Network security protection method and system based on digital twin technology

Abstract

The invention discloses a network security protection method and system based on a digital twin technology, belongs to the technical field of network security, and is used for solving the technical problems that an attack graph adopted by an existing network risk assessment method has limitation, vulnerability repair and defense depend on experience, and the effectiveness of a defense means is difficult to verify. The method comprises the following steps: constructing a network vulnerability dynamic knowledge graph based on multi-source network vulnerability information; acquiring real-time vulnerability information of the target network, and constructing an attribute attack graph of the target network according to the real-time vulnerability information and the dynamic knowledge graph; expanding the attribute attack graph based on the dynamic knowledge graph to obtain an expanded attribute attack graph; determining a predicted attack path according to the extended attribute attack graph; the attack complexity of the attack path is deduced and predicted in the digital twin model, and a defense strategy is determined according to the attack complexity level; and carrying out validity verification on the defense strategy, and feeding back the defense strategy passing the verification to the network node in the predicted attack path.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security protection method and system based on digital twin technology. Background Art

[0002] With the rapid development of the internet, the cybersecurity landscape is becoming increasingly challenging, with a growing number of vulnerabilities, posing significant threats and challenges. To address this increasingly challenging landscape, various network security technologies have been adopted to protect networks, including virus detection, firewalls, intrusion detection, and risk assessment. The emergence and application of these technologies have played a vital role in ensuring network security. Among them, network risk assessment is a proactive defense technology that can detect and identify potential attacks before or during security incidents.

[0003] However, while network risk assessment solutions based on attack graphs and various attack graph extensions have been proposed to address multi-target, multi-stage attacks and provide proactive defenses, they still face challenges such as a single vulnerability data source and the inability to update attack graph information in a timely manner, resulting in limitations in the generated attack graphs. Furthermore, after vulnerability detection and attack prediction based on attack graphs, vulnerability remediation and attack defense rely solely on empirical evidence, with no way to determine whether current defenses can truly withstand attackers' attacks, and thus no way to verify their effectiveness. This demonstrates that existing technologies still present significant vulnerabilities in network security protection. Summary of the Invention

[0004] The embodiments of the present invention provide a network security protection method and system based on digital twin technology, which are used to solve the following technical problems: the attack graphs used in existing network risk assessment methods have limitations, and vulnerability repair and defense rely on experience, making it difficult to verify the effectiveness of defense measures.

[0005] The embodiment of the present invention adopts the following technical solutions:

[0006] On the one hand, an embodiment of the present invention provides a network security protection method based on digital twin technology, the method comprising: based on a stream processing framework, collecting multi-source network vulnerability information and performing real-time change updates;

[0007] Building a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information;

[0008] Performing a network topology scan on the target network to obtain existing real-time vulnerability information, and constructing an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph;

[0009] Based on the dynamic knowledge graph, the attribute attack graph is expanded to obtain an extended attribute attack graph; and a predicted attack path is determined according to the extended attribute attack graph;

[0010] Constructing a digital twin model of the target network and deploying the predicted attack path into the digital twin model;

[0011] Deducing the attack complexity of the predicted attack path in the digital twin model, and determining a defense strategy based on the attack complexity level;

[0012] The effectiveness of the defense strategy is verified through the digital twin model, and the verified defense strategy is fed back to the network nodes in the predicted attack path for automatic execution.

[0013] In one feasible implementation, based on a stream processing framework, multi-source network vulnerability information is collected and updated in real time, specifically including:

[0014] Based on the stream processing framework, basic network vulnerability information is collected from different types of vulnerability libraries; network attack intelligence information of network attack events is obtained from the Internet; and network security discussion information is obtained from information security network forums;

[0015] Aggregating the basic network vulnerability information, the network attack intelligence information, and the network security discussion information into the multi-source network vulnerability information;

[0016] The stream processing framework monitors changes in the multi-source network vulnerability information and incrementally updates the multi-source network vulnerability information based on the changes; wherein the incrementally updated multi-source network vulnerability information retains the content before the change while adding the content after the change.

