Malicious entity identification method based on subjective logic reputation

Abstract

The invention provides a malicious entity identification method based on subjective logic reputation. The method comprises the following steps: acquiring entities in a target network, and constructing a bipartite graph; initializing an initial reputation value of the node; when the initial reputation value difference meets a reputation propagation condition, reputation propagation between the nodes is carried out, a propagation structure is updated, and when the propagation structure meets a propagation convergence condition, reputation propagation is stopped to obtain a neighbor node set of the nodes; calculating neighbor node reputation, aggregating the initial reputation value of the node and the neighbor node reputation to obtain an aggregated reputation value; calculating the historical reputation influence of the node by using the discount reputation, and calculating a final reputation value according to the historical reputation influence and the aggregated reputation value; and judging whether the entity corresponding to the node is a malicious entity according to the final reputation value. By applying the method, multi-aspect and multi-dimensional reputation propagation and aggregation can be realized, the node reputation is dynamically updated, the reputation influence between entities is fully and reasonably considered, and malicious entities can be accurately identified in a complex and changeable network environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious entity identification method based on subjective logical reputation. Background Art

[0002] With the rapid development of the Internet of Everything (IoE), the risk of malware spreading from the internet to local area networks (LANs) has significantly increased. The widespread adoption of IoT devices further exacerbates the security threat posed by malicious entities invading the network. This threat is not limited to cyberspace but can potentially cause actual harm. In this context, methods for detecting existing or emerging malicious entities within the network have become crucial for ensuring IoT security.

[0003] In order to detect malicious entities in the network, the existing technology proposes static malware identification technology combined with antivirus software and identification methods based on traditional reputation mechanisms. However, both have obvious limitations.

[0004] Static malware identification techniques typically rely on using file identifiers (such as file hash values) to query threat intelligence platforms to determine if a file has been marked as malicious. This method, while only capable of intelligently identifying known malware, is ineffective against zero-day malware. Furthermore, it can cause malware not included in threat intelligence platforms to remain dormant for extended periods, leading to delays in malware detection. Furthermore, due to the characteristics of hash functions, attackers can easily evade detection mechanisms by simply making minor modifications to file contents. This passive malicious entity identification method, which relies on static identifiers, struggles to address new attacks and advanced attackers, and is insufficiently equipped to cope with the rapid changes and complexities of IoT networks.

[0005] Traditional reputation mechanisms typically assign reputation scores based on the strength of evidence presented by individual nodes. However, this approach can easily generate erroneous reputation assessments when insufficient evidence is available, due to a lack of consideration for uncertainty. Furthermore, reputation aggregation often employs simple methods such as weighted averaging to combine reputation values ​​from different sources. This approach can overlook the interdependencies and dynamic nature of multi-source data, leading to biases in the reputation aggregation process and compromising the accuracy and robustness of the overall reputation assessment. Consequently, this mechanism struggles to adapt to real-world needs in complex and volatile network environments.

[0006] Therefore, it is necessary to provide a method for accurately identifying malicious entities to solve the problem of difficulty in identifying malicious entities in complex network environments. Summary of the Invention

[0007] The purpose of the present invention is to provide a malicious entity identification method based on subjective logical reputation, so as to accurately identify malicious entities in a complex and changeable network environment.

[0008] In a first aspect, the present invention provides a malicious entity identification method based on subjective logical reputation, including: obtaining entities in a target network, constructing a bipartite graph according to the process connection between the entities; initializing the subjective logical reputation of the node to obtain the initial reputation value of the node; setting the node reputation propagation condition, reputation propagation structure and propagation convergence condition, judging whether the reputation propagation condition is met according to the initial reputation value difference between the nodes, performing reputation propagation between the nodes when the initial reputation value difference meets the reputation propagation condition, updating the propagation structure, judging whether the updated propagation structure meets the propagation convergence condition, and stopping the reputation propagation when the propagation structure meets the propagation convergence condition to obtain a set of neighbor nodes of the node; performing neighbor node reputation aggregation calculation according to the neighbor node set to obtain the neighbor node reputation, aggregating the node's initial reputation value and the neighbor node reputation to obtain the aggregated reputation value; using the discounted reputation to calculate the node's historical reputation influence, and calculating the cumulative time-discounted reputation according to the historical reputation influence and the aggregated reputation value to update the node's final reputation value; judging whether the entity corresponding to the node is a malicious entity according to the final reputation value to obtain a malicious entity identification result.

[0009] The beneficial effects of the subjective logical reputation-based malicious entity identification method provided by this invention include: by constructing a graph model to define subjective logical reputation values ​​for each entity in the network and their relationships, taking into account the subjective logical reputation propagation and aggregation mechanism between nodes, and dynamically updating the reputation scores of nodes to infer potential malicious entities. Furthermore, a convergent reputation propagation mechanism is established, capable of multifaceted and multi-dimensional reputation propagation and aggregation, fully and rationally considering the reputation influence between entities, and accurately identifying malicious entities in complex and changing network environments.

