Multi-dimensional data unknown threat identification system and method thereof

Abstract

The invention discloses a multi-dimensional data unknown threat identification system and method, and relates to the technical field of network security, and the method comprises the steps: extracting entity data, asset data and traffic data in log information according to a time sequence, and generating a ternary data set (entity data, asset data and traffic data); according to the multi-dimensional data unknown threat identification system and method, a ternary data set (entity data, asset data and flow data) is collected, whether the flow data is known abnormal data or not is analyzed, and if not, the unknown threat is identified; and if yes, analyzing whether the traffic data of the ternary data groups which are similar to the asset data, the traffic data and the entity data of the corresponding ternary data groups in the time sequence conform to the attack stage characteristics or not, and calculating the probability and the risk level that the sequence is an attack sequence, so that the risk level of the ternary data groups corresponding to the unknown traffic data can be judged according to the risk level of the ternary data groups. And the effect of identifying unknown threats is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a multi-dimensional data unknown threat identification system and method. Background Art

[0002] With the rapid development of information technology, the internet has become deeply integrated into every aspect of life, becoming an indispensable part of modern society. However, at the same time, information theft and privacy violations via the internet have become increasingly rampant, bringing unprecedented convenience to people while also posing severe security challenges. Cybersecurity has become a major concern, and ensuring cybersecurity to protect citizens' personal information and businesses' trade secrets is a pressing issue that needs to be addressed.

[0003] Prior art publication CN116192470A discloses an unknown threat identification method based on adaptive snapshot integration, applied to the real-time, refined classification of encrypted network traffic and capable of identifying unknown threats caused by concept drift. The method comprises an encrypted traffic preprocessing and feature extraction module; an encrypted traffic time series feature neural network classification module; a new traffic classification module; a snapshot integration module; and a transfer learning module. This method can cope with the increasing volume of unknown anomaly traffic and provide clustering results for expert labeling. It also effectively addresses concept drift and category imbalance, thereby ensuring the reliability of anomaly traffic detection.

[0004] However, with the continuous iteration and advancement of network security technology, malicious programs are also constantly being updated. How to quickly identify whether the unknown types of behaviors of the program are malicious and improve the identification and judgment of unknown threats is a problem that needs to be solved. Summary of the Invention

[0005] The purpose of the present invention is to provide a multi-dimensional data unknown threat identification system and method thereof to address the above-mentioned deficiencies in the prior art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for identifying unknown threats from multi-dimensional data, comprising the following steps:

[0007] S1. Extract entity data, asset data, and traffic data from the log information in time series to generate a triplet of (entity data, asset data, traffic data);

[0008] S2. Perform cluster analysis on the asset data and traffic data based on the ternary data group, respectively, to obtain multiple ternary data group asset similarity clusters and multiple ternary data group traffic similarity clusters, and take the intersection of the ternary data group asset similarity clusters and the ternary data group traffic similarity clusters to generate a set of ternary data group asset traffic similarity clusters;

[0009] S3. Based on the traffic data and known abnormal traffic data, analyze whether the traffic data is a known abnormality. If not, obtain an unknown traffic triplet data set.

[0010] S4, searching the three-dimensional data group containing the asset data and flow data in the unknown flow three-dimensional data group in the asset flow similar cluster set of the three-dimensional data group to generate a similar unknown three-dimensional data group set;

[0011] S5. Based on the entity data and the set of similar unknown triple data groups, a character matching search is performed to generate a set of unknown triple data groups similar to the entity;

[0012] S6. Arranging the triple data groups in the set of similar unknown triple data groups of the same entity in time sequence to generate a set of similar unknown entity operation sequences;

[0013] S7. Perform abnormal risk level analysis on the similar unknown entity operation sequence to generate abnormal risk level data of the similar unknown entity operation sequence.