[0017] In a feasible implementation, based on the multi-source network vulnerability information, a dynamic knowledge graph of network vulnerabilities is constructed, specifically including:

[0018] Extracting vulnerability attribute fields from the multi-source network vulnerability information; assigning corresponding attribute weights to each vulnerability attribute field according to the frequency of occurrence of each vulnerability attribute field;

[0019] Generate a preset number of reserved fields and set the attribute weight of the reserved fields to 0;

[0020] Perform entity recognition and relationship extraction on each vulnerability attribute field using reserved fields to construct an "entity-relationship-entity" triple; wherein the triple contains the reserved entity corresponding to the reserved field;

[0021] Extracting attribute information of each entity from the multi-source network vulnerability information; wherein the attribute information at least includes the attribute weight, attack method, attack condition, attack success rate, and attack benefit;

[0022] Based on the triples and the attribute information, a dynamic knowledge graph of the network vulnerability is constructed, and only entities with attribute weights not equal to 0 are used as actual knowledge graph nodes;

[0023] When a new vulnerability attribute field appears in the multi-source network vulnerability information, the new vulnerability attribute field is replaced into one of the reserved entities, and the attribute weight of the reserved entity is increased by 1;

[0024] The relationship between the new vulnerability attribute field and each actual knowledge graph node is extracted and integrated into the dynamic knowledge graph to achieve dynamic update of the dynamic knowledge graph.

[0025] In a feasible implementation, a network topology scan is performed on the target network to obtain existing real-time vulnerability information, and an attribute attack graph of the target network is constructed based on the real-time vulnerability information and the dynamic knowledge graph, specifically including:

[0026] Perform vulnerability scanning and topology scanning on the target network to determine vulnerable nodes in the target network and obtain real-time vulnerability information of the vulnerable nodes; wherein the real-time vulnerability information includes at least vulnerability type and vulnerability description;

[0027] According to the real-time vulnerability information of each vulnerability node, searching for the corresponding target knowledge graph node in the dynamic knowledge graph, and obtaining the attribute information of the target knowledge graph node;

[0028] Using the attack condition in the attribute information as the precondition of the corresponding vulnerability node to generate a precondition node; using the attack benefit in the attribute information as the postcondition of the corresponding vulnerability node to generate a postcondition node;

[0029] Based on the causal relationship between the precondition node and the postcondition node of each vulnerability node, each vulnerability node is connected with each condition node in sequence to obtain the attribute attack graph of the target network.

[0030] In a feasible implementation, based on the dynamic knowledge graph, the attribute attack graph is expanded to obtain an extended attribute attack graph, specifically including:

[0031] In the dynamic knowledge graph, the relationship between every two target knowledge graph nodes is obtained to form a relationship set;

[0032] In the relationship set, the node relationships that do not appear in the attribute attack graph are screened to obtain potential node relationships between the target knowledge graph nodes;

[0033] Determine the connection condition between the two based on the attribute information of the target knowledge graph nodes with potential node relationships;

[0034] Based on the potential node relationships and connection conditions, corresponding connection lines and connection condition nodes are added to the attribute attack graph to expand the attribute attack graph to obtain an expanded attribute attack graph.

[0035] In a feasible implementation, determining a predicted attack path according to the extended attribute attack graph specifically includes:

[0036] Obtaining sibling nodes of each vulnerability node in the extended attribute attack graph; wherein the sibling nodes refer to multiple vulnerability nodes connected to the same post-condition node;

[0037] Calculate the vulnerability risk value of each vulnerability node in the same level node according to the attribute information in the dynamic knowledge graph;

[0038] Mark the vulnerable nodes whose vulnerability risk values ​​among the same-level nodes do not reach the preset threshold as unreadable nodes; if the vulnerability risk values ​​of all vulnerable nodes among the same-level nodes do not reach the preset threshold, retain the vulnerable node with the highest vulnerability risk value and mark it as a readable node;

[0039] All readable nodes are obtained in the extended attribute attack graph, and a number of predicted attack paths are determined based on the connection relationships between the readable nodes.

[0040] In a feasible implementation, based on the attribute information in the dynamic knowledge graph, the vulnerability risk value of each vulnerability node in the same level node is calculated, specifically including:

[0041] Obtain the attribute information of each vulnerability node in the dynamic knowledge graph among the nodes at the same level;

[0042] Generate a corresponding attack difficulty value based on the attack method and the difficulty of achieving the attack condition in the attribute information;

[0043] The attack difficulty value, attack success rate, and attack benefit are weightedly calculated using the attribute weights in the attribute information to obtain a vulnerability risk value for each vulnerability node.