[0010] In a possible embodiment, entities in the target network include an intranet host vertex set H, a process vertex set P, an IP vertex set A, and a file vertex set F; a bipartite graph is constructed based on the process connections between the entities, including: taking the union of the intranet host vertex set H, the IP vertex set A, and the file vertex set F as the vertex set to obtain V′=(H∪A∪F), limiting the edge attributes to the processes between the vertices, and constructing a bipartite graph to obtain G(V′,P).

[0011] In another possible embodiment, when the initial reputation value difference satisfies the reputation propagation condition, reputation propagation between nodes is performed, and the propagation structure is updated, including: when the initial reputation value difference satisfies the reputation propagation condition, listing the propagation node in the neighbor node set of the propagated node; changing the propagation structure from P to i→j =(Δ i→j ,d) Update to P′ i→j =(Δ′i→j =T i→j Δ i→j ,d′=d-1), where P i→j represents the propagation structure of the propagation node, Δ i→j represents the initial reputation value difference between nodes i→j, d represents the propagation distance of the propagation node, and P′ i→j represents the propagation structure of the propagated node, Δ′ i→j Represents the difference in propagation, T i→j represents the initial reputation value of the propagating node, and d′ represents the propagation distance of the propagated node.

[0012] In other possible embodiments, neighbor node reputations are aggregated and calculated based on a neighbor node set to obtain neighbor node reputations, and the initial reputation values ​​of the aggregated nodes and the neighbor node reputations are used to obtain an aggregated reputation value, including: setting process weights between nodes and reputation weights of different types of nodes; calculating the reputations of different types of nodes in the neighbor node set based on process weights, reputation weights, and neighbor node types, and aggregating and calculating the reputations of all types of neighbor nodes in the neighbor node set to obtain neighbor node reputations; and obtaining an aggregated reputation value by aggregating the initial reputation values ​​of the aggregated nodes and the neighbor node reputations.

[0013] The process weight calculation is defined to satisfy the following formula: in, represents the process weight, δ represents the process reputation parameter, represents the set of processes between nodes i→j, T i→p Represents the initial reputation value of node i; the reputation weight calculation is defined to satisfy the following formula: Among them, w i→j Represents the reputation weight, and φ represents the weight parameter of the node reputation value. The reputation of different types of nodes in the neighbor node set is calculated separately according to the process weight, reputation weight, and neighbor node type. The reputation of all types of neighbor nodes in the neighbor node set is aggregated to obtain the neighbor node reputation, including: the subjective logical reputation aggregation calculation of all nodes in the neighbor node set whose corresponding entity type is c satisfies the following formula: in, represents the aggregated trust value of neighbor nodes of type c, Indicates the aggregated untrusted value of neighbor nodes of type c. Represents the aggregated uncertainty value of neighbor nodes of type c, I c Represents all neighbor nodes of type c in the neighbor node set; the reputation value calculation of all neighbor nodes of type c satisfies the following formula: Where ρ represents the uncertainty adjustment parameter; the reputation calculation of all types of aggregated neighbor nodes satisfies the following formula: in, represents the aggregate trust value of all types of neighbor nodes, Represents the aggregated untrustworthy value of all types of neighbor nodes, represents the aggregate uncertainty value of all types of neighbor nodes, C j represents the set of all types of neighbor nodes of node j, and η represents the weight parameter.

[0014] Aggregate the initial reputation value of the node and the reputation of the neighboring nodes to obtain the aggregated reputation value, including: the aggregation calculation of the initial reputation value of the node and the reputation of the neighboring nodes satisfies the following formula: in, represents the aggregated trust value of node j, represents the aggregate untrusted value of node j, represents the aggregated uncertainty value of node j, b i→j represents the initial trust value of node j, d i→j represents the initial untrusted value of node j, u i→j represents the initial uncertain value of node j, represents the aggregated trust value of neighbor nodes, Indicates the aggregated untrusted value of neighbor nodes, Represents the aggregated uncertainty value of neighbor nodes; the calculation of the node's aggregated reputation value satisfies the following formula: Where ρ represents the uncertainty adjustment parameter.

[0015] The cumulative time-discounted reputation is calculated based on the historical reputation impact and the aggregated reputation value to update the final reputation value of the node, including: the cumulative time-discounted reputation calculation satisfies the following formula: Among them, b′ i→j represents the trust value of the cumulative time discount, d′ i→j represents the untrustworthy value of the cumulative time discount, u′ i→j represents the uncertainty value of the cumulative time discount, t represents the node information time, represents the node information time set, γ represents the time decay parameter, γ t Indicates the influence of historical reputation, represents the aggregate trust value of the node with information time t, represents the aggregated untrustworthy value of the node with information time t, Represents the aggregated uncertainty value of the node with information time t; the final reputation value calculation satisfies the following formula: i→j =b′ i→j +ρ*u′ i→j , where ρ represents the uncertainty adjustment parameter.

