Network target range-based graph storage method, device and equipment and readable storage medium

Abstract

Embodiments of the present application provide a graph storage method and device based on a network range, equipment and readable storage medium. The method comprises: obtaining a network topology graph, and reading an attack path formed by a connection edge between each topology node and a target node from the network topology graph; configuring a first weight for a target connection edge directly connected with an attack initiation node and a target connection edge directly connected with the target node, and configuring a second weight for other connection edges to obtain a weight sum of each attack path; determining a target maximum weight sum of each topology node to the target node based on the weight sum; determining a storage level of each topology node in descending order of the target maximum weight sum; and respectively performing chain storage on an attack path associated with each topology node according to the storage level of each topology node to obtain graph storage data corresponding to the network topology graph. In this way, the storage efficiency and editing flexibility of the network topology graph can be improved.

Description

Technical Field

[0001] This application relates to the field of graph data processing technology, and in particular to a graph storage method, apparatus, device and readable storage medium based on a network range. Background Technology

[0002] A network range is a highly simulated virtualized network environment that can dynamically construct complex network scenarios, providing a controllable experimental platform for network security research, equipment testing, and personnel training. This helps researchers gain a deeper understanding of network behavior, discover potential security vulnerabilities, and develop effective defense strategies.

[0003] Network topology is the core component of a network testbed. It intuitively reflects the connection relationships and data flow between various nodes in the network (such as servers, routers, switches, and terminal devices). Therefore, it is necessary to construct an accurate and reasonable network topology to ensure that the network testbed can realistically simulate the expected network environment and behavior, thereby providing a reliable foundation for subsequent network attack and defense experiments, performance testing, and other tasks.

[0004] In related technologies, network topology storage often relies on manual storage. Specifically, operators need to manually label each node according to business requirements, and then drag and drop nodes and draw directed edges one by one through the graphical interface, resulting in low storage efficiency. On the other hand, when this storage method needs to be adjusted or edited later, it often requires a global traversal of the entire topology structure to locate and modify the relevant nodes or edges, resulting in poor overall editing flexibility and difficulty in meeting the rapid iteration requirements of dynamic network environments. Summary of the Invention

[0005] This application proposes a graph storage method, apparatus, device, and readable storage medium based on a network test range, which can improve the storage efficiency and editing flexibility of network topology graphs.

[0006] To achieve the above objectives, a first aspect of this application proposes a graph storage method based on a network test range, the method comprising:

[0007] Obtain a network topology graph to be stored. The network topology graph contains multiple topology nodes, and there is a connecting edge between any two topology nodes. The multiple topology nodes include at least one attack initiating node and at least one target node.

[0008] From the network topology graph, traverse and read at least one attack path formed by the connection edges between each topology node and the target node;

[0009] a target connection edge directly connected with the attack initiation node is configured with a first weight, a target connection edge directly connected with the target node is configured with the first weight, and other connection edges in the network topology graph except the target connection edges are configured with a second weight, to obtain a weight sum of an attack path between each topology node and the target node, the first weight being greater than the second weight;

[0010] based on the weight sum of the attack path between each topology node and the target node, determine a target maximum weight sum of each topology node to the target node;

[0011] sort the plurality of topology nodes in a descending order of the target maximum weight sum to obtain a node ordering relationship, and determine a storage level of each topology node in a storage area according to the node ordering relationship;

[0012] respectively chain store the attack paths associated with each topology node according to the storage level of each topology node in the storage area, to obtain graph storage data corresponding to the network topology graph.

[0013] Correspondingly, a second aspect of the embodiment of the application proposes a graph storage device based on a network target range, the device comprising:

[0014] an acquisition module configured to acquire a network topology graph to be stored, the network topology graph containing a plurality of topology nodes, any two topology nodes having a connection edge therebetween, the plurality of topology nodes containing at least one attack initiation node and at least one target node;

[0015] a reading module configured to read at least one attack path formed by connection edges between each topology node and the target node from the network topology graph;

[0016] a configuration module configured to configure a target connection edge directly connected with the attack initiation node with a first weight, configure a target connection edge directly connected with the target node with the first weight, and configure other connection edges in the network topology graph except the target connection edges with a second weight, to obtain a weight sum of an attack path between each topology node and the target node, the first weight being greater than the second weight;

[0017] a determination module configured to determine a target maximum weight sum of each topology node to the target node based on the weight sum of the attack path between each topology node and the target node;

[0018] a sorting module configured to sort the plurality of topology nodes in a descending order of the target maximum weight sum to obtain a node ordering relationship, and determine a storage level of each topology node in a storage area according to the node ordering relationship;

[0019] a storage module, configured to store each attack path associated with each topology node in a chain manner according to a storage level of each topology node in a storage area, to obtain graph storage data corresponding to the network topology graph.

[0020] In some embodiments, the network range-based graph storage device further comprises a query module, configured to:

[0021] determine query information based on the attack path analysis request in response to the attack path query request, wherein the query information comprises at least one query topology node;

[0022] sequentially query each storage level in the graph storage data according to a query order from high to low based on the query information, to obtain corresponding query results.

[0023] In some embodiments, the network range-based graph storage device further comprises an addition module, configured to:

[0024] when there is at least one new topology node, sequentially query each storage level in the network topology graph according to a query order from high to low, to determine at least one first to-be-adjusted attack path corresponding to the new topology node;

[0025] add the new topology node in the first to-be-adjusted attack path to obtain a first target attack path, and calculate a first weight sum of each first target attack path;

[0026] redetermine a first maximum weight sum of a first topology node of each first target attack path based on the first weight sum, and determine a first storage level of the first topology node in the graph storage data based on the first maximum weight sum;

[0027] update an attack path corresponding to the first topology node in the first storage level.

[0028] In some embodiments, the network range-based graph storage device further comprises a deletion module, configured to:

[0029] when there is at least one to-be-deleted topology node, sequentially query each storage level in the network topology graph according to a query order from high to low, to determine at least one second to-be-adjusted attack path corresponding to the to-be-deleted topology node;

[0030] delete the to-be-deleted topology node in the second to-be-adjusted attack path to obtain a second target attack path, and calculate a second weight sum of each second target attack path;

[0031] re-determine a second maximum weight sum of a first topological node of each second target attack path based on the second weight sum, and determine a second storage level of the graph storage data of the first topological node based on the second maximum weight sum;

[0032] update the attack path corresponding to the first topological node in the second storage level.

[0033] In some embodiments, the network range-based graph storage device further comprises a sum module configured to:

[0034] For each network topology graph, obtain a first access frequency of the attack initiation node in all attack paths, and obtain a second access frequency of the target node in all attack paths;

[0035] perform weighted sum based on the first access frequency and the second access frequency to obtain a first weight;

[0036] obtain a preset weight proportion factor, and adjust the first weight based on the weight proportion factor to obtain a second weight.

[0037] In some embodiments, the network range-based graph storage device further comprises a second determination module configured to:

[0038] When there are at least two target topological nodes corresponding to the same target maximum weight sum, obtain a target attack path corresponding to the target maximum weight sum of each target topological node, and a last modification timestamp of each target attack path;

[0039] based on the order of the last modification timestamps, determine a target storage level of the at least two target topological nodes from a plurality of storage levels respectively.

[0040] In some embodiments, the network range-based graph storage device further comprises a storage module configured to:

[0041] In each storage level, create a vertex table item for each topological node in at least one attack path contained in the corresponding each topological node in sequence, wherein the vertex table item comprises a node identifier, an out-edge first pointer and an in-edge first pointer of the each topological node;

[0042] For the at least one attack path, create an arc node for a connection edge between adjacent topological nodes, and link the arc nodes in path order to obtain chain storage data of the at least one attack path, wherein the arc node comprises an arc tail vertex index, an arc head vertex index, a same arc tail pointer and a same arc head pointer;

[0043] Based on multiple chained storage data corresponding to multiple storage levels, graph storage data corresponding to the network topology graph is generated.

