A multi-view fusion dynamic network attack and defense deduction system

Abstract

The application relates to the field of network attack and defense technology, in particular to a dynamic network attack and defense deduction system fusing multiple perspectives, which comprises a node initial positioning module, a communication behavior detection module, a behavior direction labeling module, a role conversion judgment module and a main chain fusion construction module. In the application, chain independence recognition is realized through target transformation analysis in path evolution, and the reverse propagation paragraph in the path is deduced in combination with behavior sequence and direction, role reconstruction logic is deduced through path direction change, node role labels and ordering structure are dynamically adjusted, the deviation of path judgment under a single perspective can be effectively eliminated, the recognition ability of attack chain integrity is enhanced, the expression of information continuity in the path evolution process is improved, the automatic judgment ability of key behavior combination in the attack path is strengthened, the restoration and tracking of the attack leading chain under the information fusion of multiple paths are realized, and the authenticity, precision and behavior recognition accuracy of the attack and defense deduction result in the dynamic environment are significantly improved.

Description

TECHNICAL FIELD

[0001] The application relates to the field of network attack and defense technology, and in particular to a dynamic network attack and defense deduction system fusing multiple perspectives. BACKGROUND

[0002] The network attack and defense technology field belongs to the network and information security category, mainly studies how to resist network attacks through defense mechanisms, identifies potential threats, and overall safeguards network space security, covers multiple levels such as network layer security, system security, application layer security, and data transmission security, and has high dynamic and antagonistic properties. Among them, the traditional dynamic network attack and defense deduction system refers to a system for simulating the attack and defense process constructed in the network security training and strategy verification process, which usually adopts a pre-defined attack path construction, a rule-based intrusion event triggering mechanism, a static topology and flow data-driven deduction process, a fixed script execution logic, and a single perspective log recording and analysis method to complete the design and execution of the entire deduction process.

[0003] In the traditional network attack and defense deduction process, the preset path and rule-driven mechanism are mainly used, which is carried out under the condition of fixed script execution and static topology, lacks means for integrating behavior data in different network perspectives, and it is difficult to establish an effective path mapping relationship under the condition of low path coincidence and inconsistent behavior timing, which leads to the omission of key behavior nodes in the attack chain, especially in complex attack processes, it is difficult to reflect the path direction change and role conversion logic, resulting in role judgment errors or path chain breaks in the deduction result, affecting the evaluation effect of network security strategy and the goal achievement of the exercise task. SUMMARY

[0004] The purpose of the present application is to solve the shortcomings in the prior art and to provide a dynamic network attack and defense deduction system fusing multiple perspectives.

[0005] In order to achieve the above-mentioned purpose, the application adopts the following technical scheme: a dynamic network attack and defense deduction system fusing multiple perspectives comprises:

[0006] The node initial positioning module obtains the node behavior log data collected in each network perspective of the attack and defense exercise platform, counts the number of node identification coincidences, labels the jump candidate nodes, counts the shortest path length of the behavior path corresponding to the jump candidate nodes in different network perspectives, and generates a cross-perspective initial path set;

[0007] The communication behavior detection module extracts the evolution sequence of the node communication target in each path according to the cross-perspective initial path set, records the number of target changes, identifies the node position corresponding to the changes, confirms whether the target behavior segment has independent chain attributes, and obtains the main path communication evolution segment.

[0008] The behavior direction labeling module obtains adjacent action combinations between nodes and arranges them in time sequence based on the main path communication evolution paragraph, labels the behavior paragraph as a reverse direction of advancement, records start and end nodes of all reverse direction of advancement paragraphs, and constructs a path advancement direction reversal structure;

[0009] The role conversion determination module marks the action category of the start node in the reverse behavior paragraph according to the path advancement direction reversal structure, confirms the attack party dominant path paragraph, resets the role label of all nodes in the path to the attack party, reorders the nodes and updates the behavior direction label, and generates an attack role reorganization path paragraph.

[0010] As a further scheme of the application, the cross-view initial path set includes a node jump sequence, a view mapping structure and a path length distribution, the main path communication evolution paragraph includes a target evolution number, a node change position and a chain independence label, the path advancement direction reversal structure includes a reverse behavior paragraph position, a reverse advancement proportion and a direction determination label, and the attack role reorganization path paragraph includes an attack start node category, a dominant path behavior combination and a node role label set.

[0011] As a further scheme of the application, the node initial positioning module includes:

[0012] The node identification submodule extracts the node identifier, communication target identifier, action type and behavior time number in each log record based on the node behavior log data collected in each network view of the attack and defense drill platform, counts the coincidence number of node identifiers in different behavior records, and filters a node coincidence degree filtered set from all nodes by screening nodes with a coincidence number lower than a node behavior correlation degree threshold value;

[0013] The jump determination submodule judges a node set with a time difference greater than a set value as a jump candidate node based on each node in the node coincidence degree filtered set according to the behavior time number difference, combs the behavior path of the jump candidate node in multiple network views, identifies the connection state and sequence characteristics between the paths, and obtains an effective jump node relationship set;

[0014] The path generation submodule combines the node pairs marked in the effective jump node relationship set, summarizes the start and end node sequences of the behavior path in different network views, integrates the path connection relationship between cross-view angles, performs node path mapping under multiple views, and generates a cross-view initial path set.

[0015] As a further scheme of the application, the communication behavior detection module includes:

[0016] The target sequence extraction submodule extracts the node and the communication target number information in each path based on the cross-view initial path set, identifies the change of the communication target between the nodes, locates the node in which the communication target changes in each path, traverses all paths and records the positions of all change nodes, and obtains a communication target change position set;

[0017] The sequence difference determination submodule compares the communication target numbers at the starting stage of the path according to the node order, judges the difference degree, and if the continuous communication target number change occurs in the path segment, marks the behavior deviation, and obtains a target difference matching degree value.

[0018] The chain calibration submodule identifies the continuous paragraph composed of the communication target change nodes according to the path segment calibrated as deviated in the target difference matching degree value, judges whether an independent communication structure is formed, if the integrity in the logical structure is possessed and the obvious target evolution trend is shown, the independent chain is calibrated, and the behavior direction and the dependence relationship between adjacent nodes are recorded in sequence, and a main path communication evolution paragraph is obtained.