[0016] In a second aspect, the present invention further provides a malicious entity identification device based on subjective logical reputation, comprising: a bipartite graph construction unit, configured to obtain entities in a target network and construct a bipartite graph based on process connections between the entities;

[0017] An initialization unit is used to initialize the subjective logical reputation of the node to obtain the initial reputation value of the node; a reputation propagation unit is used to set the node reputation propagation conditions, reputation propagation structure and propagation convergence conditions, and judge whether the reputation propagation conditions are met based on the initial reputation value difference between the nodes. When the initial reputation value difference meets the reputation propagation conditions, reputation propagation between the nodes is performed, the propagation structure is updated, and it is judged whether the updated propagation structure meets the propagation convergence conditions. When the propagation structure meets the propagation convergence conditions, reputation propagation is stopped to obtain the node's neighbor node set; a reputation aggregation unit is used to perform neighbor node reputation aggregation calculation based on the neighbor node set to obtain the neighbor node reputation, and the initial reputation value of the node and the neighbor node reputation are aggregated to obtain the aggregated reputation value; a reputation calculation unit is used to use the discounted reputation to calculate the node's historical reputation influence, and calculate the cumulative time-discounted reputation based on the historical reputation influence and the aggregated reputation value to update the node's final reputation value; a judgment unit is used to judge whether the entity corresponding to the node is a malicious entity based on the final reputation value to obtain a malicious entity identification result.

[0018] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned malicious entity identification method based on subjective logical reputation when executed by a processor.

[0019] In a fourth aspect, the present invention also provides an electronic device comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned malicious entity identification method based on subjective logical reputation.

[0020] For the beneficial effects of the second to fourth aspects, please refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of a malicious entity identification method based on subjective logical reputation provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of the main structure of a malicious entity identification method based on subjective logical reputation provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of a malicious entity identification device based on subjective logical reputation provided by an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the present invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0026] This embodiment provides a method for identifying malicious entities based on subjective logical reputation. Figure 1 and Figure 2 , the method comprising:

[0027] S101: Obtain entities in the target network and construct a bipartite graph based on the process connections between the entities.

[0028] In a possible embodiment, entities in the target network include an intranet host vertex set H, a process vertex set P, an IP vertex set A, and a file vertex set F; a bipartite graph is constructed based on the process connections between the entities, including: taking the union of the intranet host vertex set H, the IP vertex set A, and the file vertex set F as the vertex set to obtain V′=(H∪A∪F), limiting the edge attributes to the processes between the vertices, and constructing a bipartite graph to obtain G(V′,P).

[0029] In a specific embodiment, all entities in the target network to be protected are obtained, including the intranet host IP, all processes and sub-processes opened by the host, the external IP connected to the process, and the sub-files opened by the process. Due to the composition of the entity, four vertex sets are set, namely the intranet host vertex set H, the process vertex set p, the IP vertex set A, and the file vertex set F. Among them, since there is no connection between the three vertex sets H, A, and F, the union of the three is taken as V′=(H∪A∪F), and a bipartite graph can be obtained by constructing a bipartite graph based on the entity: G=(V ′,P,E), where E represents the connection between V′ and P. Furthermore, since all vertices in vertex set V′ are connected by process set P, G = (V′,P,E) can be optimized to G(V′,P), forming a bipartite graph with vertex sets as nodes and edges defined as processes between vertices. This optimized bipartite graph optimizes the nodes and edges originally constructed from the process set, using processes as the connecting medium between two nodes. This facilitates the application of subjective logic theory to leverage the thoughts of shared friends to determine the degree of belief.

[0030] S102: Initialize the subjective logical reputation of the node to obtain the initial reputation value of the node.

[0031] In a possible embodiment, initializing the subjective logical reputation of a node to obtain an initial reputation value of the node includes: defining the subjective logical reputation of the node, including defining the subjective logical triple {b i→j ,d i→j ,u i→j}, where b i→j represents the trust value, d i→j Indicates untrusted value, u i→j Represents an uncertain value and defines a formula for calculating reputation based on subjective logic triples. Initializing a node's subjective logic triples based on threat intelligence allows calculation of the node's initial reputation.

[0032] In a specific embodiment, for entity j, there exists a subjective logical triple {b i→j ,d i→j ,u i→j}, that is, the subjective logic triple of the node is obtained, where b i→j represents the trust value, d i→j Indicates untrusted value, u i→j Indicates an uncertain value. The relationship between the three in the subjective logic triple satisfies: b i→j +d i→j +u i→j =1. The reputation value calculation satisfies the following formula: T i→j =b i→j +ρ*u i→j , where T i→j represents the reputation value of the node, and ρ represents the uncertainty adjustment parameter. For all nodes, the triple design can be defined as in, represents the threat level belief value obtained by node j from threat intelligence, Represents the uncertainty parameter of node j. For reputation calculation, the uncertainty adjustment parameter ρ ranges from [0, 1]. A larger ρ indicates that the uncertain entity is more likely to be benign. For example, ρ is 0.5.

