Network attack path graph updating method and device, terminal equipment and storage medium

Abstract

The invention discloses a method and a device for updating a network attack path diagram, terminal equipment and a storage medium, and belongs to the field of information security, and the method is the method for updating the network attack path diagram. Therefore, more comprehensive path coverage is realized; and the potential target attack path is automatically generated according to the connection relationship between the threat node and each path node in the network attack path graph, so that the path searching efficiency is improved, and the query omission of the potential attack path can be reduced. Therefore, the updating efficiency of the network attack path diagram can be improved, the path related to the attack behavior can be updated more accurately and comprehensively, and delay and omission of manual troubleshooting are avoided. By implementing the invention, the problems of incomplete path coverage and low updating efficiency of the network attack path diagram in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device, terminal equipment and storage medium for updating a network attack path map. Background Art

[0002] To address network security challenges, network attack graph technology is widely recognized as an effective means of identifying, analyzing, and defending against network attacks. By modeling and analyzing factors such as attack paths, attacker behavior, and system vulnerabilities, network attack graphs can clearly depict the attacker's journey from intrusion to control system, helping security personnel intuitively analyze vulnerability correlations within the network.

[0003] However, traditional technologies rely on static rule sets and manual analysis to update attack path maps. Static rule sets can only intercept traffic and data from specific or designated network addresses, and cannot find paths related to attack behaviors based on network attack addresses and attack ports of unknown attacks, resulting in incomplete updated path coverage. Moreover, when relying on manual analysis of vulnerability reports and network logs, security personnel need to manually associate threats with related nodes in the network attack map. However, the number of nodes in the power network is huge (such as power grid equipment, network equipment, servers, etc.), and manual analysis will be inefficient and prone to missing potential paths. Therefore, the existing technology has the problems of incomplete path coverage and inefficient updating of network attack path maps. Summary of the Invention

[0004] The embodiments of the present invention provide a method, apparatus, terminal device and storage medium for updating a network attack path map, which can improve the updating efficiency of the network attack path map and can more accurately and comprehensively update the paths related to the attack behavior, so that security maintenance personnel can quickly deploy blocking strategies based on the updated path map, avoiding delays and omissions in manual investigation, and effectively solving the problems of insufficient path coverage and low efficiency in updating the network attack path map in the prior art.

[0005] An embodiment of the present invention provides a method for updating a network attack path map, comprising:

[0006] Acquire threat intelligence data for describing attack behavior characteristics of a network attacker; wherein the threat intelligence data includes: a plurality of attacked first power grid devices; the first power grid devices include: a first port number and a first subnet address;

[0007] For each first power grid device, marking a power grid device node of the first power grid device in a network attack path graph as a threat node; wherein the network attack path graph includes a connection relationship between a plurality of path nodes and a network attack path composed of different path nodes; the path nodes include: a power grid device node, a network device node, a server node, and a boundary protection node for implementing network boundary protection;

[0008] For each threat node, a target attack path is generated based on the first port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph;

[0009] Each target attack path corresponding to each threat node is used as a newly added network attack path, and the network attack path map is updated.

[0010] Preferably, the border protection node corresponds to a plurality of second port numbers that are allowed to be accessed; the server node corresponds to a plurality of second subnet addresses managed by the server; and the network device node corresponds to a router table;

[0011] Generating a target attack path according to the port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph includes:

[0012] Several border protection nodes whose second port numbers are the same as the first port numbers are used as target border protection nodes;

[0013] Several server nodes having the same second subnet address as the first subnet address are used as target server nodes;

[0014] According to the connection relationship between the threat node and each path node in the network attack path graph, the network device node connected to the threat node is used as the target network device node;

[0015] For each target network device node, determine the target data forwarding path of the threat node in each path node according to the routing table of the target network device node;

[0016] According to each target boundary protection node, each target server node, each target network device node and each target data forwarding path, a target attack path corresponding to the threat node is generated.

[0017] Preferably, it also includes:

[0018] For each target attack path, the risk level corresponding to each path node is calculated based on the attack impact coefficient of the target attack path on each path node and the importance weight of each path node in the target attack path;

[0019] The path node with a risk level greater than a preset level threshold is taken as the target path node, and warning information is generated to characterize the risk of intrusion on the target path node.

[0020] Preferably, the network attack path corresponds to a path data; the path data includes: the time difference between the generation time of the network attack path and the current time, the diffusion speed of the network attack path, the attack interval period of the network attack path, the path length of the network attack path, and the node importance value of each path node in the network attack path;

[0021] After the network attack path map is updated, the following steps are further included:

[0022] The updated network attack path diagram is input into a preset attack spread probability prediction model, so that the attack spread probability prediction model generates a time series feature for characterizing the time evolution law of the attack behavior based on the time difference between the generation time of the network attack path in the path data and the current time, the diffusion speed of the network attack path, and the attack interval period of the network attack path; generates a structural feature for characterizing the static risk of the attack behavior based on the path length of the network attack path in the path data and the node importance value of each path node in the network attack path; performs weighted fusion of the time series feature and the structural feature based on the attention mechanism to generate a fused feature; and outputs the attack spread probability corresponding to the network attack path diagram based on the fused feature.

[0023] Preferably, it also includes:

[0024] Acquire second-grid equipment with fixed vulnerabilities;

[0025] Marking the power grid device node corresponding to the second power grid device in the network attack path diagram as a node to be processed;

[0026] Marking a plurality of network attack paths containing the to-be-processed nodes in the network attack path graph as to-be-processed network attack paths;

[0027] For each pending network attack path, determine whether the pending network attack path is connected after deleting the pending node; if so, delete the pending node in the pending network attack path to generate an updated pending network attack path;

[0028] If not, the node to be processed is used as a breakpoint to divide the network attack path to be processed into an upstream attack path and a downstream attack path; whether the number of path nodes of the upstream attack path is greater than a preset number value, if so, the upstream attack path is used as the updated network attack path to be processed; if not, the upstream attack path is deleted; whether the number of path nodes of the downstream attack path is greater than a preset number value, if so, the downstream attack path is used as the updated network attack path to be processed; if not, the downstream attack path is deleted;

[0029] The network attack path graph is updated according to each updated network attack path to be processed.

