Network security event analysis method, system and equipment

Abstract

The invention belongs to the field of network security, particularly relates to a network security event analysis method, system and equipment, and aims to solve the problem that the existing network security event analysis and detection technology is poor in detection effect. Comprising the following steps: determining common data and suspicious data in a network security data set; constructing a multi-dimensional base line for the suspicious data, and generating a composite feature vector in combination with the feature vector of the common data; identifying an abnormal line in the composite feature vector as an abnormal event node; constructing an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node; determining an event type based on a node feature matrix of the event graph; and generating a network security event analysis result based on the event type, the abnormal score, the event occurrence time, the event occurrence position and the attack path. The network security event analysis method and the network security event analysis device have stronger generalization ability for novel attacks, and improve the accuracy of network security event analysis.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a network security incident analysis method, system, and device. Background Art

[0002] A network security incident refers to an event that damages the confidentiality, integrity, and availability of network systems, data, or services through technical means (such as attacks, intrusions, destruction, and leaks) or human operational errors. With the rapid development of network technology, network security issues are becoming increasingly serious. Accurate detection and analysis of network security incidents are necessary to ensure the security of network systems.

[0003] Current technologies for analyzing and detecting network security incidents include: based on the matching and comparison of network security incident data with attack databases, in-depth analysis of network security incidents, attack codes, host information, and even attack data composed of split and reorganized components, however, this analysis method uses a fixed threshold judgment mechanism, and the recognition rate of new attacks is low; or screening servers that need security protection based on the attack situation of the server, thereby reducing the number of servers that need security protection, and thus reducing the manpower and time costs of server security protection. However, only attack intervals are counted, and the correlation between attack types is ignored, resulting in a high false alarm rate.

[0004] In addition, existing network security incidents also have the problem of covert penetration attacks across vendor network supply chains. For example, in the industrial Internet, attackers implant backdoors through legitimate supplier VPN entrances (such as the remote maintenance channel of a PLC equipment manufacturer) and use legitimate credentials to complete lateral penetration attacks from device maintenance terminals → production control systems → ERP systems → core databases; the attacks are characterized by concealment.

[0005] Therefore, existing network security incident analysis methods have problems such as high false alarm rate and lack of dynamic adaptability, making it difficult to accurately analyze and process such network security incidents, resulting in the inability to effectively ensure the security of network systems. Summary of the Invention

[0006] In order to solve the above-mentioned problem in the prior art, namely, the problem that the existing network security incident analysis and detection technology has poor detection effect, the first aspect of this application proposes a network security incident analysis method, comprising: Obtain network security data sets from each target device within the network security monitoring scope and perform business logic compliance verification on the network security data sets to identify normal data that meets the verification criteria and suspicious data that does not meet the verification criteria; Construct a multi-dimensional baseline for suspicious data and generate a composite feature vector by combining the feature vectors of normal data; Based on the anomaly score obtained by anomaly detection on the composite feature vector, the abnormal rows in the composite feature vector are identified as abnormal event nodes; Construct an event graph based on the relationships between different target devices, the relationships between target devices and users, and the relationships between target devices and abnormal event nodes; Perform hierarchical information aggregation on the event graph to obtain a node feature matrix, where the node feature matrix is ​​used to determine the event type; Generate network security event analysis results based on event type, anomaly score, event occurrence time, event occurrence location, and attack path, where the attack path is determined by the path connected by the anomaly event nodes.

[0007] As a preferred implementation, a multi-dimensional baseline is constructed for suspicious data, and a composite feature vector is generated by combining the feature vectors of ordinary data, including: Obtain a multi-dimensional baseline based on the digital fingerprint of the target device where the suspicious data is located, the protocol entropy value of the protocol parsing data of the suspicious data, and the probability of initiating events between different target devices; Perform feature extraction on text data and numerical data in ordinary data to obtain a set of feature vectors; The multidimensional baseline is integrated into the feature vector set to generate a composite feature vector.

[0008] As a preferred embodiment, obtaining a multidimensional baseline includes: Obtaining a function code set extracted by performing protocol parsing on a network security data set, and determining a protocol entropy value based on a probability distribution of the function code set; Taking the probability of initiating an event between the first target device and the second target device as the element corresponding to the device pair, traverse all device pairs and construct a supply chain topology matrix, where the device pair consists of the first target device and the second target device, and the rows and columns of the supply chain topology matrix are the target device indexes; The multidimensional baseline consists of digital fingerprint, protocol entropy, and supply chain topology matrix.

[0009] As a preferred implementation, obtaining a feature vector set includes: For text data in the general data, extracting text features based on the frequency of occurrence of any term in any log record and the inverse document frequency of any term in the text data, wherein the text data includes multiple log records; For the numerical data in the common data, all numerical data are extracted to form the original feature matrix, and the numerical features are extracted by reducing the dimension of the original feature matrix; The feature vector set is composed of text features and numerical features.

[0010] As a preferred embodiment, identifying abnormal rows in the composite feature vector as abnormal event nodes includes: In the composite feature vector, randomly select sample subsets for recursive partitioning to construct an isolation forest; Perform anomaly detection on any row in the composite feature vector set based on the isolation forest and determine the anomaly score of any row; When the anomaly score of any row is greater than or equal to the anomaly threshold, an abnormal event node for any behavior is determined.

[0011] As a preferred implementation, constructing an event graph includes: Determine the device edge based on the communication relationship between target devices, determine the user device edge based on the user's access relationship to the target device, and determine the event device edge based on the target devices associated with the abnormal event; The target device is used as the device node, the user entity accessing the target device is used as the user node, and the abnormal event node is used as the event node. The event graph is constructed by combining the device edge, user-device edge, and event-device edge.

[0012] As a preferred embodiment, the method further includes: Based on the degree of association between any node and its neighboring nodes in the event graph, the attention weight of any node to its neighboring nodes is determined; Based on all the attention weights corresponding to any node, the feature of any node is enhanced to obtain the node feature matrix with enhanced key associations.

[0013] As a preferred embodiment, the node feature matrix is ​​used to determine the event type, including: Classify the node feature matrix to obtain a category probability vector, where any element in the category probability vector corresponds to the probability of an event type; Compare the numerical values ​​of each element in the category probability vector and determine the event type corresponding to the element with the largest probability as the event type.

[0014] The second aspect of this application provides a network security incident analysis system, comprising: The data verification module is used to obtain the network security data set of each target device within the network security monitoring range and perform business logic compliance verification on the network security data set to determine the normal data that meets the verification and the suspicious data that does not meet the verification; Feature extraction module, used to construct a multi-dimensional baseline for suspicious data and generate a composite feature vector by combining the feature vectors of normal data; An anomaly detection module is used to identify abnormal rows in the composite feature vector as abnormal event nodes based on the anomaly score obtained by performing anomaly detection on the composite feature vector; An event graph construction module is used to construct an event graph based on the relationship between different target devices, the relationship between target devices and users, and the relationship between target devices and abnormal event nodes; An event type determination module is used to perform hierarchical information aggregation on the event graph and obtain a node feature matrix, wherein the node feature matrix is ​​used to determine the event type; The event analysis result generation module is used to generate network security event analysis results based on event type, anomaly score, event occurrence time, event occurrence location, and attack path, where the attack path is determined by the path connected by the anomaly event nodes.

[0015] In a third aspect of the present application, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned method for analyzing network security events.

