A network security event analysis method, system and device

Abstract

The application belongs to the field of network security, and particularly relates to a network security event analysis method, system and device, aiming to solve the problem of poor detection effect of existing network security event analysis and detection technology. The method comprises the following steps: determining normal data and suspicious data in a network security data set; constructing a multi-dimensional baseline for the suspicious data, and generating a composite feature vector in combination with the feature vector of the normal data; identifying an abnormal row in the composite feature vector as an abnormal event node; constructing an event graph based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the abnormal event node; determining an event type based on the node feature matrix of the event graph; and generating a network security event analysis result based on the event type, an abnormal score, an event occurrence time, an event occurrence location and an attack path. The application has stronger generalization ability for new attacks, and improves the accuracy of network security event analysis.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network security, and particularly relates to a network security event analysis method, system and device. BACKGROUND

[0002] A network security event refers to an event that causes the confidentiality, integrity and availability of a network system, data or service to be damaged through technical means (such as attacks, intrusions, destruction and leakage) or human operation errors. With the rapid development of network technology, network security problems are becoming increasingly serious, and it is necessary to accurately detect and analyze network security events to ensure the security of network systems.

[0003] Current network security event analysis and detection technologies include: matching and comparison based on network security event data and attack databases, in-depth analysis of attack codes, host information and even attack data reorganized and split from network security events, and comprehensive analysis of network security events. However, this analysis method is a fixed threshold judgment mechanism, and the recognition rate of new attacks is low; or according to the attacked situation of the server, the server that needs to be protected is screened, thereby reducing the number of servers that need to be protected, and then reducing the labor cost and time cost of protecting the server. However, only the attack interval is counted, and the attack type correlation is ignored, and the false positive rate is high.

[0004] In addition, the existing network security events also have the problem of hidden penetration attacks across the supply chain of different manufacturers, for example, in the industrial internet, attackers implant backdoors through legal supplier VPN entrances (such as remote maintenance channels of certain PLC device manufacturers), and use legal credentials to complete attack horizontal penetration from device maintenance terminals to production control systems to ERP systems to core databases. The attack has feature concealment.

[0005] Therefore, the existing network security event analysis method has the problems of high false positive rate and lack of dynamic adaptability, and it is difficult to accurately analyze and process such network security events, which leads to the inability to effectively protect the security of network systems. SUMMARY

[0006] In order to solve the above problems in the prior art, that is, the poor detection effect of the existing network security event analysis and detection technology, the present application first aspect provides a network security event analysis method, comprising:

[0007] Obtaining network security data sets of each target device within a network security monitoring range, and performing business logic compliance verification on the network security data sets to determine normal data that meets the verification and suspicious data that does not meet the verification;

[0008] A multi-dimensional baseline is constructed for suspicious data, and a composite feature vector is generated in combination with a feature vector of normal data;

[0009] An abnormal row in the composite feature vector is identified as an abnormal event node based on an abnormal score obtained by performing anomaly detection on the composite feature vector;

[0010] An event graph is constructed based on relationships between different target devices, relationships between the target devices and users, and relationships between the target devices and the abnormal event node;

[0011] Layered information aggregation is performed on the event graph to obtain a node feature matrix, wherein the node feature matrix is used to determine an event type;

[0012] A network security event analysis result is generated based on the event type, the abnormal score, an event occurrence time, an event occurrence location, and an attack path, wherein the attack path is determined through a path connected by the abnormal event nodes.

[0013] As a preferred implementation, a multi-dimensional baseline is constructed for suspicious data, and a composite feature vector is generated in combination with a feature vector of normal data, including:

[0014] A multi-dimensional baseline is obtained based on a digital fingerprint of a target device where the suspicious data is located, a protocol entropy value of protocol analysis data of the suspicious data, and a probability of initiating an event between different target devices;

[0015] Feature extraction is performed on text data and numerical data in the normal data respectively to obtain a feature vector set;

[0016] The multi-dimensional baseline is integrated into the feature vector set to generate a composite feature vector.

[0017] As a preferred implementation, the multi-dimensional baseline is obtained, including:

[0018] A function code set extracted by protocol analysis on a network security data set is obtained, and a protocol entropy value is determined based on a probability distribution of the function code set;

[0019] A probability of initiating an event between a first target device and a second target device is taken as an element corresponding to a device pair to traverse all device pairs to construct a supply chain topology matrix, wherein the device pair is composed of the first target device and the second target device, and a row and a column of the supply chain topology matrix are target device indexes;

[0020] The multi-dimensional baseline is composed of the digital fingerprint, the protocol entropy value, and the supply chain topology matrix.

[0021] As a preferred implementation, the feature vector set is obtained, including:

[0022] For text data in the general data, text features are extracted based on a frequency of occurrence of any word item in any log record, an inverse document frequency of any word item in the text data, wherein the text data comprises a plurality of log records;

[0023] For numerical data in the general data, all numerical data is extracted to form an original feature matrix, and numerical features are extracted by dimension reduction on the original feature matrix;

[0024] The feature vector set is composed of the text features and the numerical features.

[0025] As a preferred embodiment, an abnormal row in the composite feature vector is identified as an abnormal event node, comprising:

[0026] In the composite feature vector, a sample subset is randomly extracted for recursive partitioning to construct an isolation forest;

[0027] Based on the isolation forest, anomaly detection is performed on any row in the composite feature vector set to determine an anomaly score of the row;

[0028] In a case where the anomaly score of any row is greater than or equal to an anomaly threshold, the row is determined as an abnormal event node.

[0029] As a preferred embodiment, an event graph is constructed, comprising:

[0030] Device edges are determined based on a communication relationship between target devices, user-device edges are determined based on an access relationship of a user to the target devices, and event-device edges are determined based on target devices associated with abnormal event occurrences;

[0031] The target devices are taken as device nodes, the user entities accessing the target devices are taken as user nodes, and the abnormal event nodes are taken as event nodes, and the event graph is constructed in combination with the device edges, the user-device edges, and the event-device edges.

[0032] As a preferred embodiment, the method further comprises:

[0033] Based on a degree of association between any node and neighbor nodes in the event graph, attention weights of the any node to the neighbor nodes are determined;

[0034] Based on all attention weights corresponding to any node, feature enhancement is performed on the any node to obtain an enhanced key-association node feature matrix.

[0035] As a preferred embodiment, the node feature matrix is used to determine an event type, comprising:

[0036] Classification is performed on the node feature matrix to obtain a category probability vector, wherein any element in the category probability vector corresponds to a probability of an event type;

[0037] Compare the numerical values ​​of each element in the category probability vector, and determine the event type corresponding to the element with the highest probability as the event type.

[0038] A second aspect of this application proposes a network security incident analysis system, comprising:

[0039] The data verification module is used to acquire network security datasets of various target devices within the network security monitoring range, and to perform business logic compliance verification on the network security datasets to determine the ordinary data that meets the verification criteria and the suspicious data that does not meet the verification criteria.

[0040] The feature extraction module is used to construct a multidimensional baseline for suspicious data and generate a composite feature vector by combining the feature vectors of ordinary data.

[0041] The anomaly detection module is used to identify abnormal rows in the composite feature vector based on the anomaly score obtained by anomaly detection of the composite feature vector, and to identify them as abnormal event nodes.

[0042] The event graph construction module is used to construct an event graph based on the relationships between different target devices, the relationships between target devices and users, and the relationships between target devices and abnormal event nodes.

[0043] The event type determination module is used to perform hierarchical information aggregation on the event graph and obtain the node feature matrix, where the node feature matrix is ​​used to determine the event type.

[0044] The event analysis result generation module is used to generate network security event analysis results based on event type, anomaly score, event occurrence time, event occurrence location, and attack path. The attack path is determined by the path connected by the anomaly event nodes.