[0030] Preferably, it also includes:

[0031] Acquire first power grid operation data for indicating that an abnormality occurs in a first device and the duration of the abnormality is greater than a preset time threshold; wherein the first device includes: a power grid device or a network device;

[0032] Marking a path node corresponding to the first device in the network attack path graph as a first node;

[0033] Marking a plurality of network attack paths including the first node in the network attack path graph as first network attack paths;

[0034] For each first network attack path, updating the current risk score of the first network attack path according to the abnormal duration and the time decay factor corresponding to the first network attack path to generate an updated risk score;

[0035] For each first network attack path, updating the current processing priority of the first network attack path according to the updated risk score to generate an updated processing priority;

[0036] The network attack path map is updated according to the updated processing priority of each first network attack path.

[0037] Preferably, it also includes:

[0038] Acquire second power grid operation data for indicating that the configuration of the second device has been updated; wherein the second power grid operation data includes: configuration update time; the second device includes: power grid device or network device;

[0039] Marking the path node corresponding to the second device in the network attack path graph as a second node;

[0040] Marking a plurality of network attack paths including the second node in the network attack path graph as second network attack paths;

[0041] For each second network attack path, when it is determined that the time difference between the generation time corresponding to the second network attack path and the configuration update time is greater than a preset time difference threshold, marking the second network attack path as an expired path;

[0042] When it is determined that there is at least one expired path, the weight of the expired path is reduced, and the network attack path map is updated according to the weight of each expired path.

[0043] Based on the above method embodiments, the present invention provides corresponding device embodiments.

[0044] An embodiment of the present invention provides a network attack path map updating device, comprising: a threat intelligence data acquisition module, a threat node marking module, a target attack path generation module, and a path map updating module;

[0045] The threat intelligence data acquisition module is used to acquire threat intelligence data used to describe the attack behavior characteristics of the network attacker; wherein the threat intelligence data includes: a plurality of attacked first power grid devices; the first power grid devices include: a first port number and a first subnet address;

[0046] The threat node marking module is configured to mark, for each first power grid device, a power grid device node of the first power grid device in a network attack path graph as a threat node; wherein the network attack path graph includes a connection relationship between a plurality of path nodes and a network attack path composed of different path nodes; the path nodes include: power grid device nodes, network device nodes, server nodes, and boundary protection nodes for implementing network boundary protection;

[0047] The target attack path generation module is configured to generate a target attack path for each threat node based on the first port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph;

[0048] The path map updating module is used to update the network attack path map by taking each target attack path corresponding to each threat node as a newly added network attack path.

[0049] Based on the above method embodiments, the present invention provides corresponding terminal device embodiments.

[0050] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the method for updating the network attack path map described in the above-mentioned embodiment of the invention.

[0051] Based on the above method embodiment, the present invention provides a corresponding storage medium embodiment.

[0052] Another embodiment of the present invention provides a storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a method for updating a network attack path map described in the above-mentioned embodiment of the invention.

[0053] The following beneficial effects are achieved by implementing the present invention:

[0054] Embodiments of the present invention provide a method, apparatus, terminal device, and storage medium for updating a network attack path map. The present invention can analyze the first power grid device under attack, the port number of the first power grid device, and the subnet address of the first power grid device in threat intelligence data. After marking the corresponding threat node in the network attack path map based on the attacked first power grid device, the present invention can generate an attack path associated with the threat node based not only on the physical connection relationship of the threat node but also on the port number and subnet address. Compared with the prior art, even for an unknown attacker, the present invention can find the path associated with the attack behavior based on the port and subnet of the attacked device, thereby achieving more comprehensive path coverage. Furthermore, the present invention can automatically analyze the threat intelligence data and automatically generate potential target attack paths based on the connection relationship between the threat node and each path node in the network attack path map. This not only improves the path search efficiency, but also reduces the omission of potential attack paths by finding the associated potential paths through the connection relationship of the path nodes. Therefore, the present invention can improve the update efficiency of the network attack path map and can more accurately and comprehensively update the paths associated with the attack behavior, allowing security maintenance personnel to quickly deploy blocking strategies based on the updated path map, avoiding delays and omissions in manual investigation. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 The figure is a flow chart of a method for updating a network attack path map provided by one embodiment of the present invention.

[0056] Figure 2 The present invention is a schematic structural diagram of a device for updating a network attack path map provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0058] like Figure 1 As shown, in order to solve the problems of insufficient path coverage and low efficiency in updating network attack path maps in the prior art, an embodiment of the present invention provides a method for updating a network attack path map, including:

[0059] Step S1: Acquire threat intelligence data for describing attack behavior characteristics of a network attacker; wherein the threat intelligence data includes: a plurality of attacked first power grid devices; the first power grid devices include: a first port number and a first subnet address;

[0060] Step S2: For each first power grid device, mark the power grid device node of the first power grid device in the network attack path graph as a threat node; wherein the network attack path graph includes a connection relationship between a plurality of path nodes and a network attack path composed of different path nodes; the path nodes include: power grid device nodes, network device nodes, server nodes, and boundary protection nodes for implementing network boundary protection;

[0061] Step S3: For each threat node, a target attack path is generated based on the first port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph;

[0062] Step S4: taking each target attack path corresponding to each threat node as a newly added network attack path, and updating the network attack path graph.

[0063] For step S1, since each power grid device in the collected threat intelligence can be automatically matched to the corresponding node in the path map, and the path generation process can be triggered according to the first port number and the first subnet address in the threat intelligence, the present invention does not need to manually analyze logs or vulnerability reports one by one. Through data collection of threat intelligence data and data association operations between threat intelligence data and network attack path maps, potential target attack paths can be found, and the network attack path map can be updated.