[0016] Beneficial effects of this application: (1) By determining the abnormal event nodes, performing initial anomaly detection on network security events, further constructing the event graph and determining the event type, the network security event analysis results can be gradually determined, and data features and correlations can be automatically learned without relying on manual rules for updating. It has stronger generalization capabilities for new attacks and reduces the false alarm rate.

[0017] (2) By constructing an event graph that includes users, devices, and events, it can effectively capture complex cross-entity and multi-stage associations, improving the limitation of traditional methods that can only detect isolated events, and further improving the accuracy of network security event analysis.

[0018] (3) By introducing a multi-dimensional baseline of suspicious data and combining it with the characteristic vectors of ordinary data, it can support multi-dimensional fusion verification and discover potential hidden dangers. Compared with traditional single indicator verification, it is more comprehensive and reliable, solves the problem of single indicator misjudgment, and further improves the accuracy of network security incident judgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 This is a flowchart of a network security incident analysis method provided by one embodiment of the present application; Figure 2 This is a system block diagram of a network security incident analysis system provided by one embodiment of the present application; Figure 3 It is a structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. DETAILED DESCRIPTION

[0020] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are intended only to illustrate the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0021] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] The present application provides a network security event analysis method, which obtains a network security data set of each target device within the network security monitoring range, and performs business logic compliance verification on the network security data set to determine normal data that meets the verification and suspicious data that does not meet the verification; constructs a multidimensional baseline for the suspicious data, and generates a composite feature vector in combination with the feature vector of the normal data; identifies abnormal rows in the composite feature vector based on anomaly scores obtained by anomaly detection on the composite feature vector, as abnormal event nodes; constructs an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node; performs hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is ​​used to determine the event type; generates a network security event analysis result based on the event type, anomaly score, event occurrence time, event occurrence location, and attack path, wherein the attack path is determined by the path connecting the abnormal event nodes, and can gradually determine the network security event analysis result, automatically learn data features and correlation relationships, without relying on manual rules for updating, has stronger generalization ability for new attacks, reduces false alarm rate, and improves the accuracy of network security event analysis.

[0023] In order to more clearly illustrate the network security incident analysis method of the present application, the following is combined with Figure 1 Each step in the embodiments of the present application is described in detail.

[0024] A network security incident analysis method according to the first embodiment of the present application includes steps S10 to S60, each of which is described in detail as follows: Step S10: obtaining a network security data set of each target device within the network security monitoring range, and performing business logic compliance verification on the network security data set to determine normal data that meets the verification requirements and suspicious data that does not meet the verification requirements.

[0025] Optionally, the network security monitoring scope covers the entire protected network, including all networked devices such as servers, routers, terminals, PLCs, human-machine interfaces (HMIs), etc. Any device can be a target device.

[0026] Optionally, the network security data set includes at least network traffic data, system logs, security device log data, device firmware data, and supply chain relationship data. Security device log data may include firewall logs, intrusion detection system logs, etc.; device firmware data may include PLC firmware binary files and HMI component features; and supply chain relationship data may include manufacturer device lists and maintenance permission mapping tables.

[0027] Optionally, network security data from multiple sources can be collected in real time through devices and agents deployed in the network and integrated to obtain a network security data set.

[0028] As an example, network traffic data can be obtained by capturing raw data packets through the switch mirror port or collecting traffic statistics through the NetFlow / sFlow protocol; Syslog collectors can be deployed on servers / terminals to collect operating system event logs in real time and obtain system log data; PLC firmware binary files and HMI interface component features can be collected through the device management interface (SNMP / API) to obtain device firmware data; vendor equipment lists and maintenance permission mapping tables can be synchronized through the CMDB database to obtain supply chain relationship data; firewall rule tables and device connection relationships can be collected through the SDN controller API to obtain network topology data; and cross-vendor device interaction event streams can be collected to build supply chain topology relationships.

[0029] Among them, Event=(t,src,dst,type), where t is the timestamp of the event; src is the event source device ID (such as the PLC device number); dst is the event target device ID (such as the SCADA system ID); type is the event type (such as data reading and writing, firmware update, permission change, etc.).

[0030] It should be noted that the timestamp in the embodiment of the present application can be accurate to milliseconds.

[0031] Through multi-source data fusion processing, it is possible to simultaneously process multi-source heterogeneous data such as network traffic data, system log data, and security device log data. Through data preprocessing and feature extraction, it can fully utilize the information of various types of data to improve the accuracy of event analysis. Combined with anomaly detection algorithms and association rule mining algorithms, it can not only detect known attack patterns, but also discover the correlation between potential abnormal behaviors and event characteristics, with strong dynamic adaptability. Through the security verification mechanism, the execution effect of the response strategy is verified to ensure that the network system can truly recover to a safe state, thereby improving the reliability and effectiveness of the system.

[0032] Furthermore, during the process of performing protocol parsing on the network security data set, business logic compliance verification is performed on the network security data set to determine normal data that meets the verification requirements and suspicious data that does not meet the verification requirements.

[0033] In protocol parsing, the message is decapsulated and the function code and data segment are extracted. For the network protocol data contained in the network security dataset, the state machine parsing method is used to define the protocol state set S={s0,s1,…,sz}, where s0 is the initial state and s1,…,sz are the intermediate states in the protocol interaction.

[0034] As an example, the protocol state set S={s0,s1,s3}, where s0 represents waiting for a request frame; s1 represents parsing a function code; s2 represents parsing an address code; and s3 represents CRC checking.

[0035] Furthermore, by continuously matching protocol fields (such as the source port and destination port in the TCP / IP protocol), binary protocol data is parsed into structured information. For example, for the Modbus protocol, fields such as function code and address code are parsed to form easy-to-process protocol data objects.

[0036] During the parsing process, business logic compliance verification is performed. This includes verifying that the function code matches the device type and that the data range complies with engineering constraints. For the Modbus protocol, this includes verifying that the function code and address code are within a reasonable range. If the state transition function fails to transition normally during the parsing process, or if data that does not conform to the protocol standard format is encountered, this is considered a protocol parsing anomaly.

[0037] In the embodiment of the present application, data with protocol parsing anomalies are marked as invalid data and removed, and valid data is retained. Among the valid data, data that meets the verification criteria are marked as normal data, and data that does not meet the verification criteria are marked as suspicious data.

[0038] It should be noted that suspicious data requires updating behavioral patterns by building a baseline, such as learning new device interaction patterns.

[0039] As another example, during the protocol parsing process, the protocol is double-verified, specifically including: basic protocol compliance verification and business logic compliance verification.

[0040] The basic protocol compliance verification includes the message length complying with the RFC standard, the function code being within the scope of the specification definition, and the CRC check being correct. It also checks whether the data fields are complete and comply with the specification based on the standard format and rules of the protocol.

[0041] For example, for the TCP / IP protocol, check whether key fields such as the source port and destination port exist and are in the correct format; if the verification does not meet the requirements, mark it as an attack, and perform business logic compliance verification after the verification meets the requirements.

[0042] In other embodiments, data preprocessing may be performed on the network security dataset, for example, noise filtering, protocol parsing, binary processing, and normalization processing may be performed on the network security dataset in sequence.

[0043] In the embodiment of this application, the original network security data set is recorded as D raw First, noise filtering is performed to remove noise from the data, such as duplicate records, malformed data, and redundant data irrelevant to cybersecurity incident analysis. Protocol decoding (such as Modbus decapsulation) is performed on the clean data stream for protocol parsing. Specialized processing is performed on the firmware / binary segment after protocol parsing. Finally, numerical features are normalized.

