A network security protection method and system based on digital twin technology

Abstract

The application discloses a network security protection method and system based on digital twin technology, and belongs to the technical field of network security, and is used for solving the technical problem that the attack graph used by the existing network risk assessment method has limitations, and the vulnerability repair and defense depend on experience, and the effectiveness of the defense means is difficult to verify. The method comprises the following steps: constructing a network vulnerability dynamic knowledge graph based on multi-source network vulnerability information; acquiring real-time vulnerability information of a target network, and constructing an attribute attack graph of the target network according to the real-time vulnerability information and the dynamic knowledge graph; extending the attribute attack graph based on the dynamic knowledge graph to obtain an extended attribute attack graph; determining a predicted attack path according to the extended attribute attack graph; deducing the attack complexity of the predicted attack path in a digital twin model, and determining a defense strategy according to the attack complexity level; verifying the effectiveness of the defense strategy, and feeding back the defense strategy that passes the verification to a network node in the predicted attack path.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security protection method and system based on digital twin technology. Background Technology

[0002] With the rapid development of the internet, the cybersecurity situation is becoming increasingly severe, with the number of vulnerabilities constantly increasing, posing a huge threat and challenge to network security. To address this increasingly serious cybersecurity situation, various cybersecurity technologies have been adopted to protect network security, including virus detection, firewalls, intrusion detection, and risk assessment. The emergence and application of these technologies have played a crucial role in ensuring network security. Among them, network risk assessment is a proactive defense technology that can detect and identify potential attack behaviors before or during a security incident.

[0003] However, while current network risk assessment schemes based on attack graph technology and various extensions of attack graphs have been proposed to address multi-target, multi-stage attacks and provide early defense, limitations remain. These limitations include a single vulnerability data source and the inability to update attack graph information in a timely manner. Furthermore, after vulnerability detection and attack prediction based on attack graphs, vulnerability remediation and attack defense rely solely on experience, making it impossible to determine whether current defense measures can truly withstand attackers' attacks and thus unable to verify their effectiveness. Therefore, existing technologies still have significant vulnerabilities in network security protection. Summary of the Invention

[0004] This invention provides a network security protection method and system based on digital twin technology to solve the following technical problems: existing network risk assessment methods use attack graphs that have limitations, and vulnerability repair and defense rely on experience, making it difficult to verify the effectiveness of defense measures.

[0005] The embodiments of the present invention adopt the following technical solutions:

[0006] On the one hand, embodiments of the present invention provide a network security protection method based on digital twin technology, the method including: collecting multi-source network vulnerability information and updating it in real time based on a stream processing framework;

[0007] Based on the aforementioned multi-source network vulnerability information, a dynamic knowledge graph of network vulnerabilities is constructed.

[0008] A network topology scan is performed on the target network to obtain real-time vulnerability information, and an attribute attack graph of the target network is constructed based on the real-time vulnerability information and the dynamic knowledge graph.

[0009] Based on the dynamic knowledge graph, the attribute attack graph is expanded to obtain an extended attribute attack graph; based on the extended attribute attack graph, a predicted attack path is determined.

[0010] Construct a digital twin model of the target network and deploy the predicted attack path into the digital twin model;

[0011] The attack complexity of the predicted attack path is deduced in the digital twin model, and a defense strategy is determined based on the attack complexity level.

[0012] The effectiveness of the defense strategy is verified by the digital twin model, and the verified defense strategy is fed back to the network nodes in the predicted attack path for automated execution.

[0013] In one feasible implementation, based on a stream processing framework, multi-source network vulnerability information is collected and updated in real time, specifically including:

[0014] Based on a stream processing framework, basic network vulnerability information is collected from different types of vulnerability databases; network attack intelligence information of network attack events is obtained from the Internet; and network security discussion information is obtained from information security network forums.

[0015] The basic network vulnerability information, the network attack intelligence information, and the network security discussion information are aggregated into the multi-source network vulnerability information.

[0016] The streaming processing framework monitors changes in the multi-source network vulnerability information and incrementally updates the information based on these changes. The incrementally updated information retains the original content while adding the updated content.