[0019] As a further scheme of the application, the behavior direction annotation module comprises:

[0020] The triple construction submodule obtains all node behavior data in the main path communication evolution paragraph, extracts the action type and the time number of each node, sorts all nodes according to the time number from small to large, selects the action of adjacent three groups of nodes to form an action triple according to the time sequence, constructs a triple sequence, and generates an action triple sequence set.

[0021] The reverse relationship identification submodule judges whether the action combination of each triple belongs to the reverse relationship type based on the action triple sequence set, identifies the standard whether the triple action combination matches, marks the reverse behavior fragment of the triple, annotates the starting node and the ending node, records the position of all triples meeting the reverse relationship rule in the path and the path number, and obtains a reverse promotion node distribution table.

[0022] The direction reversal judgment submodule obtains the proportion between the number of reverse promotion nodes in each path and the total number of path nodes according to the number of nodes in the reverse promotion node distribution table, if the number of reverse nodes exceeds the attack chain confidence score threshold of the total number, the path is judged as a promotion direction reversal path, the promotion reversal degree score of the path is obtained, and a path promotion direction reversal structure is obtained.

[0023] As a further scheme of the application, the role conversion determination module comprises:

[0024] The behavior recognition submodule is based on the path advancing direction reversal structure, combines all starting nodes marked as reverse behavior sections in the path, reads the action category corresponding to each starting node, extracts the action information of each group of starting nodes and subsequent nodes in sequence according to the path order, constructs a behavior combination sequence according to the action order, records the position and path number if the action order of continuous combination is met, and obtains an attack behavior combination marking value;

[0025] The path structure screening submodule reads the paragraph number marked as established in each path and the time number change direction of the path main sequence direction based on the attack behavior combination marking value, extracts the time number sequence of the current paragraph node, performs directional judgment on the time number change trend between the path starting node and the first node of the current paragraph, marks the path paragraph as an attack party dominant paragraph if the time increment direction is consistent, records the path number and node index position, calculates the path advancing direction and behavior structure matching degree score, generates a path direction consistency evaluation result, and generates a path direction consistency evaluation result.

[0026] The role reconstruction submodule extracts the path paragraph marked as a dominant paragraph according to the path direction consistency evaluation result, reads the current role label field of all nodes in the paragraph, uniformly assigns the value as the attack party role identifier, rearranges the node number sequence in the paragraph according to the time number, synchronously updates the rearrangement result to the path structure, and updates the behavior direction label according to the node sequence change to obtain an attack role reorganization path segment.

[0027] As a further scheme of the application, the system further comprises:

[0028] The main chain fusion construction module rearranges the nodes according to the time number and node identifier of each node in the attack role reorganization path segment, inherits the sequence of nodes with the same label, integrates and merges the path segments to construct a single dominant chain, and obtains a fusion multi-perspective dynamic network attack and defense deduction result.

[0029] The fusion multi-perspective dynamic network attack and defense deduction result comprises a unified time sequence, a node behavior inheritance sequence, and a dominant chain structure.

[0030] As a further scheme of the application, the main chain fusion construction module comprises:

[0031] The node sequence adjustment submodule extracts the time number and node identifier of each node in the attack role reorganization path segment, extracts the time number of each node and performs an increment judgment on the time number, rearranges the position of the corresponding node identifier according to the judgment result, completes the time sequence reconstruction of all nodes through continuous judgment and exchange operation, and obtains a node time sequence arrangement result.

[0032] The label inheritance merging submodule extracts the role label value corresponding to each node based on the node time sequence arrangement result, and traverses and checks all label values in time sequence, performs continuous merging operation on adjacent nodes with the same label value, divides nodes with consistent label values into a group, records the node sequence and the starting and ending positions of each group, reassigns new label structure identifiers to each group according to the node continuity relationship and labels the merging order, and generates a label consistent merging structure sequence;

[0033] The main chain fusion construction submodule extracts the starting and ending numbers of nodes in each label group according to the label consistent merging structure sequence, establishes the order mapping structure between nodes in time sequence, synchronously reads the path segment number and label identifier of the corresponding node in each connection process, excludes abnormal structures, and obtains the dynamic network attack and defense deduction result of fusion multi-view.

[0034] Compared with the prior art, the advantages and positive effects of the present application are that:

[0035] In the present application, the chain independence is recognized through target transformation analysis in path evolution, the reverse propagation paragraph in the path is deduced by combining the behavior sequence and direction, the role reconstruction logic is deduced through path direction change, the node role label and order structure are dynamically adjusted, the deviation of path judgment under a single view can be effectively eliminated, the recognition ability of attack chain integrity can be enhanced, the information continuity expression in the path evolution process can be improved, the automatic judgment ability of key behavior combination in the attack path can be strengthened, the restoration and tracking of the attack dominant chain under multi-path information fusion can be realized, and the authenticity, precision and behavior recognition accuracy of the attack and defense deduction result in the dynamic environment can be significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 The system flowchart of the present application is shown in the figure;

[0037] Figure 2 The node initial positioning module flowchart of the present application is shown in the figure;

[0038] Figure 3 The communication behavior detection module flowchart of the present application is shown in the figure;

[0039] Figure 4 The behavior direction labeling module flowchart of the present application is shown in the figure;

[0040] Figure 5 The role conversion judgment module flowchart of the present application is shown in the figure;

[0041] Figure 6 The main chain fusion construction module flowchart of the present application is shown in the figure. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0043] In the description of the present invention, it should be understood that the terms "length," "width," "up," "down," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inside," "outside," and the like, indicating positions or relationships, are based on the positions or relationships shown in the accompanying drawings and are intended only to facilitate the description of the present invention and simplify the description. They do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limiting the present invention. Furthermore, in the description of the present invention, "plurality" means two or more, unless otherwise expressly and specifically defined.

[0044] See also Figure 1 A dynamic network attack and defense simulation system integrating multiple perspectives includes:

[0045] The node initial positioning module obtains node behavior log data collected from various network perspectives of the attack and defense drill platform, extracts the node identifier, communication target identifier, action type, and behavior time number of each node, counts the number of node identifier overlaps, selects the node set with the number of overlaps below the node behavior correlation threshold (which meets the framework's TTP correlation standard), marks the nodes with a time difference greater than 1 second as jump candidate nodes, and counts the shortest path lengths of the corresponding behavior paths of the jump candidate nodes in different network perspectives to generate the cross-perspective initial path set;

[0046] The communication behavior detection module extracts the evolution sequence of the communication targets of nodes within each path based on the cross-view initial path set, records the number of target changes, and identifies the node positions corresponding to the changes. It then calculates the sequence difference between the communication target numbers of all nodes and the target numbers of the original path segments. If the difference is greater than the matching confidence level (set as ≥0.75 according to the standard), the target behavior segment is confirmed to have independent chain properties, and the main path communication evolution segment is obtained.

