An attack-defense relationship analysis method, system and storage medium based on artificial intelligence

Abstract

The application provides an attack-defense relationship analysis method and system based on artificial intelligence. The method includes the following steps: combing digital asset basic data, determining the network level and business service dependency relationship of the assets; optimizing the depth and breadth algorithm to determine the search depth and traversal range; adapting the important value of the associated digital assets; calculating the interaction correlation and attribute similarity; constructing reasoning rules; constructing an analysis and identification model; and embedding an analysis library to generate an adaptive defense strategy. The system includes data sorting, algorithm optimization, important value adaptation and other modules. The application can quickly locate the affected asset boundary, accurately analyze the attack-defense relationship, provide an adaptive defense strategy, and avoid affecting irrelevant assets.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an attack and defense relationship analysis method and system based on artificial intelligence. Background Technology

[0002] In recent years, with the rapid development of information technology, cyberattack methods and tools have become increasingly sophisticated and diverse. At the same time, the scale of digital assets that defenders need to protect is constantly expanding, encompassing various important data and systems of enterprises, institutions, and individuals. Against this backdrop, how to quickly and accurately locate the boundaries of affected digital assets, rationally analyze the offensive and defensive relationships involved, and derive adaptive defense strategies accordingly has become a critical issue that urgently needs to be addressed in the field of cybersecurity.

[0003] Existing attack-defense relationship analysis methods often have limitations when facing complex network environments and massive amounts of digital assets. For example, when determining the search depth and traversal range, they may not fully consider factors such as the location, business value, and deployment location of digital assets within the network architecture, leading to inaccurate analysis results and an inability to quickly locate critical assets. Furthermore, the analysis of the interaction relationships and attribute similarities between assets is not deep enough, making it difficult to construct accurate attack-defense relationship models. This affects the effectiveness of defense strategies and may even lead to situations where defensive measures negatively impact unrelated digital assets.

[0004] Therefore, there is an urgent need for a targeted, AI-based method and system for analyzing offensive and defensive relationships. Summary of the Invention

[0005] The purpose of this invention is to provide an attack and defense relationship analysis method and system based on artificial intelligence, so as to provide adaptive defense strategies quickly and accurately, and avoid the impact of defense measures on other unrelated digital assets.

[0006] Firstly, this application provides an attack-defense relationship analysis method based on artificial intelligence, the method comprising:

[0007] Organize basic data on digital assets, collect interaction characteristics of digital assets carried in network traffic, and determine the relationship between digital assets in terms of network layer and business service dependencies.

[0008] Based on the location and interaction of digital assets in the network architecture, the depth algorithm is optimized to determine the search depth; based on the business value and deployment location of digital assets, the breadth algorithm is optimized to define the traversal range.

[0009] According to the business requirements, different scene information is determined, and according to the search depth, the range of traversal and the scene information, the knowledge graph adapts the important value of the corresponding associated digital assets;

[0010] The duration of the traffic interaction is calculated by using the timestamp, and the average value of the traffic is calculated accordingly. The real-time traffic data is compared with the average value to determine the intensity of the traffic interaction. A threshold value is set to determine the strength of the correlation between systems, and the interaction correlation is obtained.

[0011] The text data contained in the attribute characteristics of the digital assets is encoded with labels, and each category is mapped to a unique number. The BERT model is used to perform deeper vectorization processing on the text data to calculate the attribute similarity.

[0012] When an asset has vulnerability 1 and vulnerability 2, if vulnerability 1 is exploited by an attacker to obtain user permissions, and vulnerability 2 requires user permissions before being exploited by an attacker, vulnerability 1 and vulnerability 2 can be continuously exploited. When an asset has a vulnerability, a connection relationship between the vulnerability and the asset is established. If there are asset 1 and asset 2, asset 1 can access asset 2, and asset 2 has a vulnerability. If the vulnerability requires user permissions before being exploited by an attacker, a connection relationship between asset 1 and the vulnerability is established. If an asset has a vulnerability, and the vulnerability has a specific mitigation measure, the asset uses the mitigation measure.

[0013] The interaction correlation and the attribute similarity are analyzed, the data processed by the algorithm is labeled, the target assets to be evaluated are classified based on the important value of the digital assets, different weight values are defined for the interaction correlation and the attribute similarity for different types, a decision tree is constructed, the dependency relationship values of the core assets and the non-core assets are calculated, and the construction of the analysis and recognition model is completed.