[0045] A third aspect of this application proposes an electronic device comprising:

[0046] At least one processor; and

[0047] A memory communicatively connected to at least one of the processors; wherein,

[0048] The memory stores instructions that can be executed by the processor to implement the aforementioned method for network security incident analysis.

[0049] The beneficial effects of this application are:

[0050] (1) By determining the abnormal event node, the network security event is initially abnormally detected, the event graph is further constructed, and the event type is determined, the network security event analysis result can be determined gradually, the data features and the correlation are automatically learned, the manual rules do not need to be updated, the new attack has stronger generalization ability, and the false alarm rate is reduced.

[0051] (2) By constructing the event graph including the user, the device and the event, the complex correlation across entities and multiple stages can be effectively captured, the limitation that the traditional method can only detect isolated events is improved, and the accuracy of the network security event analysis is further improved.

[0052] (3) By introducing the multi-dimensional baseline of suspicious data, the multi-dimensional fusion verification can be supported in combination with the feature vector of ordinary data, the latent hidden danger can be found, compared with the traditional single index verification, the multi-dimensional fusion verification is more comprehensive and reliable, the single index misjudgment problem is solved, and the accuracy of the network security event judgment is further improved. BRIEF DESCRIPTION OF DRAWINGS

[0053] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments with reference to the attached drawings:

[0054] Figure 1 is a flowchart of a network security event analysis method provided by an embodiment of the application;

[0055] Figure 2 is a system block diagram of a network security event analysis system provided by an embodiment of the application;

[0056] Figure 3 is a structural schematic diagram of a computer system of a server for implementing the method, system and device embodiments of the application. DETAILED DESCRIPTION

[0057] The application will be further described in detail below with reference to the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for convenience of description.

[0058] It should be noted that the embodiments and features in the embodiments in the application can be combined with each other without conflict. The application will be described in detail below with reference to the drawings and embodiments.

[0059] The application provides a network security event analysis method. The method obtains network security data sets of target devices in a network security monitoring range, and performs business logic compliance verification on the network security data sets to determine normal data meeting the verification and suspicious data not meeting the verification. A multi-dimensional baseline is constructed for the suspicious data, and a composite feature vector is generated in combination with a feature vector of the normal data. An abnormal score obtained through abnormal detection on the composite feature vector is used to identify an abnormal row in the composite feature vector as an abnormal event node. An event graph is constructed based on relationships between different target devices, relationships between the target devices and users, and relationships between the target devices and the abnormal event nodes. Layered information aggregation is performed on the event graph to obtain a node feature matrix, wherein the node feature matrix is used to determine an event type. Based on the event type, the abnormal score, an event occurrence time, an event occurrence location, and an attack path, a network security event analysis result is generated, wherein the attack path is determined through a path connected by the abnormal event nodes, the network security event analysis result can be determined step by step, data features and correlation relationships can be automatically learned, manual rules do not need to be updated, new attacks have stronger generalization ability, the false positive rate is reduced, and the accuracy of network security event analysis is improved.

[0060] In order to more clearly describe the network security event analysis method of the application, the following describes the network security event analysis method of the application in combination with Figure 1 The steps in the embodiments of the application are described in detail.

[0061] The network security event analysis method of the first embodiment of the application includes steps S10-S60, and the steps are described in detail as follows.

[0062] In step S10, network security data sets of target devices in a network security monitoring range are obtained, and business logic compliance verification is performed on the network security data sets to determine normal data meeting the verification and suspicious data not meeting the verification.

[0063] Optionally, the network security monitoring range covers the entire protected network, including all networked devices, such as servers, routers, terminals, PLCs, human-machine interfaces (HMI), etc., and any device can be a target device.

[0064] Optionally, the network security data sets at least include network traffic data, system logs, security device log data, device firmware data, and supply chain relationship data. The security device log data can be firewall logs, intrusion detection system logs, etc.; the device firmware data can be PLC firmware binary files, HMI component features; and the supply chain relationship data can be vendor device lists, maintenance permission mapping tables, etc.

[0065] Optionally, network security data from multiple sources can be collected in real time through devices and agents deployed in the network, and integrated to obtain a network security dataset.

[0066] As an example, network traffic data can be obtained by capturing raw data packets through switch mirroring ports or collecting traffic statistics via NetFlow / sFlow protocols; a Syslog collector can be deployed on servers / terminals to collect operating system event logs in real time to obtain system log data; device firmware data can be obtained by collecting PLC firmware binary files and HMI interface component characteristics through device management interfaces (SNMP / API); supply chain relationship data can be obtained by synchronizing vendor device lists and maintenance permission mapping tables through CMDB databases; network topology data can be obtained by collecting firewall rule tables and device connection relationships through SDN controller APIs; and cross-vendor device interaction event streams (Events) can be collected to build supply chain topology relationships.

[0067] Where Event=(t,src,dst,type), where t is the event occurrence timestamp; src is the event source device ID (such as PLC device number); dst is the event target device ID (such as SCADA system ID); and type is the event type (such as data read / write, firmware update, permission change, etc.).

[0068] It should be noted that the timestamps in the embodiments of this application can be accurate to milliseconds.

[0069] By integrating multi-source data, it can simultaneously process heterogeneous data from multiple sources, such as network traffic data, system log data, and security device log data. Through data preprocessing and feature extraction, it fully utilizes the information from various types of data to improve the accuracy of event analysis. Combining anomaly detection algorithms and association rule mining algorithms, it can not only detect known attack patterns but also discover the correlation between potential abnormal behaviors and event characteristics, exhibiting strong dynamic adaptability. Through a security verification mechanism, the execution effect of response strategies is verified, ensuring that the network system can truly recover to a secure state, thereby improving the system's reliability and effectiveness.

[0070] Furthermore, during the protocol parsing process of the network security dataset, business logic compliance verification is performed on the network security dataset to identify ordinary data that meets the verification criteria and suspicious data that does not meet the verification criteria.

[0071] In protocol parsing, messages are decapsulated, function codes and data segments are extracted. For network protocol data contained in network security datasets, a state machine parsing method is adopted, defining a protocol state set S={s0,s1,…,sz}, where s0 is the initial state and s1,…,sz are intermediate states in protocol interaction.

[0072] As an example, the protocol state set S={s0, s1, s3}, wherein s0 represents waiting for a request frame; s1 represents parsing a function code; s2 represents parsing an address code; and s3 represents CRC verification.

[0073] Further, by constantly matching protocol fields (such as source port, destination port, etc. in the TCP / IP protocol), the binary protocol data is parsed into structured information. For example, for the Modbus protocol, the function code, address code and other fields are parsed to form protocol data objects that are easy to process.

[0074] In the parsing process, business logic compliance verification is performed, and the verification content of the business logic compliance verification includes matching of the function code and the device type and data range compliance with engineering constraints. For the Modbus protocol, it is verified whether the function code, address code and the like are within a reasonable range. If the state cannot be normally transferred according to the state transition function in the parsing process, or data that does not conform to the protocol standard format appears, it is determined that the protocol parsing is abnormal.

[0075] In the embodiments of the present application, the data with protocol parsing abnormality is marked as invalid data and is discarded, and valid data is retained. In the valid data, the data that conforms to the verification is marked as normal data, and the data that does not conform to the verification is marked as suspicious data.

[0076] It should be noted that the suspicious data needs to be updated by constructing a baseline behavior mode, for example, learning a new device interaction mode.

[0077] As another example, in the protocol parsing process, the protocol is double-verified, specifically including: basic protocol compliance verification and business logic compliance verification.

[0078] The verification content of the basic protocol compliance verification includes that the message length conforms to the RFC standard, the function code is within the specification definition range, and the CRC verification is correct, and according to the standard format and rules of the protocol, it is checked whether the data field is complete and conforms to the specification.

[0079] For example, for the TCP / IP protocol, it is checked whether the key fields such as the source port and the destination port exist and are correct in format; when the verification does not conform, it is marked as an attack, and after the verification conforms, the business logic compliance verification is performed.