[0014] Furthermore, the S2 includes the following steps:

[0015] S21. Perform cluster analysis on the asset data of the triple data group based on DBSCAN clustering to generate multiple triple data group asset similarity clusters, each cluster consisting of multiple triple data groups with similar assets;

[0016] S22. Perform cluster analysis on the traffic data of the triple data group based on DBSCAN clustering to generate multiple triple data group traffic similarity clusters, each cluster consisting of multiple triple data groups with similar traffic; wherein the asset data and traffic data need to be standardized before using DBSCAN clustering;

[0017] S23. Intersections are taken for each of the three-dimensional data group asset similarity clusters and the three-dimensional data group traffic similarity clusters to generate a set of three-dimensional data group asset traffic similarity clusters. In one embodiment, there are three-dimensional data group asset similarity cluster 1, three-dimensional data group asset similarity cluster 2, three-dimensional data group asset similarity cluster 3, three-dimensional data group traffic similarity cluster a, and three-dimensional data group traffic similarity cluster b. Thus, there are six intersection combinations: 1a, 1b, 2a, 2b, 3a, and 3b.

[0018] Furthermore, the S3 includes the following steps:

[0019] S31, collecting known abnormal traffic data;

[0020] S32, normalizing the known abnormal traffic data and the traffic data to generate known abnormal traffic normalized data and traffic normalized data;

[0021] S33, calculating the cosine similarity between the known abnormal traffic normalization data and the traffic normalization data, and determining whether it is greater than a set cosine similarity threshold;

[0022] S34: If not, mark the triplet data group corresponding to the traffic data as an unknown traffic triplet data group.

[0023] Furthermore, the S4 includes the following steps:

[0024] S41, collecting the unknown traffic triple data groups to generate an unknown traffic triple data group set;

[0025] S42. Based on the double pointer method, search for the triple data group asset flow similarity cluster set and the triple data group asset flow similarity cluster with the same asset data and flow data in the unknown flow triple data group set, and generate a similar unknown triple data group set based on the triple data groups in the triple data group asset flow similarity cluster searched out.

[0026] Furthermore, the S5 includes the following steps:

[0027] S51. Perform statistical processing on the entity data to generate an entity data individual set;

[0028] S52. Based on the double pointer method, search for similar unknown triple data groups with the same entity data in the entity data individual set and generate a set of similar unknown triple data groups with the same entity data.

[0029] Furthermore, the step S7 includes the following steps:

[0030] S71. Collect attack phase traffic characteristic data and generate attack phase traffic characteristic data set , represents the traffic characteristic data of the oth attack stage, ;

[0031] S72, for each similar unknown entity operation sequence in the similar unknown entity operation sequence set, search for matching attack phase traffic feature data in the attack phase traffic feature data set G. , including the following steps:

[0032] S721, normalize the G and L to generate and ;

[0033] S722, in the Randomly generate n attack phase search particles , ;

[0034] S723, initializing algorithm parameters, maximum number of iterations T;

[0035] S724, will and The cosine similarity plus one is taken as the reciprocal as the fitness function, and the fitness function is calculated based on the fitness function. The fitness value of

[0036] S725, will The attack phase searches for the optimal individual position of the particle , the one with the smallest current fitness value As the optimal position of the group ;

[0037] S726, based on and right Update the speed and position;

[0038] The speed update formula is as follows:

[0039] ,

[0040] The position update formula is as follows:

[0041] ,

[0042] ,

[0043] Where t is the current iteration number, is the velocity inertia, and is the learning rate, 、 ~U(0,1) is a random number;

[0044] S727, calculation The fitness value of The fitness value is less than The fitness value of To update, if The minimum fitness value is less than The fitness value of , then use the minimum fitness value corresponding to right Make updates;

[0045] S728, determine whether the maximum number of iterations T is reached, if so, output Corresponding ;

[0046] S73, arranging the output according to the order of each unknown triple data group similar to the entity in each similar unknown entity operation sequence , generating similar unknown entity operation attack phase sequences.

[0047] S74. Calculate the attack phase probability corresponding to the traffic data from the unknown traffic triple data group to the last unknown triple data group similar to the entity in the attack phase sequence of the similar unknown entity operation based on the Markov chain, and generate entity operation sequence abnormality probability data;

[0048] S75. Collect risk level-operation sequence abnormality probability data, generate a risk level-operation sequence abnormality probability data set, and search the risk level-operation sequence abnormality probability data set for risk level-operation sequence abnormality probability data that matches the entity operation sequence abnormality probability data based on a brute force search method to generate entity operation sequence risk level data.