[0033] There are many types of entities corresponding to the nodes in the bipartite graph. For different types of entities, due to the different characteristics of the entities themselves, their belief values ​​and uncertainty parameters are expressed differently. Specifically, for file-type entities (entities in the file vertex set), files usually use hash codes as the unique identifiers of files, so the hash codes can be used to find out whether there are Trojan file records in the threat intelligence. If the hash code of the file exists in the Trojan record of the threat intelligence, the trust value of the file entity is the lowest, because it can be confidently considered that the entity is a malicious entity, so the certainty parameter is the largest. If the hash value of the file does not exist in the Trojan file record of the threat intelligence, although it can be considered that the threat level is the highest, since it does not exist in the threat intelligence does not mean that it is a benign file, it may also be a zero-day malicious file, so it cannot be confidently considered to be a benign file, so the uncertainty parameter is increased. Therefore, for file-type entities, the belief value and uncertainty parameter of the entity can be expressed as: For process-type entities (entities in the process vertex set), processes are running files, and the method for determining the degree of belief is the same as for file-type entities. For external IP entities (entities in the IP vertex set), whether the IP address is malicious is detected by threat intelligence. The parameter setting is similar to that of file entities. Therefore, the belief value and uncertainty parameter of the external IP entity can be expressed as: For intranet IP (entities where intranet host vertices are concentrated), due to the particularity of intranet IP, on the basis of restricting the frequent changes of IP addresses of intranet host entities, threat intelligence cannot effectively record intranet IP, so for intranet IP entities, it is impossible to set belief values ​​through their own attributes, so the initialization uncertainty of intranet IP is the highest. After initializing the subjective logic triplet of the node according to threat intelligence, the initial reputation value of the node can be obtained according to the defined reputation value calculation formula.

[0034] S103: Set node reputation propagation conditions, reputation propagation structure and propagation convergence conditions, determine whether the reputation propagation conditions are met based on the initial reputation value difference between nodes, perform reputation propagation between nodes when the initial reputation value difference meets the reputation propagation conditions, update the propagation structure, determine whether the updated propagation structure meets the propagation convergence conditions, and stop reputation propagation when the propagation structure meets the propagation convergence conditions to obtain the node's neighbor node set.

[0035] In a possible embodiment, setting the node reputation propagation condition, reputation propagation structure and propagation convergence condition includes: setting the node reputation propagation condition as: defining the initial reputation value difference between the node and the neighboring node as Among them, T i→j represents the initial reputation value of node j, Represents the initial reputation value of node j’s neighbor node, when Δ i→ j is greater than the preset propagation threshold ψ (ie Δ i→j >ψ,) triggers propagation. Set the reputation propagation structure to P i→j =(Δ i→j ,d), where d represents the propagation distance. The propagation convergence condition is Δ i→j <ψ or d=1.

[0036] In a possible embodiment, when the initial reputation value difference satisfies the reputation propagation condition, reputation propagation between nodes is performed, and the propagation structure is updated, including: when the initial reputation value difference satisfies the reputation propagation condition, the propagation node is included in the neighbor node set of the propagated node; the propagation structure is changed from P to i→j =(Δ i→j ,d) Update to P′ i→j =(Δ′ i→j =T i→j Δ i→j ,d′=d-1), where P i→j represents the propagation structure of the propagation node, Δ i→j represents the initial reputation value difference between nodes i→j, d represents the propagation distance of the propagation node, and P′ i→j represents the propagation structure of the propagated node, Δ′ i→j Represents the difference in propagation, T i→j represents the initial reputation value of the propagating node, and d′ represents the propagation distance of the propagated node.

[0037] In a specific embodiment, when performing reputation propagation, it is first determined whether the difference between the initial reputation value of node j and its neighboring nodes is greater than a preset propagation threshold. When the initial reputation value difference is greater than the preset propagation threshold, that is, Δ i→j When P > ψ, the propagation is triggered. To carry out reputation propagation, the propagation node (neighboring node) is included in the neighboring node set of the propagated node (node ​​j), and the propagation structure is changed from P to i→j =(Δ i→j ,d) Update to P′ i→j =(Δ′ i→j =T i→j Δ i→j ,d′=d-1). Since T i→j ∈[0,1], so Δ i→j and d will continue to decrease until Δ i→j When Δ<ψ or d=1, the current propagation terminates. That is, after updating the propagation structure, the updated propagation structure is used to determine whether the propagation convergence condition (Δ i→j<ψ or d=1), when the propagation convergence condition is met, the current propagation is terminated. When the reputation propagation stops, the neighbor node set of node j can be obtained.