[0044] Accordingly, a third aspect of the embodiments of this application proposes a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the graph storage method based on a network target range according to any one of the embodiments of the first aspect of this application.

[0045] Accordingly, a fourth aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the graph storage method based on a network target range according to any one of the embodiments of the first aspect of this application.

[0046] This application embodiment obtains a network topology graph to be stored. The network topology graph contains multiple topology nodes, and any two topology nodes are connected by an edge. The multiple topology nodes include at least one attack initiating node and at least one target node. From the network topology graph, at least one attack path formed by the connecting edges between each topology node and the target node is traversed and read. A first weight is assigned to the target connecting edge directly connected to the attack initiating node, and a first weight is assigned to the target connecting edge directly connected to the target node. A second weight is assigned to the other connecting edges in the network topology graph except for the target connecting edges, to obtain the total weight of the attack paths between each topology node and the target node. The first weight is greater than the second weight. Based on the total weight of the attack paths between each topology node and the target node, the maximum target weight of each topology node to the target node is determined. The multiple topology nodes are sorted in descending order of the maximum target weight to obtain the node sorting relationship. The storage level of each topology node in the storage area is determined according to the node sorting relationship. According to the storage level of each topology node in the storage area, the attack paths associated with each topology node are stored in a chain to obtain the graph storage data corresponding to the network topology graph. Therefore, on the one hand, by adopting chained storage, graph data can be automatically recorded and accessed in a more compact and ordered manner, effectively improving the storage efficiency of network topology graphs. On the other hand, this application can assign different weights to connections associated with attack initiation nodes or target nodes, quickly identifying critical paths with high access frequency (i.e., the paths with the largest total weight), and prioritizing the storage of high-frequency access paths at higher storage levels. This allows for priority access to high-frequency access paths when editing or updating is needed, eliminating the need for a global traversal of the topology, thus improving search efficiency. During editing, only local adjustments to relevant links are required, without the need for a full traversal and reconstruction of the entire topology, greatly enhancing editing flexibility and better adapting to the rapid iteration needs of dynamic network environments. In summary, this application can improve the storage efficiency and editing flexibility of network topology graphs. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the architecture of a graph storage system based on a network test range provided in an embodiment of this application;

[0048] Figure 2 This is a flowchart of a graph storage method based on a network target range provided in an embodiment of this application;

[0049] Figure 3 This is an example diagram of the network topology provided in the embodiments of this application;

[0050] Figure 4 This is an example diagram illustrating the structure of graph storage data provided in the embodiments of this application;

[0051] Figure 5 This is a schematic diagram of the functional modules of the graph storage device based on a network range provided in the embodiments of this application;

[0052] Figure 6 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0056] A network range is a highly simulated virtualized network environment that can dynamically construct complex network scenarios, providing a controllable experimental platform for network security research, equipment testing, and personnel training. This helps researchers gain a deeper understanding of network behavior, discover potential security vulnerabilities, and develop effective defense strategies.

[0057] Network topology is the core component of a network testbed. It intuitively reflects the connection relationships and data flow between various nodes in the network (such as servers, routers, switches, and terminal devices). Therefore, it is necessary to construct an accurate and reasonable network topology to ensure that the network testbed can realistically simulate the expected network environment and behavior, thereby providing a reliable foundation for subsequent network attack and defense experiments, performance testing, and other tasks.

[0058] In related technologies, network topology storage often relies on manual storage. Specifically, operators need to manually label each node according to business requirements, and then drag and drop nodes and draw directed edges one by one through the graphical interface, resulting in low storage efficiency. On the other hand, when this storage method needs to be adjusted or edited later, it often requires a global traversal of the entire topology structure to locate and modify the relevant nodes or edges, resulting in poor overall editing flexibility and difficulty in meeting the rapid iteration requirements of dynamic network environments.

[0059] Based on this, embodiments of this application provide a graph storage method, apparatus, device, and readable storage medium based on a network target range, which can improve the storage efficiency and editing flexibility of network topology graphs.

[0060] The graph storage method, apparatus, device, and readable storage medium based on network ranges provided in this application are specifically described through the following embodiments. First, the graph storage system based on network ranges in this application is described.

[0061] Please refer to Figure 1 In some implementations, embodiments of this application provide a graph storage system based on a network target range.

[0062] In some implementations, the graph storage system may include a terminal 11 and a server 12. For example, the terminal 11 may be a personal computer, workstation, or a mobile terminal such as a tablet or smartphone. Users perform configuration operations on the terminal 11 through a graphical interface or command-line tool, and the user's operation instructions are encapsulated into request messages and sent to the server 12 via a network.

[0063] Furthermore, server 12 can be a general-purpose server, a high-performance computing server, a storage server, etc. After receiving the request message sent by terminal 11, server 12 parses the request and extracts key information such as network topology and attack paths. Then, server 12 processes the graph data according to the graph storage method. For example, server 12 can calculate the edge weights according to formulas, generate graph storage data, and perform operations such as insertion, query, or deletion, and save the processed graph storage data in a storage device, such as a hard drive, solid-state drive, or distributed storage system. At the same time, server 12 also manages and maintains the stored graph storage data, including data backup, recovery, and index optimization, to ensure data integrity and efficient access.

[0064] Furthermore, after the server 12 completes the storage operation of the graph storage data, it can encapsulate the operation result into a response message and send it back to the terminal 11 via the network. The terminal 11 will then display the query result returned by the server 12 to the user in a graphical manner, making it convenient for the user to view and analyze the storage status and graph flow information of the network topology graph.

[0065] The graph storage method based on network target range in this application can be illustrated through the following embodiments.

[0066] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user will be obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent will the necessary user-related data for the normal operation of the embodiments of this application be obtained.

[0067] In this application embodiment, the description will focus on a network-based graph storage device, which can be integrated into a computer device. See [link to relevant documentation]. Figure 2 , Figure 2 The flowchart illustrates the steps of the graph storage method based on a network test range provided in this application embodiment. This application embodiment takes the graph storage device based on a network test range being specifically integrated into a terminal or server as an example. When the processor on the terminal or server executes the program instructions corresponding to the graph storage method based on the network test range, the specific process is as follows:

[0068] Step 101: Obtain the network topology graph to be stored. The network topology graph contains multiple topology nodes. There is a connecting edge between any two topology nodes. Among the multiple topology nodes, there is at least one attack initiating node and at least one target node.

[0069] In some implementations, in order to provide structured input for subsequent graph storage, a network topology graph containing attack path logic can be obtained, thereby laying the data foundation for weight-optimized storage of dynamic attack paths.

[0070] Among them, the network topology graph can be a logically directed graph structure, consisting of topology nodes (network entities) and connecting edges (flow relationships between nodes), used to describe the reachable paths and attack behavior flow of the simulated network in the software-defined range.

[0071] Among them, topology nodes can be logical entities in the network topology diagram, representing simulated network devices such as servers, core routers, and switches in the software-defined range. They have unique identification attributes and can carry roles (attack source, target, etc.) in the attack path.

[0072] Among them, the connecting edge can be a directed connection between topological nodes, representing the feasible path direction of network traffic or attack behavior (such as from the attacker to the intermediate node A), and its weight can be differentiated according to whether it contains high-frequency access nodes (attacker / target).

[0073] The attack initiating node can be a special node (such as a user terminal) marked as the source of the attack in the network topology diagram.

[0074] The target node can be a special node marked as an attack target in the network topology diagram (such as a critical server), which can be used as the endpoint for calculating the reachable path weight.

[0075] For example, network topology diagrams can be generated manually by users, generated based on network scanning tools, obtained based on configuration files, or obtained based on user-defined scripts. They can be tree-structured diagrams or network diagrams, etc.