[0080] In other embodiments, the network security data set can also be preprocessed, for example, the network security data set is sequentially subjected to noise filtering, protocol parsing, binary processing and normalization processing.

[0081] In the embodiments of the present application, the original network security data set is denoted as D raw, first, noise filtering processing is performed to remove noise data in the data, such as repeated records, format error data, redundant data irrelevant to network security event analysis, etc. Protocol decoding (such as Modbus unpacking) is performed on the pure data stream to parse the protocol. The firmware / binary segment after protocol parsing is processed. Finally, the numerical features are standardized.

[0082] wherein the determination of noise data is identified by a preset noise feature rule, for example, repeated invalid logs, format error data, etc. The noise data is identified and removed according to the preset noise feature rule to obtain a denoising data set.

[0083] In binary processing, the firmware file is divided into blocks and hash is calculated. For the firmware binary data in the structured information after protocol parsing, the sliding window algorithm is used to extract features. Set the window size as w and the step size as s. For a binary data sequence, the subsequence features are extracted by a preset size window to form a feature set. At the same time, the extracted binary features are aligned. The part less than w length is filled with padding value (such as 0).

[0084] Normalization processing converts numerical data of different formats and different ranges into a unified numerical range, so as to facilitate subsequent feature extraction and analysis, and improve the accuracy and efficiency of the algorithm.

[0085] As an example, for numerical data, normalization processing is performed by a normalization formula, for example, by formula for normalization, wherein, x' is the numerical data after normalization processing, x is the original numerical data, from the numerical field in the feature set, x min is the minimum value of the numerical data in the data set, x max is the maximum value of the numerical data in the data set, x min and x max are obtained by statistical processing of all data in the field.

[0086] The numerical data after normalization processing x' is replaced by the corresponding original numerical data x in the denoising data set after noise filtering to obtain the final preprocessed data set.

[0087] Step S20, constructing a multi-dimensional baseline for suspicious data, and generating a composite feature vector combining the feature vector of ordinary data.

[0088] Optionally, a multi-dimensional baseline is constructed for suspicious data, a feature vector is extracted for normal data, the multi-dimensional baseline and the feature vector are combined to generate a composite feature vector, and a network security event is verified in multiple dimensions.

[0089] In the embodiments of the present application, a multi-dimensional baseline is acquired based on a digital fingerprint of a target device where suspicious data is located, a protocol entropy value of protocol analysis data of the suspicious data, and a probability of initiating an event between different target devices.

[0090] The digital fingerprint of the target device is constructed by the firmware binary and the HMI feature acquired by preprocessing the target device.

[0091] As an example, the firmware binary is PLC_firmware.bin (preprocessed block data), and the HMI feature is represented by a feature vector, which can be [control type, binding protocol, open port] (preprocessed extraction).

[0092] Further, a 128-bit hash value G is generated by the following formula device :

[0093]

[0094] wherein F firm represents the firmware binary file, F HMI represents the HMI feature vector, ConvID(F firm ) feat represents one-dimensional convolutional neural network extraction of firmware features, PCA(F HMI ) reduced represents principal component analysis dimension reduction extraction of HMI features, represents binary concatenation, which splices the firmware features and the HMI features, and SHA256() represents SHA256 hash encryption of the spliced feature vector.

[0095] It should be noted that the digital fingerprint G device is a unique digital fingerprint of the target device, which satisfies uniqueness and tamper resistance.

[0096] By fusing the hash of the firmware code convolution feature and the HMI configuration, the digital fingerprint of the target device is constructed, the gene map of each target device can be generated, the unforgeable device DNA is constructed, and the hidden detection difficulty of the industrial control device firmware tampering is solved.

[0097] Further, a function code set extracted by protocol analysis on a network security data set is acquired, and a protocol entropy value is determined based on the probability distribution of the function code.

[0098] Optionally, the probability distribution of the function code set can be obtained by calculating the use probability of each function code. Taking function code c as an example, the ratio of the number of occurrences of function code c to the total number of occurrences of each function code in the function code set is calculated as the use probability p(c) of function code c.

[0099] As an example, the protocol entropy value E can be determined based on the probability distribution of the function code by the following formula baseline :

[0100]

[0101] In some embodiments, the protocol entropy value can be dynamically updated, and the updated protocol entropy value is used to construct a multi-dimensional baseline.

[0102] Optionally, the normal traffic entropy value is obtained by monitoring; the protocol entropy value and the normal traffic entropy value are weighted and summed to obtain an updated protocol entropy value.

[0103] As an example, the update of the protocol entropy value can be performed by the following formula:

[0104]

[0105] wherein, E NEW represents the updated protocol entropy value, a represents the historical weight, E normal represents the normal traffic entropy value.

[0106] Through the entropy analysis based on the protocol function code, the abnormal operation (such as Modbus read register over-length data transmission) in the standard protocol can be accurately identified, and the deficiency of the traditional anomaly detection on the protocol content analysis is made up.

[0107] Further, the probability of initiating an event between the first target device and the second target device is taken as the corresponding element of the device pair, all device pairs are traversed, and a supply chain topology matrix is constructed, wherein the device pair is composed of the first target device and the second target device, and the row and column of the supply chain topology matrix are target device indexes.

[0108] Optionally, the probability of initiating an event between the first target device and the second target device is determined based on the ratio between the number of interaction events between the first target device and the second target device and the number of all interaction events participated by the first target device.

[0109] Taking the ith target device and the jth target device as an example, i is the target device index of the first target device, and j is the target device index of the second target device, then the probability M SUPPLY [i,j] of initiating an event between the first target device and the second target device can be calculated by the following formula:

[0110]

[0111] wherein, M SUPPLY [i,j] represents the probability of the i-th target device initiating an event to the j-th target device, event(i→j) represents the number of events from the i-th target device to the j-th target device, and total(i) represents the total number of events in which the i-th target device participates.

[0112] It should be noted that the target device index is the device ID, the source is the device asset list, and the initiating event can be sending data, triggering cooperation, etc.

[0113] It can be understood that the probability M SUPPLY [i,j] can represent the timing dependency strength between the i-th target device and the j-th target device, and the value range is [0, 1]. If M SUPPLY [i,j] > M1, it means that the i-th target device and the j-th target device are strongly associated, for example, real-time data interaction between PLC and SCADA; if M2 < M SUPPLY [i,j] < M3, it means that the i-th target device and the j-th target device are moderately associated, for example, periodic calibration between devices; if M SUPPLY [i,j] < M4, it means that the i-th target device and the j-th target device are weakly associated, for example, occasional communication between devices across regions.

[0114] wherein, M1, M2, M3, and M4 are all preset threshold values for degree segmentation of the timing dependency strength, and M1 > M3 > M2 > M4. As an example, M1 can be 0.8, M3 can be 0.7, M2 can be 0.3, and M4 can be 0.1.

[0115] Any two target devices form a device pair, and the target device index is used as the row and column of the matrix. The probability M SUPPLY [i,j] corresponding to the device pair is used as the element at the (i,j) position to generate the supply chain topology matrix.

[0116] It should be noted that the supply chain topology matrix can be a static matrix or a dynamic matrix. The dynamic matrix changes with scenarios such as device failure or new device access, and the element values in the supply chain topology matrix can change in real time.

[0117] In the embodiments of the present application, for a static matrix, the device physical topology is fixedly connected, for example, hardwiring of PLC and HMI in a factory.

[0118] For dynamic matrix, if the device fails, it will automatically bypass, for example, if the jth target device fails, the ith target device can bypass the jth target device by temporarily increasing the probability between the ith target device and other target devices, for example, the probability M SUPPLY [i,r] is temporarily increased by 30%. If load balancing is to be achieved, the AGV path can be dynamically adjusted, for example, task allocation based on probability value ranking; if a new device is connected, the matrix dimension of the supply chain topology matrix is automatically expanded, for example, the original supply chain topology matrix size is 100x100, when a new target device with index 101 is connected, the matrix dimension is expanded to 101x101.