[0038] The reputation propagation process can easily fall into an infinite propagation cycle, resulting in high resource consumption. After multiple propagations, the reputation values ​​of all entities will collectively decline, ultimately rendering their reputations ineffective. Therefore, it is necessary to design constraints for propagation. Furthermore, to prevent infinite propagation between nodes, the propagating node is stored in the evidence set of the propagated node, and nodes in the evidence set are ignored during the next propagation. Furthermore, a collection of evidence composed of multiple low-reputation nodes can form an evidence chain.

[0039] S104: performing neighbor node reputation aggregation calculation based on the neighbor node set to obtain neighbor node reputation, and obtaining an aggregated reputation value by aggregating the initial reputation value of the node and the reputation of the neighbor nodes.

[0040] In a possible embodiment, neighbor node reputations are aggregated and calculated based on a neighbor node set to obtain neighbor node reputations, and the initial reputation values ​​of the aggregated nodes and the neighbor node reputations are used to obtain an aggregated reputation value, including: setting process weights between nodes and reputation weights of different types of nodes; calculating the reputations of different types of nodes in the neighbor node set based on process weights, reputation weights, and neighbor node types, and aggregating and calculating the reputations of all types of neighbor nodes in the neighbor node set to obtain neighbor node reputations; and obtaining an aggregated reputation value by aggregating the initial reputation values ​​of the aggregated nodes and the neighbor node reputations.

[0041] In a specific embodiment, the process weight calculation is defined to satisfy the following formula: in, represents the process weight, δ represents the process reputation parameter, represents the set of processes between nodes i→j, T i→p Represents the initial reputation value of node i; the reputation weight calculation is defined to satisfy the following formula: Among them, w i→j Represents the reputation weight, and φ represents the weight parameter of the node reputation value. The reputation of different types of nodes in the neighbor node set is calculated separately based on the process weight, reputation weight, and neighbor node type. The reputation of all types of neighbor nodes in the neighbor node set is aggregated to obtain the neighbor node reputation, including: the subjective logical reputation aggregation calculation of all nodes in the neighbor node set whose corresponding entity type is c satisfies the following formula: in, represents the aggregated trust value of neighbor nodes of type c, Indicates the aggregated untrusted value of neighbor nodes of type c. Represents the aggregated uncertainty value of neighbor nodes of type c, Ic Represents all neighbor nodes of type c in the neighbor node set; the reputation value calculation of all neighbor nodes of type c satisfies the following formula: Where ρ represents the uncertainty adjustment parameter.

[0042] The reputation calculation of all types of aggregated neighbor nodes satisfies the following formula: in, represents the aggregate trust value of all types of neighbor nodes, Represents the aggregated untrustworthy value of all types of neighbor nodes, represents the aggregate uncertainty value of all types of neighbor nodes, C j represents the set of all types of neighbor nodes of node j, and η represents the weight parameter.

[0043] Aggregate the initial reputation value of the node and the reputation of the neighboring nodes to obtain the aggregated reputation value, including: the aggregation calculation of the initial reputation value of the node and the reputation of the neighboring nodes satisfies the following formula: in, represents the aggregated trust value of node j, represents the aggregate untrusted value of node j, represents the aggregated uncertainty value of node j, b i→j represents the initial trust value of node j, d i→j represents the initial untrusted value of node j, u i→j represents the initial uncertain value of node j, represents the aggregated trust value of neighbor nodes, Indicates the aggregated untrusted value of neighbor nodes, Represents the aggregated uncertainty value of neighbor nodes; the calculation of the node's aggregated reputation value satisfies the following formula: Where ρ represents the uncertainty adjustment parameter.

[0044] For example, due to the uncertainty of reputation between nodes, the reputation value of the original node can be estimated by considering the reputation of the node's neighbors. Adhering to the principle of "birds of a feather flock together," if there are a large number of malicious nodes in the node's neighborhood, the original node can be considered as a malicious node. Therefore, it is crucial to consider the influence of neighboring nodes. However, when considering the influence of neighbors, the weight relationship needs to be considered. Since the design of the bipartite graph is that nodes are connected by process entities as edges, it should be noted that, for example, there may be multiple processes on the host connected to the same file, which means that there is more than one edge between nodes, so the edge (process) weight needs to be considered.

[0045] The process weight calculation of node i→j satisfies the following formula: in, represents the process weight, δ represents the process reputation parameter, represents the set of processes between nodes i→j, T i→p Represents the initial reputation value of node i. i→p ∈[0,1], The weight of low credibility can be increased. The value range of δ is δ>0. For example, the value of δ is δ=ln2.

