A network situation monitoring system and method

Abstract

The application relates to the technical field of network monitoring, and provides a network situation monitoring system and method, wherein entities and relations of multi-source data are extracted by a perception fusion module, and causal rules of an attack behavior knowledge base are combined to construct a network situation graph, a causal correlation of an attack chain is identified by combining time sequence analysis and a causal discovery algorithm, and the problems of attack chain identification fragmentation and risk path prediction distortion in the prior art are solved; a simulation verification module generates a dynamic mirror based on a behavior feature library of the entity to construct an isolated simulation environment, simultaneously correlates and calculates a performance value of the causal strength of the attack chain and a defense effect, and provides a precise basis for defense strategy screening; and a response feedback module takes the performance value as a reward function, optimizes the defense strategy through reinforcement learning, simultaneously updates the network situation graph, the attack behavior knowledge base and the isolated simulation environment through a feedback mechanism, and significantly improves the response capability of the system to complex attacks and attack variations.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network monitoring, in particular to a network situation monitoring system and method. BACKGROUND

[0002] With the complication of network attack means and the heterogeneity of network environment, network situation monitoring has become the core technology to guarantee network security. In the prior art, isolated alarm data is collected through an intrusion detection system and a firewall and the like, but only single-point threat detection can be achieved, and global situation cannot be associated and analyzed. There are also schemes for identifying attack behaviors based on rule matching or simple machine learning by integrating multi-source data, but data fusion stays at surface association, and lacks deep analysis of attack chain causality logic. Meanwhile, some schemes introduce a simulation environment to verify a defense strategy, but the simulation environment is mostly constructed based on static states, and there is deviation from the real environment, and the optimization of the defense strategy relies on artificial experience, and lacks a dynamic iteration mechanism.

[0003] Based on the above deficiencies, the technical problem to be solved by the present application is how to realize closed-loop monitoring of accurate perception, reliable verification and dynamic optimization of network attacks in a complex network environment. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application provides a network situation monitoring system and method.

[0005] In a first aspect, the present application provides a network situation monitoring system, which comprises a perception fusion module, a simulation verification module and a response feedback module.

[0006] The perception fusion module is configured to acquire multi-source data including network traffic logs, asset configuration databases and threat intelligence, extract entities and relationships of the multi-source data, and combine an attack behavior knowledge base storing attack chain patterns and causality rules to construct a network situation graph, and process and analyze the network situation graph through time series analysis and causality discovery algorithms to identify attack chains and risk transmission paths.

[0007] The simulation verification module is configured to construct an isolated simulation environment based on the network situation graph and dynamic mirroring of the attack chain, inject the attack chain in the isolated simulation environment, simulate a defense strategy and evaluate an effectiveness value of the defense strategy to generate a simulation verification result.

[0008] The response feedback module is configured to receive the attack chain, the risk transmission path and the simulation verification result, take the effectiveness value of the defense strategy as a reward function, optimize the defense strategy through reinforcement learning, and issue the defense strategy to an operation and maintenance system through an automatic and semi-automatic interface for execution, monitor actual effects after execution of the defense strategy, and feed back to update the network situation graph, the attack behavior knowledge base and the isolated simulation environment.

[0009] As an optional implementation, the attack chain and risk transmission path identification logic comprises:

[0010] The relationship of the entity in the network situation graph is constructed into a time sequence subgraph through time sequence analysis, and attack steps are identified in the time sequence subgraph as candidate attack chains;

[0011] The relationship in the candidate attack chain is analyzed for causality through a causal discovery algorithm, the causality strength between attack steps is calculated, and attack chains with causality strength greater than a strength threshold are screened out;

[0012] Taking the initial attack node in the attack chain as the starting point, a risk transmission directed graph is constructed in combination with the node reachability and node dependency relationship in the network situation graph, and the risk transmission coefficient of each node is calculated through a page rank algorithm to identify the risk transmission path and occurrence probability.

[0013] As an optional implementation, the network situation graph construction sub-logic comprises:

[0014] The acquired multi-source data including network traffic logs, asset configuration databases and threat intelligence are subjected to hierarchical preprocessing;

[0015] The entities of the multi-source data are extracted through a graph convolution network, and the relationship of the entities is extracted based on a long short-term memory network and a conditional random field, while the entities of the multi-source data are aligned according to the attribute similarity and relationship consistency of the entities;

[0016] The attack chain patterns and causal rules stored in the attack behavior knowledge base are extracted, the extracted entities are semantically mapped with the attack chain patterns, and the extracted relationships are matched with the causal rules to obtain the confidence of the relationships and the causality strength;

[0017] The network situation graph is constructed with the entities as nodes and the relationships as edges between the nodes, and the edges are assigned weights according to the confidence and causality strength of the relationships.