[0076] Furthermore, topology nodes can be physical devices, such as firewalls and routers; or they can be virtual devices, such as Docker containers and attack virtual machines.

[0077] Please refer to Figure 3 A network topology diagram can be a directed graph structure. Topology nodes can be various devices in the network, such as user computers (laptops), routers, servers, and firewalls. Edges represent network connections between these devices; they are data transmission paths or communication links. For example, the edge between a core router and an aggregation switch can be a connection edge.

[0078] exist Figure 3 In the included network topology diagram, the attack initiating node is a device that may carry out a network attack, which may be an unprotected or misconfigured computer; while the target node is the attacker's target, which may be a server that stores sensitive data or provides important services.

[0079] The above methods can provide accurate basic data for subsequent graph storage and analysis, thereby improving the management and analysis efficiency of network ranges and enhancing the ability to simulate and study network attack behaviors.

[0080] Step 102: From the network topology graph, traverse and read at least one attack path formed by the connection edges between each topology node and the target node.

[0081] In some implementations, in order to optimize the graph storage structure and improve the efficiency of graph storage, at least one attack path formed by the connecting edges between each topology node and the target node can be read to obtain a comprehensive and accurate data foundation, thereby enabling efficient and accurate storage.

[0082] The attack path can be a sequence of edges connecting any topological node (including the attack initiating node or intermediate topological nodes) to the target node in the network topology graph, used to characterize the feasible propagation direction of the attack behavior in the network (e.g., Figure 3 The attack path is 1→2→3→5.

[0083] For example, it is possible to read the attack paths from all topology nodes (including the attack initiating node) to the target node. For instance, in... Figure 3 In the above, at least one attack path formed by the connecting edge between topology node 1 and target node 5 can be 1→2→3→5, 1→2→3→4→5, etc.; at least one attack path formed by the connecting edge between topology node 2 and target node 5 can be 2→3→5, 2→3→4→5, etc.; at least one attack path formed by the connecting edge between topology node 3 and target node 5 can be 3→5, 3→4→5, etc.

[0084] Furthermore, in addition to the attack path, branch paths can also be extracted, such as the branch path formed between 3 and 6, and the branch path formed between 3 and 7.

[0085] By using the above methods, potential routes in the network can be quickly identified, ensuring a rapid response during graph storage and providing a data foundation for subsequent weight calculation and graph storage.

[0086] Step 103: Configure the target connection edge directly connected to the attack initiating node with a first weight, configure the target connection edge directly connected to the target node with a first weight, and configure the other connection edges in the network topology graph except for the target connection edge with a second weight, so as to obtain the sum of the attack path weights between each topology node and the target node, where the first weight is greater than the second weight.

[0087] In some implementations, to support the priority storage and fast retrieval access of high-frequency attack paths in the test range, the connection edges directly associated with special nodes (attack initiation nodes / target nodes) can be identified and assigned higher priority weights, while ordinary connection edges are assigned lower weights. Finally, the total weight of each attack path is calculated to highlight key attack paths and provide a quantitative basis for the storage priority of each subsequent path.

[0088] The target connection edge can be a directed edge that directly connects the attack initiating node in the network topology graph (e.g., ...). Figure 3 The middle edge 1→2, where 1 is the attack initiating node), and the directed edge directly connecting the target node (such as... Figure 3 (Middle edge 3→5, where 5 is the target node).

[0089] The first weight can be a high-priority weight value configured for the target connection edge, which can be used to quantify the criticality of special node-related edges in the attack path and drive the graph storage to prioritize storing paths containing such edges.

[0090] Among them, other connecting edges can be connecting edges in the network topology graph that are not directly related to the attack initiating node or the target node (such as...). Figure 3 The middle edges (2→3, 2→4) represent intermediate jump relationships, and their weights are lower than those of the target connecting edges.

[0091] The second weight can be a base weight value configured for other connected edges, used to quantify the weight contribution of non-critical path segments.

[0092] The total weight can be the sum of the weights of all connecting edges in the attack path formed from any topological node (excluding the target node) to the target node. For example, the weight of the attack path 1→2→3→5 is w1+w2+w1. The larger the total weight, the higher the path priority.

[0093] For example, the first and second weights can be set to be the same for all attack paths in all network topologies.

[0094] In some implementations, different first and second weights can be set for different network topologies, depending on the specific circumstances. For example, for different network topologies... Figure 1Set the first weight to 0.8 and the second weight to 0.4; for the network topology Figure 2 For example, you can set the first weight to 0.9, the second weight to 0.3, and so on. Furthermore, you can configure the first weight for the target connection edge directly connected to the attack initiating node, the second weight for the target connection edge directly connected to the target node, and the third weight for all other connection edges in the network topology graph except the target connection edge. The weight configuration of each connection edge can be adjusted, but it is necessary to ensure that the weight of the target connection edge is higher than the weight of the other connection edges.

[0095] In some implementations, the first and second weights can be manually configured by technicians or determined using the base attack value. For example, for each network topology, a first base attack value index for the attack initiating node and a second base attack value index for the target node can be obtained. A weighted sum of the first and second base attack value indices is then calculated to obtain the first weight. A preset weight scaling factor is then obtained, and the first weight is adjusted based on this factor to obtain the second weight. For instance, if the first base attack value index is 0.8, corresponding to a weight of 0.6, and the second base attack value index is 0.6, corresponding to a weight of 0.4, then the first weight, after weighted summation, is 0.72. If the weight scaling factor is 0.5, then the second weight is the product of the first weight and the weight scaling factor, which is 0.36.

[0096] In some implementations, the first basic attack value index for a target connection edge associated with the attack initiating node can be determined by the vulnerability threat level and port threat coefficient (i.e., the proportion of high-risk ports) of the attack initiating node. For example, if the vulnerability threat level is 9.0 and the port threat coefficient is 0.7, the first basic attack value index can be calculated as follows: First basic attack value index = [vulnerability threat level × (1 + port threat coefficient)] / 2 = (9 × 1.7) / 2 = 7.65.

[0097] Furthermore, for target connection edges associated with the target node, the second basic attack value index can be determined by multiplying the business importance level and data sensitivity. For example, if the business importance level is 5 and the data sensitivity is 0.9, the second basic attack value index can be calculated as follows: Second basic attack value index = Business importance level × Data sensitivity = 5 × 0.9 = 4.5.

[0098] Therefore, the first weight can be the sum of the first basic attack value index and the second basic attack value index, which is 12.15, or the two can be weighted and summed, with the first basic attack value index assigned a weight of 0.6 and the second basic attack value index assigned a weight of 0.4, and so on.

[0099] Furthermore, after labeling any two connecting edges in each attack path with a first or second weight, the weights of all connecting edges can be summed to obtain the total weight of the attack path. Taking attack path 1→2→3→5 as an example, if the attack initiating node is node 1, the target node is node 5, the first weight is 0.8, and the second weight is 0.4, then the weight of 1→2 is 0.8, the weight of 2→3 is 0.4, and the weight of 3→5 is 0.8. Therefore, the total weight of attack path 1→2→3→5 is 0.8 + 0.4 + 0.8 = 2. Similarly, the algorithms for other attack paths are as described above, and will not be listed here.

[0100] By using the above methods, the importance of key attack paths can be effectively highlighted, which is beneficial for the rapid storage of network topology maps based on their importance.

[0101] In some implementations, to prioritize identifying attack paths with high-frequency editing in the target range, the access frequency of the attack initiating node and the target node in the attack path (reflecting the user's editing frequency) can be statistically analyzed, and a differentiated weight can be dynamically generated by combining a weighting factor to dynamically quantify the interaction value of key nodes in the attack path, facilitating subsequent optimization of resource allocation and response speed. For example, before step 103, the following may also be included:

[0102] (A.1) For each network topology, obtain the first access frequency of the corresponding attack initiating node on all attack paths, and obtain the second access frequency of the target node on all attack paths.

