshold is updated every time attack path risk values are added.

[0074] Step five, information feedback: the threat level of the high-confidence attack path obtained by analysis is analyzed and information feedback is performed, and then the dynamic graph is updated.

[0075] In a specific example, the threat level of a high-confidence attack path is analyzed and obtained, including: comparing the path risk value variance of the high-confidence attack path with the threat threshold interval of each path risk value variance; when the path risk value variance of the high-confidence attack path belongs to a certain path risk value variance threat threshold interval, the threat level corresponding to the path risk value variance threat threshold interval is used as the threat level of the high-confidence attack path.

[0076] In a specific example, the information feedback and subsequent updating of the dynamic graph include: according to the threat level of the high-confidence attack path, the high-confidence attack path and the attack plan and defense strategy corresponding to the high-confidence attack path are fed back as event shocks to the dynamic attenuation function, thereby updating the dynamic graph.

[0077] See also Figure 2 As shown, the present application provides a network attack path prediction system based on knowledge graph in the second aspect, including: a multi-source heterogeneous data processing module for collecting network traffic data, vulnerability scanning logs and host process data, aligning the data with time and space benchmarks, and then obtaining a standardized attack metadata set.

[0078] A dynamic knowledge graph module is constructed to build a four-layer graph structure using a standardized attack metadata dataset, thereby obtaining the topological relationships and entity attributes between nodes, and updating the entity attributes through a dynamic decay function, thereby obtaining a dynamic knowledge graph.

[0079] The attack path prediction module is used to build a graph attention mechanism and attack path prediction model based on the dynamic knowledge graph to obtain attack path data.

[0080] The high-confidence attack path acquisition module is used to pass the path risk value of the attack path as an adversarial attack path sample into the training set, and then analyze and obtain the high-confidence attack path.

[0081] The information feedback module is used to analyze and determine the threat level of high-confidence attack paths, provide information feedback, and then update the dynamic map.

[0082] The above content is merely an example and explanation of the concept of the present application. Technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined in this specification, they should all fall within the scope of protection of the present application.

Claims

1. A network attack path prediction method and system based on knowledge graph, characterized in that: include: Step 1: Multi-source heterogeneous data processing: Collect network traffic data, vulnerability scan logs, and host process data, align the data in time and space, and obtain a standardized attack metadata set; Step 2: Build a dynamic knowledge graph: Use the standardized attack metadata dataset to build a four-layer graph structure, and then obtain the topological relationship between nodes and entity attributes. Then, update the entity attributes through a dynamic decay function to obtain a dynamic knowledge graph. The standardized attack metadata dataset is used to construct a four-layer graph structure, thereby obtaining the topological relationships and entity attributes between nodes, including: A1. Input a standardized attack metadata set and map its fields to a four-layer graph structure. The four-layer graph structure includes the physical layer, logical layer, vulnerability layer, and behavioral layer. The physical layer includes IP addresses, MAC addresses, and device types; the logical layer includes service ports, API call chains, and data flow directions; the vulnerability layer includes CVE numbers, CVSS scores, and affected services; and the behavioral layer includes attack pattern TTPs, session frequency, and payload characteristics. A2. Use a dual storage mode of adjacency matrix and attribute tensor to store the topological relationships between nodes and entity attributes. The adjacency matrix is ​​used to store the topological relationships between nodes, and the attribute tensor is used to record entity attributes. Step 3: Attack path prediction: Build a graph attention mechanism and attack path prediction model based on the dynamic knowledge graph to obtain attack path data; Step 4: Obtain high-confidence attack paths: The path risk value of the attack path is passed into the training set as an adversarial attack path sample, and then analyzed to obtain a high-confidence attack path; The analysis yielded high-confidence attack paths, including: D1. The variance of the path risk value of the attack path is recorded as , the prediction variance formula calculated by Bayesian uncertainty estimation Deriving the attack path The variance of the path risk value ,in Represented as an attack path Path risk value; D2. Attack path The variance of the path risk value Compared with the path risk value variance threshold, when the attack path The variance of the path risk value When the path risk value is greater than the variance threshold, the attack path is judged as a low confidence prediction and deleted, otherwise the attack path is judged as a high confidence prediction and the attack path Recorded as high confidence attack path, thus obtaining high confidence attack path; Step 5: Information Feedback: Analyze and determine the threat level of high-confidence attack paths, provide information feedback, and then update the dynamic map.

2. A network attack path prediction method based on knowledge graph according to claim 1, characterized in that: The step of aligning the data with time and space benchmarks to obtain a standardized attack metadata set includes: The original coordinates of the network traffic data, vulnerability scanning logs and host process data are translated, rotated and scaled, and then the network traffic data, vulnerability scanning logs and host process data are aligned in a unified coordinate system, so that the aligned network traffic data, vulnerability scanning logs and host process data are used as a standardized attack metadata set.