[0017] In one feasible implementation, a dynamic knowledge graph of network vulnerabilities is constructed based on the multi-source network vulnerability information, specifically including:

[0018] Extract vulnerability attribute fields from the multi-source network vulnerability information; assign corresponding attribute weights to each vulnerability attribute field based on the frequency of occurrence of each vulnerability attribute field;

[0019] Generate a preset number of reserved fields and set the attribute weight of the reserved fields to 0;

[0020] For each vulnerability attribute field, entity identification and relation extraction are performed using reserved fields to construct "entity-relationship-entity" triples; wherein, the triples contain the reserved entities corresponding to the reserved fields;

[0021] Extract attribute information for each entity from the multi-source network vulnerability information; wherein, the attribute information includes at least the attribute weight, attack method, attack conditions, attack success rate, and attack benefits;

[0022] Based on the triples and the attribute information, a dynamic knowledge graph of the network vulnerability is constructed, and only entities with attribute weights that are not zero are used as actual knowledge graph nodes.

[0023] When a new vulnerability attribute field appears in the multi-source network vulnerability information, the new vulnerability attribute field is replaced in one of the reserved entities, and the attribute weight of the reserved entity is incremented by 1.

[0024] The relationship between the new vulnerability attribute fields and each actual knowledge graph node is extracted and integrated into the dynamic knowledge graph to achieve dynamic updating of the dynamic knowledge graph.

[0025] In one feasible implementation, a network topology scan is performed on the target network to obtain real-time vulnerability information, and an attribute attack graph of the target network is constructed based on the real-time vulnerability information and the dynamic knowledge graph, specifically including:

[0026] The target network is subjected to vulnerability scanning and topology scanning to identify vulnerable nodes in the target network and to obtain real-time vulnerability information of the vulnerable nodes; wherein, the real-time vulnerability information includes at least the vulnerability type and vulnerability description;

[0027] Based on the real-time vulnerability information of each vulnerability node, the corresponding target knowledge graph node is searched in the dynamic knowledge graph, and the attribute information of the target knowledge graph node is obtained.

[0028] The attack conditions in the attribute information are used as the preconditions of the corresponding vulnerability node to generate a precondition node; the attack benefits in the attribute information are used as the postconditions of the corresponding vulnerability node to generate a postcondition node.

[0029] Based on the causal relationship between the precondition nodes and postcondition nodes of each vulnerability node, each vulnerability node is sequentially connected to each condition node to obtain the attribute attack graph of the target network.

[0030] In one feasible implementation, the attribute attack graph is extended based on the dynamic knowledge graph to obtain an extended attribute attack graph, specifically including:

[0031] In the dynamic knowledge graph, the relationship between every two target knowledge graph nodes is obtained, forming a relationship set;

[0032] In the set of relationships, node relationships that do not appear in the attribute attack graph are filtered out to obtain potential node relationships between the target knowledge graph nodes;

[0033] Based on the attribute information of target knowledge graph nodes with potential node relationships, determine the connection conditions between them;

[0034] Based on the potential node relationships and connection conditions, corresponding connection lines and connection condition nodes are added to the attribute attack graph to expand the attribute attack graph and obtain an extended attribute attack graph.

[0035] In one feasible implementation, determining the predicted attack path based on the extended attribute attack graph specifically includes:

[0036] Obtain the sibling nodes of each vulnerable node in the extended attribute attack graph; wherein, the sibling nodes refer to multiple vulnerable nodes connected to the same postcondition node;

[0037] Based on the attribute information in the dynamic knowledge graph, calculate the vulnerability risk value of each vulnerability node in the same level node;

[0038] Vulnerable nodes whose vulnerability risk value does not reach the preset threshold are marked as unreadable nodes; if the vulnerability risk value of all vulnerable nodes in the same level does not reach the preset threshold, the vulnerable node with the highest vulnerability risk value is retained and marked as a readable node.

[0039] All readable nodes are obtained in the extended attribute attack graph, and several predicted attack paths are determined based on the connection relationships between the readable nodes.

[0040] In one feasible implementation, based on the attribute information in the dynamic knowledge graph, the vulnerability risk value of each vulnerability node in the peer node is calculated, specifically including:

[0041] Obtain the attribute information of each vulnerability node in the dynamic knowledge graph at the same level;

[0042] Based on the attack methods and the difficulty of achieving the attack conditions in the attribute information, a corresponding attack difficulty value is generated;

[0043] By using the attribute weights in the attribute information, the attack difficulty value, attack success rate, and attack benefits are weighted and calculated to obtain the vulnerability risk value of each vulnerability node.