[0103] (A.2) The first weight is obtained by weighted summation based on the first access frequency and the second access frequency;

[0104] (A.3) Obtain the preset weight ratio factor, and adjust the first weight based on the weight ratio factor to obtain the second weight.

[0105] The first access frequency can be the percentage of attack and defense events in which the attack initiating node is successfully activated within a preset time window.

[0106] The second access frequency can be the probability that the target node is the final target in the attack path.

[0107] The weight ratio factor can be an adjustment coefficient that is dynamically adjusted based on the current attack and defense situation in the target range. The weight ratio factor can be determined based on topological complexity, attack threat level, and business priority. The specific value can be set according to the actual situation.

[0108] For example, the first access frequency can be calculated in the following way:

[0109] First access frequency = Number of valid attack chains triggered by the attack initiating node / Total number of attack and defense events in the target range;

[0110] Furthermore, the second access frequency can be calculated in the following way:

[0111] Second access frequency = number of attack paths ending at the target node / total number of paths reaching the target node.

[0112] For example, if the preset time window is the past 7 days, and considering network topology A, a total of 50 attack and defense events occurred in the target range in the past 7 days. Among them, 15 effective attack chains were triggered by attack initiating node 1 (10 of which compromised node 5). There are a total of 8 reachable paths starting from node 1, and 5 paths targeting node 5. In the current situation parameters, the topology complexity is 0.65, the attack threat level is 0.9, and the service priority is 0.8. Then, the first access frequency = 15 / 50 = 0.3, meaning that attack initiating node 1 plays a key role in 30% of the attack and defense events; the second access frequency = 5 / 8 = 0.625, meaning that target node 5 is the target node in 62.5% of the reachable paths.

[0113] Furthermore, the weight coefficient corresponding to the first access frequency is 0.7, and the weight coefficient corresponding to the second access frequency is 0.3. Therefore, the first weight is: 0.7 × 0.3 + 0.3 × 0.625 = 0.3975. If the weight ratio factor is set to 0.4, then the second weight is the product of the first weight and the weight ratio factor, specifically 0.159.

[0114] By using the above methods and through weight calculation, the system can always focus on the critical paths that users frequently edit during subsequent graph storage processes, thereby meeting the storage requirements for adaptive, automated, efficient, and highly accurate dynamic topologies.

[0115] Step 104: Based on the sum of the weights of the attack paths from each topology node to the target node, determine the maximum total weight of the target from each topology node to the target node.

[0116] In some implementations, to ensure that the attack path with the largest total weight is stored at the top of the heap, the target maximum weight of the current topology node can be determined based on the total weight of at least one attack path between each topology node and the target node. This allows for subsequent comparison of the target maximum weights of all topology nodes, thereby determining the storage level of each topology node and improving storage efficiency as well as the efficiency of subsequent queries and edits.

[0117] The maximum sum of target weights can be the maximum value of the sum of weights among all reachable attack paths from any topology node in the network topology graph to the target node. It is used to characterize the priority of the most critical attack path from the topology node to the target node and is the basis for determining the storage location of the topology node in subsequent sorting and storage.

[0118] In some implementations, to determine the sum of the weights of the highest-value attack paths from each topology node to the target node, the sum of the weights of all possible attack paths from the topology node to the target node can be obtained. The sums of the weights of all possible attack paths can be compared, and the largest sum of weights can be taken as the target maximum sum of weights to determine the most threatening attack path of the topology node. Then, it can be compared with the most threatening attack paths of other topology nodes to quickly and accurately determine the storage level of the attack path corresponding to each topology node.

[0119] For example, if there are 3 attack paths between topology node A and target node, namely attack paths 1 to 3, where the total weight of attack path 1 (the calculation method has been explained above and will not be repeated here) is 5, the total weight of attack path 2 is 7, and the total weight of attack path 3 is 9, then by comparing the total weights of the 3 attack paths, the maximum total weight can be determined to be 9, and 9 can be taken as the maximum total weight of the target of topology node A.

[0120] The above method facilitates the determination of the storage level of each topology node based on the maximum total weight of the target, thereby storing the attack path that the user is most likely to access (with the maximum total weight) at the top, which is convenient for users to store efficiently, access quickly, and edit efficiently.

[0121] Step 105: Sort multiple topology nodes in descending order of the maximum total weight of the target to obtain the node sorting relationship, and determine the storage level of each topology node in the storage area based on the node sorting relationship.

[0122] In some implementations, to ensure that information related to the most threatening attack paths is processed and stored first, the topology nodes can be sorted in descending order based on the maximum total weight of the targets (reflecting the priority of attack path storage and access), generating a node sorting relationship, and dividing the storage area hierarchy of each topology node accordingly. This allows the weighted cross-linked list proposed in this application to prioritize the storage of nodes of high-frequency attack paths in the high-speed access area (i.e., the top of the heap), thereby improving the real-time storage, querying, and editing efficiency of dynamic topologies in software-defined ranges.

[0123] The node sorting relationship can be a sorting sequence of topological nodes according to the sum of the target's maximum weight (from largest to smallest). It is used to characterize the priority of the attack path associated with the node. The higher the sorting, the more critical the attack path and the greater the possibility of it being accessed.

[0124] The storage area can be a physical memory partition based on a weighted cross-linked list (WCLL).

[0125] The storage level can be the hierarchical index of the data storage of each topology node in the entire graph. For example, if the attack path related to topology node a is stored at the top level, then the storage level of topology node a1 is level 0 (or level 1 if counting from 1).

[0126] In some implementations, topology nodes can be sorted according to their target maximum weight sum to identify the most frequently accessed attack paths in the network topology. Specifically, each topology node can be sorted from largest to smallest based on its target maximum weight sum, resulting in a node sorting relationship. Then, based on this relationship, the topology node with the largest target maximum weight sum is assigned to the top layer (first layer), the topology node with the second largest target maximum weight sum is assigned to the second layer, and so on. This ensures that critical topology nodes and their associated attack paths can be accessed and processed more quickly, optimizing storage resource utilization and enhancing the ability to respond rapidly to potential security threats.

[0127] For example, if there are four topology nodes A, B, C, and D (D is the target node) in a network topology graph, the calculated maximum weight sum of each topology node to D is as follows: A = 30, B = 45, and C = 20. First, sort them from largest to smallest according to the maximum weight sum, resulting in the order B(45) > A(30) > C(20). Then, based on this sorting relationship, determine the storage level of topology nodes A, B, and C in the storage area. For example, B is located at level 0 (highest query priority), A is located at level 1, and C is located at level 2. This means that when the system needs to query or edit paths, it will prioritize querying and processing data related to topology node B, because it is considered to be the most likely part of the attack path and the most frequently accessed part. In this way, information can be processed most quickly and accurately.

[0128] By using the above methods, the paths corresponding to high-importance topology nodes can be effectively identified, so that they can be prioritized for storage and thus improve the system's response speed.

[0129] In some implementations, to resolve storage conflicts between topology nodes with the same total weight, when at least two target topology nodes have the same maximum total target weight, the last modification timestamp of the target attack path can be introduced as a secondary sorting criterion to dynamically determine the size of the target topology node at the appropriate level. This ensures that frequently edited attack paths are preferentially stored in lower-level regions (such as the top of the heap), thereby optimizing the storage efficiency of real-time topology updates in software-defined ranges. For example, graph storage methods based on network ranges may also include:

[0130] (B.1) When there are at least two target topology nodes with the same maximum target weight, obtain the target attack path corresponding to the maximum target weight of each target topology node, and the last modification timestamp of each target attack path;

[0131] (B.2) Based on the order of the last modification timestamps, determine the target storage level of at least two target topology nodes from multiple storage levels.

[0132] The target topology nodes can be a set of topology nodes with the same maximum target weight sum and requiring allocation to a storage level. For example, if the maximum target weight sum corresponding to topology node A and topology node B is 8, and these two topology nodes are directly allocated to the same storage level, then topology node A and topology node B are both target topology nodes.