[0044] In a feasible implementation, the attack complexity of the predicted attack path is deduced in the digital twin model, and a defense strategy is determined according to the attack complexity level, specifically including:

[0045] After deploying the predicted attack path to the digital twin model, simulate attacks on the vulnerable nodes according to the attack method of each vulnerable node in the predicted attack path, and record the attack skills and attack time used by the vulnerable nodes that were successfully attacked during the simulation, as well as the number of vulnerable nodes that were successfully attacked in the predicted attack path;

[0046] Calculating the attack complexity of the predicted attack path based on the number of attack skills, the attack time, and the number of successfully attacked vulnerability nodes in the predicted attack path;

[0047] Determining the attack complexity level of the predicted attack path according to a preset attack complexity level classification rule;

[0048] According to the attack complexity level, the defense strategy library of the corresponding level is called, and the defense strategy suitable for the attack skills and attack time used by each vulnerability node is searched in the defense strategy library to form the defense strategy for the predicted attack path.

[0049] In a feasible implementation, the effectiveness of the defense strategy is verified by the digital twin model, specifically including:

[0050] Applying the defense strategy to all vulnerability nodes in the predicted attack path in the digital twin model to perform attack simulation for a preset duration;

[0051] Calculate the blocking rate of the defense strategy against attack behaviors and the false positive rate against normal business traffic within the preset time period;

[0052] If the blocking rate and the false positive rate both meet the preset conditions, the defense strategy passes the effectiveness verification.

[0053] On the other hand, an embodiment of the present invention further provides a network security protection system based on digital twin technology, the system comprising:

[0054] An attack graph construction module is used to collect multi-source network vulnerability information based on a stream processing framework and perform real-time changes and updates; construct a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; perform a network topology scan on the target network to obtain existing real-time vulnerability information, and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph;

[0055] An attack path prediction module is configured to expand the attribute attack graph based on the dynamic knowledge graph to obtain an extended attribute attack graph; and determine a predicted attack path based on the extended attribute attack graph;

[0056] A defense strategy verification module is used to build a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy based on the attack complexity level; verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automatic execution.

[0057] Compared with the existing technology, the network security protection method and system based on digital twin technology provided by the embodiments of the present invention have the following beneficial effects:

[0058] The present invention collects real-time and changing multi-source network vulnerability information across the entire network through a stream processing framework, and constructs a dynamically updated network vulnerability knowledge graph based on this information. Then, based on the large amount of correlated vulnerability attribute information stored in the knowledge graph, the traditional attribute attack graph is expanded with information sources, so that the vulnerability nodes in the target network attack graph can be associated with related vulnerability instance information in the entire network and updated in real time, thereby improving the accuracy of attack path prediction, reducing the limitations of traditional attack graphs, and helping to effectively prevent attack behaviors.

[0059] After performing vulnerability detection and attack path prediction based on the attack graph, the present invention deduces the attack complexity of the predicted attack path through the digital twin model, thereby selecting a defense strategy that is more suitable for each vulnerability node, and simulates and implements the defense strategy in the digital twin model. It can intuitively see whether the defense strategy is effective in resisting attack behaviors, thereby ensuring the effectiveness of the defense strategy executed in the actual network node. There is no need to rely on experience and speculation for strategy formulation, which greatly improves network security and the reliability of defense measures, and has high practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments described in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0061] Figure 1 A flowchart of a network security protection method based on digital twin technology provided by an embodiment of the present invention;

[0062] Figure 2 A schematic diagram of an attribute attack graph provided by an embodiment of the present invention;

[0063] Figure 3A schematic structural diagram of a network security protection system based on digital twin technology provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0065] The embodiment of the present invention provides a network security protection method based on digital twin technology, such as Figure 1 As shown, the network security protection method based on digital twin technology specifically includes steps S101-S105:

[0066] S101. Based on the stream processing framework, collect multi-source network vulnerability information and update it in real time; based on the multi-source network vulnerability information, build a dynamic knowledge graph of network vulnerabilities.