[0046] A flexible aggregation method is adopted for node reputations of different entity types. Therefore, for a certain type c, the subjective logical aggregation formula of neighbor nodes satisfies: w i→j Represents the weight of the neighbor node’s reputation value. Since neighbor nodes also include process relationships, w i→j The weight of the process is also considered, so w i→j The calculation satisfies the following formula: Among them, w i→j Represents the reputation weight, φ represents the weight parameter of the node reputation value, the numerator represents the weight of the process, and the remaining part uses the Sigmoid function to smooth the weight. Among them, the value range of φ is φ>0. The larger φ is, the greater the relationship between the function and reputation. i→j For each item i∈I c {b i→j ,d i→j ,u i→j}The weights are the same, and the weights satisfy normalization, and there is b i→j +d i→j +u i→j =1, so Satisfy the subjective logic reputation constraint. For type c, the reputation value can be defined as

[0047] After obtaining all types of neighbor reputations of a node, it is necessary to aggregate all types of neighbor reputations. The calculation of all types of reputations of aggregated neighbor nodes satisfies the following formula: in, represents the aggregate trust value of all types of neighbor nodes, Represents the aggregated untrustworthy value of all types of neighbor nodes, represents the aggregate uncertainty value of all types of neighbor nodes, C j represents the set of all types of neighbor nodes of node j, and η represents the weight parameter.

[0048] Due to the existence of uncertainty, for two subjective logic triples, considering the trust value and distrust value of the other party under high uncertainty, the aggregate calculation of the node's initial reputation value and the neighbor node's reputation satisfies the following formula: in, represents the aggregated trust value of node j, represents the aggregate untrusted value of node j, represents the aggregated uncertainty value of node j, b i→j represents the initial trust value of node j, d i→j represents the initial untrusted value of node j, u i→j represents the initial uncertain value of node j, represents the aggregated trust value of neighbor nodes, Indicates the aggregated untrusted value of neighbor nodes, Represents the aggregated uncertainty value of neighbor nodes. According to the uncertainty of weight u, the more confident part will have a larger weight, and the less confident part will have a smaller weight. In addition, the above formula also conforms to The calculation of the node's aggregate reputation value satisfies:

[0049] S105: Calculate the historical reputation influence of the node using the discounted reputation, and calculate the accumulated time discounted reputation based on the historical reputation influence and the aggregated reputation value to update the final reputation value of the node.

[0050] In one possible embodiment, the cumulative time-discounted reputation is calculated based on the historical reputation impact and the aggregated reputation value to update the final reputation value of the node, including: the cumulative time-discounted reputation calculation satisfies the following formula: Among them, b′ i→j represents the trust value of the cumulative time discount, d′ i→j represents the untrustworthy value of the cumulative time discount, u′ i→j represents the uncertainty value of the cumulative time discount, t represents the node information time, represents the node information time set, γ represents the time decay parameter, γ t Indicates the influence of historical reputation, represents the aggregate trust value of the node with information time t, represents the aggregated untrustworthy value of the node with information time t, Represents the aggregated uncertainty value of the node with information time t; the final reputation value calculation satisfies the following formula: i→j =b′ i→j +ρ*u′ i→j , where ρ represents the uncertainty adjustment parameter.

[0051] In a specific embodiment, since the process of running a process on a host is dynamic, processes running in different time periods are different from other entity information. In order to comprehensively consider the host entity information, historical entity information also needs to be considered. Therefore, a discount subjective logic is used to integrate historical information, so that entity information with a longer history will be considered less, while entity information with a newer time will be considered more. The reputation calculation of the cumulative time discount satisfies the following formula: Setting γ t By exponentially attenuating the impact of historical entity information, the weight of the denominator can maintain the normalization of a single formula. By discounting the node reputation of different entity information times through the time decay parameter, a reasonable consideration of the node's historical reputation is achieved. In addition, when hour, So the overall weight is b′ i→j +d′ i→j +u′ i→j =1. Satisfy the constraints of subjective logical reputation. The final reputation value calculation satisfies the following formula: T′ i→j =b′ u→j +ρ*u′ u→j .

[0052] S106: Determine whether the entity corresponding to the node is a malicious entity based on the final reputation value to obtain a malicious entity identification result.

[0053] In one possible embodiment, the final reputation value is compared with a preset malicious entity identification threshold to determine whether the final reputation value is lower than the preset malicious entity identification threshold. If the final reputation value is lower than the preset malicious entity identification threshold, the node's reputation is considered too low, and the entity corresponding to the node is determined to be a malicious entity.

[0054] The proposed malicious entity identification method based on subjective logical reputation builds a graph model to define subjective logical reputation values ​​for each entity in the network and their relationships. This method dynamically updates node reputation scores, taking into account the influence of subjective logical reputation propagation and aggregation mechanisms between nodes, to infer potential malicious entities. Furthermore, by analyzing the relationships between nodes, the location and source of malicious nodes can be further traced.

[0055] The malicious entity identification method based on subjective logic reputation of the present invention aggregates threat intelligence and information of the local map structure, can effectively predict potential new zero-day malware and new zero-day malicious IP, builds the relationship between entities and hosts, and can infer the degree of malice and malicious influence between intranet hosts. The method of the present invention also establishes a convergent reputation propagation mechanism, which can achieve multi-faceted and multi-dimensional reputation propagation and aggregation to fully and reasonably consider the reputation influence between entities. Overall, the malicious entity identification method based on subjective logic reputation of the present invention constructs a highly robust reputation system through multiple reputation aggregations, which can effectively prevent collusion between malicious attackers and can accurately identify malicious entities in complex and changeable network environments.