[0064] Illustratively, embodiments of the present invention can utilize API interfaces, data capture tools, and subscriptions to threat intelligence sources to obtain the latest threat information and attack methods from various threat intelligence sources in real time, thereby generating threat intelligence data that describes the attack behavior characteristics of network attackers. Furthermore, the collected threat intelligence data can be cleaned and standardized to remove redundant and noisy data and ensure data accuracy and consistency. For example, data cleaning tools can be used to remove duplicate records, correct malformed data entries, and convert data from different sources into a unified format and structure.

[0065] For step S2, when the threat intelligence shows that the power grid equipment corresponding to a port under a specific subnet address is attacked, the system can quickly find the node corresponding to the device in the network attack path diagram and mark it as a threat node, thereby identifying the part and scope of the network that is threatened by the attack.

[0066] It can be understood that since the network attack path diagram contains the connection relationship of several path nodes and the network attack path composed of different path nodes, and the path nodes include power grid device nodes, network device nodes, server nodes and boundary protection nodes for implementing network boundary protection. Then, the embodiment of the present invention can search for the corresponding power grid device node in the network attack path diagram based on the identification information of the first power grid device in the threat intelligence data (such as device name, device number, etc.). For example, the threat intelligence shows that a power control device in a certain substation is under attack. The system will find the power grid device node representing the power control device in the network attack path diagram and mark it as a threat node.

[0067] Schematically, grid device nodes correspond to equipment directly involved in the production, transmission, distribution, and control of electrical energy within the power system. Network device nodes correspond to devices responsible for network connectivity, traffic forwarding, and security protection, such as routers, switches, and load balancers. Server nodes correspond to business servers, data servers, and cloud servers. Boundary protection nodes refer to security devices deployed at the network boundary for access control and threat isolation, such as boundary firewalls, unified threat management (UTM) devices, and virtual private network (VPN) gateways.

[0068] In a preferred embodiment, the present invention can connect various grid device nodes, network device nodes, server nodes, and border protection nodes according to the topology of the power grid, and then mark or divide several network attack paths based on historical threat intelligence data on the formed connection diagram to generate a network attack path diagram. Then, the network attack path diagram is first constructed by the following method:

[0069] A network attack graph is a model based on graph theory that is used to represent potential attack paths in a network and the strategies that attackers may adopt. In an attack graph, nodes usually represent assets in the network, such as servers, workstations, databases, etc., while edges represent the connections between assets or vulnerabilities that attackers can exploit. An attack graph is usually represented as G = (V, E), where V is a set of nodes representing various types of assets in the network, and E is a set of edges representing the connections between assets or attack paths. For example, starting from the starting node v s To the target node v t The path P = {v s ,v1,v2,…,v t} represents the specific attack steps that the attacker may take, and each pair of adjacent nodes (v i ,v i+1 )∈E represents a potential attack step.

[0070] Threat intelligence is information about potential and existing threats, including attackers’ motivations, attack methods, exploited vulnerabilities, attack tools, etc. The set of threat intelligence is represented by T = {t1, t2, …, t n}, where each threat intelligence t i Contains attributes such as timestamp τ i , threat type θ i 、Attacker IPα i Through real-time collection and analysis, these data can provide the latest threat information for the construction and updating of network attack maps, ensuring that the attack maps can dynamically reflect the current security situation.

[0071] First, the network topology of the power grid is scanned, identifying all connected devices and the data forwarding processes between them. Nodes are then categorized and labeled based on device type, function, and importance, such as critical servers, databases, and workstations. Each node represents an asset in the network, ensuring that the attack graph comprehensively covers all critical components in the network environment.

[0072] Based on the network topology and service dependencies of the power grid, we establish connection relationships between nodes as edges in the attack graph. For example, we analyze the network topology to determine the physical and logical connection relationships between devices, identify dependencies between services (such as web servers depending on database servers), and convert these connection relationships into edges in the graph. We also define connection properties such as bandwidth and latency to reflect the connection characteristics in the actual network environment.

[0073] Then, based on threat intelligence data, potential attack paths and the strategies that attackers might adopt are defined, and each path can be assigned a corresponding risk score. Specifically, a behavioral model of the attacker is constructed based on threat intelligence data, possible attack methods and tools are identified, and path generation algorithms (such as depth-first search and breadth-first search) are used to generate possible attack paths within the attack graph. The risk score for each path is calculated based on factors such as the complexity of the attack path, the vulnerability of the nodes involved, and the probability of attack success. Priorities are assigned and a network attack path map is generated to facilitate subsequent monitoring and protection.

[0074] For step S3, in a preferred embodiment, the border protection node corresponds to a plurality of second port numbers that are allowed to be accessed; the server node corresponds to a plurality of second subnet addresses managed by the server; and the network device node corresponds to a router table;

[0075] Then, when generating a target attack path based on the port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph, the target attack path is specifically generated as follows:

[0076] Several border protection nodes whose second port numbers are the same as the first port numbers are used as target border protection nodes;

[0077] Several server nodes having the same second subnet address as the first subnet address are used as target server nodes;

[0078] According to the connection relationship between the threat node and each path node in the network attack path graph, the network device node connected to the threat node is used as the target network device node;

[0079] For each target network device node, determine the target data forwarding path of the threat node in each path node according to the routing table of the target network device node;

[0080] According to each target boundary protection node, each target server node, each target network device node and each target data forwarding path, a target attack path corresponding to the threat node is generated.

[0081] Illustratively, the embodiment of the present invention accurately finds the attack path related to the threat node by matching the threat node related information (port number, subnet address) and utilizing the connection relationship and routing table between nodes. Specifically, assume that the following nodes and configurations exist in a power SCADA system network:

[0082] The attack behavior characteristics of the network attacker in the threat intelligence data are as follows: the attacker controls an industrial control device and discovers the open port 8080 of the industrial control device through port scanning, and detects a vulnerability in the subnet 192.168.1.0 / 24;

[0083] Border protection node (firewall): Node A: Allow ports 80 (HTTP), 443 (HTTPS), and 8080 (SCADA service). Node B: Allow ports 22 (SSH) and 3389 (RDP).