[0067] Specifically, first, basic network vulnerability information is collected from different types of vulnerability libraries through a stream processing framework; and network attack intelligence information of network attack events is obtained on the Internet; and network security discussion information is obtained from information security network forums.

[0068] Furthermore, basic network vulnerability information, network attack intelligence information, and network security discussion information are aggregated into multi-source network vulnerability information.

[0069] As a feasible implementation, different vulnerability libraries include at least public network vulnerability libraries such as CVE, NVD, CNVD, and CNNVD. A wide variety of real-world cyberattacks occur on the internet. By crawling information from various cybersecurity platforms or forums, we can obtain cyberattack intelligence information about these attacks. Furthermore, we can extract important discussion information from various cybersecurity forums. Aggregating this multi-source data into multi-source network vulnerability information can overcome the limitations of traditional network risk assessments, which often rely on a single data source, and establish a solid data foundation for the subsequent construction of a knowledge graph.

[0070] Furthermore, the changed content of multi-source network vulnerability information is monitored through a stream processing framework, and the multi-source network vulnerability information is incrementally updated according to the changed content; wherein, the multi-source network vulnerability information after the incremental update retains the content before the change while adding the content after the change.

[0071] By utilizing a stream processing framework capable of acquiring and processing data in real time, changes to network vulnerability information can be captured in real time as they are updated. Furthermore, this application does not update all data, nor does it overwrite the original content with the changes. Instead, it incrementally updates only the added or modified content to the existing multi-source network vulnerability information, further enhancing the diversity and comprehensiveness of the information.

[0072] Furthermore, vulnerability attribute fields are extracted from multi-source network vulnerability information. Then, a corresponding attribute weight is assigned to each vulnerability attribute field based on its frequency of occurrence. At the same time, a preset number of reserved fields are generated, and the attribute weight of the reserved fields is set to 0.

[0073] Furthermore, for each vulnerability attribute field, entity recognition and relationship extraction are performed using reserved fields to construct "entity-relationship-entity" triples. The triples contain reserved entities corresponding to the reserved fields.

[0074] Attribute information of each entity is extracted from multi-source network vulnerability information; wherein the attribute information at least includes attribute weight, attack method, attack condition, attack success rate and attack benefit.

[0075] Furthermore, based on triples and attribute information, a dynamic knowledge graph of network vulnerabilities is constructed, and only entities with attribute weights not equal to 0 are used as actual knowledge graph nodes.

[0076] As a feasible implementation, when a new vulnerability attribute field appears in multi-source network vulnerability information, the new vulnerability attribute field is replaced with one of the reserved entities, and the attribute weight of the reserved entity is increased by 1. The relationship between the new vulnerability attribute field and each actual knowledge graph node is extracted and integrated into the dynamic knowledge graph to achieve dynamic updating of the dynamic knowledge graph.

[0077] The present invention assigns attribute weights to the fields extracted from the vulnerability information. On the one hand, it is possible to assign higher weights to fields with a large number of occurrences, because fields with a large number of occurrences mean that they are more common and more susceptible to long-term research and attack by attackers, so the danger is also higher, and the possibility of being attacked first is higher, so it is necessary to focus on defending the nodes and vulnerabilities related to these fields. On the other hand, in order to facilitate the creation of reserved fields, multiple reserved entities are created in the knowledge graph. When a field that has never appeared is updated in the multi-source network vulnerability information, there is no need to go through the entity extraction-relationship extraction-triplet construction process of the entire multi-source network vulnerability information again. Instead, only the newly added field is mapped to the reserved entity, and then the relationship between the reserved entity and other entities in the knowledge graph is extracted, thereby directly adding it to the knowledge graph without changing the position and relationship of other nodes, thereby realizing a dynamic knowledge graph. And in use, only nodes with attribute weights greater than 0 will be used as actual knowledge graph nodes. Reserved nodes will not be added to the dynamic knowledge graph because their attribute weights are 0, so the integrity of the knowledge graph will not be affected.

[0078] S102: Scan the target network topology to obtain real-time vulnerability information, and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph.