[0119] By introducing the supply chain topology matrix, the interaction weight of cross-vendor devices can be quantified, and low-frequency but dangerous horizontal movement attacks (such as penetrating the core database through the supplier VPN) can be effectively detected, solving the problem of missed judgment of cross-domain attacks in traditional correlation analysis.

[0120] Further, the multi-dimensional baseline Baseline={G device , E baseline , M supply} is composed of digital fingerprints, protocol entropy values, and supply chain topology matrices.

[0121] In some embodiments, the constructed multi-dimensional baseline is verified to determine whether the multi-dimensional baseline construction is completed.

[0122] As an example, the coverage of the multi-dimensional baseline is verified, if the device gene coverage rate ≥ 98% (all networked devices); the protocol type coverage rate = 100% (all detected protocols); the device path coverage rate ≥ 95% (device pairs that exist interaction), the coverage verification is passed.

[0123] As another example, the stability of the multi-dimensional baseline is verified, if the entropy value fluctuation for 24 consecutive hours <0.1; the topology matrix change rate <0.05, the stability verification is passed.

[0124] In the embodiments of the present application, different feature extraction methods can be used to extract key features for ordinary data, and feature vector sets are obtained by extracting features from text data and numerical data in ordinary data respectively.

[0125] For text data in ordinary data, text features are extracted based on the frequency of any term in any log record and the inverse document frequency of any term in the text data, wherein the text data includes multiple log records.

[0126] As an example, the text data D includes a plurality of log records d, and a plurality of word items t are included in the log record d, and the occurrence frequency of the word item t in the log record d is calculated as the occurrence frequency tf(t, d) of the word item t in the log record d by calculating the proportion of the number of occurrences of the word item t in the log record d to the total number of words in the log record d.

[0127] The inverse document frequency is used to statistically quantify the importance of a word item in a document set, and the lower the frequency of occurrence of a word item in a document set, the stronger the distinguishing ability of the word item to the document, and the higher the importance, thereby quantifying the scarcity of the word item in the document set.

[0128] The inverse document frequency idf(t, D) can be obtained by the following formula:

[0129]

[0130] Wherein, |D| represents the total number of log records in the text data D, and |{d e D: t e d}| represents the number of log records containing the word item t.

[0131] In the embodiments of the present application, any log record is a document, and the text data including a plurality of log records is a document set of all log records. The importance of the word item in the entire text data can be determined by calculating the inverse document frequency.

[0132] The importance of the word item t is obtained by calculating the product tf-idf(t, d, D) of the occurrence frequency tf(t, d) of the word item t and the inverse document frequency idf(t, D), which is used for text feature extraction, and the higher the tf-idf(t, d, D), the more significant the effect of the word item on anomaly detection.

[0133] It should be noted that the occurrence frequency tf(t, d) represents the importance of the word item t in the log record d, highlighting the local importance of the word item t, and the inverse document frequency idf(t, D) represents the global importance of the word item t in the text data, improving the global distinguishing ability, and the local high frequency and global scarcity features are fused by multiplying the two, which can accurately represent the identification ability of the word item t in the text data, and the key text features can be extracted by the importance, which can highlight the key words meaningful for network security event analysis.

[0134] For numerical data in ordinary data, all numerical data is extracted to form an original feature matrix, and numerical features are extracted by dimension reduction of the original feature matrix.

[0135] Optionally, principal component analysis can be used for dimension reduction to remove redundant features, retain main features, reduce data dimensions, and improve the running efficiency of subsequent analysis algorithms.

[0136] As an example, the original feature matrix X composed of all numerical data is an n x p matrix, with n samples and p numerical features, each row representing a sample and each column representing a feature. X can be represented as follows:

[0137]

[0138] The covariance matrix C can be calculated by the formula , where X T is the transpose matrix of X. Further, the covariance matrix is decomposed into eigenvalues and corresponding orthogonal eigenvectors, which are arranged according to the size of the corresponding eigenvalues to form an eigenvector matrix. The column vectors of the eigenvector matrix are orthogonal principal component directions, corresponding to the directions with the largest data variance.

[0139] After determining the principal component directions, the eigenvectors corresponding to the first K largest eigenvalues are selected to form a principal component matrix, where the product of the first K largest eigenvalues needs to be greater than 85% of the product of all eigenvalues, that is, the principal components that retain 85% of the variance of the reduced matrix need to be retained.

[0140] The original feature matrix X is an n x p matrix, and the reduced matrix Y is an n x K matrix, where K < p. Each row of matrix Y is the coordinate of the original feature matrix X in the K-dimensional principal component space.

[0141] Further, the feature vector set F is composed of text features and numerical features, which can be represented as , where tf-idf(d1), tf-idf(d m ) represents each text feature, m represents the number of log records in the text data, Y1, Y n represents each numerical feature, and n represents the number of samples in the numerical data.

[0142] Further, a multi-dimensional baseline is integrated into the feature vector set to generate a composite feature vector .

[0143] Step S30, based on the anomaly score obtained by anomaly detection on the composite feature vector, identifying the abnormal row in the composite feature vector as an abnormal event node.

[0144] Optionally, the abnormal points in the data usually have the characteristics of "few and different", so they are more easily isolated quickly (short path) in the randomly divided data space, while the normal points need more segmentation steps (long path) due to dense distribution. Therefore, the isolation forest can be used to measure the path length to quantify the degree of abnormality of the data.

[0145] In the embodiment of the present application, in the composite feature vector, a sample subset is randomly extracted for recursive division to construct an isolation forest; based on the isolation forest, anomaly detection is performed on any row in the composite feature vector set to determine an anomaly score of any row; in the case that the anomaly score of any row is greater than or equal to an anomaly threshold, the any row is determined as an abnormal event node.

[0146] The method for constructing the isolation forest is as follows: a sample is randomly extracted from the composite feature vector F' as a sample subset, the number of samples for extraction is usually much smaller than the size of the original data set, and the number of samples for extraction is fixed each time; the sample subset extracted is recursively divided, in each division process, a feature is randomly selected, and a division point is randomly selected in the value range of the feature, the sample subset is divided into two parts, which are respectively used as the left subtree and the right subtree of the node. Repeat the process until each leaf node contains only one sample, or the maximum depth of the tree reaches a preset value; repeat the steps of random sampling and recursive division to construct multiple isolated trees, and these trees collectively constitute an isolation forest. Each tree is based on different random sampling and division, thereby ensuring the diversity and stability of the model.

[0147] Further, a row in the composite feature vector F' is extracted as a sample feature vector f, and an isolation forest score s(f) corresponding to each sample feature vector f is calculated. By calculating s(f), the abnormality degree of each sample can be quantified, the device gene abnormality and protocol entropy mutation event can be identified, and the network security event can be preliminarily screened and judged.

[0148] The calculation method of the isolation forest score is a prior art, which will not be described in detail in the embodiment of the present application.

[0149] It should be noted that when the isolation forest score s(f) is close to 1, it means that the path length of the sample feature vector f is extremely short and can be easily isolated in the isolation forest, and the sample is extremely likely to be an abnormal sample, which means that a network security event may occur. At this time, the sample can be marked as a highly suspicious anomaly, and further detailed analysis process is triggered, for example, in combination with the association rule mining algorithm, the association relationship between the abnormal sample and other samples is analyzed to determine whether there is an attack chain or other related security threats, and a high-priority alarm is sent to the security management personnel. When s(f) is close to 0, it means that the path length of the sample feature vector f is longer, and the distribution in the isolation forest is similar to that of the normal sample. The sample is most likely a normal sample, that is, the current network state is normal, and the regular data collection and monitoring can be continued. When s(f) is an intermediate value, the abnormality degree of the sample feature vector f is uncertain, and the sample can be marked as moderately suspicious, and continuous data collection and monitoring are continued. At the same time, more dimensional data and analysis methods can be combined, such as checking the network traffic trend corresponding to the sample, the related records in the system log, and the like, to further determine whether the sample is a real abnormal sample.