[0014] The analysis and recognition model and the reasoning rules are embedded in the digital asset analysis library, which can analyze the attack-defense relationship of the target assets and obtain an adaptive defense strategy.

[0015] In a second aspect, the present application provides an attack-defense relationship analysis system based on artificial intelligence, which comprises:

[0016] The data collation module is used to collate the digital asset basic data, collect the interaction characteristics of the digital assets carried in the network traffic, and determine the relationship of the digital assets in the network level and the business service dependency;

[0017] The algorithm optimization module is used to optimize the search depth according to the position and interaction of the digital assets in the network architecture, and to optimize the traversal range according to the business value and deployment position of the digital assets.

[0018] An importance value adaptation module is configured to determine scene information according to service requirements, combine search depth, traversal range and scene information, and adapt the importance value of the associated digital assets by using a knowledge graph.

[0019] An interaction correlation calculation module is configured to calculate the duration and average value of traffic interaction by using timestamps, compare real-time traffic data with the average value, set a threshold to determine the strength of the correlation between systems, and obtain the interaction correlation.

[0020] An attribute similarity calculation module is configured to perform label encoding and BERT model processing on text data in the attribute features of the digital assets, and calculate the attribute similarity.

[0021] An inference rule construction module is configured to construct inference rules and clarify the relationship between assets, vulnerabilities and mitigation measures.

[0022] A model construction module is configured to analyze the interaction correlation and attribute similarity, label data, classify target assets based on the importance value, define weights to construct a decision tree, calculate dependency values, and complete the construction of an analysis and recognition model.

[0023] An analysis library embedding module is configured to embed the analysis and recognition model and the inference rules into a digital asset analysis library, analyze the attack-defense relationship for target assets, and obtain an adaptive defense strategy.

[0024] In a third aspect, the present application provides an attack-defense relationship analysis system based on artificial intelligence, which comprises a processor and a memory.

[0025] The memory is configured to store program code and transmit the program code to the processor.

[0026] The processor is configured to execute the method according to the instructions in the program code.

[0027] In a fourth aspect, the present application provides a computer readable storage medium for storing program code, which is used to implement the method according to any one of the possible implementations of the first aspect.

[0028] Advantages

[0029] The application provides an attack-defense relationship analysis method and system based on artificial intelligence, which combs digital asset basic data, determines reasonable search depth and traversal range according to the relationship between assets in the network level and business service dependence, adapts the importance value of the associated digital assets, constructs an analysis and identification model, and can quickly locate the boundary of the affected digital assets. The attack-defense relationship analysis based on this can fully consider the interactive correlation and attribute similarity between assets, combine the constructed reasoning rules, more accurately analyze the attack-defense process, and thus better give adaptive defense strategies, overcoming the problem that existing defense measures have a negative impact on irrelevant digital assets, and meeting the demand for quickly and accurately providing adaptive defense strategies.

[0030] The method and system of the application have the following advantages and effects:

[0031] The interactive correlation and attribute similarity between assets can be fully considered, the constructed reasoning rules can be combined, the attack-defense process can be more accurately analyzed, and thus adaptive defense strategies can be better given;

[0032] The problem that existing defense measures have a negative impact on irrelevant digital assets is overcome, and the demand for quickly and accurately providing adaptive defense strategies is met. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

[0034] Figure 1 The flowchart of the application;

[0035] Figure 2 The system architecture diagram of the application. DETAILED DESCRIPTION

[0036] The preferred embodiments of the application will be described in detail below with reference to the drawings, so that the advantages and features of the application can be more easily understood by those skilled in the art, and the protection scope of the application can be more clearly and definitely defined.

[0037] The attack-defense relationship analysis method based on artificial intelligence provided in the application comprises:

[0038] Step one, comb digital asset basic data, construct a digital asset basic data set, and form basic associations, including:

[0039] Data resources are obtained from a business database, logs of security equipment, data of network traffic equipment, data of asset mapping, and manual statistical forms.

[0040] Develop a comprehensive data model, set uniform fields and data structures for each type of data, format and standardize data resources from different sources;

[0041] Remove invalid or incomplete records and verify the validity and accuracy of the data;

[0042] Implement data fusion to match and integrate data from different data sources but associated with each other;

[0043] Collect asset interaction features of network traffic, analyze indicators, obtain key information of network activity and communication intensity, and then understand the usage and performance of the network, build a traffic interaction heat evaluation framework, and identify the traffic interaction strength between target business and associated business;

[0044] In some preferred embodiments, indicators are collected, and by analyzing these indicators, key information of network activity and communication intensity can be obtained.