[0044] The noise data is determined by identifying the preset noise feature rules, such as repeated invalid logs, malformed data, etc. The noise data is identified and removed according to the preset noise feature rules to obtain a denoised data set.

[0045] During binary processing, hash calculations are performed on the firmware file blocks. A sliding window algorithm is used to extract features from the firmware binary data within the structured information after protocol parsing. Assuming the window size is w and the step size is s, subsequence features are extracted from the binary data sequence using a window of the preset size to form a feature set. The extracted binary features are aligned, and any portions less than the length w are padded with padding values ​​(e.g., 0).

[0046] Normalization converts numerical data of different formats and ranges into a unified numerical range to facilitate subsequent feature extraction and analysis, and improve the accuracy and efficiency of the algorithm.

[0047] As an example, for numerical data, normalization is performed using a normalization formula, such as Normalize, where x' is the normalized numerical data,x It is the original numeric data, which comes from the numeric field in the feature collection. x min is the minimum value of the numerical data in the data set. x max is the maximum value of the numerical data in the data set. x min and x max All of them are obtained by counting all the data in this field.

[0048] The normalized values x' Replace the original numerical data corresponding to the denoised dataset after noise filtering x , and obtain the final preprocessed data set.

[0049] Step S20: construct a multi-dimensional baseline for the suspicious data and generate a composite feature vector by combining the feature vectors of the normal data.

[0050] Optionally, a multi-dimensional baseline is constructed for suspicious data, feature vectors are extracted for ordinary data, and the multi-dimensional baseline and feature vectors are combined to generate a composite feature vector to perform multi-dimensional fusion verification of network security incidents.

[0051] In an embodiment of the present application, a multidimensional baseline is obtained based on the digital fingerprint of the target device where the suspicious data is located, the protocol entropy value of the protocol parsed data of the suspicious data, and the probability of initiating events between different target devices.

[0052] The digital fingerprint of the target device is constructed by pre-processing the firmware binary and HMI features obtained from the target device.

[0053] As an example, the firmware binary is PLC_firmware.bin (block data after preprocessing); HMI features are represented by feature vectors, which can be [control type, binding protocol, open port] (preprocessing extraction).

[0054] Furthermore, the 128-bit hash value G is generated by the following formula device : Among them, F firm Indicates the firmware binary file, F HMI Represents the HMI feature vector, ConvID(F firm ) feat represents the one-dimensional convolutional neural network to extract firmware features, PCA(F HMI ) reduced It represents the principal component analysis dimensionality reduction to extract HMI features, Indicates binary concatenation, which concatenates the firmware features with the HMI features. SHA256() indicates SHA256 hash encryption of the concatenated feature vector.

[0055] It should be noted that the digital fingerprint G device It is the unique digital fingerprint of the target device, ensuring uniqueness and tamper resistance.

[0056] By fusion hashing the firmware code convolution features and HMI configuration, the digital fingerprint of the target device is constructed. This can generate a genetic map of each target device and construct an unforgeable device DNA, solving the problem of covert detection of firmware tampering in industrial control equipment.

[0057] Furthermore, a function code set extracted by performing protocol parsing on the network security data set is obtained, and a protocol entropy value is determined based on the probability distribution of the function codes.

[0058] Optionally, the probability distribution of the function code set can be obtained by calculating the usage probability of each function code. Taking function code c as an example, the ratio of the number of occurrences of function code c to the total number of occurrences of each function code in the function code set is calculated as the usage probability p(c) of function code c.

[0059] As an example, the protocol entropy value E can be determined based on the probability distribution of the function code by the following formula: baseline : In some embodiments, the protocol entropy value may be dynamically updated, and the updated protocol entropy value may be used to construct a multi-dimensional baseline.

[0060] Optionally, a normal traffic entropy value is obtained through monitoring; and a weighted sum of the protocol entropy value and the normal traffic entropy value is performed to obtain an updated protocol entropy value.

[0061] As an example, the protocol entropy value can be updated using the following formula: Among them, E NEW represents the updated protocol entropy value, α represents the historical weight, E normal Indicates the normal traffic entropy value.

[0062] Through entropy analysis based on protocol function codes, abnormal operations within standard protocols (such as excessive data transmission when reading Modbus registers) can be accurately identified, making up for the shortcomings of traditional anomaly detection in protocol content analysis.

[0063] Furthermore, the probability of initiating an event between the first target device and the second target device is used as the element corresponding to the device pair, and all device pairs are traversed to construct a supply chain topology matrix, where the device pair consists of the first target device and the second target device, and the rows and columns of the supply chain topology matrix are the target device indexes.

[0064] Optionally, the probability of initiating an event between the first target device and the second target device is determined based on the ratio between the number of interaction events between the first target device and the second target device and the number of all interaction events in which the first target device participates.

[0065] Taking the i-th target device and the j-th target device as an example, i is the target device index of the first target device, j is the target device index of the second target device, then the probability M of initiating an event between the first target device and the second target device is SUPPLY [i,j] can be calculated by the following formula: Among them, M SUPPLY [i,j] represents the probability that the i-th target device initiates an event to the j-th target device, event(i→j) represents the number of events from the i-th target device to the j-th target device, and total(i) represents the total number of events in which the i-th target device participates.

[0066] It should be noted that the target device index is the device ID, the source is the device asset list, and the initiating event can be sending data, triggering collaboration, etc.

[0067] It is understandable that the probability M SUPPLY [i,j] can represent the timing dependency strength between the i-th target device and the j-th target device, and its value range is [0,1]. If M SUPPLY [i,j]>M1, indicating that the i-th target device is strongly associated with the j-th target device, such as the real-time data interaction between PLC and SCADA; if M2<M SUPPLY [i,j]<M3, indicating that the i-th target device is moderately associated with the j-th target device, such as periodic calibration between devices; if M SUPPLY [i,j]<M4, indicating that the i-th target device is weakly associated with the j-th target device, for example, cross-region devices occasionally communicate.

[0068] Among them, M1, M2, M3, and M4 are all preset thresholds used to segment the degree of timing dependency strength, and M1>M3>M2>M4. As an example, M1 can be 0.8, M3 can be 0.7, M2 can be 0.3, and M4 can be 0.1.

[0069] Any two target devices form a device pair, with the target device index as the row and column of the matrix, and the probability M corresponding to the device pair SUPPLY [i,j] is used as the element at position (i,j) to generate the supply chain topology matrix.

[0070] It should be noted that the supply chain topology matrix may be a static matrix or a dynamic matrix. In the dynamic matrix, as scenarios such as equipment failure or new equipment access change, the values ​​of each element in the supply chain topology matrix may change in real time.

[0071] In the embodiment of the present application, for a static matrix, a fixed connection is made based on the physical topology of the equipment, such as the hard wiring between the PLC and the HMI in a factory.

[0072] For a dynamic matrix, if a device fails, a detour will be automatically taken. For example, when the jth target device fails, the i-th target device can bypass the failed j-th target device by temporarily increasing the probability between it and other target devices. For example, the probability M between the i-th target device and the r-th target device can be increased. SUPPLY [i,r] temporarily increases by 30%. To achieve load balancing, AGV paths can be dynamically adjusted, for example, by assigning tasks based on probability ranking. When new devices are added, the supply chain topology matrix dimensions are automatically expanded. For example, if the original supply chain topology matrix size is 100×100, when the new target device index is 101, the matrix dimensions are expanded to 101×101.