[0150] Further, according to the actual network environment and security requirements, an abnormal threshold T0 is set. When s(f)≥T0, it is determined that the sample feature vector f is an abnormal sample, that is, a possible network security event is detected; when s(f)<T0, it is determined that the sample feature vector f is a normal sample.

[0151] In this way, potential abnormal situations can be quickly screened out from a large amount of network security data, and the purpose of anomaly detection is achieved.

[0152] It should be noted that the abnormal threshold T0 can be adjusted according to actual conditions.

[0153] The identified abnormal sample feature vector, that is, the abnormal row, is marked as an abnormal event node for abnormal event analysis.

[0154] In some embodiments, the abnormal event node can also be identified by a digital fingerprint, a protocol entropy value mutation, and the like.

[0155] As an example, the digital fingerprint G device of the target device is calculated in real time and compared with the vendor benchmark library. When the digital fingerprint G device is not in the benchmark library, it is determined that the target device has a genetic abnormality, and a security problem such as firmware tampering may occur. When the isolation forest algorithm calculates the abnormal score s(f), the path length of the corresponding sample is significantly shortened, resulting in an abnormal score s(f) close to 1, so that the abnormal event node is identified.

[0156] As another example, for protocol packet streams such as Modbus / TCP, the stability of protocol behavior is evaluated by calculating the protocol entropy value E in real time baseline When E baseline changes dramatically, the difference between the real-time entropy value and the baseline entropy value is too large, and it is determined that a protocol entropy mutation event occurs, that is, there may be a security threat such as a protocol camouflage attack. Similarly, this anomaly will also be reflected as an increase in the anomaly score s(f) in the isolation forest algorithm, and then identified as an anomaly event node.

[0157] In step S40, an event graph is constructed based on the relationship between different target devices, the relationship between the target device and the user, and the relationship between the target device and the anomaly event node.

[0158] Optionally, the event graph is used to describe events and their relationships, and can analyze the structure and evolution process of complex event sequences by representing events by nodes and logical relationships (such as time sequence relationship, causal relationship, and conditional relationship) by edges.

[0159] In the embodiments of the present application, a device edge is determined based on the communication relationship between the target devices, a user-device edge is determined based on the access relationship of the user to the target device, and an event-device edge is determined based on the target device associated with the occurrence of the anomaly event.

[0160] Specifically, a device edge is constructed based on the communication relationship of network traffic between different target devices, and the weight is the communication frequency between two target devices per unit time. Taking the ith target device and the jth target device as an example, the device edge is denoted as wherein, denotes a device node formed by the ith target device, denotes a device node formed by the jth target device, w ij denotes the weight of the device edge between the ith target device and the jth target device. A user-device edge is constructed by determining the access relationship of the user to the target device based on the login log of the user, and the weight is the access duration. Taking the ith target device and the uth user as an example, the user-device edge is denoted as wherein, denotes a user node formed by the uth user entity, t ui denotes the weight of the user-device edge between the ith target device and the uth user entity. An event-device edge is constructed by determining the target device associated with the occurrence of the anomaly event. Taking the ith target device and the eth anomaly event node as an example, the event-device edge is denoted as wherein, denotes the eth anomaly event node, and the event-device edge is an undirected edge without a corresponding weight.

[0161] Further, taking the target device as a device node, taking the user entity accessing the target device as a user node, and taking the abnormal event node as an event node, an event graph is constructed in combination with a device edge, a user device edge, and an event device edge.

[0162] The attributes of the device node V device include an IP address, a device type, an operating system, an open port, and the like; the attributes of the user node V user include a user ID, an access permission, a historical behavior feature, and the like; and the attributes of the event node V event include an event type, a timestamp, a feature vector, and the like.

[0163] As an example, the event graph can be represented as:

[0164]

[0165] wherein, , .

[0166] In step S50, layered information aggregation is performed on the event graph to obtain a node feature matrix, wherein the node feature matrix is used to determine an event type.

[0167] Optionally, the node feature matrix is a matrix used to describe the attributes and features of each node in the event graph, and is usually composed of multiple dimensions of features, such as the attributes of the node, the connection relationship between the nodes, and the text information of the node.

[0168] For the event graph G, the node feature matrix B ∈ R ((V1+V2+V3)×q) wherein V1 represents the number of device nodes, V2 represents the number of user nodes, V3 represents the number of event nodes, V1+V2+V3 represents the number of all nodes in the event graph G, q is an initial feature dimension, representing the number of node attributes, and is obtained by splicing device features, user features, and time features, for example, device features: IP (3 dimensions) + device type (one-hot, 5 dimensions), outputting 8 dimensions; user features: permission level (1 dimension) + activity level (1 dimension), outputting 2 dimensions; event features: s(f) (1 dimension) + timestamp (1 dimension), outputting 2 dimensions; and q = 8+2+2 = 12.

[0169] In the embodiments of the present application, the layered information aggregation is performed on the event graph by using a convolution formula to output the node feature matrix.

[0170] Specifically, the initial node feature matrix is represented as: Further, an adjacency matrix and a weight matrix of the initial node feature matrix are obtained; and the initial node feature matrix is transformed based on the adjacency matrix and the weight matrix to obtain the node feature matrix H (1), further transform the node feature matrix H (1) based on the adjacency matrix and the weight matrix of H (1) to obtain the node feature matrix H (2) of the second layer, until the node feature matrix H of the Lth layer is obtained.

[0171] The transformation of the node feature matrix can be achieved through a convolution formula:

[0172]

[0173] wherein H represents the node feature matrix of the (l+1)th layer, H represents the node feature matrix of the lth layer, and σ represents a ReLU activation function. represents a normalized adjacency matrix, W represents the trainable weight matrix of the lth layer. It is to be noted that the values of W are learned through a back propagation algorithm during the model training phase. During the training process, the model calculates the error between the predicted result and the true label according to a loss function (such as cross-entropy loss), and then iteratively updates the values of W using a gradient descent algorithm, so that the model can automatically learn the mapping relationship between the node features and the structure in the graph data.

[0174] In some embodiments, the event feature includes an anomaly score s(f), and the conduction path of the anomaly score s(f) in the convolution is as follows: initial feature: first layer convolution: second layer convolution:

[0175] ...final feature: . After the hierarchical information aggregation through the convolution formula, the node feature matrix H that integrates the neighborhood information is output. The anomaly score s(f) affects all subsequent feature representations through the weight matrix W .

[0176] In some preferred embodiments, the output node feature matrix is subjected to key contact enhancement to obtain an enhanced key contact node feature matrix H'. Optionally, the attention weight of any node to a neighbor node is determined based on the degree of association between the any node and the neighbor node in the event graph, and the feature of the any node is enhanced based on all the attention weights corresponding to the any node to obtain an enhanced key contact node feature matrix.

[0177] In some preferred embodiments, the output node feature matrix is subjected to key contact enhancement to obtain an enhanced key contact node feature matrix H'.

[0178] Optionally, the attention weight of any node to a neighbor node is determined based on the degree of association between the any node and the neighbor node in the event graph, and the feature of the any node is enhanced based on all the attention weights corresponding to the any node to obtain an enhanced key contact node feature matrix.

[0179] It can be understood that the higher the value of the attention weight between two nodes indicates the stronger the relevance of the two in the network security event analysis, and the relevance between any node and the neighbor node can be quantified by calculating the attention weight between the two.