[0044] In one feasible implementation, the attack complexity of the predicted attack path is deduced in the digital twin model, and a defense strategy is determined based on the attack complexity level, specifically including:

[0045] After the predicted attack path is deployed to the digital twin model, the vulnerability nodes are simulated to attack according to the attack method of each vulnerability node in the predicted attack path. The attack skills and attack time used by the vulnerability nodes that are successfully attacked during the simulation are recorded, as well as the number of vulnerability nodes that are successfully attacked in the predicted attack path.

[0046] The attack complexity of the predicted attack path is calculated based on the number of attack skills, the attack time, and the number of successfully attacked vulnerable nodes in the predicted attack path.

[0047] The attack complexity level of the predicted attack path is determined according to the preset attack complexity level classification rules.

[0048] Based on the attack complexity level, the corresponding level of defense strategy library is invoked, and defense strategies applicable to the attack skills and attack time used by each vulnerable node are searched in the defense strategy library to form the defense strategy for the predicted attack path.

[0049] In one feasible implementation, the effectiveness of the defense strategy is verified using the digital twin model, specifically including:

[0050] In the digital twin model, the defense strategy is applied to all vulnerable nodes of the predicted attack path, and an attack simulation is performed for a preset duration.

[0051] Calculate the blocking rate of the defense strategy against attacks and the false positive rate against normal business traffic within the preset time period;

[0052] If both the blocking rate and the false positive rate meet the preset conditions, the defense strategy passes the effectiveness verification.

[0053] On the other hand, embodiments of the present invention also provide a network security protection system based on digital twin technology, the system comprising:

[0054] The attack graph construction module is used to collect multi-source network vulnerability information and update it in real time based on a stream processing framework; construct a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; perform network topology scanning on the target network to obtain existing real-time vulnerability information; and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph.

[0055] The attack path prediction module is used to expand the attribute attack graph based on the dynamic knowledge graph to obtain an expanded attribute attack graph; and to determine the predicted attack path based on the expanded attribute attack graph.

[0056] The defense strategy verification module is used to construct a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy according to the attack complexity level; verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automated execution.

[0057] Compared with existing technologies, the network security protection method and system based on digital twin technology provided in this invention have the following beneficial effects:

[0058] This invention collects real-time, multi-source network vulnerability information across the entire network using a stream processing framework. Based on this information, it constructs a dynamically updated network vulnerability knowledge graph. Then, based on the large amount of interconnected vulnerability attribute information stored in the knowledge graph, it expands the information sources of traditional attribute attack graphs, enabling vulnerability nodes in the target network attack graph to be associated with relevant vulnerability instances across the entire network and to be updated in real time. This improves the accuracy of attack path prediction, reduces the limitations of traditional attack graphs, and helps to effectively prevent attacks.

[0059] Furthermore, after vulnerability detection and attack path prediction based on the attack graph, this invention uses a digital twin model to deduce the attack complexity of the predicted attack path, thereby selecting a more suitable defense strategy for each vulnerable node. The defense strategy is then simulated and implemented in the digital twin model, allowing for a direct observation of whether the defense strategy is effective in resisting attacks. This ensures the effectiveness of the defense strategy executed in actual network nodes, eliminating the need to rely on experience and guesswork for strategy formulation. This significantly improves network security and the reliability of defense measures, demonstrating high practical value. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0061] Figure 1 A flowchart of a network security protection method based on digital twin technology provided in an embodiment of the present invention;

[0062] Figure 2 This is a schematic diagram of an attribute attack graph provided in an embodiment of the present invention;

[0063] Figure 3This is a schematic diagram of a network security protection system based on digital twin technology, provided as an embodiment of the present invention. Detailed Implementation

[0064] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0065] This invention provides a network security protection method based on digital twin technology, such as... Figure 1 As shown, the network security protection method based on digital twin technology specifically includes steps S101-S105:

[0066] S101. Based on the stream processing framework, collect multi-source network vulnerability information and update it in real time; based on the multi-source network vulnerability information, construct a dynamic knowledge graph of network vulnerabilities.