[0084] Server nodes (engineering stations): Node C: Management subnet 192.168.1.0 / 24 (SCADA control instructions). Node D: Management subnet 10.0.0.0 / 8 (internal office).

[0085] Network device node (core router): Node E: The routing table contains 192.168.1.0 / 24 → next hop: 172.16.0.1. Node F: The routing table contains 10.0.0.0 / 8 → next hop: 172.16.0.2.

[0086] The process of generating the target attack path is as follows: the border protection node A (allowing port 8080) is marked as the target border protection node, the server node C (managing 192.168.1.0 / 24) is marked as the target server node, the threat node corresponding to the industrial control equipment is directly connected to the router node E, and node E is marked as the target network device node.

[0087] Since the routing table of node E is: 192.168.1.0 / 24 → next hop: 172.16.0.1, the target attack path finally generated is: attack traffic from threat node (10.10.0.5) → border protection node A (port 8080) → core router E → next hop 172.16.0.1 → target server node C (192.168.1.0 / 24).

[0088] It is understandable that the target path can be described as follows: the attacker breaks through the border protection node A by controlling and exploiting port 8080 of the threat node, forwards it through the routing of the core router E, and finally penetrates into the server node C (192.168.1.0 / 24) that manages SCADA control instructions.

[0089] Therefore, the embodiments of the present invention automatically associate node attributes with routing information to quickly generate accurate attack paths, thereby overcoming the limitations of traditional methods that rely on manual analysis and static rules.

[0090] In a preferred embodiment, the present invention can adopt a bidirectional graph traversal algorithm, starting from the marked threat node, and extending the path forward (such as each connected node) and backward (such as the attack entrance). After the path is extended, only the affected subgraph can be updated to avoid full graph reconstruction.

[0091] In order to ensure that the overall structure and data consistency of the attack graph are not affected during the incremental update process of the above-mentioned path, and to avoid disorder of the graph structure due to partial updates, the present invention can adopt a transaction management mechanism to ensure the atomicity and consistency of the incremental update operation and prevent data inconsistency caused by partial updates; a concurrency control strategy can also be designed to prevent conflicts when multiple threads or multiple processes update the attack graph at the same time, thereby ensuring data consistency and integrity; version control is performed on the update process of the attack graph, the changes in each update are recorded, and rollback operations are supported to improve the reliability and maintainability of the system.

[0092] Regarding step S4, in a preferred embodiment, each target attack path corresponding to each threat node can be added to the network attack path map, thereby achieving an update of the network attack path map.

[0093] For example, if the newly added target attack path contains nodes that do not exist in the original network attack path graph, these new nodes can be added to the graph. At the same time, the new nodes are given corresponding attribute information, such as node type (grid device node, network device node, etc.), related port number, subnet address, etc.

[0094] For the connection relationship between nodes in the new path, if there is no record in the original network attack path graph, these new connection relationships will be added to the graph. The connection relationship can be represented by a directed edge, and the direction of the edge indicates the possible propagation direction of the attack. At the same time, some attributes can be added to the edge, such as attack type, attack probability, etc.

[0095] Therefore, when power grid equipment is subjected to a new type of port scanning attack, the present invention can quickly mark the affected power grid equipment nodes through threat intelligence data, generate a new path including the attack port and subnet, and update the path map in real time, so that security personnel can quickly locate the risk of attack spread and give priority to handling high-risk paths.

[0096] In a preferred embodiment, the present invention can also evaluate the network range and key nodes that may be affected by each attack path based on the updated attack graph, and identify high-risk areas.

[0097] After the network attack path graph is updated, the method further includes: for each target attack path, calculating a risk level value corresponding to each path node according to the attack influence coefficient of the target attack path on each path node and the importance weight of each path node in the target attack path;

[0098] The path node with a risk level greater than a preset level threshold is taken as the target path node, and warning information is generated to characterize the risk of intrusion on the target path node.

[0099] Specifically, for each target attack path, the risk level corresponding to each path node is calculated according to the following formula:

[0100]

[0101] Among them, the risk degree value is used to measure the impact of the attack path on the path node, ψ(P,a i ) is the path node a i The risk level value in the target attack path P; A is the set of path nodes, δ(P,a i ) is the target attack path P to path node a i The attack influence coefficient, γ(a i ) is the path node a i Importance weight of the target attack path P.

[0102] Illustratively, the attack impact coefficient takes into account the actual impact of the attack path on each node; different attack methods may have different impacts on the same node; the importance weight reflects the criticality of the node in the entire target attack path. This method combines the attack impact coefficient and importance weight to calculate the risk level of path nodes, enabling more accurate risk assessment. When potential attack risks arise in the network, high-risk areas and target path nodes can be identified promptly and accurately, helping to improve emergency response capabilities.

[0103] In a preferred embodiment, the present invention can also predict the attack spread probability corresponding to the network attack path diagram based on the updated attack graph.

[0104] Schematically, the network attack path further corresponds to a path data; the path data includes: the time difference between the generation time of the network attack path and the current time, the diffusion speed of the network attack path, the attack interval period of the network attack path, the path length of the network attack path, and the node importance value of each path node in the network attack path;

[0105] After the network attack path map is updated, the method further includes:

[0106] The updated network attack path diagram is input into a preset attack spread probability prediction model, so that the attack spread probability prediction model generates a time series feature for characterizing the time evolution law of the attack behavior based on the time difference between the generation time of the network attack path in the path data and the current time, the diffusion speed of the network attack path, and the attack interval period of the network attack path; generates a structural feature for characterizing the static risk of the attack behavior based on the path length of the network attack path in the path data and the node importance value of each path node in the network attack path; performs weighted fusion of the time series feature and the structural feature based on the attention mechanism to generate a fused feature; and outputs the attack spread probability corresponding to the network attack path diagram based on the fused feature.