[0045] Identify asset association features based on expert experience, determine the relationship between assets in terms of network level and service dependency by analyzing the first feature, understand the location and interaction of assets in the network architecture; by analyzing the second feature, determine the association of assets in business and physical layers, understand the business value and deployment location of assets;

[0046] In some preferred embodiments, the first feature includes IP, port, system_layer, web_layer and the like, and the second feature includes asset_name, business_layer and physical_layer and the like.

[0047] The definitions of each feature are as follows:

[0048] asset_name: asset name, used to identify a specific asset.

[0049] IP: IP address of the asset, which is the key identifier of the asset network identity.

[0050] port: port opened by asset IP, reflecting the type of network service provided by the asset.

[0051] business_layer: indicates the classification of assets in the business layer.

[0052] physical_layer: indicates the characteristics of assets in the physical layer.

[0053] system_layer: indicates the hierarchy of assets in the system architecture.

[0054] web_layer: to present the location of assets in the network architecture.

[0055] According to the understanding of the location and interaction of assets in the network architecture, the depth algorithm is optimized, the location is adopted, and the depth search is terminated in time to avoid falling into an infinite loop, and according to the understanding of the business value and deployment location of the assets, the breadth strategy is optimized, the reasonable range of traversal is determined according to the business value, and the attack path and attack relationship are inferred and judged within the reasonable range, so as to avoid too large range and avoid discovering hidden attack paths and attack behaviors.

[0056] Collect asset attribute characteristics based on asset mapping, use the third characteristic to identify software dependency between assets, understand the mutual dependency of assets in software configuration and service; analyze the network connection and communication dependency between assets by analyzing the fourth characteristic, and reveal how assets interact through network ports and information systems;

[0057] In some preferred embodiments, the third characteristic includes component_name, version, service_provider, and deployment_environment, and the fourth characteristic includes re_ip, re_system, affiliated_unit, and re_port.

[0058] In the asset correlation feature, the main data feature list includes [component_name, version, re_ip, re_system, affiliated_unit, re_port, service_provider, deployment_environment], and the definition of each feature is as follows:

[0059] component_name (component name): used to identify a specific component in the asset.

[0060] version (version number): represents the version information of the component.

[0061] re_ip (associated IP asset): indicates other IP assets associated with the asset.

[0062] re_system (associated information system): indicates which information systems the asset is associated with.

[0063] affiliated_unit (affiliated unit): indicates the unit or organization to which the asset belongs.

[0064] re_port (relevant port): shows the network port connection between assets and other assets.

[0065] service_provider (service provider): refers to the provider that provides services for the asset.

[0066] deployment_environment (deployment environment): describes the deployment of the asset, such as cloud environment or local environment.

[0067] Step two, network security threat detection and response, abnormal behavior monitoring, security incident correlation analysis, network security situation awareness, including:

[0068] Define various entity categories, depict the classification system of assets at different levels, and describe the attributes and characteristics of assets;

[0069] Cypher query language is used to store data and build corresponding nodes and relationships in the knowledge graph;

[0070] The integrity, consistency and accuracy of the knowledge graph are tested through a series of standards and methods, and are identified and corrected;

[0071] According to business needs, use knowledge graph to support decision making, risk assessment, threat analysis in various scenarios, regularly update knowledge graph data, and continuously monitor and optimize the system;

[0072] Based on the start time recorded in the traffic data, the total number of bytes of traffic between different IPs in the same time period is extracted, and the traffic interaction frequency is calculated;

[0073] Use timestamps to calculate the duration of traffic interaction, and calculate the average value of traffic accordingly;

[0074] Compare real-time traffic data with the average value to determine the strength of traffic interaction, set a threshold value, and determine the strength of the association between systems according to this threshold value to obtain the interaction correlation;

[0075] Label encoding is used for text data contained in asset attribute features, mapping each category to a unique number, and using the BERT model for deeper vectorization processing of text data to calculate attribute similarity and reflect semantic association between texts;

[0076] Detailed similarity calculation is performed on asset attribute features to accurately identify and evaluate the correlation strength between asset attributes. For this purpose, cosine similarity is chosen as the calculation method, which is suitable for processing numerical data. Since asset attribute features contain text data, these text data need to be vectorized first.