[0047] The behavior direction annotation module obtains adjacent action combinations between nodes based on the action types and time numbers of the nodes in the main path communication evolution segment and arranges them in chronological order. It constructs a sequence of continuous action triples and determines the direction relationship of each triple. If the action combination shows a reverse behavior relationship such as "response-receive-request" or "cancel-suspend-request", the behavior segment is marked as a reverse advancement direction. The start and end nodes of all reverse advancement direction segments are recorded. The proportion of reverse advancement nodes in the path is counted to see if it exceeds the attack chain confidence score. If so, a path advancement direction reversal structure is generated.

[0048] The role conversion determination module reverses the structure according to the path advancing direction, marks the action category of the starting node in the reverse behavior segment, and counts whether the subsequent node exists the typical action combination "lateral movement-privilege escalation-communication implantation". If the continuous combination is established and the behavior direction is consistent with the path main sequence direction, it is considered that the attack path segment is dominated by the attacker, all the nodes in the path are reset to the role label of the attacker, the node sequence is recompiled and the behavior direction label is updated, and the attack role reorganization path segment is generated;

[0049] The main chain fusion construction module reorders the nodes according to the behavior time number and the node identifier of each node in the attack role reorganization path segment, inherits the sequence of the nodes with the same label, integrates and merges the path segment to construct a single dominant chain, and obtains the dynamic network attack and defense deduction result of fusion of multiple perspectives.

[0050] The cross-perspective initial path set includes node jump sequence, perspective mapping structure and path length distribution. The main path communication evolution paragraph includes target evolution times, node change position and chain independence label. The path advancing direction reversal structure includes reverse behavior segment position, reverse advancing proportion and direction determination label. The attack role reorganization path segment includes attack starting node category, dominant path behavior combination and node role label set. The dynamic network attack and defense deduction result of fusion of multiple perspectives includes unified time sequence, node behavior inheritance sequence and dominant chain structure.

[0051] Please refer to Figure 2 , the node initial positioning module includes:

[0052] The node identification sub-module extracts the node identifier, communication target identifier, action type and behavior time number in each log record based on the node behavior log data collected in each network perspective of the attack and defense exercise platform, counts the coincidence times of the node identifiers in different behavior records, and filters the node set with the coincidence times below the node behavior correlation threshold from all nodes to generate a node coincidence degree filtered set.

[0053] Based on the node behavior log data collected in each network perspective of the attack and defense exercise platform, the node identifier, communication target identifier, action type and behavior time number in each log record are obtained. For example, in a certain attack and defense scene, the log behavior information of 5 nodes is collected, the node numbers are N1 to N5, among which node N1 initiates communication to N2 at time number 101, node N2 receives the communication of N1 at 103, node N3 initiates communication to N4 at 104, node N4 receives the communication of N3 at 106, and node N5 initiates communication action to N1 again at 109. Cross-log coincidence identification is performed on all nodes, the number of times that the node identifier is recorded repeatedly in multiple log perspectives is counted, for example, N1 appears 5 times, N2 appears 2 times, N3 appears 7 times, N4 appears 1 time, and N5 appears 3 times. The coincidence number data indicates that some nodes frequently appear in multiple communications, which is easy to cause misjudgment due to excessive relevance. Therefore, a node behavior correlation degree threshold is introduced to exclude the influence of high-frequency nodes. The threshold is set according to the median value of the coincidence number of all nodes combined with the deviation standard. In this embodiment, it is set to 4 times, indicating that the nodes less than the value are considered as low coincidence rate nodes. The screening result is nodes N2, N4 and N5, among which N1 and N3 are excluded because their coincidence numbers are 5 and 7 respectively. The node coincidence degree filtering set is obtained, as shown in Table 1.

[0054] Table 1 Node behavior data table

[0055]

[0056] As shown in Table 1, the coincidence numbers of N2, N4 and N5 are 2, 1 and 3 respectively, which meet the low coincidence rate condition and are retained for subsequent jump analysis.

[0057] The jump determination submodule determines the node set whose time difference is greater than the set value (1 second) based on each node in the node coincidence degree filtering set according to the behavior time number difference, and marks the node set as a jump candidate node. The behavior path of the jump candidate node in multiple network perspectives is combed, the connection state and sequence characteristics between the paths are identified, and an effective jump node relationship set is obtained.

[0058] Based on the node coincidence degree filtering set of nodes N2, N4, N5, the time number of each pair of node combination is calculated by difference value, and whether the time difference is greater than 1 second is judged, for example, the time number of N2 is 103, N4 is 106, and the difference value is 3, N4 and N5 are 106 and 109 respectively, and the difference value is 3, which meet the jump time difference condition, so N2→N4 and N4→N5 can be identified as jump candidate node pair, which is marked into jump candidate set, then according to the communication target identification field in the log, the connection path involved in the original behavior sequence of the above node combination is extracted, for example, N2→N4 path can be represented as N2→N3→N4 in view A, and N4→N5 path can be represented as N4→N2→N5 in view B, the path sequence recorded by each group of node pairs in different views is extracted, and the connection order and jump direction between nodes in the path segment are identified, the sequence structure information of the path segment required by the jump path and the jump trajectory segment are arranged, the reachability of the path in the logical graph and the path connection relationship between nodes are further confirmed, the path combinations that cannot be connected are filtered out, and finally the node pair set that meets the time difference requirement and the continuous existence of the behavior path is formed, and the effective jump node relationship set is obtained.

[0059] The path generation sub-module summarizes the start and end node sequences of the behavior path in different network views according to the node pair combination marked in the effective jump node relationship set, integrates the path connection relationship between different views, maps the node path in multiple views, and generates a cross-view initial path set.