[0073] By introducing the supply chain topology matrix, we can quantify the interaction weights of devices across vendors, effectively detect low-frequency but dangerous lateral movement attacks (such as infiltrating the core database through the vendor VPN), and solve the problem of traditional correlation analysis missing cross-domain attacks.

[0074] Furthermore, the digital fingerprint, protocol entropy, and supply chain topology matrix form a multidimensional baseline Baseline={G device , E baseline , M supply}.

[0075] In some embodiments, the constructed multidimensional baseline is verified to determine whether the construction of the multidimensional baseline is complete.

[0076] As an example, to verify the coverage of a multidimensional baseline, if the device gene coverage is ≥98% (all connected devices); the protocol type coverage is 100% (all detection protocols); and the device path coverage is ≥95% (for interacting device pairs), then the coverage verification passes.

[0077] As another example, to verify the stability of the multidimensional baseline, if the entropy fluctuation for 24 consecutive hours is <0.1 and the topological matrix change rate is <0.05, the stability verification is passed.

[0078] In the embodiment of the present application, for ordinary data, different feature extraction methods can be used to extract key features, and feature extraction is performed on text data and numerical data in the ordinary data respectively to obtain a set of feature vectors.

[0079] For text data in general data, text features are extracted based on the occurrence frequency of any term in any log record and the inverse document frequency of any term in the text data, wherein the text data includes multiple log records.

[0080] As an example, text data D includes multiple log records d, and log record d includes multiple terms t. The frequency of occurrence of term t in log record d is calculated as the ratio of the number of times term t appears in log record d to the total number of words in log record d, which is the frequency of occurrence tf(t,d) of term t in log record d.

[0081] Inverse document frequency is used to count the importance of terms in a document collection. The lower the frequency of a term in a document collection, the stronger its ability to distinguish documents and the higher its importance, thereby quantifying the scarcity of the term in the document collection.

[0082] The inverse document frequency idf(t,D) can be obtained by the following formula: Where |D| represents the total number of log records in the text data D, and |{d∈D:t∈d}| represents the number of log records containing the term t.

[0083] In the embodiment of the present application, any log record is a document, and the text data including multiple log records is a document set of all log records. The importance of a term in the entire text data can be determined by calculating the inverse document frequency.

[0084] By calculating the product of the occurrence frequency tf(t,d) and the inverse document frequency idf(t,D) of the term t, tf-idf(t,d,D) is obtained to obtain the importance of the term t, which is used for text feature extraction. The higher the tf-idf(t,d,D), the more significant the effect of the term on anomaly detection.

[0085] It should be noted that the occurrence frequency tf(t,d) represents the importance of the term t in the log record d, highlighting the local importance of the term t. The inverse document frequency idf(t,D) represents the global importance of the term t in the text data, improving the global differentiation ability. By multiplying the two, the local high-frequency and global scarce features are integrated, which can accurately represent the identification ability of the term t in the text data. By extracting key text features through importance, it can highlight keywords that are meaningful for network security incident analysis.

[0086] For the numerical data in the common data, all the numerical data are extracted to form the original feature matrix, and the numerical features are extracted by reducing the dimension of the original feature matrix.

[0087] Optionally, principal component analysis can be used for dimensionality reduction to remove redundant features, retain the main features, reduce the data dimension, and improve the operating efficiency of subsequent analysis algorithms.

[0088] As an example, the original feature matrix X composed of all numerical data is extracted as an n×p matrix. There are n samples and p numerical features. Each row represents a sample and each column represents a feature. X can be expressed as follows: By formula The covariance matrix C can be calculated to describe the correlation between features, where X T is the transposed matrix of X. Furthermore, the covariance matrix is ​​eigendecomposed, and multiple eigenvalues ​​and corresponding orthogonal eigenvectors are obtained according to the characteristic equation. The orthogonal eigenvectors are arranged according to the size of the corresponding eigenvalues ​​to form an eigenvector matrix. The column vectors of the eigenvector matrix are orthogonal principal component directions, corresponding to the direction with the largest data variance.

[0089] After determining the direction of the principal component, the eigenvectors corresponding to the first K largest eigenvalues ​​are selected to form the principal component matrix, where the ratio of the product of the first K largest eigenvalues ​​to the product of all eigenvalues ​​needs to be greater than 85%, that is, the matrix after dimensionality reduction needs to retain the principal component of 85% of the variance.

[0090] The original feature matrix X is an n×p matrix, and through dimensionality reduction, it is obtained as an n×K matrix Y, where K < p. Each row of the matrix Y is the coordinate of the original feature matrix X in the K-dimensional principal component space.

[0091] Furthermore, the feature vector set F composed of text features and numerical features can be expressed as , where tf-idf(d1), tf-idf(d m ) represents each text feature, m represents the number of log records in the text data, Y1, Y nRepresents each numerical feature, and n represents the number of samples in the numerical data.

[0092] Furthermore, the multidimensional baseline is integrated into the feature vector set to generate a composite feature vector .

[0093] Step S30 : Based on the anomaly score obtained by performing anomaly detection on the composite feature vector, an abnormal row in the composite feature vector is identified as an abnormal event node.

[0094] Alternatively, outliers in data are often "few but distinct" and therefore easier to isolate quickly (short paths) in a randomly split data space, whereas normal points, due to their dense distribution, require more splitting steps (long paths). Therefore, the degree of data anomaly can be quantified by measuring path length using Isolation Forest.

[0095] In an embodiment of the present application, a sample subset is randomly selected from a composite feature vector for recursive partitioning to construct an isolation forest; an anomaly detection is performed on any row in the composite feature vector set based on the isolation forest to determine the anomaly score of any row; and when the anomaly score of any row is greater than or equal to the anomaly threshold, any behavioral abnormal event node is determined.

[0096] The isolation forest construction method involves randomly extracting samples from the composite feature vector F' as a sample subset. The number of samples sampled is typically much smaller than the size of the original dataset, and the number of samples sampled each time is fixed. The sample subset is recursively partitioned. During each partition, a feature is randomly selected, and a partition point is randomly selected within the feature's value range. The sample subset is then divided into two parts, which serve as the left and right subtrees of the node, respectively. This process is repeated until each leaf node contains only one sample or the tree reaches a predetermined maximum depth. The random sampling and recursive partitioning steps are repeated to construct multiple isolation trees, which together form the isolation forest. Each tree is based on a different random sampling and partitioning method, ensuring the diversity and stability of the model.

[0097] Furthermore, a row in the composite feature vector F' is extracted as the sample feature vector f, and the corresponding isolation forest score s(f) is calculated for each sample feature vector f. By calculating s(f), the degree of abnormality of each sample can be quantified, and device gene abnormalities and protocol entropy mutation events can be identified, thereby performing preliminary screening and judgment of network security incidents.

[0098] Among them, the calculation method of the isolation forest score is an existing technology and will not be repeated in the embodiments of this application.