[0067] Specifically, firstly, basic network vulnerability information is collected from different types of vulnerability databases through a stream processing framework; secondly, network attack intelligence information on network attack events is obtained from the Internet; and thirdly, network security discussion information is obtained from information security network forums.

[0068] Furthermore, basic network vulnerability information, network attack intelligence information, and network security discussion information are aggregated into multi-source network vulnerability information.

[0069] As a feasible implementation method, different types of vulnerability databases should include at least publicly available network vulnerability databases such as CVE, NVD, CNVD, and CNNVD. In reality, various real-world network attack events occur on the internet. By crawling information from various network security platforms or forums, network attack intelligence information about these attack times can be obtained. Important discussion information can also be extracted from various network security forums. Aggregating this multi-source data into multi-source network vulnerability information can overcome the shortcomings of traditional network risk assessments due to their single data source, creating a solid data foundation for subsequent knowledge graph construction.

[0070] Furthermore, the changes in multi-source network vulnerability information are monitored through a stream processing framework, and incremental updates are performed on the multi-source network vulnerability information based on the changes. The incrementally updated multi-source network vulnerability information retains the content before the changes while adding the content after the changes.

[0071] By employing a stream processing framework capable of real-time data acquisition and processing, changes to network vulnerability information can be captured in real time as the information is updated. Furthermore, this application does not update all data or overwrite the original content with changes; instead, it only incrementally updates the existing multi-source network vulnerability information with the added or changed content, thereby further enhancing the diversity and comprehensiveness of the information.

[0072] Furthermore, vulnerability attribute fields are extracted from the multi-source network vulnerability information. Then, based on the frequency of occurrence of each vulnerability attribute field, a corresponding attribute weight is assigned to each vulnerability attribute field. At the same time, a preset number of reserved fields are generated, and the attribute weight of the reserved fields is set to 0.

[0073] Furthermore, for each vulnerability attribute field, entity identification and relationship extraction are performed using reserved fields to construct "entity-relationship-entity" triples. Each triple contains the reserved entity corresponding to the reserved field.

[0074] Extract the attribute information of each entity from the multi-source network vulnerability information; the attribute information includes at least the attribute weight, attack method, attack conditions, attack success rate and attack benefits.

[0075] Furthermore, based on triples and attribute information, a dynamic knowledge graph of network vulnerabilities is constructed, and only entities with attribute weights that are not zero are used as actual knowledge graph nodes.

[0076] As a feasible implementation, when a new vulnerability attribute field appears in multi-source network vulnerability information, the new vulnerability attribute field is replaced in one of the reserved entities, and the attribute weight of the reserved entity is incremented by 1. The relationship between the new vulnerability attribute field and each actual knowledge graph node is extracted and integrated into the dynamic knowledge graph to achieve dynamic updates of the dynamic knowledge graph.

[0077] This invention assigns attribute weights to fields extracted from vulnerability information. Firstly, it assigns higher weights to fields that appear frequently, as these are more common and easier for attackers to study and exploit, thus posing a greater risk and making them more likely to be targeted first. Therefore, these fields and their associated nodes and vulnerabilities require focused defense. Secondly, it facilitates the creation of reserved fields. Multiple reserved entities are created in the knowledge graph. When a previously unseen field is updated in the multi-source network vulnerability information, the entire process of entity extraction, relation extraction, and triple construction is skipped. Instead, the new field is mapped to a reserved entity, and its relationship with other entities in the knowledge graph is extracted, directly adding it without altering the positions and relationships of other nodes, thus achieving a dynamic knowledge graph. Furthermore, only nodes with attribute weights greater than 0 are used as actual knowledge graph nodes; reserved nodes, with attribute weights of 0, are not added to the dynamic knowledge graph, thus preserving its integrity.

[0078] S102. Perform a network topology scan on the target network to obtain real-time vulnerability information, and construct an attribute attack graph of the target network based on the real-time vulnerability information and dynamic knowledge graph.

[0079] Specifically, vulnerability scanning and topology scanning are performed on the target network to identify vulnerable nodes in the target network and obtain real-time vulnerability information of the vulnerable nodes; wherein, the real-time vulnerability information includes at least the vulnerability type and vulnerability description.