[0107] Illustratively, this invention can integrate multi-dimensional information and distinguish different attack characteristics to predict the spread of an attack. For example, time difference can reflect the timeliness of the attack, diffusion speed can reflect the attack's propagation capability, and node importance values can highlight the impact of key nodes in the attack. The combined use of this information allows risk assessment to be more accurate, rather than limited to a single factor.

[0108] In this embodiment of the present invention, time series features can capture the temporal evolution of attack behavior, while structural features reflect the static risk of an attack. The combination of these two features can clearly distinguish the characteristics of different types of attacks. For example, some attacks may spread rapidly in a short period of time (with prominent time series features), while others may cause serious impact by attacking key nodes (with prominent structural features). The present invention can achieve this characteristic differentiation, allowing for a more accurate assessment of the potential harm of an attack, thereby deriving an accurate probability of attack spread.

[0109] Optionally, the attack spread probability prediction model of the present invention can use a dual LSTM + Random Forest model. LSTM is used to learn time series dependencies (such as attack interval period), and Random Forest is used to process static features (such as node importance). The prediction results are ultimately output through weighted voting. The weight ratio of time series dependencies to static features can be 7:3.

[0110] Schematically, during the model prediction process, the present invention can also introduce a path pruning strategy to perform full feature prediction only on high-risk paths, and use a lightweight linear regression model for the remaining paths to reduce computing resource consumption.

[0111] The present invention can use machine learning algorithms to predict the expansion trend of attack paths, identify potential attack spread risks in advance, and help security protection systems take preventive measures. Based on historical attack path data, machine learning models (such as random forests, support vector machines, neural networks, etc.) are trained to obtain a preset attack spread probability prediction model to learn the patterns and laws of attack spread. The trained model can then be used to predict the risks of the current attack path and assess its possible future expansion direction and attack intensity. Based on the prediction results, an early warning mechanism can be designed. When a high-risk attack spread trend is detected, an early warning can be issued to the security operation center in a timely manner to guide the implementation of protective measures to prevent potential security threats in advance.

[0112] Optionally, the attack spread probability prediction model of the present invention achieves high-precision prediction by learning the mapping relationship between feature vectors and attack spread results. The feature vector can be expressed as:

[0113] F=[f1,f2,…,f m ];

[0114] Among them, f m represents the mth feature, such as path length, node importance, attack success rate, etc. Optionally, the machine learning model adopted in the present invention includes Random Forest, Support Vector Machine (SVM) and Neural Network.

[0115] Furthermore, the feature vector F is used for prediction:

[0116] P spread =η(F);

[0117] Where η represents a trained prediction model, such as random forest, support vector machine, or neural network, which outputs the probability of attack spread P spread .

[0118] In a preferred embodiment, the present invention can also automatically analyze the upstream and downstream dependencies of nodes deleted due to vulnerability repair and update the network attack path map, so that:

[0119] Acquire second-grid equipment with fixed vulnerabilities;

[0120] Marking the power grid device node corresponding to the second power grid device in the network attack path diagram as a node to be processed;

[0121] Marking a plurality of network attack paths containing the to-be-processed nodes in the network attack path graph as to-be-processed network attack paths;

[0122] For each pending network attack path, determine whether the pending network attack path is connected after deleting the pending node; if so, delete the pending node in the pending network attack path to generate an updated pending network attack path;

[0123] If not, the node to be processed is used as a breakpoint to divide the network attack path to be processed into an upstream attack path and a downstream attack path; whether the number of path nodes of the upstream attack path is greater than a preset number value, if so, the upstream attack path is used as the updated network attack path to be processed; if not, the upstream attack path is deleted; whether the number of path nodes of the downstream attack path is greater than a preset number value, if so, the downstream attack path is used as the updated network attack path to be processed; if not, the downstream attack path is deleted;

[0124] The network attack path graph is updated according to each updated network attack path to be processed.

[0125] Illustratively, after the vulnerability in the second power grid device is fixed, the threat status of the corresponding power grid device node in the network changes. By marking this node as pending and processing the network attack path containing it, the network attack path map can promptly reflect the true security status of the network. For example, an existing attack path based on the vulnerability may no longer be valid due to the vulnerability fix. Updating the path map can prevent security personnel from making incorrect decisions based on outdated information.

[0126] If the network attack path map is not updated promptly, nodes with fixed vulnerabilities will still appear in the attack path, which may cause security personnel to overestimate the attack risk faced by the network and waste unnecessary security resources. The update process ensures that the attack paths in the path map are based on the current network reality, improving the accuracy of risk assessment.

[0127] In a preferred embodiment, the present invention can also update the network attack path map when an abnormality occurs in the device and the abnormality lasts longer than a preset time threshold, then:

[0128] Acquire first power grid operation data for indicating that an abnormality occurs in a first device and the duration of the abnormality is greater than a preset time threshold; wherein the first device includes: a power grid device or a network device;

[0129] Marking a path node corresponding to the first device in the network attack path graph as a first node;

[0130] Marking a plurality of network attack paths including the first node in the network attack path graph as first network attack paths;

[0131] For each first network attack path, updating the current risk score of the first network attack path according to the abnormal duration and the time decay factor corresponding to the first network attack path to generate an updated risk score;

[0132] For each first network attack path, updating the current processing priority of the first network attack path according to the updated risk score to generate an updated processing priority;

[0133] The network attack path map is updated according to the updated processing priority of each first network attack path.

[0134] Indicatively, when a device status (such as a firewall blocking rate > 90%) does not recover for 5 minutes (i.e., there is an anomaly), the time attenuation factor of the relevant attack path can be applied to the risk score, and the priority of the attack path can be lowered according to the risk score, thereby achieving an update of the network attack path map.