[0180] Taking the i-th node as an example, the j-th node is a neighbor node of the i-th node, and the attention weight between the i-th node and the j-th node can be calculated by the following formula :

[0181]

[0182] wherein exp() represents an exponential function with a natural constant e as a base number, represents the feature vector of the i-th node, represents the feature vector of the j-th node, represents the feature vector of the k-th node, and W represents a trainable weight matrix, represents the neighbor node set of the i-th node.

[0183] In the embodiments of the present application, the weight matrix W is used to map the feature vector to a higher dimensional space, and enhance the feature expression capability.

[0184] Further, the calculated weighted aggregation operation is implemented to enhance the features.

[0185] As an example, the updated feature can be determined by the following formula:

[0186]

[0187] wherein, represents the feature vector of the i-th node updated feature vector, represents the attention weight of the i-th node to the j-th node, and the j-th node belongs to the neighbor node set of the i-th node , and σ represents the ReLU activation function.

[0188] The neighbor node features are fused according to the importance, and through multi-layer stacking, high-order correlations among devices, users and events are gradually captured, and an enhanced key correlation node feature matrix H' composed of updated feature vectors is output.

[0189] Further, the node feature matrix is classified to obtain a category probability vector, wherein any element in the category probability vector corresponds to the probability of an event type; the numerical values of the elements in the category probability vector are compared to determine the event type corresponding to the element with the largest probability as the event type.

[0190] The node feature matrix H or the node feature matrix H' that enhances key associations is input into a fully connected layer or a classifier (such as the Softmax function) to obtain a class probability vector.

[0191] As an example, the node feature matrix H' that enhances key associations is input into the Softmax function, using the formula: The category probability vector y is calculated. event .

[0192] Among them, W class This is the classification weight matrix, used to map node features to the corresponding category space, and to learn the optimal parameters for category differentiation through training.

[0193] Furthermore, the event type is determined by applying the maximum probability principle to the category probability vector: Category probability vector y event Each element in the algorithm corresponds to a probability of an event type. By comparing the values ​​of each element, the event type corresponding to the element with the highest probability value is selected as the final determination. For example, if y event If the probability value of an intrusion event is the highest, then the current event is determined to be an intrusion event. event Its function is to quantify the probability that a node belongs to different event categories, and finally determine the event type, thereby achieving automated event classification and risk identification.

[0194] In some embodiments, after identifying abnormal event nodes, event type identification can also be performed using association rule mining algorithms.

[0195] As an example, after detecting anomaly samples via s(f), the system utilizes the Apriori algorithm (an association rule mining algorithm) to further analyze the association relationships between the features of the anomaly samples and other features. When analyzing feature association relationships, the association rule mining algorithm mines association rules between features. Setting the minimum support threshold as min_sup and the minimum confidence threshold as min_conf, the system generates frequent itemsets and association rules to obtain the association relationships between event features. Here, min_sup and min_conf are set by the user according to actual needs.

[0196] For example, if the abnormal sample contains specific network attack features (such as specific port scanning patterns, communication features of malware, etc.), and these features match the preset event type rules, the system can determine the event type. At the same time, the system combines other information such as the time, location, devices and users involved in the event, to comprehensively determine the event type. For example, if a large number of access requests from the same IP address segment are sent to the specific ports of multiple servers at the same time within a short period of time, and the characteristics of these access requests match the characteristics of a denial of service attack (DDoS), the system will determine that the event is a DDoS attack event.

[0197] In step S60, based on the event type, the abnormal score, the event occurrence time, the event occurrence location, and the attack path, a network security event analysis result is generated, wherein the attack path is determined by the path connected by the abnormal event nodes.

[0198] Optionally, the event type is determined by the event analysis result; and the abnormal score reflects the severity of the event.

[0199] Optionally, the event time field can be extracted from the log data, and for cross-device events (such as distributed attacks), the time of each device is synchronized through the network time protocol (NTP) to ensure the consistency of the time stamp, and the event occurrence time is determined.

[0200] Optionally, the event occurrence location includes the device location and the user location, the IP address is mapped to the geographic location (country / region, city) through an IP geolocation database (such as MaxMind), the physical location of the device (such as the data center floor, the cabinet number) is obtained from the asset database to determine the device location; and the IP address of the user when logging in is analyzed, and if the user uses a mobile device, the GPS or base station positioning data is combined to determine the user location.

[0201] Optionally, the attention weight is determined by The high-weight path connected with the event node is extracted to determine the attack path.

[0202] The embodiments of the present application realize the propagation and aggregation of information on the graph structure through the operation of the node feature matrix and the adjacency matrix, so that each node can fuse the feature information of its neighbor nodes, thereby learning a more expressive feature representation, laying a foundation for the accurate classification of subsequent event nodes. In the hierarchical convolution operation process, each convolution operation transforms the node features through a weight matrix and realizes information transmission between nodes in combination with the adjacency matrix, and high-order graph structure features are gradually extracted through multiple convolution layers. Through multiple convolution operations, not only the local neighborhood features of the nodes can be effectively extracted, but also information can be gradually propagated in the graph structure, and the potential complex correlation between the nodes can be mined, thereby providing a more comprehensive and more representative feature basis for subsequent complex event recognition based on correlation analysis.

[0203] In some embodiments, after determining the event analysis result, a corresponding response strategy can be matched according to the set response rule library.

[0204] Optionally, the response strategy includes isolating the attack source, blocking the network connection, recording the event log, sending the alarm notification, and baseline guidance, etc.

[0205] It can be understood that the response rule library pre-defines the processing measures corresponding to different event types and severity, and by matching the event analysis result, a corresponding response strategy is selected, such as for a serious intrusion event, triggering the strategy of isolating the attack source and blocking the network connection; for a general abnormal event, recording the event log and sending the alarm notification.

[0206] As an example, the baseline guidance strategy can be: for device gene tampering, the response action is: isolating the device and restoring the reference firmware; for protocol entropy mutation, the response action is: blocking the abnormal session and resetting the protocol stack configuration; for supply chain path anomaly, the response action is: disconnecting the high-risk path and enhancing the path audit.

[0207] Further, the execution result of the response strategy and the network state data after execution are collected, and compared with the network state data before execution to judge the execution effect of the response strategy, so as to realize security verification. If the security verification is passed, it means that the response strategy is effective, the network system recovers to a safe state, and the process ends; if the verification is not passed, feedback information is generated, and the process returns to the event analysis step or the response decision step, and the analysis and decision process is adjusted again.

[0208] Optionally, after collecting the network state data, the dimension index values are calculated, and the feature vector is constructed through the dimension index values to serve as the verification basis. The network state data includes the network topology graph, the user behavior sequence, the traffic anomaly index, the log correlation degree, and the system performance index.

[0209] As an example, the security verification can be performed through the following process:

[0210] Network state data before and after the collection strategy response, including network topology graph (adjacency matrix A), user behavior sequence (x t ), traffic anomaly indicators, log correlation degree and system performance indicators.

[0211] The network topology graph acquisition method comprises:

[0212] Active detection: using ICMP / TCP protocol scanning (such as Nmap); Protocol analysis: analyzing LLDP (Link Layer Discovery Protocol), CDP (Cisco Discovery Protocol) to obtain device connection relationship; Controller integration: SDN controller (OpenDaylight / ONOS) provides a full network topology view, and an API interface returns a JSON format topology.

[0213] The adjacency matrix A is output after collection.

[0214] Further, the values of each dimension indicator are calculated to construct a feature vector .

[0215] The difference topology difference of the adjacency matrix of the network connection graph before and after the response is calculated by the formula: , The greater the value, the more significant the network connection change, wherein is the adjacency matrix of the network before the response; is the adjacency matrix of the network after the response; N is the number of network device nodes.

[0216] The user behavior anomaly score is calculated by the formula:

[0217]

[0218] s user , wherein T is the length of the sliding window time; x t is the real-time behavior feature (such as login time, access frequency); is the normal behavior feature predicted by the LSTM model.