[0060] According to the node pair combination N2→N4 and N4→N5 in the effective jump node relationship set, a plurality of network view logs are called in the attack and defense platform, the path sequence of each node pair in the view is extracted, for example, in view A, the behavior path of N2→N4 is N2→N3→N4, and in view B, the path is N2→N5→N4, the number of nodes involved in the path sequence, the jump direction and the behavior time are included in the comparison parameters, the path mapping list is established in multiple views respectively, the start point, end point and intermediate node of each path are marked, and the path chain information is recorded in array structure, for example, path 1: [N2, N3, N4], path 2: [N4, N2, N5], the jump sequence formed by the same node pair in different views is normalized, and the repeated jump segment in the path sequence is merged, a cross-view node path structure group is constructed, the coverage frequency and integrity of each path segment in different log views are recorded, the time number distribution is synchronously reserved in the structure, the behavior time sequence graph is constructed, the comparison structure between cross-view behavior paths is formed, and finally the above cross-view path mapping group is integrated to generate a cross-view initial path set.

[0061] Please refer to Figure 3 , the communication behavior detection module comprises:

[0062] The target sequence extraction submodule extracts the node and its communication target number information in each path based on the initial path set across the perspective, identifies the change of the communication target between nodes, locates the node where the communication target changes in each path, traverses all paths and records the positions of all change nodes, and obtains the communication target change position set;

[0063] The path data in the initial path set across the perspective is obtained, the communication target number, node number and behavior time number of each node in the path are extracted in turn, the nodes are arranged in ascending order according to the time number, the communication target evolution sequence of each path is constructed, the change of the communication target number between adjacent nodes is identified in each path, the nodes with changes are marked and recorded, for example, the node sequence in path P1 is N1→N2→N3, and the corresponding communication target numbers are M1, M1 and M2 respectively, so it is considered that N3 has changed the communication target, and similarly, in path P2, if the communication target numbers of N4, N5 and N6 are M3, M4 and M4 respectively, it is determined that N5 is the target change node, the communication target evolution sequence is formed by traversing all paths and analyzing the change of the target number of each node, and all the nodes with changes and the information such as the node number, path and time number are recorded, in this process, the structural connectivity of all change nodes and adjacent nodes is also judged to confirm the legality of their positions in the path, and finally a complete list of change node positions and change times is generated, and the communication target change position set is obtained.

[0064] Table 2: Communication target evolution data table

[0065]

[0066] As shown in Table 2, node N3 in path P1 is the communication target change point, and node N5 in path P2 is the change point, and the order corresponding to the time number further confirms the relative time sequence position of the target change event in the behavior path.

[0067] The sequence difference judgment submodule compares all change node sequences in the communication target change position set with the communication target numbers at the starting stage of the path, judges the difference degree according to the node order, and according to the set matching confidence threshold, if there is a continuous change of the communication target number in the path segment, it is marked that there is a behavior deviation, and the target difference matching degree value is obtained;

[0068] Based on the annotation results of the communication target change position set, the difference between the identified communication target change node in each path and the path starting stage target number is judged, for example, in path P1, the starting node N1 communication target is M1, the change node N3 target number is M2, the identification number is inconsistent, then it is recorded as a target difference event, the total number of nodes in the path is 3, one of which is N1 and N2 (the target is M1), the consistent proportion is 2 / 3, that is, 66.7%, which is lower than the preset matching confidence threshold 0.75, so the path is marked as a target offset path, in path P2, N4 is M3, N5 is M4, there is a target change, N6 is still M4, which is consistent with the previous one, the total number of nodes is 3, and the consistent proportion is 66.7%, which is also lower than the threshold standard, so it is marked as a difference path segment again, after traversing all the paths, the difference identification path segment is coded, and the matching degree record list corresponding to the difference path is formed, a complete mapping relationship is formed through the path number and the difference node identification, and the target difference matching degree value is obtained.

[0069] The chain calibration sub-module identifies the continuous paragraph composed of the communication target change nodes according to the path segment calibrated as deviated in the target difference matching degree value, judges whether an independent communication structure is formed, and if the logical structure has integrity and shows an obvious target evolution trend, an independent chain is calibrated, and the behavior direction and dependency relationship between adjacent nodes are recorded in order to obtain the main path communication evolution paragraph.

[0070] According to the path segment judged as deviated in the target difference matching degree value, the continuous structure of the related nodes in the path is selected, and whether it meets the structural integrity requirement is checked, including node behavior time continuity, node number order rationality, and communication target number real existence, etc. On the basis of meeting the structural requirement, the chain is divided for these node paragraphs, and the logical position of the chain in the path is calibrated, such as N2→N3 in P1 forming a chain unit, and N4→N5 in P2 being another chain unit. At the same time, the communication target change sequence in each chain is extracted as auxiliary information for describing the evolution direction and target jump state of the chain. After the chain structure is confirmed, the behavior sequence and the communication target change sequence are respectively summarized as two-level chain description, the number combination of the node pairs in each chain unit and the target number evolution direction are recorded, the start and end positions of the chain in the path are marked, and the chain numbers are uniformly archived. Finally, all the path segments forming the evolution structure are sorted out, a complete path segment calibration set is established, and the main path communication evolution paragraph is generated.

[0071] Please refer to Figure 4 The behavior direction marking module includes:

[0072] The triple construction submodule obtains all node behavior data in the main path communication evolution paragraph, extracts the action type and time number of each node, sorts all nodes in ascending order of time number, selects the actions of adjacent three groups of nodes in time sequence to form an action triple, constructs a triple sequence, and generates an action triple sequence set;

[0073] All node behavior data in the main path communication evolution paragraph is obtained, the action type and time number of each node are extracted as basic fields, the action type is derived from the behavior label recorded in the log, including "request", "receive", "response", "cancel", "abort", etc., and the time number is the event trigger time recorded by the system, in seconds, within each path, the node behavior is sorted in ascending order of time number to ensure that the logical order between actions is not destroyed, for example, the time numbers of nodes N1, N2 and N3 in path P1 are 100 seconds, 105 seconds and 110 seconds, and the action types are "request", "receive" and "response" in turn, the time numbers of nodes N4, N5 and N6 in path P2 are 200 seconds, 195 seconds and 190 seconds, and the action types are "response", "abort" and "request", according to the time sequence, three adjacent nodes form a triple, and the corresponding path number and node number are marked, a path internal triple sequence is constructed, for example, the triple in P1 is N1→N2→N3, and the triple in P2 is N4→N5→N6, and the reverse flag field is initialized to no or yes, which is updated according to subsequent judgment, the action type field is used to identify the triple behavior arrangement mode, and the label score field is used to score the behavior of each node, which is used for subsequent weighted identification, the score range is set to 0 to 1, for example, the response is 0.7, the abort is 0.8, and the request is 0.9, corresponding to the influence weight of different behaviors, and the initial data is as follows:

[0074] Table 3 Node behavior triple analysis table

[0075]

[0076] As shown in Table 3, the time sequence of nodes in P1 path is in normal order, and the action types "request-receive-response" are in normal combination, the time in P2 path is in reverse order, and the action types "response-abort-request" are in reverse combination, which provides structural input for subsequent reverse identification, and finally generates an action triple sequence set.