[0049] Furthermore, the method further comprises:

[0050] S81. Collect management plan data corresponding to the risk level of each entity operation sequence to generate a management plan-entity operation sequence risk level data set;

[0051] S82. Based on a brute force search method, searching the management solution-entity operation sequence risk level data set for a management solution that matches the entity operation sequence risk level data, and generating management solution feedback data;

[0052] S83. Execute management operations based on the feedback data of the management plan, wherein the management plan includes marking the entity data, asset data and flow data in the unknown flow triple data group with corresponding entity risk level tags and flow risk level tags according to the size of the entity operation sequence risk level data, and providing feedback reminders.

[0053] A multi-dimensional data unknown threat identification system includes a data acquisition module, a storage, a processor, and a feedback module.

[0054] The data collection module is used to collect log information, known abnormal traffic data, attack phase traffic feature data, and management plan data corresponding to the risk level of each entity operation sequence and store them in the storage;

[0055] Memory is also used to store computer programs;

[0056] The processor is used to execute a computer program to implement a multi-dimensional data unknown threat identification method provided by the present invention;

[0057] The feedback module is used to send management plan feedback data to system administrators.

[0058] 1. Compared with the prior art, the present invention provides a multi-dimensional data unknown threat identification system and method. By collecting (entity data, asset data, flow data) triple data groups and analyzing whether the flow data is known abnormal data, if not, the flow data of the triple data groups with similar asset data, similar flow data, and the same entity data as the corresponding triple data groups in the time series are analyzed to see whether they meet the characteristics of the attack stage. The probability and risk level of the sequence being an attack sequence are calculated, so as to identify the risk level of the triple data groups corresponding to the unknown flow data based on the risk level of the triple data groups with similar data, similar flow data, and the same entity data, thereby achieving the effect of identifying unknown threats.

[0059] 2. Compared with the existing technology, the present invention provides a multi-dimensional data unknown threat identification system and method, which marks the threat level of the traffic data and entity data in the corresponding triple data group of unknown traffic data according to the risk level of the triple data group with similar asset data, similar traffic data, and identical entity data, and provides corresponding risk warnings for asset data, thereby improving the system's subsequent recognition speed of the abnormal traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0061] Figure 1 A diagram of method steps provided by an embodiment of the present invention;

[0062] Figure 2 This is a system structure block diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0064] Example embodiments will be described more fully hereinafter with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the scope of this disclosure to those skilled in the art.

[0065] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0066] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0067] The terms used herein are used only to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a," "an," and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements, and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or groups thereof is not excluded.

[0068] The embodiments described herein may be described with reference to plan views and / or cross-sectional views, with the aid of idealized schematic diagrams of the present disclosure. Thus, the example illustrations may be modified based on manufacturing techniques and / or tolerances. Therefore, the embodiments are not limited to the embodiments shown in the accompanying drawings, but include modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the accompanying drawings are schematic in nature, and the shapes of the regions shown in the drawings illustrate specific shapes of the regions of the elements, but are not intended to be limiting.

[0069] See also Figure 1 , a multi-dimensional data unknown threat identification method, comprising the following steps:

[0070] S1. Extract entity data, asset data, and traffic data from log information in time series to generate a (entity data, asset data, traffic data) triplet. Entity data can include user ID, service account, host name, IP address, process ID, etc. Entity data also includes supplementary entity data, such as the entity's department, role, permission level, and geographic location. Asset data can include server host name, database instance name, API endpoint URL, and sensitive file path. It also includes related supplementary data, such as web server / DB / file storage, criticality level (such as high, medium, and low), business line, and exposure surface (such as internal and external). Traffic data includes source address, destination address, protocol (such as TCP, UDP, and ICMP), application layer protocol (such as HTTP and SMB), timestamp, packet / byte size, connection status (such as SYN, ACK, FIN, and RST), DNS query / response, and certificate information.

[0071] S2. Perform cluster analysis on the asset data and traffic data based on the ternary data group respectively to obtain multiple ternary data group asset similarity clusters and multiple ternary data group traffic similarity clusters, and take the intersection of the ternary data group asset similarity clusters and the ternary data group traffic similarity clusters to generate a set of ternary data group asset traffic similarity clusters, including the following steps:

[0072] S21. Perform cluster analysis on the asset data of the triple data group based on DBSCAN clustering to generate multiple triple data group asset similarity clusters, each cluster consisting of multiple triple data groups with similar assets;