[0018] As an optional implementation, the dynamic mirror comprises:

[0019] The behavior sequence of the entity is captured in real time through a probe, and the behavior sequence of the entity includes the operation behavior of the asset entity, the network interaction feature and the attack feature of the threat entity;

[0020] The behavior sequence of the entity is subjected to feature dimension reduction, and the behavior identifier is assigned to each entity to construct the behavior feature library of the entity;

[0021] The dynamic mirror of the entity state at any time point is generated based on the behavior feature library of the entity.

[0022] As an optional implementation, the simulation verification result generation logic comprises:

[0023] based on the behavior feature library of the entity in the dynamic mirror image, injecting an attack behavior sequence in the isolated simulation environment according to the timestamp of the attack chain, wherein the attack behavior sequence is associated with the behavior identifier and the behavior feature of the entity;

[0024] deploying multiple sets of defense strategies in the isolated simulation environment, and obtaining the attack blocking success rate, business interruption time, resource consumption and false positive rate under different defense strategies by comparing the behavior features of the entity;

[0025] associating and calculating the attack blocking success rate, business interruption time, resource consumption and false positive rate with the causal strength of the attack chain to obtain the performance value of the different defense strategies;

[0026] According to the performance value, the defense strategy is screened, and the simulation verification result including the adaptation degree of the defense strategy to the behavior feature of different entities, the coverage degree of the association rule to the attack chain and the execution cost is generated.

[0027] As an optional implementation, the construction sub-logic of the isolated simulation environment includes:

[0028] According to the behavior feature library of the entity in the dynamic mirror image, the behavior feature of the simulated entity and the association rule of the attack chain are extracted, resources are allocated and isolated network domains are created through the virtualization resource pool;

[0029] The network topology and protocol parameters of the attack chain are replicated through the minimum spanning tree algorithm, and the security rules are adapted in the isolated network domain to construct the isolated simulation environment;

[0030] The entity matching the real environment is integrated into the isolated simulation environment, and the behavior feature library of the entity is implanted, and the function and performance error between the isolated simulation environment and the real environment is calibrated to adjust the isolated simulation environment.

[0031] As an optional implementation, the feedback update logic of the network situation map includes:

[0032] Monitoring the actual effect after the execution of the defense strategy, adjusting the attributes of the entity in the multi-source data, and marking the timestamp and change reason of the state change of the entity;

[0033] Judging the change amount of the relationship before and after the execution of the defense strategy, and adjusting the weight of the confidence degree of the relationship according to the proportion of the change amount;

[0034] When the defense strategy intercepts new attack behaviors, automatically adding new attack nodes and new relationships, and assigning initial confidence degrees to the new relationships to feedback and update the network situation map.

[0035] As an optional implementation, the feedback update logic of the attack behavior knowledge base includes:

[0036] The actual intercepted attack behavior sequence of the contrast defense strategy is compared with the attack chain mode in the attack behavior knowledge base, the variation point of the attack chain mode is identified through a sequence comparison algorithm, a new attack chain mode is generated and the variation probability is marked;

[0037] Based on the change of the risk transmission path after the execution of the defense strategy, the strength threshold of the causal rule in the attack behavior knowledge base is corrected;

[0038] Based on the coverage in the simulation verification result, the attack behavior not covered is extracted to generate candidate rules to update the attack behavior knowledge base.

[0039] As an optional implementation, the optimization sub-logic of the defense strategy includes:

[0040] The causal strength of the attack chain, the occurrence probability of the risk transmission path and the adaptation degree and coverage in the simulation verification result are taken as state variables to form a state space of reinforcement learning;

[0041] The defense strategy is decomposed into defense actions, each defense action is associated with an execution cost to form an action space of reinforcement learning;

[0042] The performance value of the defense strategy is taken as a reward function, the defense action sequence is searched in the state space through Monte Carlo tree search, and the reward function is corrected in combination with the actual effect monitored by the operation and maintenance system in each iteration to optimize the defense strategy.

[0043] In a second aspect, the present application provides a network situation monitoring method, which comprises: acquiring multi-source data, extracting entities and relationships of the multi-source data, and combining an attack behavior knowledge base storing attack chain modes and causal rules to construct a network situation graph, and simultaneously processing and analyzing the network situation graph through time series analysis and causal discovery algorithm to identify attack chains and risk transmission paths;

[0044] Based on the dynamic mirroring of the network situation graph and the attack chain, an isolated simulation environment is constructed, the attack chain is injected into the isolated simulation environment, the defense strategy is simulated and the performance value of the defense strategy is evaluated to generate a simulation verification result;

[0045] The attack chain, the risk transmission path and the simulation verification result are received, the performance value of the defense strategy is taken as a reward function, the defense strategy is optimized through reinforcement learning, and is issued to the operation and maintenance system through an automatic and semi-automatic interface for execution;

[0046] The actual effect after the execution of the defense strategy is monitored, and the network situation graph, the attack behavior knowledge base and the isolated simulation environment are updated.