[0077] Since the data comes from different technical capabilities and each group name is different, the label encoding may not effectively capture the semantic information between these names. To solve this problem, the BERT model is introduced, which performs a deeper vectorization of the text data, allowing the calculated similarity to better reflect the semantic association between texts.

[0078] Constructing inference rules, when an asset has vulnerability 1 and vulnerability 2, if vulnerability 1 is exploited by an attacker to obtain user permissions, and vulnerability 2 requires user permissions before being exploited by an attacker, vulnerability 1 and vulnerability 2 can be exploited continuously; when an asset has a vulnerability, a connection relationship between the vulnerability and the asset is established; if there are asset 1 and asset 2, asset 1 can access asset 2, and asset 2 has a vulnerability, if the vulnerability requires user permissions before being exploited by an attacker, a connection relationship between asset 1 and the vulnerability is established; if an asset has a vulnerability, and the vulnerability has a specific mitigation measure, the asset uses the mitigation measure.

[0079] BERT (Bidirectional Encoder Representations from Transformers) is a pre-trained deep learning model based on Transformer, used for understanding natural language. Its core idea is to capture rich language features and contextual information through a language model pre-trained on a large amount of text data, and then apply these pre-trained language representations to downstream NLP tasks through fine-tuning.

[0080] The innovation of BERT lies in the adoption of a bidirectional Transformer architecture, allowing the model to consider both left and right contextual information for each word in the input text, thus more accurately understanding language. Its pre-training includes two main tasks:

[0081] Masked Language Model (MLM): Randomly mask some words in a sentence (e.g., replace 15% of the words with a special token [MASK]) and then let the model predict these masked words. This way forces the model to learn more comprehensive contextual information to better understand and predict words.

[0082] Next Sentence Prediction (NSP): Given two sentences A and B, the model needs to predict whether B is the next sentence of A. This helps the model learn to understand the relationship between sentences, which is particularly important for tasks that require understanding the logical relationship between sentences, such as question-answering systems.

[0083] The Transformer is the core architecture of BERT, which relies on the self-attention mechanism to process sequence data. The self-attention mechanism allows the model to consider all elements in the sequence when processing each element of the sequence and dynamically adjust the correlation weight between different elements. This mechanism enables the model to effectively capture long-distance dependencies and complex contextual relationships.

[0084] The Transformer architecture consists of both an encoder and a decoder, but in BERT only the encoder part of the Transformer is used. The encoder is stacked with multiple identical layers, each of which mainly contains two sub-layers: multi-head self-attention and feed-forward networks. The multi-head self-attention layer captures different aspects of information in parallel by dividing attention into multiple heads, improving the model's sensitivity to different position information. The feed-forward network further processes the representation of each position.

[0085] Through this structure, the BERT model can learn complex language representations from words to sentences and even entire documents, providing strong language understanding capabilities for various NLP tasks.

[0086] Step three, decision-making of defense strategy and disposal strategy, including:

[0087] Analyze the interaction relevance and attribute similarity, label the data processed by the algorithm, classify the target assets to be evaluated based on asset importance, define different weight values for interaction relevance and attribute similarity for different types, construct a decision tree, and calculate the dependency relationship values of core assets and non-core assets;

[0088] First, classify the target assets to be evaluated based on asset importance, and define the weights of interaction relevance and attribute similarity in the dependency relationship calculation process as 0.8 and 0.2 respectively for core assets. For non-core assets, based on the deployment location of the target assets, classify the assets deployed in the core area, and define the weights of interaction relevance and attribute similarity in the dependency relationship calculation process as 0.6 and 0.4 respectively. For non-core assets deployed in non-core areas, based on the asset type, classify the target assets, and define the weights of interaction relevance and attribute similarity as 0.6 and 0.4 respectively for production systems, and as 0.5 and 0.5 respectively for non-production systems.

[0089] The calculated dependency value is compared with a range of authorized threshold values to obtain a qualitative evaluation of the strength of the dependency, and the construction of the analysis and identification model is completed.

[0090] The digital asset association knowledge graph and reasoning rules are embedded in the digital asset association basic library bottom layer to realize dynamic and comprehensive digital asset bottom account management, and the results of asset relationship identification and intelligent recommendation are output to the linkable security capability and security hub to provide important asset data for vulnerability detection, threat research and judgment, event impact assessment, and support dynamic management of security risks and auxiliary security decision-making.

[0091] The analysis and identification model and the reasoning rules are embedded in the digital asset analysis library to analyze the attack and defense relationship of the target asset with the digital asset, and obtain an adaptive defense strategy.