[0073] S22. Perform cluster analysis on the traffic data of the triple data group based on DBSCAN clustering to generate multiple triple data group traffic similarity clusters, each cluster consisting of multiple triple data groups with similar traffic; wherein the asset data and traffic data need to be standardized before using DBSCAN clustering;

[0074] S23. Intersections are taken for each of the three-dimensional data group asset similarity clusters and the three-dimensional data group traffic similarity clusters to generate a set of three-dimensional data group asset traffic similarity clusters. In one embodiment, there are three-dimensional data group asset similarity cluster 1, three-dimensional data group asset similarity cluster 2, three-dimensional data group asset similarity cluster 3, three-dimensional data group traffic similarity cluster a, and three-dimensional data group traffic similarity cluster b. Thus, there are six intersection combinations: 1a, 1b, 2a, 2b, 3a, and 3b.

[0075] S3. Based on the traffic data and the known abnormal traffic data, analyzing whether the traffic data is a known abnormality, and if not, obtaining an unknown traffic triplet data group, including the following steps:

[0076] S31. Collect known abnormal traffic data, which can be collected from the threat intelligence platform (IOC library);

[0077] S32, normalizing the known abnormal traffic data and the traffic data to generate known abnormal traffic normalized data and traffic normalized data;

[0078] S33, calculating the cosine similarity between the known abnormal traffic normalization data and the traffic normalization data, and determining whether it is greater than a set cosine similarity threshold;

[0079] If not, the data triplet corresponding to the traffic data is marked as an unknown traffic data triplet. If so, feedback can be provided based on the threat level of the known abnormal traffic normalized data matched by the traffic normalized data and the threat level of the entity data in the same data triplet, thereby quickly identifying the threat.

[0080] S4, searching for a three-dimensional data group containing asset data and flow data in the unknown flow triple data group from the asset flow similarity cluster set of the triple data group, and generating a similar unknown triple data group set, including the following steps:

[0081] S41, collecting the unknown traffic triple data groups to generate an unknown traffic triple data group set;

[0082] S42. Based on the double pointer method, search for the triple data group asset flow similarity cluster set and the triple data group asset flow similarity cluster with the same asset data and flow data in the unknown flow triple data group set, and generate a similar unknown triple data group set based on the triple data groups in the triple data group asset flow similarity cluster searched out.

[0083] S5. Based on the entity data and the set of similar unknown triple data groups, a character matching search is performed to generate a set of unknown triple data groups similar to the entity, including the following steps:

[0084] S51. Perform statistical processing on the entity data to generate an entity data individual set;

[0085] S52. Based on the double pointer method, search for similar unknown triple data groups with the same entity data in the entity data individual set, generate similar unknown triple data groups with the same entity, and collect similar unknown triple data groups with the same entity to generate a similar unknown triple data group set with the same entity.

[0086] S6. Arranging the triple data groups in the set of similar unknown triple data groups of the same entity in time sequence to generate a plurality of similar unknown entity operation sequences to form a similar unknown entity operation sequence set;

[0087] S7, performing abnormal risk level analysis on the similar unknown entity operation sequence to generate abnormal risk level data of the similar unknown entity operation sequence, including the following steps:

[0088] S71. Collect attack phase traffic characteristic data and generate attack phase traffic characteristic data set , represents the traffic characteristic data of the oth attack stage, ;

[0089] S72, for each similar unknown entity operation sequence in the similar unknown entity operation sequence set, search for matching attack phase traffic feature data in the attack phase traffic feature data set G. , including the following steps:

[0090] S721, normalize the G and L to generate and ;

[0091] S722, in the Randomly generate n attack phase search particles , ;

[0092] S723, initializing algorithm parameters, maximum number of iterations T;

[0093] S724, will and The cosine similarity plus one is taken as the reciprocal as the fitness function, and the fitness function is calculated based on the fitness function. The fitness value of

[0094] S725, will The attack phase searches for the optimal individual position of the particle , the one with the smallest current fitness value As the optimal position of the group ;

[0095] S726, based on and right Update the speed and position;

[0096] The speed update formula is as follows:

[0097] ,

[0098] The position update formula is as follows:

[0099] ,

[0100] ,

[0101] Where t is the current iteration number, is the velocity inertia, and is the learning rate, 、 ~U (0, 1) is a random number; because the attack phase traffic feature data set G has a minimum value of 0 and a maximum value of 1 after normalization, Make The value ranges from 0 to 1, that is, If the value is greater than 1, it is 1; if the value is less than 0, it is 0; if the value is between 0 and 1, it is Remain unchanged.