3. The network attack path prediction method based on knowledge graph according to claim 1 is characterized in that: The updating of entity attributes by a dynamic decay function includes: Through the dynamic decay function Get entity attribute values ,in Represents the initial value of the entity attribute, Expressed as a natural constant, Expressed as the number of detection days, Expressed as the number of days of initial detection, Expressed as the natural attenuation coefficient, is the defense event impact coefficient; Expressed as The impact of defense events that occurred in the detection days is , is a natural integer greater than or equal to 1, Expressed as the total number of detection days; Expressed as The number of detection days to defend against the impact of events on attributes; According to the calculation formula Determine the impact coefficient of defense events ,in is the current threat level, is the number of defense strategies stored in the database, is the shock attenuation factor, which is dynamically adjusted according to the system load.

4. The network attack path prediction method based on knowledge graph according to claim 1 is characterized in that: The method of constructing a graph attention mechanism and an attack path prediction model based on a dynamic knowledge graph to obtain attack path data includes: B1. Use the dynamic knowledge graph as the node feature of the attack path prediction model, where the attack path prediction model includes a graph attention layer, an LSTM timing layer, and a risk rating layer; B2. Use the graph attention layer to adjust the attention distribution through the path entropy weight system, output the effective path entropy weight, and inject the effective path entropy weight into the LSTM gate through the Hadamard product; then obtain the time series correlation through the LSTM time series layer; and then calculate the path risk value through the risk rating layer. , where the path risk value The calculation formula is ,in and They are respectively expressed as the weight factor of the CVSS score and the weight factor of the time series correlation, thereby predicting the attack path and obtaining the path risk value of the attack path; B3. Arrange the acquired attack path risk values ​​in descending order to obtain an attack path sequence, and record the attack path, attack path risk value, and attack path sequence as attack path data.

5. A network attack path prediction method based on knowledge graph according to claim 4, characterized in that: The graph attention layer is used to adjust the attention distribution through the path entropy weight system, output the effective path entropy weight, and inject the effective path entropy weight into the LSTM gate through the Hadamard product, including: C1. The two entity nodes in the knowledge graph are recorded as and ,in It is represented as the association path between two entity nodes, and the path is recorded as , and the path The entropy value is recorded as , and thus the path entropy is converted to Mapping to path entropy weight ∈(0,1), according to the calculation formula Obtain path entropy weight ,in is a natural constant; C2. First, perform feature concatenation to convert the LSTM time series features and the input features at the current time point Splice to , through the input gated weight matrix Perform linear mapping and input gated path entropy weight and the attention weight distribution matrix Perform Hadamard product operation to generate attention modulation signal, then add the linear transformation result to the attention signal, and finally pass the Sigmoid function Generate input gating value to complete gating generation; record the input gate control value of LSTM as , and the calculation formula is obtained ,in =1,2,......z, It represents each time point, z represents the total number of time points, and z is an integer greater than or equal to 1; thus, the effective path entropy value weight is obtained.

6. A network attack path prediction method based on knowledge graph according to claim 1, characterized in that: The analysis resulted in a high-confidence threat level for attack paths, including: The path risk value variance of the high-confidence attack path is compared with the threat threshold interval of each path risk value variance. When the path risk value variance of the high-confidence attack path belongs to a certain path risk value variance threat threshold interval, the threat level corresponding to the path risk value variance threat threshold interval is used as the threat level of the high-confidence attack path.

7. The network attack path prediction method based on knowledge graph according to claim 1 is characterized in that: The information feedback and the updating of the dynamic graph include: According to the threat level of the high-confidence attack path, the high-confidence attack path and the attack plan and defense strategy corresponding to the high-confidence attack path are used as event shocks and fed back to the dynamic attenuation function to update the dynamic graph.

8. A network attack path prediction system based on knowledge graph according to any one of claims 1 to 7, characterized in that: include: A multi-source heterogeneous data processing module is used to collect network traffic data, vulnerability scan logs, and host process data, align the data with time and space benchmarks, and then obtain a standardized attack metadata set; Construct a dynamic knowledge graph module, which uses a standardized attack metadata dataset to construct a four-layer graph structure, thereby obtaining the topological relationships between nodes and entity attributes, and then updating entity attributes through a dynamic decay function to obtain a dynamic knowledge graph; The attack path prediction module is used to build a graph attention mechanism and attack path prediction model based on the dynamic knowledge graph to obtain attack path data; The high-confidence attack path acquisition module is used to pass the path risk value of the attack path as an adversarial attack path sample into the training set, and then analyze and obtain the high-confidence attack path; The information feedback module is used to analyze and determine the threat level of high-confidence attack paths, provide information feedback, and then update the dynamic map.

Images