[0077] The reverse relationship identification submodule judges whether the action combination of each triple belongs to the reverse relationship type based on the action triple sequence set, identifies the standard whether the triple action combination matches, marks the reverse behavior segment of the triple, numbers the starting node and the terminal node, records the position of all triples meeting the reverse relationship rule in the path and the path number thereof, and obtains a reverse promotion node distribution table;

[0078] Based on the action triple sequence set, each triple is identified by reverse relationship. The identification standard is that the time number is decreasing and the action type conforms to the reverse behavior template. The system first parses the action type and time number corresponding to the triple. For example, in path P2, the time of N4 is 200 seconds, N5 is 195 seconds, and N6 is 190 seconds. The time decrease is established. The three-node actions are "response", "stop", and "request" in sequence. The preset reverse template "response-stop-request" is matched and it is judged to be a reverse behavior fragment. The system marks the path segment between the starting node N4 and the ending node N6 in the triple as a reverse structure, and at the same time marks the reverse structure of the nodes in the triple. The tag field is updated to "yes", and the label score of each node is extracted and recorded. For example, N4 is a response behavior with a score of 0.7, N5 is an abort behavior with a score of 0.8, and N6 is a request behavior with a score of 0.9. The same identification operation is performed on the P2 path. Finally, the number, distribution location and score list of the reverse behavior triplets are counted and saved as the reverse advancement behavior distribution table. The triple N1→N2→N3 in the path P1 does not meet the time decrease or action reverse order requirements, and is marked as a non-reverse structure and not included in the subsequent direction analysis sequence. After the system traverses all paths, it obtains the detailed distribution of the identified reverse behavior fragments and obtains the reverse advancement node distribution table.

[0079] The direction reversal judgment submodule counts the ratio between the number of reverse-propulsion nodes and the total number of path nodes in each path based on the number of nodes in the reverse-propulsion node distribution table. If the number of reverse nodes exceeds the attack chain confidence score threshold of the total number, the path is determined to be a propulsion direction reversal path, and the formula is used:

[0080] ;

[0081] The calculation obtains the path advancement reverse degree score and the path advancement direction reversal structure, where: Indicates the path advancement reverse degree score, in seconds; For the The time number of the reverse behavior node, in seconds; is the mean time number of all nodes in the path, in seconds; is the number of reverse propulsion nodes identified in the path; For the The behavior label score of the reverse triples is in the range of ; is the total number of reverse triplets;

[0082] According to the statistical information of the reverse propulsion node distribution table, first calculate the mean of the behavior time numbers of all reverse propulsion nodes in the path and the average value of the absolute value of the difference between each reverse node time number and the average value as the time offset degree index in the path, and then obtaining the label score of the behavior node in each reverse triple, calculating the average value as the adjustment factor, multiplying the two dimensions to form the reverse score of the path advancing direction Taking path P2 as an example, the reverse node time numbers are 200 seconds, 195 seconds and 190 seconds, and the average value is:

[0083] ;

[0084] The node offset values are:

[0085] , , The average offset is: ;

[0086] The corresponding label scores of the triples are 0.7, 0.8 and 0.9, and the average value is: ;

[0087] The reverse score is: ;

[0088] The score is compared with the attack chain confidence score threshold value, if the threshold value is set to 5, since , the system judges that there is a reverse trend in the path advancing direction, and the corresponding path is marked as a direction reversal path, and the score is used as an input factor of the behavior chain reconstruction module to finally generate the path advancing direction reversal structure.

[0089] The path advancing reverse degree score represents the comprehensive strength of the reverse advancing tendency in the behavior chain composed of the node action sequence and time evolution in a certain network behavior path. This score combines the offset degree of the node time number and the severity of the behavior property reflected by the behavior label, and reflects the influence degree of the reverse structure composed of non-positive behavior sequences such as “response-receive-request” and “abort-request” on the overall advancing direction of the path. The greater this value, the more dispersed the reverse behavior in time and the more concentrated the high-risk action types in behavior in the path, indicating that the path is more likely to be an abnormal path or an attack path. Therefore, the path advancing reverse degree score can be used as a key judgment basis for determining whether the path direction has reversed and whether the path has deviated from the normal advancing chain.

[0090] The formula is based on the combined effect structure of "time offset degree" and "behavior score intensity". First, the absolute value of the difference between the time number of all reverse advancing nodes and the average time number of the path is used as the basic index reflecting the degree of abnormality of the behavior time sequence, and the sum is divided by the number of nodes to obtain the average time offset value of the reverse behavior in the path. This part expresses the degree of disorder of the behavior time sequence in the path in the form of mean value with dimension of seconds; secondly, in order to reflect the weight influence of the behavior content itself, the action label score associated with each reverse triple is introduced, and the scores are summed and averaged as a dimensionless adjustment factor of behavior deviation. Since the score represents the severity or attack correlation of the reverse behavior, the factor is added 1 to construct a relative gain ratio to avoid offsetting the overall score when the label score is zero; finally, the above two parts are multiplied to form a composite quantity based on the behavior time sequence offset and the adjustment of the behavior level score, which is used to measure whether the path appears reverse advancing direction. The core logic is: the greater the time offset, the higher the label score, the stronger the reverse trend of the behavior, so as to reflect in The formula does not use square root or exponential form, but uses the average deviation multiplied by the normalized score to enhance the controllability of the calculation, ensure the dimensionality of the uniformity and the logic of the clarity.