[0092] In some preferred embodiments, the analysis and identification model accepts the IP address of the asset as input, and uses the Cypher query language to retrieve relevant asset basic data, traffic interaction data, and asset attribute data from the graph database.

[0093] Next, these extracted data are respectively sent to an interaction correlation analysis algorithm based on knowledge graph traffic data and an attribute similarity evaluation algorithm based on knowledge graph attribute data for processing. After the processing of these two algorithms, the interaction correlation value and the attribute similarity value are output, which are then input into an expert system-based decision tree algorithm. Through this series of steps, the final accurate calculation result is obtained.

[0094] Figure 2 The architecture diagram of the attack and defense relationship analysis system based on artificial intelligence provided in the present application, the system comprises:

[0095] The data collation module is used for collating digital asset basic data, collecting the interaction features of digital assets carried in network traffic, and determining the relationship of digital assets in network level and business service dependency;

[0096] The algorithm optimization module is used for optimizing the search depth according to the position and interaction of digital assets in the network architecture, and optimizing the traversal range according to the business value and deployment position of digital assets;

[0097] The important value adaptation module is used for determining scene information according to business requirements, combining search depth, traversal range and scene information, and adapting the important value of digital assets by using a knowledge graph;

[0098] The interaction correlation calculation module is used for calculating the traffic interaction duration and average value by using the timestamp, comparing the real-time traffic data with the average value, setting a threshold to determine the strength of the inter-system correlation, and obtaining the interaction correlation.

[0099] An attribute similarity calculation module is configured to perform label coding and BERT model processing on text data in the digital asset attribute features, and calculate attribute similarity;

[0100] An inference rule construction module is configured to construct inference rules, and explicitly define the relationship between assets, vulnerabilities, and mitigation measures;

[0101] A model construction module is configured to analyze interaction relevance and attribute similarity, label data, classify target assets based on importance values, define weights to construct a decision tree, calculate dependency values, and complete construction of an analysis and identification model;

[0102] An analysis library embedding module is configured to embed the analysis and identification model and the inference rules into a digital asset analysis library, analyze attack and defense relationships for target assets, and obtain an adaptive defense strategy.

[0103] The present application provides an attack and defense relationship analysis system based on artificial intelligence, which comprises a processor and a memory:

[0104] The memory is configured to store program code and transmit the program code to the processor;

[0105] The processor is configured to execute the method according to the instructions in the program code.

[0106] The present application provides a computer readable storage medium for storing program code, which is used to implement the method according to any one of the embodiments of the first aspect.

[0107] In specific implementations, the present application further provides a computer storage medium, wherein the computer storage medium can store a program, and the program can include some or all steps in the embodiments of the present application when executed. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM) and the like.

[0108] Those skilled in the art can clearly understand that the technology in the embodiments of the present application can be realized by means of software and necessary general hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present application or the parts that make contributions to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as a ROM / RAM, a magnetic disk, an optical disk and the like, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device and the like) to execute the method described in the embodiments of the present application or some parts of the embodiments.

[0109] Reference can be made to the same or similar parts between different embodiments of the specification. In particular, for the embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the description in the method embodiments.

[0110] The above-described embodiments of the present application do not constitute a limitation on the protection scope of the present application.

Claims

1. An artificial intelligence-based attack-defense relationship analysis method, characterized by, The method comprises: combing digital asset basic data, collecting the interaction characteristics of digital assets carried in network traffic, and determining the relationship of digital assets in network level and business service dependence; According to the position and interaction of digital assets in the network architecture, the depth algorithm is optimized to determine the depth of the search; according to the business value and deployment position of the digital assets, the breadth algorithm is optimized to determine the range of traversal; According to the business demand, different scene information is determined, according to the depth of the search, the range of traversal and the scene information, the important value of the corresponding associated digital assets is adapted by using the knowledge graph; The duration of traffic interaction is calculated by using the timestamp, and the average value of the traffic is calculated, the real-time traffic data is compared with the average value, the strength of the traffic interaction is judged, the threshold value is set, and the correlation between the systems is determined according to the threshold value, and the interaction correlation is obtained; The text data contained in the attribute characteristics of the digital assets is encoded by using label encoding, each category is mapped to a unique number, the text data is vectorized by using the BERT model, and the attribute similarity is calculated; When the asset has vulnerability 1 and vulnerability 2, if the attacker obtains user permission after vulnerability 1 is exploited, and the permission required before vulnerability 2 is exploited by the attacker is user permission, vulnerability 1 and vulnerability 2 are exploited continuously; when the asset has a vulnerability, a connection relationship between the vulnerability and the asset is established; if there are asset 1 and asset 2, asset 1 can access asset 2, and asset 2 has a vulnerability, if the permission required before the vulnerability is exploited by the attacker is user permission, a connection relationship between asset 1 and the vulnerability is established; if the asset has a vulnerability, and the vulnerability has a specific mitigation measure, the asset uses the mitigation measure; The interaction correlation and the attribute similarity are analyzed, the real-time traffic data processed by the depth algorithm and the breadth algorithm are labeled, the target assets to be evaluated are classified based on the important value of the digital assets, different weight values are defined for the interaction correlation and the attribute similarity according to different types, a decision tree is constructed, the dependency relationship value of the core asset and the non-core asset is calculated, the calculated dependency relationship value is compared with the approved threshold range, the qualitative evaluation of the strength of the dependency relationship is obtained, and the construction of the analysis and identification model is completed; The analysis and identification model and the reasoning rule are embedded in the digital asset analysis library, the attack and defense relationship of the target asset is analyzed, and the self-adaptive defense strategy is obtained.