[0047] Compared with the prior art, the beneficial effects of the present application are: through the perception fusion module to extract the entities and relationships of multi-source data and combine the causal rules of the attack behavior knowledge base, a network situation map is constructed, the causal correlation of the attack chain is identified by combining the time sequence analysis and the causal discovery algorithm, and the problems of fragmentation of attack chain identification and distortion of risk path prediction in the prior art are solved; the simulation verification module generates a dynamic mirror based on the behavior characteristic library of the entity to construct an isolated simulation environment, ensures the function and performance consistency of the isolated simulation environment and the real environment, and at the same time, the causal strength of the attack chain and the defense effect are associated to calculate the performance value, solving the problems of simulation environment distortion and one-sided strategy evaluation, and providing accurate basis for defense strategy screening; the response feedback module takes the performance value as the reward function, optimizes the defense strategy through reinforcement learning, and at the same time, updates the network situation map, the attack behavior knowledge base and the isolated simulation environment through the feedback mechanism, solving the problems of static defense strategy and poor adaptability in the prior art, and significantly improving the response capability of the system to complex attacks and attack variations. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. Among them:

[0049] Figure 1 A principle flow chart of a network situation monitoring system provided by the embodiments of the present application;

[0050] Figure 2 A generation logic chart of simulation verification results of a network situation monitoring system provided by the embodiments of the present application;

[0051] Figure 3 An optimization sub-logic chart of a defense strategy of a network situation monitoring system provided by the embodiments of the present application;

[0052] Figure 4 A step flow chart of a network situation monitoring method provided by the embodiments of the present application. DETAILED DESCRIPTION

[0053] In order to make the purposes, technical solutions and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings of the specification. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments.

[0054] Embodiment 1

[0055] As Figure 1As shown, a principle flow chart of a network situation monitoring system is provided in the embodiments of the present application, which includes a perception fusion module, a simulation verification module and a response feedback module.

[0056] The perception fusion module is used to acquire multi-source data including network traffic logs, asset configuration databases and threat intelligence, extract entities and relationships of the multi-source data, and combine an attack behavior knowledge base storing attack chain patterns and causal rules to construct a network situation graph, and analyze the network situation graph through time series analysis and causal discovery algorithm to identify attack chains and risk transmission paths.

[0057] Further, the construction of the network situation graph includes:

[0058] The acquired multi-source data including network traffic logs, asset configuration databases and threat intelligence are subjected to hierarchical preprocessing;

[0059] The entities of the multi-source data are extracted through a graph convolution network, and the relationships of the entities are extracted based on a long short-term memory network and a conditional random field, and the entities of the multi-source data are aligned according to the attribute similarity and relationship consistency of the entities;

[0060] The attack chain patterns and causal rules stored in the attack behavior knowledge base are extracted, the extracted entities are semantically mapped with the attack chain patterns, and the extracted relationships are matched with the causal rules to obtain the confidence of the relationships and the causal strength;

[0061] The network situation graph is constructed with the entities as nodes and the relationships as edges between the nodes, and the edges are assigned weights according to the confidence of the relationships and the causal strength.

[0062] The sources and formats of network traffic logs, asset configuration data and threat intelligence are significantly different. Network traffic logs contain unstructured alert descriptions and message information, asset configuration data records asset attributes in structured tables, and threat intelligence often presents attack characteristics and vulnerability information in semi-structured text. These differences will cause format conflicts when directly integrating data, and there will be noise or missing values in the original data, which will interfere with the accurate extraction of entities and relationships if not handled. In specific implementation, for unstructured network traffic logs, the natural language description in them is semantically analyzed by a pre-trained language model, and key information such as attack type and IP address involved is extracted and converted into structured fields. For structured asset configuration data, different formats of asset attributes are uniformly converted to a standard format through pre-set field mapping rules, ensuring consistent representation of information such as operating system version and open port. For semi-structured threat intelligence, information extraction technology is used to extract vulnerability numbers and attack characteristics, and compare them with the internally maintained intelligence validity list to filter out outdated intelligence and add time attribute labels to the remaining intelligence. In addition, anomaly detection technology is used to identify and remove noise records in the three types of data. For asset attribute data with missing values, historical interaction data of the asset and typical configurations of similar assets are combined to complete the data reasonably. Thus, the format barriers of multi-source data are eliminated, the data quality is improved, and standardized and high-quality inputs are provided for the subsequent extraction of entities and relationships, avoiding extraction bias caused by data format confusion or noise interference.