[0091] Please refer to Figure 5 , the role conversion determination module comprises:

[0092] The behavior recognition submodule is based on the reverse advancing direction structure of the path, combines all the starting nodes marked as reverse behavior segments in the path, reads the action category corresponding to each starting node, extracts the action information of each starting node and its subsequent node in sequence according to the path order, constructs the action combination sequence according to the action order, records the position and path number if the action order of continuous combination is met, and obtains the attack behavior combination mark value;

[0093] Based on the reverse advancing direction structure of the path, the action category field corresponding to the starting node in the path is obtained, all starting nodes in P1 to P3 paths are extracted, and the action type field record is read, for example, in path P2, the action of starting node N4 is "lateral movement", the action categories of subsequent nodes N5 and N6 are "privilege escalation" and "communication implantation" respectively, and the three are constructed into an action combination sequence. The system performs sequence judgment operation on the sequence to confirm whether it strictly meets the arrangement of "lateral movement-privilege escalation-communication implantation", and marks it as a miss if the sequence does not meet or lacks any action. If it is hit, the path number and node index are recorded, and the attack behavior combination score is further extracted from the three-node behavior score field in the combination to construct the attack behavior combination score. The behavior score is set according to the severity score of the node action type, lateral movement is set to 0.7, privilege escalation is set to 0.8, and communication implantation is set to 0.9. If there are multiple combinations in the path, all combinations are processed in sequence and numbered, and the following sample data is obtained:

[0094] Table 4 Path attack behavior sample data table

[0095]

[0096] As shown in Table 4, the three nodes in path P2 constitute a hit behavior combination. After the system records the combination path number and extracts the behavior score value, it finally obtains the attack behavior combination tag value.

[0097] The path structure screening submodule reads the segment number of each path where the behavior combination is marked as established based on the attack behavior combination mark value, compares it with the time number change direction of the path main sequence direction, extracts the time number sequence of the current segment node, and performs directional judgment on the time number change trend between the path starting node and the first node of the current segment. If the time increment direction is consistent, the path segment is marked as the attacker's dominant segment, the path number and node index position are recorded, and the formula is used:

[0098] ;

[0099] The calculation obtains the matching score between the path advancement direction and the behavior structure, and generates the path direction consistency evaluation result; among them, Indicates the matching score in seconds. For the The time number of each paragraph node, in seconds. is the mean value of the time period number, in seconds. For the The scoring value of a typical attack behavior node is in the range of [0,1]. For the The deduction score value of the reverse behavior node is in the range of [0,1]. is the total number of paragraph nodes, is the number of typical attack behavior combination segments;

[0100] Based on the attack behavior combined tag value, all hit path segments are extracted, and the combined node time number field is read path by path to form a sequence. The time numbers of the combined nodes N4, N5, and N6 in the P2 path are 180 seconds, 175 seconds, and 170 seconds respectively. The average of these three groups of time numbers is calculated as follows:

[0101] ;

[0102] Calculate the absolute offset of each node relative to the mean: , , , the sum of the offsets is 10, and the average is: ;

[0103] Further extract the behavior score value: , , , the sum is 2.4, the deduction score is 0, the number of matching combination segments , the formula is:

[0104] ;

[0105] In this formula, is the time offset sum, is the behavior score of the combination node, is the reverse deduction score value in the same path segment, and the final operation obtains a matching degree score of 5.994. The score is higher than the preset consistency judgment threshold of 3.5, meets the dominant path segment standard, and further obtains the path direction consistency evaluation result.

[0106] The matching degree score is a composite index for measuring whether a paragraph in the path meets the attack party's promotion characteristics in two dimensions of time evolution and behavior type. Its value reflects whether the nodes in the paragraph present a relatively consistent promotion trend in time and whether the behavior combination constitutes typical attack behavior combination, such as "horizontal movement", "privilege escalation", "communication implantation", etc. The higher the score value, the more concentrated the time distribution of the nodes in the paragraph, and the more attack characteristics the behavior combination has, and thus it is more likely to belong to the attack party's dominant path segment. The score is formed by the product of the time offset average and the behavior score factor, which considers both the compactness of the time sequence structure and the attack tendency strength of the behavior action, and is an important basis for identifying the attack dominant direction of the path behavior segment.

[0107] The formula is based on the joint performance of the node behavior in the path in two dimensions of time and action property. The first part represents the average offset degree of the time number of each node in the paragraph relative to the time average of the paragraph, which is used to quantify the dispersion of behavior on the time axis. The larger the value, the more dispersed the behavior time sequence of the nodes in the paragraph is; the second part is the dimensionless behavior score adjustment term, where represents the cumulative score of typical attack behavior in the path segment, The deduction item represents the reverse or non-compliance behavior score of the promotion sequence, the behavior tendency average value is obtained by subtracting the two and dividing by the number of combined segments, and the score adjustment factor is constructed by adding 1, which forms a multiplicative enhancement to the time offset, and the multiplication of the two reflects the synergistic reaction between the behavior content and the behavior timing. If the node time offset is large and the behavior score is concentrated on the attack tendency, the final score will significantly increase, reflecting that the path segment is more inclined to attack dominance in the direction of behavior promotion. This structure does not use the square root or power index form to maintain the structure intuitive and unit consistency, and the logical combination of all terms reflects the weighted integration of behavior offset and behavior characteristics, which constitutes a comprehensive quantity of path direction consistency score.

[0108] The role reconstruction submodule extracts the path paragraph marked as the dominant segment according to the path direction consistency evaluation result, reads the current role label field of all nodes in the paragraph, uniformly assigns it as the attacker role identifier, rearranges the node number order in the paragraph according to the time number, updates the rearrangement result to the path structure, and updates the behavior direction label according to the node order change to obtain the attack role reorganization path segment.

[0109] According to the path direction consistency evaluation result, it is determined that the N4-N6 paragraph in the path P2 is the attack dominant path segment, the role label fields corresponding to the nodes N4, N5 and N6 are extracted and uniformly set as "attackers", and the time number fields 180 seconds, 175 seconds and 170 seconds are read. Perform ascending order sorting on the sequence, and the node order after rearrangement is N6→N5→N4. The system rewrites the node order record of the paragraph in the path structure, and updates the behavior direction field between N6 and N4 to the forward promotion direction. The "communication implantation" behavior of node N6 is marked as the starting node, which identifies the starting point of the path promotion, and the "horizontal movement" of node N4 is marked as the end of the behavior execution in this paragraph. After updating the role label and behavior direction, the attack role reorganization path segment is obtained.