[0219] The traffic anomaly indicators include traffic anomaly entropy value and connection number fluctuation rate. The data packets are collected in real time by a network traffic probe (such as Bro / Zeek, Wireshark), and the traffic anomaly entropy value is calculated by the proportion of traffic of various protocols (such as HTTP, DNS). The higher the entropy value, the more complex the traffic, and the higher the abnormality.

[0220] Further, the traffic anomaly score is calculated by the formula:

[0221] ​​

[0222] The number of connections is calculated.

[0223] For the log correlation degree, the frequent item set in the log is mined based on the Apriori algorithm, and the matching rate of the real-time log and the historical frequent rule is calculated as the correlation degree by taking the ratio of the number of matched frequent rules to the total number of detected rules, that is, the log correlation degree.

[0224] For the system performance index, the CPU usage, memory usage, disk I / O, etc. are collected through the device monitoring interface (such as Prometheus, Zabbix), and it is judged whether the system performance is abnormal. Taking CPU as an example, the formula is:

[0225]

[0226] The CPU utilization is calculated, and if it exceeds 80% for more than 5 minutes, it is considered to be abnormal.

[0227] The feature vector constructed is represented as:

[0228] .

[0229] Further, the input weighted support vector machine (WSVM) model outputs the verification result, wherein the verification result is pass or fail.

[0230] As an example, WSVM is used to integrate multi-dimensional indicators, and the formula is: .

[0231] wherein, represents the weight obtained by WSVM training, b represents the bias obtained by WSVM training, represents a Gaussian kernel function, represents a verification label.

[0232] It should be noted that the Gaussian kernel function is used to measure the similarity of samples, and the verification label is 1 and -1, wherein 1 represents safety and -1 represents insecurity.

[0233] The verification result is as follows:

[0234] f(X)=1: verification passes, the network security state returns to normal, and the process ends.

[0235] f(X)=-1: verification fails, there is a residual security risk, triggers secondary verification, reconstructs the event graph, and updates the association relationship.

[0236] Wherein, the steps of reconstructing the event graph are:

[0237] Collect new data, including real-time device gene G device ​, abnormal protocol entropy, attack path weight.

[0238] The event graph is updated by adding new event nodes (such as secondary attack events) and updating edge weights (such as the communication frequency w ij between devices). ij ) between devices.

[0239] The baseline is updated by the following formula:

[0240]

[0241] wherein, represents the historical weight coefficient, 0≤ ≤1; E baseline represents the historical protocol entropy baseline value (old value before updating); E normal represents the newly observed normal traffic protocol entropy value, which is calculated by the formula .

[0242] Add new legal device hash to the device gene library; recalculate M SUPPLY [i,j] based on new practice flow and update the supply chain topology matrix.

[0243] Update target: adapt the model to new attack patterns (such as changes in horizontal movement path).

[0244] During verification, verify the device gene compliance (whether in the benchmark library) and the legality of the supply chain path: the device gene benchmark library is used to judge the legality of the device, if the device gene hash value is not in the benchmark library, it is considered that the device is at risk; the baseline threshold of the supply chain topology matrix is used to judge whether the interaction path between devices is normal, if M SUPPLY [i,j] is over the baseline threshold, it is determined as a cross-vendor low-frequency horizontal movement attack.

[0245] When the security verification fails, for example, the attack path is not completely blocked, new abnormal behavior patterns appear, etc., real-time device DNA, abnormal protocol entropy value, attack path weight, etc. Information is stored in the feedback queue, and then triggers baseline adaptive update.

[0246] When updating the correlation relationship of the overall system, an automatic update strategy based on incremental learning algorithm is adopted. Taking the protocol entropy baseline value E baseline as an example, the formula is used for exponential moving average calculation, in this way, the baseline value can gradually adapt to the new attack pattern.

[0247] For the device gene benchmark library, when a new legal device gene hash value G deviceWhen this happens, it will be added to the benchmark library, thereby expanding the benchmark library to more comprehensively cover the characteristics of legitimate devices.

[0248] Based on the changes in inter-device interaction events within the time window, the supply chain topology matrix M is recalculated. SUPPLY [i,j] When a new normal cross-vendor device interaction path is detected, or when the interaction frequency and weight of an existing path change significantly and reasonably, the baseline threshold of the corresponding path will be updated. For example, if a company introduces a new supplier partnership, resulting in a change in the interaction mode between devices, the system will update the baseline of the supply chain topology matrix based on the new interaction data to accurately identify future abnormal lateral movement behavior.

[0249] The conclusion of security incident analysis employs a multi-condition fusion strategy, organically combining dynamic thresholds, indicator trends, and manual confirmation, as detailed below:

[0250] Normal termination: Taking f(X)=1 as the core, when f(X)=1, the verification passes and the process ends. In other embodiments, additional indicator verification can be added as needed.

[0251] Abnormal Loops: Forced termination is achieved through a triple mechanism of maximum retry count, time threshold, and early warning of sudden indicator changes to prevent resource exhaustion; for example, when f(X) = -1, the cumulative number of loops reaches 5, or a single loop takes more than 1 hour, or a new high-risk indicator appears during the loop (e.g., a sudden increase in ΔA, etc.). s user (Breaking historical records).

[0252] Gradual recovery: Allows the process to end once the indicators have decayed to the target level, adapting to the natural recovery scenario of low-risk anomalies.

[0253] While ensuring security, it also takes into account system efficiency and actual operation and maintenance needs, forming a complete "detection-response-verification-termination" closed loop.

[0254] This application's embodiments incorporate three types of heterogeneous nodes—device, user, and event—into a unified event graph structure. The ternary entity association detection and analysis solves the chain analysis problem in APT attacks, which involves "attack entry point (user) → lateral movement (device) → attack target (event)". It separates topological differences from abnormal user behavior and integrates indicators for analysis and judgment, thus solving the problem of misjudgment by a single indicator. Through the WSVM adaptive decision-making dynamic adjustment mechanism, it improves the decision sensitivity of key abnormal indicators.

[0255] The application can simultaneously process network flow data, system log data, security device log data and other multi-source heterogeneous data through multi-source data fusion processing, fully utilize the information of various data through data preprocessing and feature extraction, and improve the accuracy of event analysis; in combination with an abnormality detection algorithm and an association rule mining algorithm, not only known attack patterns can be detected, but also potential abnormal behaviors and the association relationship between event characteristics can be found, and strong dynamic adaptability is achieved; through a security verification mechanism, the execution effect of a response strategy is verified, it is ensured that a network system can truly recover to a safe state, and the reliability and effectiveness of the system are improved.

[0256] Although the steps are described in the above-mentioned order in the above embodiments, it can be understood by those skilled in the art that, in order to achieve the effect of the embodiments, the different steps do not have to be executed in such an order, and they can be executed simultaneously (in parallel) or in a reversed order, and these simple changes are within the protection scope of the application.

[0257] Please refer to Figure 2 The network security event analysis system of the second embodiment of the application comprises a data verification module 100, a feature extraction module 200, an abnormality detection module 300, an event graph construction module 400, an event type determination module 500 and an event analysis result generation module 600.

[0258] The data verification module 100 is used for acquiring network security data sets of target devices in a network security monitoring range, and performing business logic compliance verification on the network security data sets to determine normal data meeting the verification and suspicious data not meeting the verification.

[0259] The feature extraction module 200 is used for constructing a multi-dimensional baseline for the suspicious data, and generating a composite feature vector in combination with a feature vector of the normal data.

[0260] The abnormality detection module 300 is used for identifying an abnormal row in the composite feature vector as an abnormal event node based on an abnormality score obtained by performing abnormality detection on the composite feature vector.

[0261] The event graph construction module 400 is used for constructing an event graph based on the relationship between different target devices, the relationship between the target devices and users, and the relationship between the target devices and the abnormal event nodes.

[0262] The event type determination module 500 is used for performing hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is used for determining an event type.