[0079] Specifically, vulnerability scanning and topology scanning are performed on the target network to determine the vulnerable nodes in the target network and obtain real-time vulnerability information of the vulnerable nodes; wherein the real-time vulnerability information at least includes the vulnerability type and vulnerability description.

[0080] Furthermore, based on the real-time vulnerability information of each vulnerability node, the corresponding target knowledge graph node is searched in the dynamic knowledge graph, and the attribute information of the target knowledge graph node is obtained.

[0081] Furthermore, the attack conditions in the attribute information are used as the preconditions of the corresponding vulnerability nodes to generate precondition nodes. The attack benefits in the attribute information are used as the postconditions of the corresponding vulnerability nodes to generate postcondition nodes. Then, based on the causal relationship between the precondition nodes and postcondition nodes of each vulnerability node, each vulnerability node is sequentially connected to each condition node to obtain the attribute attack graph of the target network.

[0082] As a feasible implementation, each vulnerability type corresponds to different attack conditions and attack consequences (or attack benefits for the attacker). This information is included in the entity attributes when constructing the knowledge graph. When constructing the attribute attack graph, by searching the attribute information corresponding to the vulnerability type of each vulnerability node in the dynamic knowledge graph, the attack conditions and attack consequences of each vulnerability node can be determined. The attack consequences of one or more vulnerability nodes may be the attack conditions of other vulnerability nodes. Based on this causal relationship, the vulnerability results can be connected into one or more attack paths, thus forming an attribute attack graph.

[0083] In one embodiment, Figure 2 A schematic diagram of an attribute attack graph provided by an embodiment of the present invention is shown as follows: Figure 2 As shown in the figure, the attack conditions and attack benefits of each vulnerability node are used as conditional nodes. In the figure, vulnerability node 1 and vulnerability node 2 are connected through conditional node 2. The content of conditional node 2 is both the attack benefit of vulnerability node 1 and the attack condition of vulnerability node 2. Searching for nodes with the same characteristics among all vulnerability nodes, thus forming the following Figure 2 The attribute attack graph shown.

[0084] S103. Based on the dynamic knowledge graph, the attribute attack graph is expanded to obtain an extended attribute attack graph; and a predicted attack path is determined according to the extended attribute attack graph.

[0085] Specifically, in the dynamic knowledge graph, the relationship between every two target knowledge graph nodes is obtained to form a relationship set. In the relationship set, node relationships that do not appear in the attribute attack graph are filtered to obtain potential node relationships between the target knowledge graph nodes.

[0086] Furthermore, based on the attribute information of the target knowledge graph nodes with potential node relationships, the connection conditions between the two are determined.

[0087] Furthermore, based on the potential node relationships and connection conditions, corresponding connection lines and connection condition nodes are added to the attribute attack graph to expand the attribute attack graph and obtain an extended attribute attack graph.

[0088] Since the information in the knowledge graph is more comprehensive, in addition to the causal relationship between attack conditions and attack benefits, there may be other potential connections between vulnerability nodes. Therefore, by analyzing the attribute information of each vulnerability node in the dynamic knowledge graph, we can obtain the ignored potential relationships between the vulnerability nodes in the attribute attack graph. The vulnerability nodes with potential relationships are connected through connection conditions, so that the above-mentioned attribute attack graph can be further expanded. After expansion, more attack paths may be formed, increasing the search range of attack paths.

[0089] Furthermore, the sibling nodes of each vulnerability node are obtained in the extended attribute attack graph; wherein, the sibling nodes refer to multiple vulnerability nodes connected to the same post-condition node. Figure 2 As shown, vulnerability node 2 and vulnerability node 3 are connected to the same post-condition node 5, so vulnerability node 2 and vulnerability node 3 are sibling nodes.

[0090] It should be noted that Figure 2 Only a few nodes are shown, which is just a simple diagram for explaining the present invention. In a real attack graph, there may be more complex vulnerability node relationships, and the number of peer nodes included is not limited to two. Figure 2 The number of nodes and connection relationships in are examples and are not limitations of the present invention.

[0091] Furthermore, based on the attribute information in the dynamic knowledge graph, the vulnerability risk value of each vulnerable node in the same level is calculated. Vulnerable nodes in the same level whose vulnerability risk value does not reach the preset threshold are then marked as unreadable nodes. If the vulnerability risk values ​​of all vulnerable nodes in the same level do not reach the preset threshold, the vulnerable node with the highest vulnerability risk value is retained and marked as readable. All readable nodes in the extended attribute attack graph are obtained, and based on the connection relationships between readable nodes, several predicted attack paths are determined.