[0099] It should be noted that when the Isolation Forest score s(f) is close to 1, it indicates that the path length of the sample feature vector f is extremely short, and it is very easy to be isolated in the Isolation Forest. This sample is very likely to be an abnormal sample, which means that a network security event may have occurred. At this time, this sample can be marked as highly suspicious and an abnormal sample, and a further detailed analysis process can be triggered. For example, combined with the association rule mining algorithm, analyze the association relationship between this abnormal sample and other samples to determine whether there is an attack chain or other related security threats, and at the same time send a high-priority alert to the security management personnel. When s(f) is close to 0, it means that the path length of the sample feature vector f is relatively long, similar to the distribution of normal samples in the Isolation Forest. This sample is most likely a normal sample, that is, the current network state is normal, and conventional data collection and monitoring can continue to be maintained. When s(f) is at an intermediate value, it means that the degree of abnormality of the sample feature vector f is uncertain. This sample can be marked as moderately suspicious, and continuous data collection and monitoring can continue. At the same time, more dimensions of data and analysis methods can be combined, such as checking the change trend of the network traffic corresponding to this sample, relevant records in the system log, etc., to further determine whether this sample is a real abnormal sample.

[0100] Furthermore, an anomaly threshold T0 is set according to the actual network environment and security requirements. When s(f)≥T0, it is determined that the sample feature vector f is an abnormal sample, that is, a possible network security event is detected; when s(f)<T0, it is determined that the sample feature vector f is a normal sample.

[0101] In this way, potential abnormal situations can be quickly screened out from a large amount of network security data, achieving the purpose of anomaly detection.

[0102] It should be noted that the anomaly threshold T0 can be adjusted according to the actual situation.

[0103] The identified abnormal sample feature vector, that is, the abnormal row, is marked as an abnormal event node for abnormal event analysis.

[0104] In some embodiments, abnormal event nodes can also be identified by methods such as digital fingerprints and protocol entropy value mutations.

[0105] As an example, the digital fingerprint G of the target device is calculated in real time device , and compared with the vendor benchmark library. When the digital fingerprint G device is not in the benchmark library, it is determined that there is a genetic abnormality in the target device, and security problems such as firmware tampering may have occurred. When calculating the anomaly score s(f) by the Isolation Forest algorithm, the path length of the corresponding sample will be significantly shortened, resulting in the anomaly score s(f) approaching 1, thus being identified as an abnormal event node.

[0106] As another example, for Modbus / TCP protocol message streams, the protocol entropy value E is calculated in real time. baseline To evaluate the stability of the protocol behavior, when E baseline When a dramatic change occurs, the difference between the real-time entropy value and the baseline entropy value is too large, indicating a protocol entropy mutation event, which may indicate a security threat such as a protocol spoofing attack. Similarly, this anomaly will be reflected in the isolation forest algorithm as an increase in the anomaly score s(f), and then identified as an abnormal event node.

[0107] Step S40: construct an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node.

[0108] Optionally, an event graph is used to describe events and their relationships, with nodes representing events and edges representing logical relationships (such as temporal relationships, causal relationships, and conditional relationships). It can analyze the structure and evolution of complex event sequences.

[0109] In an embodiment of the present application, the device edge is determined based on the communication relationship between target devices, the user device edge is determined based on the user's access relationship to the target device, and the event device edge is determined based on the target device associated with the abnormal event.

[0110] Specifically, based on the communication relationship of network traffic between different target devices, a device edge is constructed, and the weight is the communication frequency between two target devices per unit time. Taking the i-th target device and the j-th target device as an example, the device edge ,in, Represents the device node consisting of the i-th target device, Represents the device node consisting of the jth target device, w ij Represents the weight of the device edge between the i-th target device and the j-th target device. By reading the user's login log to determine the user's access relationship to the target device, a user-device edge is constructed with the weight being the access duration. Taking the i-th target device and the u-th user as an example, the user-device edge is recorded as ,in, represents the user node composed of the u-th user entity, t ui Represents the weight of the user-device edge between the i-th target device and the u-th user entity. By determining the target device associated with the abnormal event, the event-device edge is constructed. Taking the i-th target device and the e-th abnormal event node as an example, the event-device edge is recorded as ,in, Represents the e-th abnormal event node. The event device edge is an undirected edge and has no corresponding weight.

[0111] Furthermore, the target device is used as the device node, the user entity accessing the target device is used as the user node, and the abnormal event node is used as the event node. The device edge, user device edge and event device edge are combined to construct an event graph.

[0112] Among them, the device node V device The attributes of the user node V include IP address, device type, operating system, open ports, etc. user The attributes of event node V include user ID, access rights, historical behavior characteristics, etc. event The attributes include event type, timestamp, feature vector, etc.

[0113] As an example, the event graph can be represented as: in, , .

[0114] Step S50: performing hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is ​​used to determine the event type.

[0115] Optionally, the node feature matrix is ​​a matrix used to describe the attributes and features of each node in the event graph, and is usually composed of features in multiple dimensions, such as node attributes, connection relationships between nodes, and text information of nodes.

[0116] For the event graph G, its node feature matrix B∈R ((V1+V2+V3)×q) , where V1 represents the number of device nodes, V2 represents the number of user nodes, and V3 represents the number of event nodes. V1+V2+V3 represents the total number of nodes in the event graph G. q is the initial feature dimension, representing the number of node attributes. It is obtained by concatenating device features, user features, and time features. For example, device features: IP (3D) + device type (one-hot, 5D), the output is 8-dimensional; user features: permission level (1D) + activity (1D), the output is 2-dimensional; event features: s(f) (1D) + timestamp (1D), the output is 2-dimensional; then q = 8 + 2 + 2 = 12.

[0117] In an embodiment of the present application, the event graph is hierarchically aggregated using a convolution formula to output a node feature matrix.

[0118] Specifically, the initial node feature matrix is ​​expressed as: , further obtain the adjacency matrix and weight matrix of the initial node feature matrix; transform the initial node feature matrix based on the adjacency matrix and weight matrix to obtain the node feature matrix H of the first layer (1) , further based on the node feature matrix H (1)The adjacency matrix and weight matrix of H (1) Transform to obtain the node feature matrix H of the second layer (2) , until the node feature matrix of the Lth layer is obtained .

[0119] Among them, the transformation of the node feature matrix can be achieved through the convolution formula: in, Indicates the +1 layer node feature matrix, Indicates the Layer node feature matrix, σ represents the ReLU activation function, represents the normalized adjacency matrix, Indicates the Layer trainable weight matrix.

[0120] It should be noted that The model is learned through the back propagation algorithm during the training phase. During the training process, the model calculates the error between the predicted result and the true label based on the loss function (such as cross entropy loss), and then uses the gradient descent algorithm to iteratively update The value of , enables it to automatically learn the mapping relationship between node features and structures in graph data.

[0121] In some embodiments, the event features include an abnormality score s(f), whose conduction path in the convolution is: initial feature: ; First convolution layer: ; Second convolution layer: ;...;Final Features: .

[0122] After layered information aggregation through the convolution formula, the node feature matrix of the fused neighborhood information is output The anomaly score s(f) is calculated by the weight matrix Affects all subsequent feature representations.

[0123] In some preferred embodiments, the output node feature matrix is ​​subjected to key relationship enhancement to obtain a key relationship enhanced node feature matrix H'.

[0124] Optionally, based on the degree of association between any node and its neighboring nodes in the event graph, the attention weight of any node to its neighboring nodes is determined; based on all attention weights corresponding to any node, the features of any node are enhanced to obtain a node feature matrix with enhanced key associations.