[0080] Furthermore, based on the real-time vulnerability information of each vulnerability node, the corresponding target knowledge graph node is searched in the dynamic knowledge graph, and the attribute information of the target knowledge graph node is obtained.

[0081] Furthermore, the attack conditions in the attribute information are used as preconditions for the corresponding vulnerability nodes to generate precondition nodes; the attack benefits in the attribute information are used as postconditions for the corresponding vulnerability nodes to generate postcondition nodes. Then, based on the causal relationship between the precondition nodes and postcondition nodes of each vulnerability node, each vulnerability node is sequentially connected to each condition node to obtain the attribute attack graph of the target network.

[0082] As a feasible implementation method, each vulnerability type corresponds to different attack conditions and attack consequences (i.e., attack gains for the attacker). This information is included in the entity attributes when constructing the knowledge graph. When constructing the attribute attack graph, by searching for the attribute information corresponding to the vulnerability type of each vulnerability node in the dynamic knowledge graph, the attack conditions and attack consequences of each vulnerability node can be determined. Furthermore, the attack consequences of one or more vulnerability nodes may be the attack conditions of other vulnerability nodes. Based on this causal relationship, vulnerability results can be linked into one or more attack paths, thus forming the attribute attack graph.

[0083] In one embodiment, Figure 2 This is a schematic diagram of an attribute attack graph provided in an embodiment of the present invention, such as... Figure 2 As shown, the attack conditions and rewards for each vulnerable node are treated as condition nodes. In the diagram, vulnerable node 1 and vulnerable node 2 are connected through condition node 2. The content of condition node 2 is both the attack reward for vulnerable node 1 and the attack condition for vulnerable node 2. Nodes with the same characteristics are searched among all vulnerable nodes, thus forming a network as shown. Figure 2 The diagram shows the attribute attack.

[0084] S103. Based on the dynamic knowledge graph, the attribute attack graph is extended to obtain the extended attribute attack graph; based on the extended attribute attack graph, the predicted attack path is determined.

[0085] Specifically, in the dynamic knowledge graph, the relationships between every two target knowledge graph nodes are obtained, forming a relationship set. From this relationship set, node relationships not present in the attribute attack graph are filtered out to obtain potential node relationships between target knowledge graph nodes.

[0086] Furthermore, based on the attribute information of the target knowledge graph nodes that have potential node relationships, the connection conditions between them are determined.

[0087] Furthermore, based on the potential node relationships and connection conditions, corresponding connecting lines and connection condition nodes are added to the attribute attack graph to expand the attribute attack graph and obtain an extended attribute attack graph.

[0088] Because knowledge graphs contain more comprehensive information, in addition to the causal relationship between attack conditions and attack benefits, there may be other potential connections between various vulnerability nodes. Therefore, by analyzing the attribute information of each vulnerability node in a dynamic knowledge graph, we can obtain the potential relationships that are ignored between vulnerability nodes in the attribute attack graph. By connecting vulnerability nodes with potential relationships through connection conditions, we can further expand the aforementioned attribute attack graph. After expansion, more attack paths may be formed, increasing the search range of attack paths.

[0089] Furthermore, the sibling nodes of each vulnerable node are obtained in the extended attribute attack graph; where sibling nodes refer to multiple vulnerable nodes connected to the same postcondition node. For example... Figure 2 As shown, vulnerability node 2 and vulnerability node 3 are connected to the same postcondition node 5, therefore vulnerability node 2 and vulnerability node 3 are sibling nodes.

[0090] It should be noted that, Figure 2 Only a very small number of nodes are shown, and this is merely a simplified diagram to explain the invention. A real attack graph may contain many more complex vulnerability node relationships, and the number of sibling nodes included is not limited to two. Figure 2 The number of nodes and connection relationships shown are examples and are not limitations of this invention.

[0091] Furthermore, based on the attribute information in the dynamic knowledge graph, the vulnerability risk value of each vulnerable node in the same level is calculated. Then, vulnerable nodes in the same level whose vulnerability risk value does not reach a preset threshold are marked as unreadable nodes; if the vulnerability risk value of all vulnerable nodes in the same level does not reach the preset threshold, the vulnerable node with the highest vulnerability risk value is retained and marked as a readable node. All readable nodes are obtained in the extended attribute attack graph, and several predicted attack paths are determined based on the connection relationships between the readable nodes.