[0092] As a feasible implementation, the vulnerability risk value of each vulnerable node in a peer node is calculated based on the attribute information in the dynamic knowledge graph. Specifically, the method includes obtaining the attribute information of each vulnerable node in the peer node in the dynamic knowledge graph. Based on the attack method and the difficulty of achieving the attack conditions in the attribute information, a corresponding attack difficulty value is generated. Using the attribute weights in the attribute information, the attack difficulty value, attack success rate, and attack benefit are weighted to obtain the vulnerability risk value of each vulnerable node.

[0093] For vulnerable nodes at the same level, attackers often only select one or several nodes that are easier to attack, as long as they can open up the attack path. Therefore, the present invention comprehensively considers the attack success rate of each node, the difficulty of achieving the attack method and attack conditions, the attack benefits, and the attribute weights set above, and evaluates the vulnerability risk value of each node at the same level, thereby retaining the vulnerable nodes with the highest vulnerability risk value or multiple vulnerability risk values ​​reaching the preset threshold among the nodes at the same level. While ensuring the prediction accuracy, the number of predicted attack paths is greatly reduced, saving calculation time and reducing computational complexity.

[0094] S104. Build a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy based on the attack complexity level.

[0095] Specifically, a digital twin model of the target network is constructed, and the predicted attack path is deployed into the digital twin model.

[0096] Furthermore, after the predicted attack path is deployed to the digital twin model, a simulated attack is performed on the vulnerable node according to the attack method of each vulnerable node in the predicted attack path, and the attack skills and attack time used by the vulnerable nodes that are successfully attacked during the simulation are recorded, as well as the number of vulnerable nodes that are successfully attacked in the predicted attack path.

[0097] Furthermore, the attack complexity of the predicted attack path is calculated based on the number of attack skills, attack time, and the number of successfully attacked vulnerability nodes in the predicted attack path. Specifically, the attack complexity can be calculated by assigning weights to each of these skills and performing a weighted calculation, or by using other algorithms, which are not limited in this invention.

[0098] Furthermore, the attack complexity level of the predicted attack path is determined based on the preset attack complexity classification rules. Then, based on the attack complexity level, the corresponding defense strategy library is called up. A defense strategy suitable for the attack skills and attack time used by each vulnerability node is searched in the defense strategy library to form a defense strategy for the predicted attack path.

[0099] As a feasible implementation, the present invention establishes a pre-defined attack complexity classification system. For example, attack complexity within a certain range is classified as level 1, within another range as level 2, and so on. A corresponding defense strategy library is created for each level. Each defense strategy library stores defense strategies corresponding to different vulnerability types, attack methods, and attack conditions. The corresponding defense strategy can be found based on any information field.

[0100] S105. Verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automated execution.

[0101] Specifically, the defense strategy is applied to all vulnerable nodes in the predicted attack path in the digital twin model, and several attack simulations of a preset duration are performed.

[0102] Furthermore, the initial defense strategy's blocking rate against attack behaviors and its false-kill rate against normal traffic are calculated within a preset time period. If both the blocking rate and the false-kill rate meet the preset conditions, the defense strategy passes the effectiveness verification.

[0103] Finally, the verified defense strategy is fed back to the network nodes in the predicted attack path for automatic execution without human intervention.

[0104] In addition, the embodiment of the present invention also provides a network security protection system based on digital twin technology, such as Figure 3 As shown, the network security protection system 300 based on digital twin technology specifically includes:

[0105] The attack graph construction module 310 is used to collect multi-source network vulnerability information based on the stream processing framework and update it in real time; construct a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; scan the network topology of the target network to obtain existing real-time vulnerability information, and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph;

[0106] The attack path prediction module 320 is configured to expand the attribute attack graph based on the dynamic knowledge graph to obtain an extended attribute attack graph; and determine a predicted attack path based on the extended attribute attack graph;

[0107] The defense strategy verification module 330 is used to build a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy according to the attack complexity level; verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automatic execution.