[0135] In a preferred embodiment, the present invention can also update the network attack path map when the configuration of the device is updated, and then:

[0136] Acquire second power grid operation data for indicating that the configuration of the second device has been updated; wherein the second power grid operation data includes: configuration update time; the second device includes: power grid device or network device;

[0137] Marking the path node corresponding to the second device in the network attack path graph as a second node;

[0138] Marking a plurality of network attack paths including the second node in the network attack path graph as second network attack paths;

[0139] For each second network attack path, when it is determined that the time difference between the generation time corresponding to the second network attack path and the configuration update time is greater than a preset time difference threshold, marking the second network attack path as an expired path;

[0140] When it is determined that there is at least one expired path, the weight of the expired path is reduced, and the network attack path map is updated according to the weight of each expired path.

[0141] In principle, when the service configuration of a device is updated (such as closing port 22), the update timestamp can be compared with the attack path generation time. If the path depends on the old configuration (for example, the time difference between the two is >10 minutes), it can be marked as an expired path and the weight of the expired path can be reduced to update the network attack path map.

[0142] It's understandable that when a device anomaly occurs and its duration exceeds a preset threshold, updating the network attack path map can promptly reflect the anomaly's impact on the attack path risk. For example, a prolonged high firewall blocking rate indicates that the network is facing significant attack pressure, and the risk of the associated attack path may be changing. By updating the risk score and handling priority based on the anomaly duration and time decay factor, and updating the network attack path map, these changes can be reflected in real time, preventing security personnel from making decisions based on outdated information.

[0143] After a device configuration is updated, some existing attack paths may no longer be valid due to the configuration change. This embodiment of the present invention compares the attack path generation time with the configuration update time, marks the expired paths, and reduces their weight. This allows the network attack path map to quickly adapt to configuration changes. After the update, it can accurately reflect the actual and effective attack paths in the current network, providing a reliable basis for security analysis.

[0144] In a preferred embodiment, the present invention can also trigger the reconstruction of a subgraph of the network attack path graph when the network topology is adjusted (such as adding a new VPN tunnel). For example, attack paths are generated only for nodes in the newly added subnet, and low-risk paths in inactive periods (such as 1-5 am) are filtered through time series analysis.

[0145] It can be understood that the present invention can monitor changes in key network attributes (such as device status, network topology changes, service configuration, etc.) in real time and dynamically feed these changes into the attack graph. In a nutshell, when a change in a key attribute is detected, a corresponding event can be generated, automatically triggering an incremental update process for the attack graph, mapping the attribute change with the correlation of the attack path. For example, when the firewall policy of a key device changes, the risk score of the attack path passing through the device is automatically adjusted to ensure that the status of the nodes and edges in the attack graph is synchronized with the actual network environment. By dynamically adjusting the structure and attributes of the attack graph, the present invention can maintain the real-time accuracy of the attack graph.

[0146] Key attribute change linkage means that changes in key attributes in the network (such as device status, network topology, service configuration, etc.) can be dynamically fed back to the attack graph to ensure that the attack graph is synchronized with the actual network environment. The key attribute change set is represented as C = {c1, c2, ..., c m}, the mapping function is φ:C→ΔG, where ΔG represents the incremental update operation of the attack graph. Specifically, when the firewall policy of a key device changes c i When the mapping function φ(c iThis may include adding new attack paths, deleting attack paths, or modifying attack path attributes. This linkage mechanism ensures that the states of nodes and edges in the attack graph are always synchronized with the actual network environment, dynamically adjusting the structure and attributes of the attack graph to maintain real-time accuracy.

[0147] In a preferred embodiment, the present invention can monitor threat intelligence data streams and network status changes in real time based on a stream processing framework (Apache Kafka) and design a multi-level event triggering mechanism, which includes:

[0148] Match the timestamp of the new threat intelligence with the time window of historical attack events (such as the last hour). If the active time window of the new threat overlaps with the peak period of historical attacks, it is marked as a high-priority change event. The network attack path map can then be updated based on the threat intelligence.

[0149] The SNMP protocol is used to collect real-time device status (such as CPU load, firewall rules), network topology (such as routing table updates) and service configuration (such as port open / closed). When changes in key attributes are detected, attribute change events are generated and dynamically bound to the attack path nodes. After binding, the network attack path map can be updated.

[0150] Therefore, this invention uses an incremental update method to achieve real-time dynamic updates of the network attack graph, which can quickly reflect the latest threat intelligence and network environment changes. Compared with traditional full reconstruction methods, this significantly shortens the update cycle and ensures that the attack graph remains highly current.

[0151] It can be understood that incremental update is a method that only updates the changed parts based on the existing attack graph, rather than rebuilding the entire graph. This can improve the update efficiency and reduce the consumption of computing resources. Specifically, the original attack graph G 原 =.V 原 ,E 原 / , the newly added node set is ΔV={v n1 ,v n2 ,…,v nm}, the newly added edge set is ΔE={e m1 ,e m2 ,…,e mk}. Then the updated attack graph is represented as G 新 =.V 原 ∪ΔV,E 原 In this way, the present invention can quickly respond to new threat intelligence and network changes, and maintain the real-time and accuracy of the attack graph.

[0152] Furthermore, the risk score is used to assess the potential threat level of each attack path, usually based on multiple factors, such as path length, severity of the vulnerability involved, probability of attack success, etc. The calculation formula for the risk score of the present invention is:

[0153]

[0154] Where R(P) represents the risk score of attack path P, n is the number of vulnerabilities in path P, and w i is the weight of the i-th vulnerability, reflecting its severity, S i is the difficulty of exploiting the i-th vulnerability or the probability of successful attack. i Typically determined based on the vulnerability's CVSS (Common Vulnerability Scoring System) score:

[0155]

[0156] The CVSS score ranges from 0 to 10. Through the above formula, the risk score of the present invention can objectively reflect the threat level of the attack path and help security experts prioritize high-risk paths.