[0102] S727, calculation The fitness value of The fitness value is less than The fitness value of To update, if The minimum fitness value is less than The fitness value of , then use the minimum fitness value corresponding to right Make updates;

[0103] S728, determine whether the maximum number of iterations T is reached, if so, output Corresponding ;

[0104] S73, arranging the output according to the order of each unknown triple data group similar to the entity in each similar unknown entity operation sequence , generating similar unknown entity operation attack phase sequences.

[0105] S74. Calculate the attack phase probability corresponding to the traffic data from the unknown traffic triple data group to the last unknown triple data group similar to the entity in the attack phase sequence of the similar unknown entity operation based on the Markov chain, and generate entity operation sequence abnormality probability data;

[0106] S75. Collect risk level-operation sequence abnormality probability data, generate a risk level-operation sequence abnormality probability data set, and search the risk level-operation sequence abnormality probability data set for risk level-operation sequence abnormality probability data that matches the entity operation sequence abnormality probability data based on a brute force search method to generate entity operation sequence risk level data.

[0107] Furthermore, the method further comprises:

[0108] S8. Based on the management plan-entity operation sequence risk level data set and the entity operation sequence risk level data, a character matching search is performed to generate management plan feedback data, and a management operation is performed according to the management plan feedback data, including the following steps:

[0109] S81. Collect management plan data corresponding to the risk level of each entity operation sequence to generate a management plan-entity operation sequence risk level data set;

[0110] S82. Based on a brute force search method, searching the management solution-entity operation sequence risk level data set for a management solution that matches the entity operation sequence risk level data, and generating management solution feedback data;

[0111] S83. Execute management operations based on the feedback data of the management plan, wherein the management plan includes marking the entity data and flow data in the unknown flow triple data group with corresponding entity threat level tags and flow threat level tags according to the size of the entity operation sequence risk level data, marking the asset data with corresponding risk warning tags and providing feedback reminders.

[0112] See also Figure 2 The present invention also provides a multi-dimensional data unknown threat identification system, including a data acquisition module, a storage, a processor, and a feedback module.

[0113] The data collection module is used to collect log information, known abnormal traffic data, attack phase traffic feature data, and management plan data corresponding to the risk level of each entity operation sequence and store them in the storage;

[0114] Memory is also used to store computer programs;

[0115] The processor is used to execute a computer program to implement a multi-dimensional data unknown threat identification method provided by the present invention;

[0116] The feedback module is used to send management plan feedback data to system administrators.

[0117] The above description is merely illustrative of certain exemplary embodiments of the present invention. It goes without saying that those skilled in the art will be able to modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and description are illustrative in nature and should not be construed as limiting the scope of protection of the claims.

Claims

1. A method for identifying unknown threats from multi-dimensional data, characterized by: The following steps are involved: S1. Extract entity data, asset data, and traffic data from the log information in time series to generate a triplet of (entity data, asset data, traffic data); S2. Perform cluster analysis on the asset data and traffic data based on the ternary data group, respectively, to obtain multiple ternary data group asset similarity clusters and multiple ternary data group traffic similarity clusters, and take the intersection of the ternary data group asset similarity clusters and the ternary data group traffic similarity clusters to generate a set of ternary data group asset traffic similarity clusters; S3. Based on the traffic data and known abnormal traffic data, analyzing whether the traffic data is a known abnormality, and if not, obtaining an unknown traffic triplet data set; S4, searching the three-dimensional data group containing the asset data and flow data in the unknown flow three-dimensional data group in the asset flow similar cluster set of the three-dimensional data group to generate a similar unknown three-dimensional data group set; S5. Based on the entity data and the set of similar unknown triple data groups, a character matching search is performed to generate a set of unknown triple data groups similar to the entity; S6. Arranging the triple data groups in the set of similar unknown triple data groups of the same entity in time sequence to generate a set of similar unknown entity operation sequences; S7. Perform abnormal risk level analysis on the similar unknown entity operation sequence to generate abnormal risk level data of the similar unknown entity operation sequence.