[0108] The various embodiments of the present invention are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from the other embodiments. In particular, the device, apparatus, and non-volatile computer storage medium embodiments are generally similar to the method embodiments, so their descriptions are simplified. For relevant details, refer to the descriptions of the method embodiments.

[0109] The above description of specific embodiments of the present invention is provided. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0110] The foregoing is merely an embodiment of the present invention and is not intended to limit the present invention. It will be apparent to those skilled in the art that various modifications and variations may be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A network security protection method based on digital twin technology, characterized in that: The method comprises: Based on the stream processing framework, it collects multi-source network vulnerability information and updates it in real time. Building a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; Performing a network topology scan on the target network to obtain existing real-time vulnerability information, and constructing an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph; Based on the dynamic knowledge graph, the attribute attack graph is expanded to obtain an extended attribute attack graph; and a predicted attack path is determined according to the extended attribute attack graph; Constructing a digital twin model of the target network and deploying the predicted attack path into the digital twin model; Deducing the attack complexity of the predicted attack path in the digital twin model, and determining a defense strategy based on the attack complexity level; The effectiveness of the defense strategy is verified through the digital twin model, and the verified defense strategy is fed back to the network nodes in the predicted attack path for automatic execution.

2. A network security protection method based on digital twin technology according to claim 1, characterized in that: Based on the stream processing framework, it collects multi-source network vulnerability information and updates it in real time, including: Based on the stream processing framework, basic network vulnerability information is collected from different types of vulnerability libraries; network attack intelligence information of network attack events is obtained from the Internet; and network security discussion information is obtained from information security network forums; Aggregating the basic network vulnerability information, the network attack intelligence information, and the network security discussion information into the multi-source network vulnerability information; The stream processing framework monitors changes in the multi-source network vulnerability information and incrementally updates the multi-source network vulnerability information based on the changes; wherein the incrementally updated multi-source network vulnerability information retains the content before the change while adding the content after the change.

3. A network security protection method based on digital twin technology according to claim 1, characterized in that: Based on the multi-source network vulnerability information, a dynamic knowledge graph of network vulnerabilities is constructed, specifically including: Extracting vulnerability attribute fields from the multi-source network vulnerability information; assigning corresponding attribute weights to each vulnerability attribute field according to the frequency of occurrence of each vulnerability attribute field; Generate a preset number of reserved fields and set the attribute weight of the reserved fields to 0; Perform entity recognition and relationship extraction on each vulnerability attribute field using reserved fields to construct an "entity-relationship-entity" triple; wherein the triple contains the reserved entity corresponding to the reserved field; Extracting attribute information of each entity from the multi-source network vulnerability information; wherein the attribute information at least includes the attribute weight, attack method, attack condition, attack success rate, and attack benefit; Based on the triples and the attribute information, a dynamic knowledge graph of the network vulnerability is constructed, and only entities with attribute weights not equal to 0 are used as actual knowledge graph nodes; When a new vulnerability attribute field appears in the multi-source network vulnerability information, the new vulnerability attribute field is replaced into one of the reserved entities, and the attribute weight of the reserved entity is increased by 1; The relationship between the new vulnerability attribute field and each actual knowledge graph node is extracted and integrated into the dynamic knowledge graph to achieve dynamic update of the dynamic knowledge graph.

4. A network security protection method based on digital twin technology according to claim 1, characterized in that: Perform a network topology scan on the target network to obtain real-time vulnerability information, and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph, specifically including: Perform vulnerability scanning and topology scanning on the target network to determine vulnerable nodes in the target network and obtain real-time vulnerability information of the vulnerable nodes; wherein the real-time vulnerability information includes at least vulnerability type and vulnerability description; According to the real-time vulnerability information of each vulnerability node, searching for the corresponding target knowledge graph node in the dynamic knowledge graph, and obtaining the attribute information of the target knowledge graph node; Using the attack condition in the attribute information as the precondition of the corresponding vulnerability node to generate a precondition node; using the attack benefit in the attribute information as the postcondition of the corresponding vulnerability node to generate a postcondition node; Based on the causal relationship between the precondition node and the postcondition node of each vulnerability node, each vulnerability node is connected with each condition node in sequence to obtain the attribute attack graph of the target network.