[0110] Please refer to Figure 6 The main chain fusion construction module includes:

[0111] The node order adjustment submodule extracts the time number and node identifier of each node in the attack role reorganization path segment, extracts the time number of each node, and performs incremental judgment on the time number. According to the judgment result, the position of the corresponding node identifier is rearranged, the time order of all nodes is reconstructed through continuous judgment and exchange operation, and the node time order arrangement result is obtained.

[0112] According to the time number and node identification of each node in the path obtained by reorganizing the path segment of the attacking role, the time number fields of nodes N1 to N5 are extracted and an initial time sequence [110, 115, 120, 105, 108] is constructed. The values of adjacent nodes are compared in sequence from the first time number, and the node with the smaller value is placed in front, and the node with the larger value is placed behind. If it is found that the time number 105 of node N4 is smaller than the number 120 of the previous node N3, N4 is adjusted in position, the time number 115 of the node N2 in front of N4 is compared, N4 is moved forward again, and the whole node is processed in this cycle to form the final ascending node number sequence [N4, N5, N1, N2, N3]. This operation process is based on the comparison of time number values and does not use any external sorting function. The judgment standard is whether the time number of the current node is smaller than that of the previous node. If so, the order of the two nodes is exchanged, and the operation is repeated until there is no reverse order pair in the whole time number sequence, and the final node time order arrangement result is obtained.

[0113] Table 5 node path information sample data table

[0114]

[0115] As shown in Table 5, the original time numbers and role labels of nodes N1 to N5 are distributed in path segments P1 and P2, and the order is adjusted to N4→N5→N1→N2→N3 after sorting, and the time number increases from 105 seconds to 120 seconds.

[0116] The label inheritance merging submodule extracts the role label value corresponding to each node based on the node time order arrangement result, and traverses and checks all label values in time order. The adjacent nodes with the same label value are continuously merged, the nodes with the same label value are divided into a group, and the node sequence and the starting and ending positions of each group are recorded. According to the node continuity relationship, new label structure identifications are assigned to each group and the merging order is determined, and a label consistent merging structure sequence is generated.

[0117] Based on the node time sequence arrangement result, the role label field corresponding to the sorted node is extracted, a label sequence [1, 1, 1, 1, 2] is constructed, the system performs adjacent node label consistency determination operation on the label sequence, and the continuous nodes with the same label are grouped. First, N4, N5, N1 and N2 are all label value 1, forming a continuous consistent label group T1, then N3 label value is 2, and a label group T2 is formed alone. After grouping, each group is numbered and the original label value is inherited to all nodes in the group, and the starting and ending node numbers of each label group are recorded as the basis parameters for subsequent structure construction. The node group information is as follows: T1 group is [N4, N5, N1, N2], and T2 group is [N3]. The system does not perform merging processing on nodes with different labels, but only performs operation on continuous sequences of nodes with the same label. Therefore, if the label sequence is [1, 2, 1], three label groups will be formed. Finally, the system forms a label grouping set based on the above continuous label same node set, and obtains a label consistent merging structure sequence.

[0118] The main chain structure construction submodule extracts the starting and ending numbers of the nodes in each label group according to the label consistent merging structure sequence, establishes the order mapping structure between the nodes in accordance with the time sequence, reads the path segment number and label identification of the corresponding node synchronously in each connection process, excludes abnormal structures, and obtains the fusion multi-angle dynamic network attack and defense deduction result.

[0119] According to the label consistent merging structure sequence, the starting and ending numbers of the nodes in each label group are extracted as structure construction references. N4 to N2 in the label group T1 are sequentially connected to form the first chain structure, a mapping structure matrix is constructed to record the node connection relationship, and it is judged whether the node labels between T1 and T2 are continuous. If not, the chain is interrupted, and the T2 group [N3] is retained as an independent structure fragment. The system labels the weight of each connection edge according to the connection order and constructs a structure order mapping table. The mapping table takes the connection node number as the horizontal dimension and the connection sequence index as the vertical dimension. The system detects whether there is a path segment number change or a label jump between the nodes. If the connection path segment jumps from P1 to P3 or the label jumps from 1 to 2, it is recorded as a breakpoint. After excluding the breakpoints, the remaining structure is included in the integration range to form the main chain structure, and the fusion multi-angle dynamic network attack and defense deduction result is finally generated.

[0120] The above is only a preferred embodiment of the present application, and does not limit the present application in other forms. Any skilled person in the art can modify or change the above disclosed technical content to equivalent embodiments applied to other fields, but any simple modification, equivalent change and modification made to the above embodiments without departing from the technical solution of the present application, according to the technical essence of the present application, still belongs to the protection scope of the technical solution of the present application.

Claims

1. A dynamic network attack and defense simulation system integrating multiple perspectives, characterized by: The system comprises: The node initial positioning module obtains the node behavior log data collected from each network perspective of the attack and defense drill platform, counts the number of node identification overlaps, marks the jump candidate nodes, and counts the shortest path lengths of the corresponding behavior paths of the jump candidate nodes in different network perspectives to generate a cross-perspective initial path set; The communication behavior detection module extracts the evolution sequence of the communication targets of the nodes in each path based on the cross-view initial path set, records the number of target changes, identifies the node positions corresponding to the changes, confirms whether the target behavior segment has independent chain properties, and obtains the main path communication evolution segment; The behavior direction labeling module obtains adjacent action combinations between nodes based on the main path communication evolution segment and arranges them in chronological order, labels the behavior segment as the reverse propulsion direction, records the start and end nodes of all reverse propulsion direction segments, and constructs a path propulsion direction reversal structure; The behavior direction labeling module includes: The triplet construction submodule obtains the behavior data of all nodes in the main path communication evolution segment, extracts the action type and time number of each node, sorts all nodes by time number from small to large, selects the actions of three adjacent groups of nodes in chronological order to form action triplets, constructs a triplet sequence, and generates an action triplet sequence set; The reverse relationship identification submodule determines whether the action combination of each triple belongs to the reverse relationship type based on the action triple sequence set. The identification criterion is whether the triple action combination matches. The reverse behavior fragment of the triple is marked, the starting node and the ending node are numbered, and the position of all triples that meet the reverse relationship rules in the path and the path number to which they belong are recorded to obtain a reverse advancement node distribution table. The direction reversal judgment submodule calculates the ratio between the number of reverse-propulsion nodes and the total number of path nodes in each path based on the number of nodes in the reverse-propulsion node distribution table. If the number of reverse-propulsion nodes exceeds the attack chain confidence score threshold of the total number, the path is determined to be a propulsion direction reversal path, and a path propulsion reversal degree score is obtained by calculation to obtain the path propulsion direction reversal structure. The role conversion determination module marks the action category of the starting node in the reverse behavior segment according to the path advancement direction reversal structure, confirms the attacker-dominated path segment, resets the role labels of all nodes in the path to the attacker, reorders the nodes and updates the behavior direction labels, and generates an attack role reorganization path segment.