[0056] See the instructions attached Figure 3 This embodiment also provides a malicious entity identification device based on subjective logical reputation, which is used to implement the above method embodiment. The device includes:

[0057] The bipartite graph construction unit 201 is used to obtain entities in the target network and construct a bipartite graph according to the process connections between the entities.

[0058] The initialization unit 202 is used to initialize the subjective logical reputation of the node to obtain an initial reputation value of the node.

[0059] The reputation propagation unit 203 is used to set the node reputation propagation conditions, reputation propagation structure and propagation convergence conditions, and judge whether the reputation propagation conditions are met based on the initial reputation value difference between the nodes. When the initial reputation value difference meets the reputation propagation conditions, reputation propagation between the nodes is performed, the propagation structure is updated, and it is judged whether the updated propagation structure meets the propagation convergence conditions. When the propagation structure meets the propagation convergence conditions, the reputation propagation is stopped to obtain the node's neighbor node set.

[0060] The reputation aggregation unit 204 is configured to perform neighbor node reputation aggregation calculation based on the neighbor node set to obtain neighbor node reputation, and to aggregate the initial reputation value of the node and the neighbor node reputation to obtain an aggregated reputation value.

[0061] The reputation calculation unit 205 is configured to use the discounted reputation to calculate the historical reputation influence of the node, and calculate the accumulated time discounted reputation based on the historical reputation influence and the aggregated reputation value to update the final reputation value of the node.

[0062] The judging unit 206 is configured to judge whether the entity corresponding to the node is a malicious entity according to the final reputation value to obtain a malicious entity identification result.

[0063] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0064] In other embodiments of the present application, the present application discloses an electronic device, such as Figure 4 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the following: Figure 1 and each step in the corresponding embodiment.

[0065] Through the description of the above embodiments, those skilled in the art will clearly understand that for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0066] The functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0067] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk.

[0068] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A malicious entity identification method based on subjective logical reputation, characterized in that: include: Obtain the entities in the target network and construct a bipartite graph based on the process connections between the entities; Initialize the subjective logical reputation of the node to obtain the initial reputation value of the node; Setting node reputation propagation conditions, reputation propagation structure, and propagation convergence conditions; determining whether the reputation propagation conditions are met based on the initial reputation value difference between the nodes; performing reputation propagation between the nodes when the initial reputation value difference meets the reputation propagation conditions; updating the propagation structure; determining whether the updated propagation structure meets the propagation convergence conditions; and stopping reputation propagation when the propagation structure meets the propagation convergence conditions to obtain a set of neighboring nodes for the node; Performing neighbor node reputation aggregation calculation based on the neighbor node set to obtain neighbor node reputation, and aggregating the initial reputation value of the node and the neighbor node reputation to obtain an aggregated reputation value; Calculating the historical reputation impact of the node using the discounted reputation, and calculating the cumulative time-discounted reputation based on the historical reputation impact and the aggregated reputation value to update the final reputation value of the node; It is determined whether the entity corresponding to the node is a malicious entity according to the final reputation value to obtain a malicious entity identification result.

2. The method according to claim 1, characterized in that The entities in the target network include the intranet host vertex set H, process vertex set P, IP vertex set A and file vertex set F; Construct a bipartite graph based on the process connections between entities, including: Take the union of the intranet host vertex set H, the IP vertex set A and the file vertex set F as the vertex set to obtain V′=(H∪A∪F), limit the edge attributes to the processes between vertices, and construct a bipartite graph to obtain G(V′,P).

3. The method according to claim 1, characterized in that When the initial reputation value difference satisfies the reputation propagation condition, reputation propagation between nodes is performed and the propagation structure is updated, including: When the initial reputation value difference satisfies the reputation propagation condition, the propagating node is included in the neighbor node set of the propagated node; The propagation structure is changed from P i→j =(Δ i→j ,d) Update to P′ i→j =(Δ′ i→j =T i→j Δ i→j ,d′=d-1), where P i→j represents the propagation structure of the propagation node, Δ i→j represents the initial reputation value difference between nodes i→j, d represents the propagation distance of the propagation node, and P′ i→j represents the propagation structure of the propagated node, Δ′ i→j Represents the difference in propagation, T i→j represents the initial reputation value of the propagating node, and d′ represents the propagation distance of the propagated node.

4. The method according to claim 1, wherein Performing neighbor node reputation aggregation calculation based on the neighbor node set to obtain neighbor node reputation, and obtaining an aggregated reputation value by aggregating the initial reputation value of the node and the reputation of the neighbor nodes, including: Set the process weights between nodes and the reputation weights of different types of nodes; Calculating the reputations of different types of nodes in the neighbor node set respectively according to the process weight, reputation weight and neighbor node type, and aggregating and calculating the reputations of all types of neighbor nodes in the neighbor node set to obtain the neighbor node reputation; The initial reputation value of the aggregation node and the reputation of the neighboring nodes are combined to obtain the aggregated reputation value.