[0133] The target attack path can be the attack path with the largest total weight among the target topology nodes and the target nodes.

[0134] The last modification timestamp can be the time identifier of the user's most recent edit to the target attack path, used to indicate the activity of the path. The more recent the timestamp, the higher the priority.

[0135] The target storage level can be a storage level allocated to target topology nodes with the same weight based on the last modification timestamp.

[0136] In some implementations, when at least two topology nodes have the same maximum target weight, they are sorted in descending order of their corresponding attack paths' last modification time (most recently modified nodes take priority) to ensure that frequently updated nodes are stored first. For example, if there are target topology nodes X and Y in the network topology, and their maximum weight to the target node is 50, then by checking the target attack paths corresponding to the maximum weight sum of 50 for these two target topology nodes, it is found that the last modification time of the target attack path for target topology node X is June 8, 2025, while the last modification time of the target attack path for target topology node Y is June 6, 2025. Based on the order of the last modification times, target topology node X is considered more active or more relevant. Therefore, target topology node X, and the attack path starting with target topology node X, are assigned to a lower target storage level (e.g., storage level 7) and enjoy higher access priority; while target topology node Y, and the attack path starting with target topology node Y, are assigned to a slightly higher target storage level (e.g., storage level 8).

[0137] In some implementations, a node activity index can be introduced as a distinguishing criterion for target topology nodes. The node activity index can comprehensively consider factors such as the historical activity frequency of the target topology node within a historical time window, the number of interactions within the current time window, and the level of security events involved. A weighted score is calculated based on this. Since nodes with frequent recent activity and involvement in high-risk security events receive higher weighted scores, nodes with higher weighted scores can be assigned a lower target storage level (e.g., storage level 7), while nodes with the second-lowest weighted scores can be assigned the second-lowest target storage level (e.g., storage level 8), and so on. This improves the efficiency of subsequent storage and access.

[0138] By using the above methods, it can be ensured that, under the same weight, newer or more timely paths are stored first based on timestamps, thereby effectively improving the scientific and rational nature of data storage.

[0139] Step 106: According to the storage level of each topology node in the storage area, the attack paths associated with each topology node are stored in a chain to obtain the graph storage data corresponding to the network topology graph.

[0140] In some implementations, in order to meet the needs of software-defined ranges for automatic, accurate and efficient storage of dynamic topologies, the attack paths associated with each topology node can be chained according to the storage level (determined by the sum of the maximum weights of the targets) to construct a weight-driven hierarchical chained storage structure, thereby improving the efficiency, organization and practicality of graph storage.

[0141] Among them, the graph storage data can be a dynamic data structure based on the weighted cross-linked list proposed in this application, which can store the attack path of the corresponding node according to the storage level of each node through chain storage.

[0142] It is understandable that low-level and high-level are relative terms. For example, the top level can be called a low level, such as level 0, or the top level can be called a high level, such as level 100, as long as the storage does not deviate from the concept of this application.

[0143] In some implementations, based on the storage hierarchy of each topology node in the storage area, higher-priority topology nodes and their associated attack paths can be placed in more easily accessible storage levels, thereby constructing a hierarchical graph storage data structure. This not only optimizes the data organization but also improves query and editing efficiency.

[0144] For example, if there are three topology nodes A, B, and C in a network topology graph, and they are assigned to storage levels 0, 1, and 2 respectively. For topology node A (level 0), it has two associated attack paths P1 and P2; topology node B (level 1) has an associated path P3; and topology node C (level 2) has an associated path P4. Then, in the storage area, topology node A and its associated paths P1 and P2 can be stored in a chained structure at the highest priority position, i.e., storage level 0 (storage level 0 is at the top level). Next, topology node B and its path P3 are stored sequentially, and finally, topology node C and its path P4 are stored. This ensures that when the system needs to quickly respond to query or edit requests, it can prioritize accessing key nodes and path information at higher levels, ensuring efficient data processing.

[0145] This application embodiment obtains a network topology graph to be stored. The network topology graph contains multiple topology nodes, and any two topology nodes are connected by an edge. The multiple topology nodes include at least one attack initiating node and at least one target node. From the network topology graph, at least one attack path formed by the connecting edges between each topology node and the target node is traversed and read. A first weight is assigned to the target connecting edge directly connected to the attack initiating node, and a first weight is assigned to the target connecting edge directly connected to the target node. A second weight is assigned to the other connecting edges in the network topology graph except for the target connecting edges, to obtain the total weight of the attack paths between each topology node and the target node. The first weight is greater than the second weight. Based on the total weight of the attack paths between each topology node and the target node, the maximum target weight of each topology node to the target node is determined. The multiple topology nodes are sorted in descending order of the maximum target weight to obtain the node sorting relationship. The storage level of each topology node in the storage area is determined according to the node sorting relationship. According to the storage level of each topology node in the storage area, the attack paths associated with each topology node are stored in a chain to obtain the graph storage data corresponding to the network topology graph. Therefore, on the one hand, by adopting chained storage, graph data can be automatically recorded and accessed in a more compact and ordered manner, effectively improving the storage efficiency of network topology graphs. On the other hand, this application can assign different weights to connections associated with attack initiation nodes or target nodes, quickly identifying critical paths with high access frequency (i.e., the paths with the largest total weight), and prioritizing the storage of high-frequency access paths at higher storage levels. This allows for priority access to high-frequency access paths when editing or updating is needed, eliminating the need for a global traversal of the topology, thus improving search efficiency. During editing, only local adjustments to relevant links are required, without the need for a full traversal and reconstruction of the entire topology, greatly enhancing editing flexibility and better adapting to the rapid iteration needs of dynamic network environments. In summary, this application can improve the storage efficiency and editing flexibility of network topology graphs.

[0146] In some implementations, to optimize data storage and access efficiency, attack paths in the network topology graph can be chained together using weight information to accurately record the topological relationships of attack paths and ensure logical continuity of any attack path across heterogeneous storage media. For example, step 106 may include:

[0147] (106.1) Sequentially in each storage level, create a vertex table entry for each topology node in at least one attack path contained in each corresponding topology node, wherein the vertex table entry includes a node identifier, an outgoing edge head pointer and an incoming edge head pointer for each topology node.

[0148] (106.2) For at least one attack path, create arc nodes for the connection edges between adjacent topology nodes, and link each arc node in the order of the path to obtain the chained storage data of at least one attack path, wherein the arc node includes the arc tail vertex index, the arc head vertex index, the same arc tail pointer and the same arc head pointer.

[0149] (106.3) Generate graph storage data corresponding to the network topology based on multiple chained storage data corresponding to multiple storage levels.

[0150] The vertex table entry can be a physical storage unit of a topological node in the storage hierarchy, containing a node identifier, an outgoing edge head pointer (pointing to the outgoing arc node with the highest weight of the node), and an incoming edge head pointer (pointing to the incoming arc node with the highest weight of the node), used to quickly locate key connecting edges.

[0151] The node identifier can be a unique identity code (such as an IP hash value) of the topology node in the target network, used to accurately identify the topology node in the vertex table entry.

[0152] Among them, the outgoing edge pointer can be a pointer in the vertex table that points to the first outgoing edge arc node of the topological node, and the outgoing edges of the same topological node are linked in descending order of weight (the connection edge with higher weight is given priority).

[0153] The incoming edge pointer can be a pointer in the vertex table that points to the first incoming edge arc node of the topological node, and the incoming edges pointing to the topological node are linked in descending order of weight.

[0154] Among them, an arc node can be a directed edge storage unit connecting two topological nodes in the attack path, containing an arc tail vertex index (starting node ID), an arc head vertex index (target node ID), a pointer to the same arc tail (linking to the next connecting edge of the same arc tail), and a pointer to the same arc head (linking to the next connecting edge of the same arc head). In this way, the core structure of graph storage data can be formed.