[0125] It can be understood that the higher the value of the attention weight between two nodes, the stronger the correlation between the two in network security incident analysis. The attention weight between any node and its neighboring node can be calculated to quantify the degree of correlation between the nodes.

[0126] Taking the i-th node as an example, the j-th node is the neighbor node of the i-th node. The attention weight between the i-th node and the j-th node can be calculated by the following formula: : Among them, exp() represents the exponential function with the natural constant e as the base, represents the feature vector of the i-th node, represents the feature vector of the jth node, represents the feature vector of the kth node, W represents the trainable weight matrix, Represents the set of neighbor nodes of the i-th node.

[0127] In the embodiment of the present application, the weight matrix W is used to map the feature vector to a higher-dimensional space to enhance the feature expression capability.

[0128] Furthermore, the calculated Weighted aggregation operation is used to achieve feature enhancement.

[0129] As an example, the updated features can be determined by the following formula: in, Represents the feature vector of the i-th node The updated feature vector of Represents the attention weight of the i-th node to the j-th node, and the j-th node belongs to the set of neighbor nodes of the i-th node , σ represents the ReLU activation function.

[0130] The neighbor node features are weighted and fused according to their importance. Through multi-layer stacking, the high-order correlations between devices, users and events are gradually captured, and the node feature matrix H' composed of updated feature vectors with enhanced key correlations is output.

[0131] Furthermore, the node feature matrix is ​​classified to obtain a category probability vector, where any element in the category probability vector corresponds to the probability of an event type; the numerical values ​​of the elements in the category probability vector are compared, and the event type corresponding to the element with the largest probability is determined as the event type.

[0132] The node feature matrix H or the node feature matrix H' with enhanced key associations is input into a fully connected layer or a classifier (such as the Softmax function) to obtain a category probability vector.

[0133] As an example, the node feature matrix H' that enhances key associations is input into the Softmax function, using the formula: Calculate the category probability vector y event .

[0134] Among them, W class is the classification weight matrix, which is used to map node features to the corresponding category space and learn the optimal parameters for category distinction through training.

[0135] Furthermore, the maximum probability principle is used to determine the event type for the category probability vector: event Each element in corresponds to the probability of an event type. By comparing the numerical values ​​of each element, the event type corresponding to the element with the largest probability value is selected as the final judgment result. For example, if y event If the probability value of the intrusion event is the largest, the current event is determined to be an intrusion event. event The role of is to quantify the possibility of nodes belonging to different event categories and ultimately determine the event type, thereby achieving automated event classification and risk identification.

[0136] In some embodiments, after an abnormal event node is identified, an association rule mining algorithm may be used to identify the event type.

[0137] As an example, after detecting an anomalous sample using s(f), the system uses the Apriori algorithm (an association rule mining algorithm) to further analyze the associations between the anomalous sample's features and other features. When analyzing feature associations, the association rule mining algorithm mines association rules between features. Setting the minimum support threshold as min_sup and the minimum confidence threshold as min_conf, the algorithm generates frequent item sets and association rules to determine the associations between event features. min_sup and min_conf are user-defined based on actual needs.

[0138] For example, if an abnormal sample contains specific network attack characteristics (such as specific port scanning patterns, malware communication characteristics, etc.), and these characteristics match the preset event type rules, the system can determine the event type. At the same time, the system combines other information, such as the time and location of the event, the devices involved, and the users, to comprehensively determine the event type. For example, if a specific port on multiple servers receives a large number of access requests from the same IP address segment simultaneously within a short period of time, and the characteristics of these access requests match those of a denial of service (DDoS) attack, the system will classify the event as a DDoS attack.

[0139] Step S60: Generate a network security event analysis result based on the event type, anomaly score, event occurrence time, event occurrence location, and attack path, wherein the attack path is determined by the path connected by the anomaly event nodes.

[0140] Optionally, the event type is determined based on the event analysis results; the anomaly score reflects the severity of the event.

[0141] Optionally, you can extract the event time field from the log data. For cross-device events (such as distributed attacks), synchronize the time of each device through the Network Time Protocol (NTP) to ensure timestamp consistency and determine the time when the event occurred.

[0142] Optionally, the location of the event includes the device location and the user location. The IP address is mapped to a geographic location (country / region, city) through an IP geolocation database (such as MaxMind), and the physical location of the device (such as the data center floor, cabinet number) is obtained from the asset database to determine the device location. The IP address of the user at login is parsed. If the user uses a mobile device, the user's location is determined in combination with GPS or base station positioning data.

[0143] Optionally, via attention weights Extract high-weight paths connected to event nodes and determine them as attack paths.

[0144] The embodiment of the present application realizes the propagation and aggregation of information on the graph structure by operating the node feature matrix and the adjacency matrix, so that each node can fuse the feature information of its neighboring nodes, thereby learning a more expressive feature representation, laying the foundation for the accurate classification of subsequent event nodes. During the layered convolution operation, each convolution operation transforms the node features through the weight matrix, and realizes the information transfer between nodes in combination with the adjacency matrix, and gradually extracts high-order graph structure features through multi-layer convolution. Through multi-layer convolution operations, not only can the local neighborhood features of the nodes be effectively extracted, but also the information can be gradually propagated in the graph structure, and the potential complex correlation relationships between nodes can be excavated, providing a more comprehensive and more representative feature basis for the subsequent complex event recognition based on correlation analysis.

[0145] In some embodiments, after determining the event analysis result, a corresponding response strategy may be matched according to a set response rule library.

[0146] Optionally, response strategies include isolating the attack source, blocking network connections, recording event logs, sending alert notifications, and providing baseline guidance.

[0147] It is understandable that the response rule library pre-defines the corresponding processing measures for different event types and severities. By matching the event analysis results, the corresponding response strategy is selected. For example, for serious intrusion incidents, the strategy of isolating the attack source and blocking the network connection is triggered; for general abnormal events, the event log is recorded and an alarm notification is sent.

[0148] As an example, the baseline guidance policy can be: for device gene tampering, the response action is: isolate the device and restore the baseline firmware; for protocol entropy mutation, the response action is: block abnormal sessions and reset the protocol stack configuration; for supply chain path anomalies, the response action is: disconnect high-risk paths and enhance path auditing.

[0149] Furthermore, the response strategy execution results and post-execution network status data are collected and compared with the pre-execution network status data to determine the effectiveness of the response strategy and implement security verification. If the security verification passes, the response strategy is effective, the network system is restored to a secure state, and the process ends. If the verification fails, feedback information is generated, returning to the event analysis step or the response decision step to readjust the analysis and decision-making process.

[0150] Optionally, after collecting network status data, calculate the indicator values ​​of each dimension, and construct a feature vector through the indicator values ​​of each dimension as a basis for verification. The network status data includes network topology diagram, user behavior sequence, traffic anomaly indicator, log correlation and system performance indicator.

[0151] As an example, security verification can be performed through the following process: Collect network status data before and after the policy response, including network topology (adjacency matrix A), user behavior sequence (x t ), traffic anomaly indicators, log correlation and system performance indicators.

[0152] The network topology map collection method includes: Active detection: Use ICMP / TCP protocol scanning (such as Nmap); Protocol parsing: Parse LLDP (Link Layer Discovery Protocol) and CDP (Cisco Discovery Protocol) to obtain device connection relationships; Controller integration: The SDN controller (OpenDaylight / ONOS) provides a full network topology view, and the API interface returns the topology in JSON format.