[0092] As a feasible implementation method, the vulnerability risk value of each vulnerable node in the same level is calculated based on the attribute information in the dynamic knowledge graph. Specifically, this includes: obtaining the attribute information of each vulnerable node in the dynamic knowledge graph; generating a corresponding attack difficulty value based on the attack methods and the difficulty of achieving the attack conditions in the attribute information; and weighting the attack difficulty value, attack success rate, and attack benefits using the attribute weights in the attribute information to obtain the vulnerability risk value of each vulnerable node.

[0093] For vulnerable nodes at the same level, attackers often only select one or a few relatively easy-to-attack nodes, as long as the attack path is established. Therefore, this invention comprehensively considers the attack success rate, attack method and difficulty of achieving attack conditions, attack benefits, and the aforementioned attribute weights of each node to evaluate the vulnerability risk value of each peer node, thereby retaining the vulnerable node with the highest vulnerability risk value or multiple vulnerability risk values ​​reaching a preset threshold. This significantly reduces the number of predicted attack paths while maintaining prediction accuracy, saving computation time and reducing computational complexity.

[0094] S104. Construct a digital twin model of the target network and deploy the predicted attack paths into the digital twin model; deduce the attack complexity of the predicted attack paths in the digital twin model and determine the defense strategy based on the attack complexity level.

[0095] Specifically, a digital twin model of the target network is constructed, and the predicted attack paths are deployed into the digital twin model.

[0096] Furthermore, after deploying the predicted attack path to the digital twin model, the vulnerability nodes are simulated to attack based on the attack methods of each vulnerability node in the predicted attack path. The attack skills and attack time used by the vulnerability nodes that are successfully attacked during the simulation are recorded, as well as the number of vulnerability nodes that are successfully attacked in the predicted attack path.

[0097] Furthermore, the attack complexity of the predicted attack path is calculated based on the number of attack skills, the attack time, and the number of successfully attacked vulnerable nodes in the predicted attack path. Specifically, weights can be assigned separately and a weighted calculation performed to obtain the attack complexity, or other algorithms can be used for calculation; this invention does not impose any limitations.

[0098] Furthermore, based on the preset attack complexity level classification rules, the attack complexity level of the predicted attack path is determined. Then, according to the attack complexity level, the corresponding level of the defense strategy library is invoked, and the defense strategy applicable to the attack skills and attack time used by each vulnerable node is searched in the defense strategy library to form the defense strategy for the predicted attack path.

[0099] As a feasible implementation method, this invention pre-constructs attack complexity level classification rules, such as attack complexity being classified as level one within a certain range, level two within another range, and so on. A corresponding defense strategy library is created for each level. Each defense strategy library stores defense strategies corresponding to different vulnerability types, attack methods, and attack conditions, allowing users to find the corresponding defense strategy based on any information field.

[0100] S105. Verify the effectiveness of the defense strategy through a digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automated execution.

[0101] Specifically, in the digital twin model, the defense strategy is applied to all vulnerable nodes of the predicted attack path, and several attack simulations are performed for a preset duration.

[0102] Furthermore, the initial defense strategy's blocking rate against attacks and its false positive rate against normal business traffic are calculated within a preset time period. If both the blocking rate and the false positive rate meet the preset conditions, the defense strategy passes the effectiveness verification.

[0103] Finally, the verified defense strategy is fed back to the network nodes in the predicted attack path for automated execution without human intervention.

[0104] In addition, embodiments of the present invention also provide a network security protection system based on digital twin technology, such as Figure 3 As shown, the network security protection system 300 based on digital twin technology specifically includes:

[0105] The attack graph construction module 310 is used to collect multi-source network vulnerability information and update it in real time based on a stream processing framework; construct a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; perform network topology scanning on the target network to obtain existing real-time vulnerability information; and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph.

[0106] The attack path prediction module 320 is used to expand the attribute attack graph based on the dynamic knowledge graph to obtain an expanded attribute attack graph; and to determine the predicted attack path based on the expanded attribute attack graph.

[0107] The defense strategy verification module 330 is used to construct a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy according to the attack complexity level; verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automated execution.