[0155] The linked storage data can be a sequence of arc nodes linked in the order of the attack path (such as the arc node chain of attack path 1→2→3→5), which can be traversed bidirectionally by pointers to the same arc tail / same arc head, and stored at a specified level (the top level 0 of the heap is the attack path with high weight).

[0156] The tail vertex index can be the edge start node identifier recorded in the arc node, used to associate vertex entries.

[0157] The arc head vertex index can be the edge target node identifier recorded in the arc node, used for reverse path location.

[0158] Among them, the same arc tail pointer can be a pointer in the arc node that points to the next edge of the same arc tail vertex (same starting node), forming a horizontal linked list.

[0159] Among them, the same arc head pointer can be a pointer in the arc node that points to the next edge of the same arc head vertex (same target node), forming a vertical linked list.

[0160] Please refer to Figure 4 For example, if the network topology includes topology nodes V0, V1, V2, and V3, and two attack paths P1 and P2, where P1 is V0→V1→V2 and P2 is V0→V3, after sorting according to the maximum sum of target weights, the resulting storage levels are: V0 at storage level 0, V1 at storage level 1, V2 at storage level 2, and V3 at storage level 3.

[0161] Furthermore, for each topological node in the storage level, a vertex table entry is created. Taking V0 as an example, its vertex table entry includes: node identifier: V0; outgoing edge head pointer: pointing to the first arc node of all arc nodes originating from V0; incoming edge head pointer: pointing to the first arc node of all arc nodes in V0.

[0162] Furthermore, for each attack path, arc nodes can be created for the connecting edges between adjacent nodes, and these arc nodes are linked in the order of the path. For example, for arc node 1 of attack path P1: it represents the connecting edge from V0 to V1, including: arc tail vertex index: 0 (V0); arc head vertex index: 1 (V1); same arc tail pointer: points to the next arc node with V0 as the arc tail (if any); same arc head pointer: points to the next arc node with V1 as the arc head (if any). For arc node 2 of attack path P1: it represents the connecting edge from V1 to V2, including: arc tail vertex index: 1 (V1); arc head vertex index: 2 (V2); same arc tail pointer: points to the next arc node with V1 as the arc tail (if any); same arc head pointer: points to the next arc node with V2 as the arc head (if any). In this way, as shown below, arc nodes can be generated. Figure 4 The connection of the arc nodes in the attack path P1 shown.

[0163] Furthermore, for arc node 3 in attack path P2, it can represent the connecting edge from V0 to V3, including: arc tail vertex index: 0 (V0); arc head vertex index: 3 (V3); same arc tail pointer: points to the next arc node with V0 as the arc tail (if any); same arc head pointer: points to the next arc node with V3 as the arc head (if any). In this way, it is possible to generate... Figure 4 The connection of the arc nodes in the attack path P2 shown.

[0164] Based on the chained storage data corresponding to all storage levels, graph storage data for the entire network topology is ultimately generated. In this way, each attack path is effectively organized and stored, facilitating rapid querying and analysis. Furthermore, since the multiple attack paths corresponding to each topology node are stored based on the sum of the maximum target weights for that topology node, it is possible to quickly and effectively locate frequently accessed and more important attack paths during subsequent searches and edits.

[0165] In some implementations, to address the real-time bottleneck of large-scale topology path queries in software-defined ranges, information such as the query topology node (e.g., the attack initiator) in the attack path query request can be parsed, and the data can be retrieved from high to low at each storage level in the graph storage data (heap top level priority). This ensures millisecond-level response for core attack paths frequently accessed by users, thereby avoiding global unordered traversal searches and effectively saving resources. For example, after step 106, the following may also be included:

[0166] (C.1) In response to an attack path query request, and based on the attack path analysis request, determine query information, wherein the query information includes at least one query topology node;

[0167] (C.2) Based on the query information, the query is performed sequentially at each storage level in the graph storage data in descending order to obtain the corresponding query results.

[0168] Among them, the attack path query request can be a search command initiated by the user for a specific attack behavior flow, which includes the range of topological nodes to be analyzed and path constraints.

[0169] The query information can be key retrieval parameters extracted from the query request, including at least one query topology node (such as attack initiation node 1) and path query attributes (such as path weight threshold), used to locate the attack path in the graph storage data. The content of the query information can be set according to the actual situation.

[0170] The query topology node can be a topology node specified in the query information, serving as the starting point for attack path retrieval.

[0171] The query results can be attack paths that match the query information requirements and are obtained from the graph storage data.

[0172] For example, in a software-defined testing environment, there is a network topology graph containing multiple topology nodes (V0, V1, V2, V3, etc.) and the connecting edges between these topology nodes, and the network topology graph has been stored as graph storage data. If a user sends an attack path query request, requesting to retrieve all attack paths starting from topology node V0.

[0173] If the attack paths corresponding to each topology node in the graph storage data are stored together with the sum of the maximum target weights of the relevant topology nodes, then storage level 0 contains V0 and its related attack paths; storage level 1 contains V1 and V3 and their related attack paths; and storage level 2 contains V2 and its related attack paths.

[0174] When the system receives a request to query all attack paths starting from node V0, it queries each storage level in the graph storage data sequentially, from highest to lowest priority, based on the query information, to obtain the corresponding query results. Since V0 is located in the highest priority level 0, it is queried here first. Assuming the query results show that V0 is directly connected to V1 and V3, V0 has been located. The next step is to locate all attack paths from V0 to the target node. At this point, a portion of these two attack paths is recorded: V0→V1 and V0→V3. Next, the query continues in the next lower storage level, 1. Considering that V1 and V3 both exist in level 1, we can query whether there are further connections between them. Assuming that V1 is found to be connected to V2, this path is completed: V0→V1→V2. Meanwhile, if V3 has no further connections, only V0→V3 is retained as a complete attack path.

[0175] Next, query the remaining possible attack paths in the lowest storage level 2. Since only V2 is in this level, and it has already been included in the previous path V0→V1→V2, no additional processing is required.

[0176] The above query method allows for the rapid location of the query topology node, specifically V0, and further queries to obtain all attack paths originating from V0: V0→V1→V2 and V0→V3. This ensures that the most relevant and important paths are accessed first, improving query efficiency and accuracy, while also making the entire query process more organized and easier to manage.

[0177] By using the above methods, we can prioritize accessing and analyzing high-level nodes that are most likely to contain critical attack paths, thereby quickly locating them. This not only improves query efficiency and accuracy but also optimizes resource utilization, ensuring that query tasks can be completed quickly and accurately even in complex network environments.

[0178] In some implementations, to quickly and accurately achieve dynamic incremental updates of attack paths in scenarios with newly added topology nodes, affected paths can be located by querying in descending order of storage level. New topology nodes are then incrementally added to generate new attack paths, and their weights are recalculated. Ultimately, only the storage level associated with the newly added topology nodes needs to be adjusted, avoiding global traversal or reconstruction of graph storage data and meeting the efficiency requirements for real-time topology editing in software-defined ranges. For example, after step 106, the following may also be included:

[0179] (D.1) When there is at least one new topology node, query each storage level in the network topology graph in descending order of query order to determine at least one first attack path to be adjusted corresponding to the new topology node.

[0180] (D.2) Add new topology nodes to the first attack path to be adjusted to obtain the first target attack path, and calculate the first weight sum of each first target attack path;

[0181] (D.3) Based on the first weight sum, redetermine the first maximum weight sum of the first topology node of each first target attack path, and based on the first maximum weight sum, determine the first storage level of the first topology node in the graph storage data;

[0182] (D.4) In the first storage level, update the attack path corresponding to the first topology node.

[0183] Among them, the newly added topology nodes can be simulated nodes that are dynamically added in the network topology graph. The weights of their associated attack paths need to be recalculated and storage levels need to be allocated.