2. The method of claim 1, wherein: The combing of the digital asset basic data includes the collection and arrangement of the type, position, business function and vulnerability information of the digital assets.

3. The method of claim 1, wherein: When the depth algorithm and the breadth algorithm are optimized, the factors considered also include the complexity of the network and the security level of the assets.

4. An artificial intelligence-based attack-defense relationship analysis system, characterized by, The system comprises: a data combing module for combing digital asset basic data, collecting the interaction characteristics of digital assets carried in network traffic, and determining the relationship of digital assets in network level and business service dependence; An algorithm optimization module is configured to optimize a deep algorithm to determine a search depth according to a position and interaction of the digital assets in the network architecture, and to optimize a breadth algorithm to determine a traversal range according to a business value and a deployment position of the digital assets; An importance value adaptation module is configured to determine scene information according to a business requirement, to adapt an importance value of the associated digital assets by combining the search depth, the traversal range and the scene information, and to use a knowledge graph. An interaction correlation calculation module is configured to calculate a traffic interaction duration and an average value by using a timestamp, to compare real-time traffic data with the average value, to determine a strength of the traffic interaction, to set a threshold to determine a strength of a correlation between systems, and to obtain the interaction correlation. An attribute similarity calculation module is configured to encode text data in attribute features of the digital assets into labels, to map each category to a unique number, to perform vectorization processing on the text data by using a BERT model, and to calculate an attribute similarity. An inference rule construction module is configured to construct inference rules to clearly define relationships between assets, vulnerabilities and mitigation measures, including: when an asset has a vulnerability 1 and a vulnerability 2, if the vulnerability 1 is exploited by an attacker to obtain user permissions and the vulnerability 2 needs user permissions before being exploited by the attacker, the vulnerability 1 and the vulnerability 2 are continuously exploited; when an asset has a vulnerability, a connection relationship between the vulnerability and the asset is established; if there are an asset 1 and an asset 2, the asset 1 can access the asset 2, and the asset 2 has a vulnerability, a connection relationship between the asset 1 and the vulnerability is established if the vulnerability needs user permissions before being exploited by an attacker; if an asset has a vulnerability, and the vulnerability has a specific mitigation measure, the asset uses the mitigation measure. A model construction module is configured to analyze the interaction correlation and the attribute similarity, to label real-time traffic data processed by the deep algorithm and the breadth algorithm, to classify target assets to be evaluated based on an importance value of the digital assets, to define different weight values for the interaction correlation and the attribute similarity for different types, to construct a decision tree, to calculate a dependency relationship value of a core asset and a non-core asset, to compare the calculated dependency relationship value with a specified threshold range to obtain a qualitative evaluation of a strength of the dependency relationship, and to complete construction of an analysis and identification model. An analysis library embedding module is configured to embed the analysis and identification model and the inference rules into a digital asset analysis library, to analyze an attack and defense relationship for a target asset, and to obtain an adaptive defense strategy.

5. An artificial intelligence-based attack-defense relationship analysis system, characterized by, The system includes a processor and a memory: The memory is configured to store program code and transmit the program code to the processor; The processor is configured to execute instructions in the program code to implement the method of any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium is configured to store program code, and the program code is configured to be executed by the processor to implement the method of any one of claims 1-3.

Images