2. The method for identifying unknown threats in multi-dimensional data according to claim 1, characterized in that: The S2 comprises the following steps: S21, performing cluster analysis on the asset data of the triple data group based on DBSCAN clustering to generate multiple triple data group asset similarity clusters; S22, performing cluster analysis on the traffic data of the triple data group based on DBSCAN clustering to generate multiple triple data group traffic similarity clusters; S23. Take the intersection of the three-dimensional data group asset similarity clusters and the three-dimensional data group flow similarity clusters to generate a three-dimensional data group asset flow similarity cluster set.

3. The method for identifying unknown threats from multi-dimensional data according to claim 1, characterized in that: The S3 includes the following steps: S31, collecting known abnormal traffic data; S32, normalizing the known abnormal traffic data and the traffic data to generate known abnormal traffic normalized data and traffic normalized data; S33, calculating the cosine similarity between the known abnormal traffic normalization data and the traffic normalization data, and determining whether it is greater than a set cosine similarity threshold; S34: If not, mark the triplet data group corresponding to the traffic data as an unknown traffic triplet data group.

4. The method for identifying unknown threats from multi-dimensional data according to claim 1, characterized in that: The S4 comprises the following steps: S41, collecting the unknown traffic triple data groups to generate an unknown traffic triple data group set; S42. Based on the double pointer method, search for the triple data group asset flow similarity cluster set and the triple data group asset flow similarity cluster with the same asset data and flow data in the unknown flow triple data group set, and generate a similar unknown triple data group set based on the triple data groups in the triple data group asset flow similarity cluster searched out.

5. The method for identifying unknown threats in multi-dimensional data according to claim 1, characterized in that: The S5 comprises the following steps: S51. Perform statistical processing on the entity data to generate an entity data individual set; S52. Based on the double pointer method, search for similar unknown triple data groups with the same entity data in the entity data individual set and generate a set of similar unknown triple data groups with the same entity data.

6. The method for identifying unknown threats in multi-dimensional data according to claim 1, characterized in that: The S7 comprises the following steps: S71. Collect attack phase traffic characteristic data and generate attack phase traffic characteristic data set , represents the traffic characteristic data of the oth attack stage, ; S72, for each similar unknown entity operation sequence in the similar unknown entity operation sequence set, search for matching attack phase traffic feature data in the attack phase traffic feature data set G. , including the following steps: S721, normalize the G and L to generate and ; S722, in the Randomly generate n attack phase search particles , ; S723, initializing algorithm parameters, maximum number of iterations T; S724, will and The cosine similarity plus one is taken as the reciprocal as the fitness function, and the fitness function is calculated based on the fitness function. The fitness value of S725, will The attack phase searches for the optimal individual position of the particle , the one with the smallest current fitness value As the optimal position of the group ; S726, based on and right Update the speed and position; S727, calculation The fitness value of The fitness value is less than The fitness value of To update, if The minimum fitness value is less than The fitness value of , then use the minimum fitness value corresponding to right Make updates; S728, determine whether the maximum number of iterations T is reached, if so, output Corresponding ; S73, arranging the output according to the order of each unknown triple data group similar to the entity in each similar unknown entity operation sequence ,generate similar unknown entity operation attack phase sequence; S74. Calculate the attack phase probability corresponding to the traffic data from the unknown traffic triple data group to the last unknown triple data group similar to the entity in the attack phase sequence of the similar unknown entity operation based on the Markov chain, and generate entity operation sequence abnormality probability data; S75. Collect risk level-operation sequence abnormality probability data, generate a risk level-operation sequence abnormality probability data set, and search the risk level-operation sequence abnormality probability data set for risk level-operation sequence abnormality probability data that matches the entity operation sequence abnormality probability data based on a brute force search method to generate entity operation sequence risk level data.

7. The method for identifying unknown threats in multi-dimensional data according to claim 1, characterized in that: The method further comprises: S81. Collect management plan data corresponding to the risk level of each entity operation sequence to generate a management plan-entity operation sequence risk level data set; S82. Based on a brute force search method, searching the management solution-entity operation sequence risk level data set for a management solution that matches the entity operation sequence risk level data, and generating management solution feedback data; S83. Execute management operations based on the feedback data of the management plan.

8. A multi-dimensional data unknown threat identification system, configured to execute the multi-dimensional data unknown threat identification method according to any one of claims 1 to 7, characterized in that: It includes data acquisition module, storage, processor and feedback module.

Images