5. A network security protection method based on digital twin technology according to claim 4, characterized in that: Based on the dynamic knowledge graph, the attribute attack graph is expanded to obtain an extended attribute attack graph, specifically including: In the dynamic knowledge graph, the relationship between every two target knowledge graph nodes is obtained to form a relationship set; In the relationship set, the node relationships that do not appear in the attribute attack graph are screened to obtain potential node relationships between the target knowledge graph nodes; Determine the connection condition between the two based on the attribute information of the target knowledge graph nodes with potential node relationships; Based on the potential node relationships and connection conditions, corresponding connection lines and connection condition nodes are added to the attribute attack graph to expand the attribute attack graph to obtain an expanded attribute attack graph.

6. The network security protection method based on digital twin technology according to claim 1 is characterized in that: Determining a predicted attack path based on the extended attribute attack graph specifically includes: Obtaining sibling nodes of each vulnerability node in the extended attribute attack graph; wherein the sibling nodes refer to multiple vulnerability nodes connected to the same post-condition node; Calculate the vulnerability risk value of each vulnerability node in the same level node according to the attribute information in the dynamic knowledge graph; Mark the vulnerable nodes whose vulnerability risk values ​​among the same-level nodes do not reach the preset threshold as unreadable nodes; if the vulnerability risk values ​​of all vulnerable nodes among the same-level nodes do not reach the preset threshold, retain the vulnerable node with the highest vulnerability risk value and mark it as a readable node; All readable nodes are obtained in the extended attribute attack graph, and a number of predicted attack paths are determined based on the connection relationships between the readable nodes.

7. A network security protection method based on digital twin technology according to claim 6, characterized in that: Calculate the vulnerability risk value of each vulnerability node in the same-level node based on the attribute information in the dynamic knowledge graph, specifically including: Obtain the attribute information of each vulnerability node in the dynamic knowledge graph among the nodes at the same level; Generate a corresponding attack difficulty value based on the attack method and the difficulty of achieving the attack condition in the attribute information; The attack difficulty value, attack success rate, and attack benefit are weightedly calculated using the attribute weights in the attribute information to obtain a vulnerability risk value for each vulnerability node.

8. The network security protection method based on digital twin technology according to claim 1 is characterized in that: Deducing the attack complexity of the predicted attack path in the digital twin model and determining a defense strategy based on the attack complexity level, specifically including: After deploying the predicted attack path to the digital twin model, simulate attacks on the vulnerable nodes according to the attack method of each vulnerable node in the predicted attack path, and record the attack skills and attack time used by the vulnerable nodes that were successfully attacked during the simulation, as well as the number of vulnerable nodes that were successfully attacked in the predicted attack path; Calculating the attack complexity of the predicted attack path based on the number of attack skills, the attack time, and the number of successfully attacked vulnerability nodes in the predicted attack path; Determining the attack complexity level of the predicted attack path according to a preset attack complexity level classification rule; According to the attack complexity level, the defense strategy library of the corresponding level is called, and the defense strategy suitable for the attack skills and attack time used by each vulnerability node is searched in the defense strategy library to form the defense strategy for the predicted attack path.

9. The network security protection method based on digital twin technology according to claim 1 is characterized in that: The effectiveness of the defense strategy is verified through the digital twin model, specifically including: Applying the defense strategy to all vulnerability nodes in the predicted attack path in the digital twin model to perform attack simulation for a preset duration; Calculate the blocking rate of the defense strategy against attack behaviors and the false positive rate against normal business traffic within the preset time period; If the blocking rate and the false positive rate both meet the preset conditions, the defense strategy passes the effectiveness verification.

10. A network security protection system based on digital twin technology, characterized in that: The system comprises: An attack graph construction module is used to collect multi-source network vulnerability information based on a stream processing framework and perform real-time changes and updates; construct a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; perform a network topology scan on the target network to obtain existing real-time vulnerability information, and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph; An attack path prediction module is configured to expand the attribute attack graph based on the dynamic knowledge graph to obtain an extended attribute attack graph; and determine a predicted attack path based on the extended attribute attack graph; A defense strategy verification module is used to build a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy based on the attack complexity level; verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automatic execution.

Images