[0157] Furthermore, the present invention can also add a timestamp tag to the newly added attack path (such as the newly added path: 2025-02-17T14:30:00Z) and record an invalid timestamp for the deleted path, thereby supporting subsequent backtracking analysis.

[0158] In a preferred embodiment, the present invention can also continuously optimize the attack path risk scoring algorithm, incorporating the latest threat intelligence and network changes to improve the accuracy of risk scoring. Specific measures include: introducing more scoring factors, such as the attacker's motivation and capabilities, the exploitability of the attack path, and historical attack success rates, and using scoring models such as Bayesian networks and fuzzy logic to improve the scientificity and rationality of risk scoring.

[0159] In a preferred embodiment, the present invention can also establish an automated feedback mechanism to feed back attack graph updates to the security protection system, guiding the implementation of real-time protection measures. For example, when a high-risk attack path is identified in the attack graph, it automatically triggers protection measures such as firewall rule updates and intrusion detection system policy adjustments, ensuring that the protection system can quickly respond to and address new security threats.

[0160] In a preferred embodiment, the present invention also fully utilizes data encryption, strict access control, and comprehensive audit monitoring mechanisms during data processing and storage to ensure the security of threat intelligence data and the protection of user privacy. Data transmission security is ensured by adopting the TLS / SSL protocol, static data is protected using AES encryption technology, and multi-factor authentication and role-based access control are implemented to prevent unauthorized access and data leakage. At the same time, comprehensive audit logging and abnormal behavior detection mechanisms can promptly detect and respond to potential security threats, enhance the overall security level of the system, and ensure the credibility of network attack maps and data integrity.

[0161] In a preferred embodiment, the present invention can also ensure that the network attack graph always reflects the latest network environment and threat intelligence through dynamic adjustment and optimization mechanisms. By adjusting the attack path structure and optimizing the risk scoring algorithm, the accuracy and practicality of the attack graph can be improved. Specifically, this includes attack path structure adjustment and risk scoring optimization. The attack path structure adjustment is represented by the function θ(P, T):

[0162] P′=θ(P,T);

[0163] Where T represents new threat intelligence data, and θ includes adding new nodes, deleting fixed nodes, or modifying the properties of existing nodes. At the same time, risk score optimization is performed by updating the formula:

[0164]

[0165] Among them, w i ′ and S i ′ represent the vulnerability weight and attack success probability, respectively, recalculated based on the latest threat intelligence and network changes. Dynamic adjustment and optimization mechanisms ensure that the attack graph promptly reflects changes in the network environment and threat intelligence, improving the system's protection capabilities and response efficiency.

[0166] In summary, this invention integrates real-time threat intelligence data from multiple sources to dynamically construct and update a network attack graph, enabling continuous monitoring and assessment of potential attack paths and threat behaviors within a network environment. By employing an incremental update method, this approach promptly reflects the latest threat information and attack techniques without affecting the existing attack graph structure, significantly improving the accuracy and real-time performance of the attack graph.

[0167] By incorporating machine learning algorithms, this system can predict attack spread trends and assist the Security Operations Center (SOC) in rapid response and decision-making. Compared to traditional full-scale reconstruction methods, this method offers significant advantages in real-time performance, computational efficiency, multi-source fusion capabilities, adaptability, and security. It is suitable for complex and changing network environments, effectively improving overall network security and ensuring the safe and stable operation of critical infrastructure.

[0168] like Figure 2 As shown, based on the above-mentioned various embodiments of the method for updating the network attack path map, the present invention provides a corresponding embodiment of the device item;

[0169] An embodiment of the present invention provides a network attack path map updating device, comprising: a threat intelligence data acquisition module, a threat node marking module, a target attack path generation module, and a path map updating module;

[0170] The threat intelligence data acquisition module is used to acquire threat intelligence data used to describe the attack behavior characteristics of the network attacker; wherein the threat intelligence data includes: a plurality of attacked first power grid devices; the first power grid devices include: a first port number and a first subnet address;

[0171] The threat node marking module is configured to mark, for each first power grid device, a power grid device node of the first power grid device in a network attack path graph as a threat node; wherein the network attack path graph includes a connection relationship between a plurality of path nodes and a network attack path composed of different path nodes; the path nodes include: power grid device nodes, network device nodes, server nodes, and boundary protection nodes for implementing network boundary protection;

[0172] The target attack path generation module is configured to generate a target attack path for each threat node based on the first port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph;

[0173] The path map updating module is used to update the network attack path map by taking each target attack path corresponding to each threat node as a newly added network attack path.

[0174] It should be noted that the device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, and may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without paying any creative effort.

[0175] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0176] Based on the above-mentioned embodiments of the method for updating the various network attack path diagrams, the present invention provides corresponding embodiments of terminal equipment items.

[0177] An embodiment of the present invention provides a terminal device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a method for updating a network attack path map as described in any method embodiment of the present invention.

[0178] The terminal device may be a computing terminal device such as a desktop computer, a notebook computer, a palmtop computer, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0179] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines.

[0180] The memory can be used to store the computer program, and the processor implements various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created based on the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0181] Based on the above-mentioned various embodiments of the method for updating the network attack path map, the present invention provides a corresponding embodiment of the storage medium item.

[0182] An embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a method for updating a network attack path map as described in any method embodiment of the present invention.

[0183] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. The computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0184] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for updating a network attack path graph, characterized in that: include: Acquire threat intelligence data for describing attack behavior characteristics of a network attacker; wherein the threat intelligence data includes: a plurality of attacked first power grid devices; the first power grid devices include: a first port number and a first subnet address; For each first power grid device, marking a power grid device node of the first power grid device in a network attack path graph as a threat node; wherein the network attack path graph includes a connection relationship between a plurality of path nodes and a network attack path composed of different path nodes; the path nodes include: a power grid device node, a network device node, a server node, and a boundary protection node for implementing network boundary protection; For each threat node, a target attack path is generated based on the first port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph; Each target attack path corresponding to each threat node is used as a newly added network attack path, and the network attack path map is updated.