2. The multi-perspective dynamic network attack and defense simulation system according to claim 1 is characterized in that: The cross-perspective initial path set includes a node jump sequence, a perspective mapping structure, and a path length distribution; the main path communication evolution segment includes the target evolution number, the node change position, and the chain independence label; the path advancement direction reversal structure includes the reverse behavior segment position, the reverse advancement ratio, and the direction determination label; the attack role reorganization path segment includes the attack starting node category, the dominant path behavior combination, and the node role label set.

3. The multi-perspective dynamic network attack and defense simulation system according to claim 1 is characterized in that: The node initial positioning module includes: The node identification submodule is based on the node behavior log data collected from various network perspectives of the attack and defense exercise platform. It extracts the node identifier, communication target identifier, action type, and behavior time number in each log record, counts the number of overlaps between node identifiers in different behavior records, and filters the node set with the number of overlaps below the node behavior correlation threshold from all nodes to generate a node overlap filter set. The jump determination submodule filters each node in the set based on the node coincidence degree, determines the node set with a time difference greater than a set value according to the difference in behavior time numbers, marks them as jump candidate nodes, sorts out the behavior paths of the jump candidate nodes in multiple network perspectives, identifies the connection status and sequence characteristics between the paths, and obtains a valid jump node relationship set; The path generation submodule summarizes the start and end node sequences of the behavior paths in different network perspectives based on the node pair combinations calibrated in the effective jump node relationship set, integrates the path connection relationships between cross-perspectives, performs node path mapping under multiple perspectives, and generates a cross-perspective initial path set.

4. The multi-perspective dynamic network attack and defense simulation system according to claim 1 is characterized in that: The communication behavior detection module includes: The target sequence extraction submodule extracts the node and communication target number information of each path based on the cross-view initial path set, identifies the changes in the communication targets between the nodes, locates the nodes in each path where the communication targets have changed, traverses all paths and records the locations of all changed nodes to obtain a communication target change location set; The sequence difference determination submodule compares all the change node sequences in the communication target change position set with the communication target numbers at the beginning of the path, and determines the degree of difference. Based on the set matching confidence threshold, if there are continuous changes in the communication target numbers in the path segment, it is marked as a behavior deviation, and the target difference matching value is obtained. The chain calibration submodule identifies the continuous segments composed of communication target change nodes based on the path segments calibrated as deviations in the target difference matching values, and determines whether an independent communication structure is formed. If the logical structure is complete and shows an obvious target evolution trend, an independent chain calibration is performed on it, and the behavior directions and dependencies between adjacent nodes are recorded in sequence to obtain the main path communication evolution segment.

5. The multi-perspective dynamic network attack and defense simulation system according to claim 1 is characterized in that: The role conversion determination module includes: The behavior recognition submodule is based on the path propulsion direction reversal structure and combines all starting nodes marked as reverse behavior segments in the path. It reads the action category corresponding to each starting node, extracts the action information of each group of starting nodes and their subsequent nodes in the path order, and constructs a behavior combination sequence according to the action sequence. If the action sequence of the continuous combination is met, the position and path number are recorded to obtain the attack behavior combination tag value; Based on the attack behavior combination tag value, the path structure screening submodule reads the segment number of each path where the behavior combination is marked as established and compares it with the time number change direction of the path main sequence direction. It extracts the time number sequence of the current segment node and performs a directional judgment on the time number change trend between the path starting node and the first node of the current segment. If the time increment direction is consistent, the path segment is marked as the attacker-dominated segment, the path number and node index position are recorded, and a calculation is performed to obtain the path advancement direction and behavior structure matching score to generate a path direction consistency assessment result. The role reconstruction submodule extracts the path segment marked as the dominant segment based on the path direction consistency evaluation result, reads the current role label field of all nodes in the segment, uniformly assigns it as the attacker role identifier, rearranges the node number sequence in the segment according to the time number, and synchronously updates the arrangement result to the path structure. At the same time, it updates the behavior direction label according to the change of the node sequence to obtain the attack role reorganization path segment.

6. The multi-perspective dynamic network attack and defense simulation system according to claim 1 is characterized in that: The system further comprises: The main chain fusion construction module reorganizes the path segments according to the attack roles, rearranges the nodes by time number based on the behavior time number and node identifier of each node in the path segment, and inherits the nodes with the same label in sequence, integrating and merging the path segments to build a single dominant chain, obtaining dynamic network attack and defense deduction results that integrate multiple perspectives; The dynamic network attack and defense simulation results integrating multiple perspectives include a unified time sequence, a node behavior inheritance sequence, and a dominant chain structure.

7. The multi-perspective dynamic network attack and defense simulation system according to claim 6 is characterized in that: The main chain fusion building block includes: The node sequence adjustment submodule reorganizes the path segment according to the attack role, extracts the time number and node identifier of each node in the path segment, extracts the time number of each node and performs an incremental judgment on the time number, rearranges the position of the corresponding node identifier based on the judgment result, and completes the time sequence reconstruction of all nodes through continuous judgment and exchange operations to obtain the node time sequence arrangement result; The label inheritance merging submodule extracts the role label value corresponding to each node based on the result of the node time sequence arrangement, and traverses and checks all label values ​​in time sequence. It performs continuous merging operations on adjacent nodes with the same label value, divides the nodes with consistent label values ​​into a group, and records the node sequence and start and end positions of each group. It reassigns a new label structure identifier to each group according to the node continuity relationship and calibrates the merging order to generate a label consistent merge structure sequence; The main chain structure construction submodule merges the structure sequence according to the consistent label, extracts the start and end numbers of the nodes in each label group, establishes a sequential mapping structure between the nodes in chronological order, and synchronously reads the path segment number and label identification of the corresponding node during each connection process, eliminates abnormal structures, and obtains dynamic network attack and defense deduction results that integrate multiple perspectives.

Images