[0184] The query order can be based on the storage hierarchy from high to low (top to bottom level) priority retrieval order to ensure that high-weight paths (such as the top path of the heap) are located first, and attack paths to be adjusted are quickly filtered.

[0185] The first attack path to be adjusted can be an attack path in the storage layer that is reachable from the newly added node. For example, the original attack path 1→2→3→5 needs to be expanded to 1→2→6→3→5 after adding node 6 at the corresponding position.

[0186] The first target attack path can be an updated attack path generated after inserting a new node into the first attack path to be adjusted, such as 1→2→6→3→5. Its weight needs to be recalculated to ensure that the first topology node is stored according to its weight.

[0187] The first weight sum can be the cumulative weight of all connected edges along the first target attack path.

[0188] The first topology node can be the topology node at the starting position of the first target attack path, such as node 1 in the attack path 1→2→6→3→5.

[0189] The first storage level can be a storage area priority that is redistributed based on the target maximum weight sum after the first topology node is updated (if the weight increases, it will be promoted from level 1 to level 0).

[0190] For example, in a software-defined range environment, there exists a network topology graph A, and a new topology node V4 is added to the network topology graph A.

[0191] Furthermore, based on V4 (the newly added topology node), the first attack path to be adjusted, containing V4, can be determined. For example, V4 can be inserted between the first attack path to be adjusted, V2→V5, to obtain the first target attack path V2→V4→V5. Then, with V4 as the first topology node, the first weight sum of the first target attack path corresponding to V4 is determined. If the first weight sum of V4→V5 is 8, since when V4 is the first topology node, only the first target attack path V4→V5 is included, the first maximum weight sum of V4 is 8, and the first storage level of V4 is determined based on the first maximum weight sum.

[0192] Furthermore, based on V4 as an intermediate topology node (not the first topology node), the first attack path to be adjusted, containing V4, can be located. For example, adjusting V1→V2→V5 yields the first target attack path V1→V2→V4→V5, and adjusting V2→V5 yields the first target attack path V2→V4→V5. To combine weights for sorted storage, the first weight sum of the first topology node in each first target attack path can be calculated, and the first maximum weight sum of that first topology node can be determined. Taking the first topology node V1 in V1→V2→V5 as an example, the weight sum of V1→V2→V5 is 10. If the original target maximum weight sum of V1 was 8, then the first maximum weight sum of V1 can be updated to 10, and the first storage level of V1 and all attack paths with V1 as the first topology node can be re-determined based on the first maximum weight sum.

[0193] Furthermore, in the existing graph storage data, the first storage level of V4 (the newly added topology node) can be determined according to the sum of the first maximum weights, and V4 and related attack paths can be stored. Similarly, based on the sum of the first maximum weights of the updated first topology node, the corresponding first storage level can be determined (if the storage level remains unchanged, no movement is needed), and the storage can be updated accordingly. Likewise, during the update process based on the first topology node, the graph storage data can be queried sequentially according to the weights from largest to smallest, prioritizing paths with higher access frequencies (e.g., V1 is stored at the top level, so V1 can be found first for editing and storage without global traversal), thereby improving editing efficiency.

[0194] By pre-sorting attack paths by weight and managing them hierarchically, during subsequent editing, only attack paths related to newly added topology nodes need to be edited, reducing unnecessary global scanning. At the same time, since the top of the heap stores the top-weighted (most frequently used) paths related to topology nodes, query and editing speeds can be greatly accelerated, ensuring the real-time performance and accuracy of editing.

[0195] In some implementations, to quickly and accurately achieve dynamic incremental updates of attack paths in node deletion scenarios, the associated paths of the node to be deleted can be located by querying in descending order of storage level. After deleting the node, the path weights are recalculated, and only the storage level of the affected nodes is adjusted. This avoids global traversal or reconstruction of graph storage data, meeting the efficiency requirements of real-time topology editing in software-defined ranges. For example, after step 106, it may also include:

[0196] (E.1) When there is at least one topology node to be deleted, query each storage level in the network topology graph in descending order of query order to determine at least one second attack path to be adjusted corresponding to the topology node to be deleted.

[0197] (E.2) Delete the topology nodes to be deleted in the second attack path to be adjusted to obtain the second target attack path, and calculate the second weight sum of each second target attack path;

[0198] (E.3) Based on the second weight sum, redetermine the second maximum weight sum of the first topology node of each second target attack path, and based on the second maximum weight sum, determine the second storage level of the first topology node in the graph storage data;

[0199] (E.4) In the second storage level, the attack path corresponding to the first topology node is updated.

[0200] Among them, the topology node to be deleted can be a simulation node that needs to be dynamically removed from the graph storage data. It is necessary to clear its associated topology path and delete the storage level where the topology node to be deleted is the first topology node.

[0201] The second attack path to be adjusted can be an attack path that contains a node to be deleted in the storage layer (e.g., the original attack path 1→2→3→5 requires the removal of node 3).

[0202] The second target attack path can be the attack path generated after deleting the topology node to be deleted in the second attack path to be adjusted (such as 1→2→5).

[0203] The second weight sum can be the cumulative weight of all connected edges in the second target attack path.

[0204] The second maximum weight sum can be the maximum path weight from the first topology node to the target node in the second target attack path, which is used to determine the storage level of the first topology node.

[0205] The second storage tier can be a storage area priority that is reallocated based on the second maximum weight sum.

[0206] In some implementations, if it is necessary to delete the topology node V4 in the graph storage data, the attack paths associated with V4 have been pre-determined as V1→V2→V4→V5 and V4→V5 (or can be determined later by querying the graph storage data). First, a hierarchical query is performed from high to low storage level. For example, in the top-level heap L0, the attack path with the highest weight can be queried, resulting in V1→V2→V4→V5. If this attack path is confirmed to contain V4, then V1→V2→V4→V5 is marked as the second attack path to be adjusted. Then, a query is performed in the second-level L1, resulting in the attack path V4→V5. If this attack path is confirmed to contain V4, then V4→V5 is marked as the second attack path to be adjusted. In this way, a full graph scan can be avoided, and the path that needs to be adjusted can be quickly found.

[0207] Furthermore, after deleting V4 from the second path to be adjusted, V1→V2→V4→V5 degenerates into V1→V2→V5, and the total weight of the second path is 8. After deleting V4 from V4→V5, the path becomes invalid, and this attack path is removed from the graph storage data.

[0208] Furthermore, based on the first topology node of each second target attack path, the second weight sum of the first topology node of each second attack path to be adjusted can be recalculated, and based on the second weight sum of at least one attack path corresponding to the first topology node, the second maximum weight sum of the first topology node can be determined to relocate the storage level of each first topology node. After determining the second storage level of each first topology node, the storage of each first topology node and its associated path can be updated.

[0209] By employing the above methods, a hierarchical and priority-driven approach is used to handle node deletion operations in the network topology. This allows for processing only the affected paths, avoiding full-graph scanning, significantly improving query efficiency, and enabling efficient maintenance and dynamic updates of attack paths. This structured, layered execution mechanism not only effectively reduces redundant computation and invalid paths but also ensures that attack path analysis results remain consistent with the current network state, enhancing the software-defined range's responsiveness, resource utilization efficiency, and overall system stability in the face of topology changes.

[0210] Please see Figure 5 This application also provides a graph storage device based on a network range, which can implement the above-described graph storage method based on a network range. The graph storage device based on a network range includes:

[0211] The acquisition module 51 is used to acquire the network topology map to be stored. The network topology map contains multiple topology nodes, and there is a connecting edge between any two topology nodes. The multiple topology nodes include at least one attack initiating node and at least one target node.

[0212] The reading module 52 is used to traverse and read at least one attack path formed by the connection edges between each topology node and the target node from the network topology graph.