[0153] After collection, the adjacency matrix A is output.

[0154] Furthermore, the index values ​​of each dimension are calculated to construct the feature vector .

[0155] By formula: Calculate the topological difference of the adjacency matrix difference of the network connection graph before and after the response , A larger value indicates a more significant change in network connectivity. is the network adjacency matrix before response; is the network adjacency matrix after response; N is the number of network device nodes.

[0156] By formula: Calculate user behavior anomaly score s user , where T is the length of the sliding window; x t Real-time behavioral characteristics (such as login time and access frequency); Normal behavior features predicted by the LSTM model.

[0157] Traffic anomaly indicators include traffic anomaly entropy and connection number fluctuation. The traffic anomaly entropy is calculated based on data packets collected in real time by network traffic probes (such as Bro / Zeek and Wireshark) and the traffic proportions of various protocols (such as HTTP and DNS). A higher entropy indicates more complex traffic and a higher likelihood of anomalies.

[0158] Furthermore, through the formula: Calculate the connection number volatility.

[0159] For log relevance, the frequent item sets in the log are mined based on the Apriori algorithm. The ratio of the number of matched frequent rules to the total number of detection rules is used as the relevance, and the matching rate between the real-time log and the historical frequent rules, i.e., the log relevance, is calculated.

[0160] For system performance indicators, use device monitoring interfaces (such as Prometheus and Zabbix) to collect CPU usage, memory usage, disk I / O, etc. to determine whether system performance is abnormal. Taking CPU as an example, the formula is: Calculate the CPU utilization. If it exceeds 80% for 5 minutes, it is considered a performance abnormality.

[0161] Constructed feature vector Expressed as: .

[0162] Furthermore, a weighted support vector machine (WSVM) model is input and a verification result is output, where the verification result is either passed or failed.

[0163] As an example, WSVM is used to integrate multi-dimensional indicators through the formula: calculate .

[0164] in, represents the weight obtained by WSVM training, b represents the bias obtained by WSVM training, represents the Gaussian kernel function, Represents a validation tag.

[0165] It should be noted that the Gaussian kernel function is used to measure sample similarity, and the verification labels are 1 and -1, where 1 indicates safety and -1 indicates unsafe.

[0166] The verification results are as follows: f(X)=1: Verification succeeds, network security status returns to normal, and the process ends.

[0167] f(X)=-1: Verification fails, there is a residual security risk, triggering secondary verification, reconstructing the event graph, and updating the association relationship.

[0168] The steps for reconstructing the event graph are: Collect new data, including real-time device genetics device , abnormal protocol entropy, and attack path weight.

[0169] By adding event nodes (such as secondary attack events) and updating edge weights (such as the communication frequency between devices w ij , user access time t ij ) to update the event graph.

[0170] Update the baseline using the following formula: in, Represents the historical weight coefficient, 0≤ ≤1; E baseline Indicates the historical protocol entropy baseline value (old value before update); E normal The entropy value of the normal traffic protocol of the new observation is expressed by the formula Calculated.

[0171] Add new legal device hashes to the device gene library; recalculate M based on the new practice flow SUPPLY [i,j], update the supply chain topology matrix.

[0172] Update goal: Adapt the model to new attack patterns (such as changes in lateral movement paths).

[0173] During the verification process, the device gene compliance (whether it is in the benchmark library) and the legitimacy of the supply chain path are verified at the same time: the device gene benchmark library is used to determine the legitimacy of the device. If the device gene hash value is not in the benchmark library, the device is considered to be at risk; the baseline threshold of the supply chain topology matrix is ​​used to determine whether the interaction path between devices is normal. If M SUPPLY If [i,j] exceeds the baseline threshold, it is determined to be a cross-vendor low-frequency lateral movement attack.

[0174] When security verification fails, for example, the attack path is not completely blocked or a new abnormal behavior pattern appears, information such as real-time device DNA, abnormal protocol entropy, and attack path weight will be stored in the feedback queue, thereby triggering a baseline adaptive update.

[0175] When updating the relationship between the whole system, an automatic update strategy based on incremental learning algorithm is adopted. baseline Update as an example, use the formula Perform an exponential moving average calculation so that the baseline value gradually adapts to emerging attack patterns.

[0176] For the device gene benchmark library, when a new legal device gene hash value G is found device When a device is detected, it is added to the baseline library, thereby expanding the baseline library to more comprehensively cover the characteristics of legitimate devices.

[0177] Recalculate the supply chain topology matrix M based on the changes in the interaction events between devices within the time window SUPPLY [i, j], when a new normal cross-vendor device interaction path is discovered, or when the interaction frequency and weight of an existing path undergo significant and reasonable changes, the baseline threshold for the corresponding path is updated. For example, if an enterprise introduces a new supplier, resulting in a change in the interaction pattern between devices, the system will update the baseline of the supply chain topology matrix based on the new interaction data to accurately identify future abnormal lateral movement behavior.

[0178] The end of security incident analysis is determined using a multi-condition fusion strategy that organically combines dynamic thresholds, indicator trends, and manual confirmation. The details are as follows: Normal end: With f(X)=1 as the core, when f(X)=1, the verification is passed and the process ends. In other embodiments, additional indicator verification can be added according to the situation.

[0179] Abnormal loop: Forced termination through the triple mechanism of maximum retry times, time threshold, and indicator mutation warning to avoid resource exhaustion; for example, when f(X) = -1, the cumulative number of loops reaches 5, or a single loop takes more than 1 hour, or a new high-risk indicator appears in the loop (such as a sudden increase in ΔA, s user Breaking historical extremes).

[0180] Gradual recovery: Allows the indicator to decay until it reaches the target, adapting to the natural recovery scenario of low-risk anomalies.

[0181] While ensuring security, it also takes into account system efficiency and actual operation and maintenance needs, forming a complete "detection-response-verification-termination" closed loop.

[0182] The embodiment of the present application incorporates three types of heterogeneous nodes, namely device, user and event, into a unified event graph structure, and performs ternary entity association detection and analysis, thereby solving the chain analysis problem of "attack entry (user) → lateral movement (device) → attack target (event)" in APT attacks. It also separates topological differences from abnormal user behavior, and integrates indicators for analysis and judgment to solve the problem of single indicator misjudgment. Through the WSVM adaptive decision dynamic adjustment mechanism, the decision sensitivity to key abnormal indicators is improved.

[0183] This application uses multi-source data fusion processing to simultaneously process multi-source heterogeneous data such as network traffic data, system log data, and security device log data. Through data preprocessing and feature extraction, it fully utilizes information from various types of data to improve the accuracy of event analysis; combined with anomaly detection algorithms and association rule mining algorithms, it can not only detect known attack patterns, but also discover the correlation between potential abnormal behaviors and event characteristics, and has strong dynamic adaptability; through a security verification mechanism, the execution effect of the response strategy is verified to ensure that the network system can truly recover to a safe state, thereby improving the reliability and effectiveness of the system.

[0184] Although the various steps in the above embodiment are described in the above-mentioned order, those skilled in the art will understand that in order to achieve the effect of this embodiment, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple changes are within the scope of protection of this application.

[0185] See also Figure 2 A network security event analysis system of the second embodiment of the present application includes: a data verification module 100, a feature extraction module 200, an anomaly detection module 300, an event graph construction module 400, an event type determination module 500 and an event analysis result generation module 600.