[0108] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0109] The foregoing has described specific embodiments of the present invention. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0110] The above description is merely an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of the present invention should be included within the protection scope of the present invention.

Claims

1. A network security protection method based on digital twin technology, characterized in that, The method includes: Based on a stream processing framework, multi-source network vulnerability information is collected and updated in real time. Based on the aforementioned multi-source network vulnerability information, a dynamic knowledge graph of network vulnerabilities is constructed, specifically including: Vulnerability attribute fields are extracted from the multi-source network vulnerability information; based on the frequency of occurrence of each vulnerability attribute field, a corresponding attribute weight is assigned to each vulnerability attribute field. Generate a preset number of reserved fields and set the attribute weight of the reserved fields to 0; For each vulnerability attribute field, entity identification and relation extraction are performed using reserved fields to construct "entity-relationship-entity" triples; wherein, the triples contain the reserved entities corresponding to the reserved fields; Extract attribute information for each entity from the multi-source network vulnerability information; wherein, the attribute information includes at least the attribute weight, attack method, attack conditions, attack success rate, and attack benefits; Based on the triples and the attribute information, a dynamic knowledge graph of the network vulnerability is constructed, and only entities with attribute weights that are not zero are used as actual knowledge graph nodes. When a new vulnerability attribute field appears in the multi-source network vulnerability information, the new vulnerability attribute field is replaced in one of the reserved entities, and the attribute weight of the reserved entity is incremented by 1. The relationship between the new vulnerability attribute fields and each actual knowledge graph node is extracted and integrated into the dynamic knowledge graph to achieve dynamic updating of the dynamic knowledge graph; A network topology scan is performed on the target network to obtain real-time vulnerability information. Based on the real-time vulnerability information and the dynamic knowledge graph, an attribute attack graph of the target network is constructed, specifically including: The target network is subjected to vulnerability scanning and topology scanning to identify vulnerable nodes in the target network and to obtain real-time vulnerability information of the vulnerable nodes; wherein, the real-time vulnerability information includes at least the vulnerability type and vulnerability description; Based on the real-time vulnerability information of each vulnerability node, the corresponding target knowledge graph node is searched in the dynamic knowledge graph, and the attribute information of the target knowledge graph node is obtained. The attack conditions in the attribute information are used as the preconditions of the corresponding vulnerability node to generate a precondition node; the attack benefits in the attribute information are used as the postconditions of the corresponding vulnerability node to generate a postcondition node. Based on the causal relationship between the precondition nodes and postcondition nodes of each vulnerable node, each vulnerable node is sequentially connected to each condition node to obtain the attribute attack graph of the target network, specifically including: The target network is subjected to vulnerability scanning and topology scanning to identify vulnerable nodes in the target network and to obtain real-time vulnerability information of the vulnerable nodes; wherein, the real-time vulnerability information includes at least the vulnerability type and vulnerability description; Based on the real-time vulnerability information of each vulnerability node, the corresponding target knowledge graph node is searched in the dynamic knowledge graph, and the attribute information of the target knowledge graph node is obtained. The attack conditions in the attribute information are used as the preconditions of the corresponding vulnerability node to generate a precondition node; the attack benefits in the attribute information are used as the postconditions of the corresponding vulnerability node to generate a postcondition node. Based on the causal relationship between the precondition nodes and postcondition nodes of each vulnerability node, each vulnerability node is sequentially connected to each condition node to obtain the attribute attack graph of the target network. Based on the dynamic knowledge graph, the attribute attack graph is extended to obtain an extended attribute attack graph, specifically including: In the dynamic knowledge graph, the relationship between every two target knowledge graph nodes is obtained, forming a relationship set; In the set of relationships, node relationships that do not appear in the attribute attack graph are filtered out to obtain potential node relationships between the target knowledge graph nodes; Based on the attribute information of target knowledge graph nodes with potential node relationships, determine the connection conditions between them; Based on the potential node relationships and connection conditions, corresponding connection lines and connection condition nodes are added to the attribute attack graph to expand the attribute attack graph, resulting in an expanded attribute attack graph; based on the expanded attribute attack graph, the predicted attack path is determined. Construct a digital twin model of the target network and deploy the predicted attack path into the digital twin model; The attack complexity of the predicted attack path is deduced in the digital twin model, and a defense strategy is determined based on the attack complexity level, specifically including: After the predicted attack path is deployed to the digital twin model, the vulnerability nodes are simulated to attack according to the attack method of each vulnerability node in the predicted attack path. The attack skills and attack time used by the vulnerability nodes that are successfully attacked during the simulation are recorded, as well as the number of vulnerability nodes that are successfully attacked in the predicted attack path. The attack complexity of the predicted attack path is calculated based on the number of attack skills, the attack time, and the number of successfully attacked vulnerable nodes in the predicted attack path. The attack complexity level of the predicted attack path is determined according to the preset attack complexity level classification rules. Based on the attack complexity level, the corresponding level of defense strategy library is invoked, and the defense strategy applicable to the attack skills and attack time used by each vulnerable node is searched in the defense strategy library to form the defense strategy for the predicted attack path. The effectiveness of the defense strategy is verified through the digital twin model, specifically including: In the digital twin model, the defense strategy is applied to all vulnerable nodes of the predicted attack path, and an attack simulation is performed for a preset duration. Calculate the blocking rate of the defense strategy against attacks and the false positive rate against normal business traffic within the preset time period; If both the blocking rate and the false positive rate meet the preset conditions, the defense strategy passes the effectiveness verification. The verified defense strategy is fed back to the network nodes in the predicted attack path for automated execution.