[0213] The configuration module 53 is used to configure the target connection edge directly connected to the attack initiating node with a first weight, and configure the target connection edge directly connected to the target node with a first weight, and configure the other connection edges in the network topology graph except for the target connection edge with a second weight, so as to obtain the total weight of the attack path between each topology node and the target node, where the first weight is greater than the second weight.

[0214] The determination module 54 is used to determine the maximum total weight of the target from each topology node to the target node based on the total weight of the attack path from each topology node to the target node;

[0215] The sorting module 55 is used to sort multiple topology nodes in descending order of the target maximum weight sum, obtain the node sorting relationship, and determine the storage level of each topology node in the storage area based on the node sorting relationship.

[0216] Storage module 56 is used to perform chained storage of the attack paths associated with each topology node according to the storage level of each topology node in the storage area, so as to obtain the graph storage data corresponding to the network topology graph.

[0217] The specific implementation of this network-based graph storage device is basically the same as the specific embodiment of the network-based graph storage method described above, and will not be repeated here. While meeting the requirements of the embodiments of this application, the network-based graph storage device may also be equipped with other functional modules to implement the network-based graph storage method in the above embodiments.

[0218] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described graph storage method based on a network target range. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0219] Please see Figure 6 , Figure 6 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0220] The processor 61 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0221] The memory 62 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 62 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 62 and called and executed by the processor 61 using the graph storage method based on a network target range according to the embodiments of this application.

[0222] Input / output interface 63 is used to implement information input and output;

[0223] The communication interface 64 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0224] Bus 65 transmits information between various components of the device (e.g., processor 61, memory 62, input / output interface 63, and communication interface 64);

[0225] The processor 61, memory 62, input / output interface 63, and communication interface 64 are interconnected within the device via bus 65.

[0226] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described graph storage method based on a network target range.

[0227] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0228] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0229] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0230] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0231] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0232] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0233] It should be understood that in this application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0234] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0235] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0236] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0237] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0238] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A graph storage method based on a network target range, characterized in that, The method includes: Obtain a network topology graph to be stored. The network topology graph contains multiple topology nodes, and there is a connecting edge between any two topology nodes. The multiple topology nodes include at least one attack initiating node and at least one target node. From the network topology graph, traverse and read at least one attack path formed by the connection edges between each topology node and the target node; The target connection edge directly connected to the attack initiating node is assigned a first weight, and the target connection edge directly connected to the target node is assigned a first weight. The other connection edges in the network topology graph, excluding the target connection edge, are assigned a second weight. The total weight of the attack path from each topology node to the target node is obtained, where the first weight is greater than the second weight. Based on the sum of the weights of the attack paths from each topology node to the target node, determine the maximum total weight of the target path from each topology node to the target node; The multiple topology nodes are sorted in descending order of the sum of the maximum target weights to obtain the node sorting relationship, and the storage level of each topology node in the storage area is determined based on the node sorting relationship. According to the storage level of each topology node in the storage area, the attack paths associated with each topology node are stored in a chain to obtain the graph storage data corresponding to the network topology graph.

2. The graph storage method based on network target range according to claim 1, characterized in that, After obtaining the graph storage data corresponding to the network topology graph by chaining the attack paths associated with each topology node according to the storage level of each topology node in the storage area, the method further includes: In response to an attack path query request, and based on the attack path analysis request, query information is determined, wherein the query information includes at least one query topology node; Based on the query information, queries are performed sequentially at each storage level in the graph storage data, from high to low, to obtain the corresponding query results.

3. The graph storage method based on network ranges according to claim 1, characterized in that, After obtaining the graph storage data corresponding to the network topology graph by chaining the attack paths associated with each topology node according to the storage level of each topology node in the storage area, the method further includes: When there is at least one new topology node, queries are performed sequentially at each storage level in the network topology graph in descending order of query order to determine at least one first attack path to be adjusted corresponding to the new topology node. The newly added topology node is added to the first attack path to be adjusted to obtain the first target attack path, and the first weight sum of each first target attack path is calculated. Based on the first total weight, the first maximum total weight of the first topology node of each first target attack path is re-determined, and based on the first maximum total weight, the first storage level of the first topology node in the graph storage data is determined; In the first storage level, the attack path corresponding to the first topology node is updated.

4. The graph storage method based on network target range according to claim 1, characterized in that, After obtaining the graph storage data corresponding to the network topology graph by chaining the attack paths associated with each topology node according to the storage level of each topology node in the storage area, the method further includes: When there is at least one topology node to be deleted, queries are performed sequentially at each storage level in the network topology graph in descending order of query order to determine at least one second attack path to be adjusted corresponding to the topology node to be deleted. In the second attack path to be adjusted, the topology node to be deleted is deleted to obtain the second target attack path, and the second weight sum of each second target attack path is calculated; Based on the second weight sum, the second maximum weight sum of the first topology node of each second target attack path is re-determined, and based on the second maximum weight sum, the second storage level of the first topology node in the graph storage data is determined; In the second storage layer, the attack path corresponding to the first topology node is updated.

5. The graph storage method based on network ranges according to claim 1, characterized in that, Before configuring the first weight for the target connection edge directly connected to the attack initiating node, and before configuring the first weight for the target connection edge directly connected to the target node, the method further includes: For each network topology, obtain the first access frequency of the corresponding attack initiating node on all attack paths, and obtain the second access frequency of the target node on all attack paths. The first weight is obtained by weighted summation based on the first access frequency and the second access frequency. Obtain a preset weight ratio factor, and adjust the first weight based on the weight ratio factor to obtain the second weight.

6. The graph storage method based on network ranges according to claim 1, characterized in that, The method further includes: When there are at least two target topology nodes with the same maximum target weight, obtain the target attack path corresponding to the maximum target weight of each target topology node, and the last modification timestamp of each target attack path; Based on the order of the last modification timestamps, the target storage level of the at least two target topology nodes is determined from multiple storage levels.

7. The graph storage method based on network target range according to claim 1, characterized in that, The attack paths associated with each topology node are chained and stored according to the storage level of each topology node in the storage area to obtain the graph storage data corresponding to the network topology graph, including: In each storage level, a vertex table entry is created for each topology node in at least one attack path contained in each topology node, wherein the vertex table entry includes a node identifier, an outgoing edge head pointer and an incoming edge head pointer of each topology node; For the at least one attack path, arc nodes are created for the connecting edges between adjacent topological nodes, and each arc node is linked in the order of the path to obtain the chained storage data of the at least one attack path. The arc node includes an arc tail vertex index, an arc head vertex index, a pointer to the same arc tail, and a pointer to the same arc head. Based on multiple chained storage data corresponding to multiple storage levels, graph storage data corresponding to the network topology graph is generated.

8. A graph storage device based on a network range, characterized in that, The device includes: The acquisition module is used to acquire a network topology map to be stored. The network topology map contains multiple topology nodes, and there is a connecting edge between any two topology nodes. The multiple topology nodes include at least one attack initiation node and at least one target node. The reading module is used to traverse and read at least one attack path formed by the connection edges between each topology node and the target node from the network topology graph; The configuration module is used to configure a first weight for the target connection edge directly connected to the attack initiating node and the target connection edge directly connected to the target node, and configure a second weight for the other connection edges in the network topology graph except for the target connection edge, so as to obtain the sum of the weights of the attack paths from each topology node to the target node, wherein the first weight is greater than the second weight. The determination module is used to determine the maximum target weight sum from each topology node to the target node based on the total weight sum of the attack paths from each topology node to the target node; The sorting module is used to sort the multiple topology nodes in descending order according to the sum of the target maximum weights, obtain the node sorting relationship, and determine the storage level of each topology node in the storage area based on the node sorting relationship. The storage module is used to perform chained storage of the attack paths associated with each topology node according to the storage level of each topology node in the storage area, so as to obtain the graph storage data corresponding to the network topology graph.

9. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the graph storage method based on a network range as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the graph storage method based on the network target range as described in any one of claims 1 to 7.

Images