[0186] The data verification module 100 is used to obtain the network security data set of each target device within the network security monitoring range and perform business logic compliance verification on the network security data set to determine the normal data that meets the verification and the suspicious data that does not meet the verification; Feature extraction module 200, used to construct a multi-dimensional baseline for suspicious data and generate a composite feature vector by combining the feature vectors of normal data; Anomaly detection module 300, for identifying abnormal rows in the composite feature vector as abnormal event nodes based on anomaly scores obtained by performing anomaly detection on the composite feature vector; An event graph construction module 400 is used to construct an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node; An event type determination module 500 is used to perform hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is ​​used to determine the event type; The event analysis result generation module 600 is used to generate network security event analysis results based on event type, anomaly score, event occurrence time, event occurrence location, and attack path, wherein the attack path is determined by the path connected by the anomaly event nodes.

[0187] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process and related instructions of the system described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0188] It should be noted that the network security incident analysis system provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present application can be further decomposed or combined. For example, the modules in the above embodiment can be combined into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present application are only for distinguishing the modules or steps and are not considered to be improper limitations of the present application.

[0189] An electronic device according to a third embodiment of the present application includes: at least one processor; and a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned network security event analysis method.

[0190] A fourth embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned network security event analysis method.

[0191] A computer program product according to a fifth embodiment of the present application, when running on an electronic device, enables the electronic device to execute the above-mentioned network security event analysis method.

[0192] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes and related instructions of the electronic device, computer-readable storage medium, and computer program product described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0193] Those skilled in the art should be aware that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, and the programs corresponding to the software modules and method steps can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. In order to clearly illustrate the interchangeability of electronic hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0194] Reference below Figure 3 , which shows a structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. Figure 3 The server shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0195] like Figure 3 As shown, the computer system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303. Various programs and data required for system operation are also stored in the RAM 303. The CPU 301, ROM 302 and RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0196] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, and the like; an output section 307 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 308 including a hard disk and the like; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. Removable media 311, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 310 as needed, so that computer programs read therefrom can be installed into the storage section 308 as needed.

[0197] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 309, and / or installed from the removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above-mentioned functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on a computer-readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0198] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0199] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0200] The terms "first", "second", etc. are used to distinguish similar objects, rather than to describe or indicate a particular order or sequence.

[0201] The term "comprise" or any other similar term is intended to cover non-exclusive inclusion such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0202] Thus far, the technical solutions of the present application have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of the present application is obviously not limited to these specific embodiments. Without departing from the principles of the present application, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present application.

Claims

1. A network security incident analysis method, characterized in that: include: Obtaining a network security data set for each target device within the network security monitoring range, and performing business logic compliance verification on the network security data set to determine normal data that meets the verification criteria and suspicious data that does not meet the verification criteria; Constructing a multidimensional baseline for the suspicious data and generating a composite feature vector by combining the feature vector of the ordinary data; Based on anomaly scores obtained by performing anomaly detection on the composite feature vector, identifying abnormal rows in the composite feature vector as abnormal event nodes; constructing an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node; Performing hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is ​​used to determine the event type; A network security event analysis result is generated based on the event type, the anomaly score, the event occurrence time, the event occurrence location, and the attack path, wherein the attack path is determined by a path connected by the anomaly event nodes.

2. A network security incident analysis method according to claim 1, characterized in that: The step of constructing a multidimensional baseline for the suspicious data and generating a composite feature vector by combining the feature vector of the common data includes: Acquire a multidimensional baseline based on the digital fingerprint of the target device where the suspicious data is located, the protocol entropy value of the protocol parsed data of the suspicious data, and the probability of initiating events between different target devices; Performing feature extraction on the text data and numerical data in the ordinary data respectively to obtain a feature vector set; The multidimensional baseline is integrated into the feature vector set to generate the composite feature vector.

3. A network security incident analysis method according to claim 2, characterized in that: The obtaining of a multidimensional baseline comprises: Obtaining a function code set extracted by performing protocol parsing on the network security data set, and determining a protocol entropy value based on a probability distribution of the function code set; Taking the probability of initiating an event between a first target device and a second target device as the element corresponding to a device pair, traverse all device pairs to construct a supply chain topology matrix, where the device pair consists of the first target device and the second target device, and the rows and columns of the supply chain topology matrix are target device indices; The multidimensional baseline is composed of the digital fingerprint, the protocol entropy value, and the supply chain topology matrix.

4. A network security incident analysis method according to claim 2, characterized in that: The acquiring of the feature vector set includes: For text data in the general data, extracting text features based on the frequency of occurrence of any term in any log record and the inverse document frequency of any term in the text data, wherein the text data includes multiple log records; For the numerical data in the ordinary data, all the numerical data are extracted to form an original feature matrix, and the numerical features are extracted by reducing the dimension of the original feature matrix; The feature vector set is composed of the text features and the numerical features.

5. A network security incident analysis method according to claim 1, characterized in that: The step of identifying abnormal rows in the composite feature vector as abnormal event nodes includes: Randomly extracting a sample subset from the composite feature vector and performing recursive partitioning to construct an isolation forest; Performing anomaly detection on any row in the composite feature vector set based on the isolation forest to determine an anomaly score for the any row; When the abnormality score of any row is greater than or equal to an abnormality threshold, the abnormal event node of any behavior is determined.

6. A network security incident analysis method according to claim 1, characterized in that: The constructing of the event graph includes: Determine the device edge based on the communication relationship between the target devices, determine the user device edge based on the user's access relationship to the target device, and determine the event device edge based on the target devices associated with the abnormal event; The event graph is constructed by taking the target device as the device node, the user entity accessing the target device as the user node, and the abnormal event node as the event node, combining the device edge, the user device edge and the event device edge.

7. A network security incident analysis method according to claim 1, characterized in that: The method further comprises: Determining an attention weight of any node to the neighboring node based on a degree of association between any node and a neighboring node in the event graph; Based on all attention weights corresponding to any one of the nodes, feature enhancement is performed on the any one of the nodes to obtain a node feature matrix that enhances key associations.

8. A network security incident analysis method according to claim 1 or 7, characterized in that: The node feature matrix is ​​used to determine the event type, including: Classifying the node feature matrix to obtain a category probability vector, wherein any element in the category probability vector corresponds to the probability of an event type; The numerical values ​​of the elements in the category probability vector are compared, and the event type corresponding to the element with the largest probability is determined as the event type.

9. A network security incident analysis system, characterized in that: include: A data verification module is used to obtain a network security data set of each target device within the network security monitoring range and perform business logic compliance verification on the network security data set to determine normal data that meets the verification requirements and suspicious data that does not meet the verification requirements; A feature extraction module is used to construct a multi-dimensional baseline for the suspicious data and generate a composite feature vector by combining the feature vectors of the ordinary data; an anomaly detection module, configured to identify abnormal rows in the composite feature vector as abnormal event nodes based on anomaly scores obtained by performing anomaly detection on the composite feature vector; An event graph construction module, configured to construct an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node; An event type determination module, configured to perform hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is ​​used to determine the event type; An event analysis result generation module is used to generate a network security event analysis result based on the event type, the anomaly score, the event occurrence time, the event occurrence location, and the attack path, wherein the attack path is determined by the path connected by the anomaly event nodes.

10. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement a network security event analysis method as described in any one of claims 1-8.

Images