5. The method according to claim 4, characterized in that The process weight calculation is defined to satisfy the following formula: in, represents the process weight, δ represents the process reputation parameter, represents the set of processes between nodes i→j, T i→p represents the initial reputation value of node i; The reputation weight calculation is defined as follows: Among them, w i→j represents the reputation weight, and φ represents the weight parameter of the node reputation value; Calculating the reputations of different types of nodes in the neighbor node set according to the process weight, the reputation weight, and the neighbor node type, and aggregating and calculating the reputations of all types of neighbor nodes in the neighbor node set to obtain the neighbor node reputation, including: In the neighbor node set, the subjective logical reputation aggregation calculation of all nodes whose entity type is c satisfies the following formula: in, represents the aggregated trust value of neighbor nodes of type c, Indicates the aggregated untrusted value of neighbor nodes of type c. Represents the aggregated uncertainty value of neighbor nodes of type c, I c Represents all neighbor nodes of type c in the neighbor node set; The reputation value calculation of all neighbor nodes of type c satisfies the following formula: Where ρ represents the uncertainty adjustment parameter; The reputation calculation of all types of aggregated neighbor nodes satisfies the following formula: in, represents the aggregate trust value of all types of neighbor nodes, Represents the aggregated untrustworthy value of all types of neighbor nodes, represents the aggregate uncertainty value of all types of neighbor nodes, C j represents the set of all types of neighbor nodes of node j, and η represents the weight parameter.

6. The method according to claim 4, characterized in that Aggregate the node's initial reputation and neighbor node reputation to get the aggregated reputation value, including: The aggregate calculation of the node's initial reputation value and the reputation of its neighboring nodes satisfies the following formula: in, represents the aggregated trust value of node j, represents the aggregate untrusted value of node j, represents the aggregated uncertainty value of node j, b i→j represents the initial trust value of node j, d i→j represents the initial untrusted value of node j, u i→j represents the initial uncertain value of node j, represents the aggregated trust value of neighbor nodes, Indicates the aggregated untrusted value of neighbor nodes, Represents the aggregated uncertainty value of neighbor nodes; The calculation of the node's aggregate reputation value satisfies the following formula: Where ρ represents the uncertainty adjustment parameter.

7. The method according to claim 1, characterized in that Calculating the accumulated time-discounted reputation based on the historical reputation impact and the aggregated reputation value to update the final reputation value of the node includes: The credit calculation of the cumulative time discount satisfies the following formula: Among them, b′ i→j represents the trust value of the cumulative time discount, d′ i→j represents the untrustworthy value of the cumulative time discount, u′ i→j represents the uncertainty value of the cumulative time discount, t represents the node information time, represents the node information time set, γ represents the time decay parameter, γ t Indicates the influence of historical reputation, represents the aggregate trust value of the node with information time t, represents the aggregated untrustworthy value of the node with information time t, represents the aggregate uncertainty value of the node with information time t; The final reputation value calculation satisfies the following formula: i→j =b′ i→j +ρ*u′ i→j , where ρ represents the uncertainty adjustment parameter.

8. A malicious entity identification device based on subjective logical reputation, characterized in that: The device comprises: A bipartite graph construction unit is used to obtain entities in the target network and construct a bipartite graph based on the process connections between the entities; Initialization unit, used to initialize the subjective logical reputation of the node to obtain the initial reputation value of the node; A reputation propagation unit is configured to set node reputation propagation conditions, a reputation propagation structure, and a propagation convergence condition, determine whether the reputation propagation condition is met based on the difference in initial reputation values ​​between nodes, perform reputation propagation between nodes when the initial reputation value difference meets the reputation propagation condition, update the propagation structure, determine whether the updated propagation structure meets the propagation convergence condition, and stop reputation propagation when the propagation structure meets the propagation convergence condition to obtain a set of neighbor nodes of the node; a reputation aggregation unit, configured to perform neighbor node reputation aggregation calculation based on the neighbor node set to obtain neighbor node reputation, and to obtain an aggregated reputation value by aggregating the initial reputation value of the node and the reputation of the neighbor nodes; a reputation calculation unit, configured to calculate the historical reputation influence of the node using the discounted reputation, and calculate the cumulative time-discounted reputation based on the historical reputation influence and the aggregated reputation value to update the final reputation value of the node; The judging unit is configured to judge whether the entity corresponding to the node is a malicious entity according to the final reputation value to obtain a malicious entity identification result.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying malicious entities based on subjective logical reputation according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor and memory; The memory is used to store computer programs; The processor is configured to execute the computer program stored in the memory, so that the electronic device executes the malicious entity identification method based on subjective logical reputation according to any one of claims 1 to 7.

Images