[0263] The event analysis result generation module 600 is configured to generate a network security event analysis result based on the event type, the anomaly score, the event occurrence time, the event occurrence location, and the attack path, wherein the attack path is determined by a path in which the abnormal event nodes are connected.

[0264] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related description of the system described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0265] It should be noted that the network security event analysis system provided in the above embodiments is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the modules or steps in the embodiments of the present application are further decomposed or combined, for example, the modules of the above embodiments can be combined into one module, or can be further split into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present application are only for distinguishing the modules and steps, and should not be considered as an improper limitation of the present application.

[0266] The electronic device of the third embodiment of the present application comprises:

[0267] at least one processor; and

[0268] a memory in communication connection with the at least one processor; wherein

[0269] The memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to implement the network security event analysis method.

[0270] The computer readable storage medium of the fourth embodiment of the present application stores computer instructions, and the computer instructions are used to be executed by the computer to implement the network security event analysis method.

[0271] The computer program product of the fifth embodiment of the present application, when running on the electronic device, makes the electronic device execute the network security event analysis method.

[0272] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related description of the electronic device, the computer readable storage medium and the computer program product described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0273] Those skilled in the art should clearly understand that the modules and method steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. The programs corresponding to the software modules and method steps can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. In order to clearly illustrate the interchangeability of electronic hardware and software, the components and steps of each example have been generally described in the above description. Whether the functions are performed by electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0274] Reference is made below to Figure 3 which shows a structural schematic diagram of a computer system of a server for implementing the embodiments of the method, system and device of the present application. Figure 3 The server shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0275] As Figure 3 shown, the computer system includes a central processing unit (CPU) 301 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 302 or loaded from a storage portion 308 into a random access memory (RAM) 303. Various programs and data required for system operation are also stored in the RAM 303. The CPU 301, the ROM 302 and the RAM 303 are connected to each other through a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0276] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as necessary. A removable medium 311 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 310 as necessary, so that a computer program read out therefrom is installed in the storage section 308 as necessary.

[0277] In particular, according to embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 309, and / or installed from the removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above-described functions defined in the methods of the present application are performed. Note that the computer readable medium described above in the present application can be either a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. Program code contained in the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical fiber cable, RF, and the like, or any suitable combination of the above.

[0278] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0279] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0280] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. For example, singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0281] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. For example, singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0282] The technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical schemes after the changes or replacements will all fall within the protection scope of the present application.

Claims

1. A cyber-security event analysis method, characterized by, The method comprises the following steps: acquiring network security data sets of each target device within a network security monitoring range, and performing business logic compliance verification on the network security data sets to determine normal data that meets the verification and suspicious data that does not meet the verification; constructing a multi-dimensional baseline for the suspicious data and generating a composite feature vector in combination with a feature vector of the normal data; identifying an abnormal row in the composite feature vector as an abnormal event node based on an abnormal score obtained by performing abnormality detection on the composite feature vector; constructing an event graph based on relationships between different target devices, relationships between the target devices and users, and relationships between the target devices and the abnormal event node; performing hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is used to determine an event type; generating a network security event analysis result based on the event type, the abnormal score, an event occurrence time, an event occurrence location, and an attack path, wherein the attack path is determined through a path connected by the abnormal event node; wherein the step of constructing a multi-dimensional baseline for the suspicious data and generating a composite feature vector in combination with a feature vector of the normal data comprises the following steps: acquiring a multi-dimensional baseline based on a digital fingerprint of a target device where the suspicious data is located, a protocol entropy value of protocol analysis data of the suspicious data, and a probability of initiating an event between different target devices; performing feature extraction on text data and numerical data in the normal data respectively to obtain a feature vector set; integrating the multi-dimensional baseline into the feature vector set to generate the composite feature vector.

2. The network security event analysis method of claim 1, wherein, The step of acquiring a multi-dimensional baseline comprises the following steps: acquiring a function code set extracted by protocol analysis of the network security data set, and determining a protocol entropy value based on a probability distribution of the function code set; treating the probability of initiating an event between a first target device and a second target device as an element corresponding to a device pair, traversing all device pairs to construct a supply chain topology matrix, wherein the device pair is composed of the first target device and the second target device, and the rows and columns of the supply chain topology matrix are target device indexes; composing the multi-dimensional baseline from the digital fingerprint, the protocol entropy value, and the supply chain topology matrix.

3. The network security event analysis method of claim 1, wherein, The step of acquiring a feature vector set comprises the following steps: for text data in the normal data, extracting text features based on the frequency of occurrence of any term in any log record and the inverse document frequency of the any term in the text data, wherein the text data comprises multiple log records; for numerical data in the normal data, extracting all numerical data to form an original feature matrix, and extracting numerical features by dimension reduction on the original feature matrix; composing the feature vector set from the text features and the numerical features.

4. The network security event analysis method of claim 1, wherein, The step of identifying an abnormal row in the composite feature vector as an abnormal event node comprises the following steps: randomly extracting a sample subset from the composite feature vector for recursive division to construct an isolation forest; performing abnormality detection on any row in the composite feature vector set based on the isolation forest to determine an abnormal score of the any row; In a case where the abnormal score of any row is greater than or equal to an abnormal threshold, determine the any behavior abnormal event node.

5. The network security event analysis method of claim 1, wherein, The event graph is constructed based on: Determine device edges based on communication relationships between target devices, determine user-device edges based on access relationships of users to the target devices, and determine event-device edges based on target devices associated with abnormal event occurrences. Take the target devices as device nodes, take user entities accessing the target devices as user nodes, and take the abnormal event nodes as event nodes.

6. The network security event analysis method of claim 1, wherein, Combine the device edges, the user-device edges, and the event-device edges to construct the event graph. The method further includes: Determine attention weights of any node in the event graph to neighbor nodes based on degrees of association between the any node and the neighbor nodes; 7. The network security event analysis method of claim 1 or 6, wherein, Perform feature enhancement on the any node based on all attention weights corresponding to the any node to obtain an enhanced key-association node feature matrix. The node feature matrix is used to determine an event type, including: Classify the node feature matrix to obtain a category probability vector, wherein any element in the category probability vector corresponds to a probability of an event type; 8. A cyber-security event analysis system characterized by, Compare numerical values of elements in the category probability vector to determine an event type corresponding to an element with the largest probability as the event type. The method includes: A data verification module is configured to obtain network security data sets of target devices within a network security monitoring range, and perform business logic compliance verification on the network security data sets to determine normal data that meets the verification and suspicious data that does not meet the verification; A feature extraction module is configured to construct a multi-dimensional baseline for the suspicious data, and generate a composite feature vector in combination with a feature vector of the normal data; An anomaly detection module is configured to identify an abnormal row in the composite feature vector as an abnormal event node based on an abnormal score obtained by performing anomaly detection on the composite feature vector; An event graph construction module is configured to construct an event graph based on relationships between different target devices, relationships between the target devices and users, and relationships between the target devices and the abnormal event nodes; An event type determination module is configured to perform hierarchical information aggregation on the event graph to obtain a node feature matrix, wherein the node feature matrix is used to determine an event type; An event analysis result generation module is configured to generate a network security event analysis result based on the event type, the abnormal score, an event occurrence time, an event occurrence location, and an attack path determined through a path connected by the abnormal event nodes. The method includes: Obtain a multi-dimensional baseline based on a digital fingerprint of a target device where the suspicious data is located, a protocol entropy value of protocol analysis data of the suspicious data, and a probability of event initiation between different target devices; Perform feature extraction on text data and numerical data in the normal data respectively to obtain a feature vector set; 9. An electronic device, comprising: Integrate the multi-dimensional baseline into the feature vector set to generate the composite feature vector. The method includes: at least one processor; and a memory in communication with the at least one processor; wherein the memory has stored instructions executable by the processor for execution by the processor to implement the method of any one of claims 1-7.

Images