2. A method for updating a network attack path map according to claim 1, characterized in that: The border protection node corresponds to a plurality of second port numbers that are allowed to be accessed; the server node corresponds to a plurality of second subnet addresses managed by the server; and the network device node corresponds to a router table; Generating a target attack path according to the port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph includes: Several border protection nodes whose second port numbers are the same as the first port numbers are used as target border protection nodes; Several server nodes having the same second subnet address as the first subnet address are used as target server nodes; According to the connection relationship between the threat node and each path node in the network attack path graph, the network device node connected to the threat node is used as the target network device node; For each target network device node, determine the target data forwarding path of the threat node in each path node according to the routing table of the target network device node; According to each target boundary protection node, each target server node, each target network device node and each target data forwarding path, a target attack path corresponding to the threat node is generated.

3. A method for updating a network attack path map according to claim 2, characterized in that: Also includes: For each target attack path, the risk level corresponding to each path node is calculated based on the attack impact coefficient of the target attack path on each path node and the importance weight of each path node in the target attack path; The path node with a risk level greater than a preset level threshold is taken as the target path node, and warning information is generated to characterize the risk of intrusion on the target path node.

4. A method for updating a network attack path map according to claim 3, characterized in that: The network attack path corresponds to a path data; the path data includes: the time difference between the generation time of the network attack path and the current time, the diffusion speed of the network attack path, the attack interval period of the network attack path, the path length of the network attack path, and the node importance value of each path node in the network attack path; After the network attack path map is updated, the following steps are further included: The updated network attack path diagram is input into a preset attack spread probability prediction model, so that the attack spread probability prediction model generates a time series feature for characterizing the time evolution law of the attack behavior based on the time difference between the generation time of the network attack path in the path data and the current time, the diffusion speed of the network attack path, and the attack interval period of the network attack path; generates a structural feature for characterizing the static risk of the attack behavior based on the path length of the network attack path in the path data and the node importance value of each path node in the network attack path; performs weighted fusion of the time series feature and the structural feature based on the attention mechanism to generate a fused feature; and outputs the attack spread probability corresponding to the network attack path diagram based on the fused feature.

5. A method for updating a network attack path map according to claim 4, characterized in that: Also includes: Acquire second-grid equipment with fixed vulnerabilities; Marking the power grid device node corresponding to the second power grid device in the network attack path diagram as a node to be processed; Marking a plurality of network attack paths containing the to-be-processed nodes in the network attack path graph as to-be-processed network attack paths; For each pending network attack path, determine whether the pending network attack path is connected after deleting the pending node; if so, delete the pending node in the pending network attack path to generate an updated pending network attack path; If not, the node to be processed is used as a breakpoint to split the network attack path to be processed into an upstream attack path and a downstream attack path; it is determined whether the number of path nodes in the upstream attack path is greater than a preset number value, and if so, the upstream attack path is used as the updated network attack path to be processed; If not, delete the upstream attack path; determine whether the number of path nodes of the downstream attack path is greater than a preset number value, and if so, use the downstream attack path as the updated network attack path to be processed; If not, deleting the downstream attack path; The network attack path graph is updated according to each updated network attack path to be processed.

6. A method for updating a network attack path map according to claim 5, characterized in that: Also includes: Acquire first power grid operation data for indicating that an abnormality occurs in a first device and the duration of the abnormality is greater than a preset time threshold; wherein the first device includes: a power grid device or a network device; Marking a path node corresponding to the first device in the network attack path graph as a first node; Marking a plurality of network attack paths including the first node in the network attack path graph as first network attack paths; For each first network attack path, updating the current risk score of the first network attack path according to the abnormal duration and the time decay factor corresponding to the first network attack path to generate an updated risk score; For each first network attack path, updating the current processing priority of the first network attack path according to the updated risk score to generate an updated processing priority; The network attack path map is updated according to the updated processing priority of each first network attack path.

7. A method for updating a network attack path map according to claim 6, characterized in that: Also includes: Acquire second power grid operation data for indicating that the configuration of the second device has been updated; wherein the second power grid operation data includes: configuration update time; the second device includes: power grid device or network device; Marking the path node corresponding to the second device in the network attack path graph as a second node; Marking a plurality of network attack paths including the second node in the network attack path graph as second network attack paths; For each second network attack path, when it is determined that the time difference between the generation time corresponding to the second network attack path and the configuration update time is greater than a preset time difference threshold, marking the second network attack path as an expired path; When it is determined that there is at least one expired path, the weight of the expired path is reduced, and the network attack path map is updated according to the weight of each expired path.

8. A device for updating a network attack path map, characterized in that: include: Threat intelligence data acquisition module, threat node marking module, target attack path generation module, and path map update module; The threat intelligence data acquisition module is used to acquire threat intelligence data used to describe the attack behavior characteristics of the network attacker; wherein the threat intelligence data includes: a plurality of attacked first power grid devices; the first power grid devices include: a first port number and a first subnet address; The threat node marking module is configured to mark, for each first power grid device, a power grid device node of the first power grid device in a network attack path graph as a threat node; wherein the network attack path graph includes a connection relationship between a plurality of path nodes and a network attack path composed of different path nodes; the path nodes include: power grid device nodes, network device nodes, server nodes, and boundary protection nodes for implementing network boundary protection; The target attack path generation module is configured to generate a target attack path for each threat node based on the first port number corresponding to the threat node, the first subnet address corresponding to the threat node, and the connection relationship between the threat node and each path node in the network attack path graph; The path map updating module is used to update the network attack path map by taking each target attack path corresponding to each threat node as a newly added network attack path.

9. A terminal device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for updating a network attack path map according to any one of claims 1 to 7 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the method for updating a network attack path map according to any one of claims 1 to 7.

Images