2. The network security protection method based on digital twin technology according to claim 1, characterized in that, Based on a stream processing framework, multi-source network vulnerability information is collected and updated in real time, specifically including: The streaming processing framework monitors changes in the multi-source network vulnerability information and incrementally updates the information based on these changes. The incrementally updated information retains the original content while adding the updated content.

3. The network security protection method based on digital twin technology according to claim 1, characterized in that, Based on the extended attribute attack graph, the predicted attack path is determined, specifically including: Obtain the sibling nodes of each vulnerable node in the extended attribute attack graph; wherein, the sibling nodes refer to multiple vulnerable nodes connected to the same postcondition node; Based on the attribute information in the dynamic knowledge graph, calculate the vulnerability risk value of each vulnerability node in the same level node; Vulnerable nodes whose vulnerability risk value does not reach the preset threshold are marked as unreadable nodes; if the vulnerability risk value of all vulnerable nodes in the same level does not reach the preset threshold, the vulnerable node with the highest vulnerability risk value is retained and marked as a readable node. All readable nodes are obtained in the extended attribute attack graph, and several predicted attack paths are determined based on the connection relationships between the readable nodes.

4. A network security protection method based on digital twin technology according to claim 3, characterized in that, Based on the attribute information in the dynamic knowledge graph, the vulnerability risk value of each vulnerability node in the same level is calculated, specifically including: Obtain the attribute information of each vulnerability node in the dynamic knowledge graph at the same level; Based on the attack methods and the difficulty of achieving the attack conditions in the attribute information, a corresponding attack difficulty value is generated; By using the attribute weights in the attribute information, the attack difficulty value, attack success rate, and attack benefits are weighted and calculated to obtain the vulnerability risk value of each vulnerability node.

5. A network security protection system based on digital twin technology, employing a network security protection method based on digital twin technology as described in any one of claims 1-4, characterized in that, The system includes: The attack graph construction module is used to collect multi-source network vulnerability information and update it in real time based on a stream processing framework; construct a dynamic knowledge graph of network vulnerabilities based on the multi-source network vulnerability information; perform network topology scanning on the target network to obtain existing real-time vulnerability information; and construct an attribute attack graph of the target network based on the real-time vulnerability information and the dynamic knowledge graph. The attack path prediction module is used to expand the attribute attack graph based on the dynamic knowledge graph to obtain an expanded attribute attack graph; and to determine the predicted attack path based on the expanded attribute attack graph. The defense strategy verification module is used to construct a digital twin model of the target network and deploy the predicted attack path into the digital twin model; deduce the attack complexity of the predicted attack path in the digital twin model and determine the defense strategy according to the attack complexity level; verify the effectiveness of the defense strategy through the digital twin model, and feed back the verified defense strategy to the network nodes in the predicted attack path for automated execution.

Images