[0063] In the preprocessed multi-source data, the same entity is represented differently in different data sources, for example, the same server is represented by IP address in traffic log and by device name in asset configuration data. If not unified, it will cause entity duplication or omission. At the same time, the relationship between entities is scattered in different data, and part of the relationship needs to be clarified through reasoning. If not extracted and aligned, it will affect the integrity and accuracy of the graph. In specific implementation, the preprocessed multi-source data is subjected to entity extraction through a graph convolution network, and type labels are assigned to the entities according to their attribute characteristics and context information, including assets, vulnerabilities and attacks, etc., and a unique identifier is generated for each entity. For entities with different representations, the entities are identified by comparing their attributes and associated relationships, for example, the assets associated with IP address and device name are determined as the same entity. Then, the explicit and implicit relationships between entities are extracted through the combination of long short-term memory network and conditional random field. The explicit relationship includes the corresponding relationship between assets and open ports and the association relationship between attack behavior and involved IP. The implicit relationship includes that a certain attack behavior exploits a certain vulnerability, which is deduced by analyzing the historical association records of attack behavior and vulnerability in threat intelligence. Finally, according to the attribute similarity and relationship consistency of the entities, the same entities identified are merged into a single node to ensure the uniqueness of the entities. Thus, the problem of inconsistent entity representation and scattered relationship in multi-source data is solved, forming a structured collection of entities and relationships, and ensuring the accuracy and continuity of entities and relationships in subsequent graph construction.

[0064] The set of entities and relationships can only reflect the static association between network elements, and cannot reflect the dynamic logical relationship in the attack scenario, i.e., the sequence and causality between attack steps, and the network situation graph needs to include these dynamic information to realize effective perception of the network situation; In specific implementation, the preset attack chain mode and causality rule are extracted from the attack behavior knowledge base, wherein the attack chain mode includes the typical attack step sequence of scanning, vulnerability exploitation and data stealing, and the causality rule includes the possibility association of a specific attack behavior when a certain vulnerability exists, the extracted entities are semantically associated with the standard entities in the attack chain mode, for example, the specific vulnerability in the data is corresponding to the vulnerability type involved in the attack chain mode in the knowledge base, and the relationship between entities is matched with the causality rule, the confidence and causality strength of the relationship are determined according to the matching degree, and finally the network situation graph is constructed with entities as nodes and the relationship between entities as edges, wherein the nodes include the attributes of the entities, and the weight of the edges is determined according to the confidence and causality strength of the relationship, and at the same time, the network situation graph is hierarchically organized according to the asset layer, the vulnerability layer and the threat layer, and the association between different types of entities is clearly presented; so that the network situation graph not only includes the static association between entities, but also integrates the dynamic causality logic in the attack scenario, which can more comprehensively reflect the security situation of the network, realize the change from data association to situation understanding, and provide rich information basis for the identification of attack chain and risk transmission path, so that the identification process can be accurately carried out based on the semantic and logical relationship of the attack.

[0065] Specifically, the identification logic of the attack chain and the risk transmission path includes:

[0066] The relationship of the entity in the network situation graph is constructed into a time sequence subgraph through time sequence analysis, and the attack step is identified in the time sequence subgraph as a candidate attack chain;

[0067] The causality of the relationship in the candidate attack chain is analyzed by a causality discovery algorithm, the causality strength between the attack steps is calculated, and the attack chain with a causality strength greater than a strength threshold is screened out;

[0068] Taking the initial attack node in the attack chain as the starting point, combining the node reachability and node dependency relationship in the network situation graph, a risk transmission directed graph is constructed, and the risk transmission coefficient of each node is calculated through a page level algorithm to identify the risk transmission path and the occurrence probability.

[0069] The network attack behavior has obvious time sequence characteristics, and the attack steps occur in time sequence. However, the relationship in the network situation graph does not explicitly reflect the time dimension, and the attack step order cannot be directly identified. Therefore, the time sequence analysis is needed to construct a time sequence subgraph to extract the time sequence of the attack. In the implementation, the time information associated with the relationship of the entities in the network situation graph is extracted, including the time of the attack behavior and the time of the asset state change. According to the time sequence, the relationships are sorted, and the time sequence subgraph is constructed. In the time sequence subgraph, the attack steps with regularity are identified through time sequence pattern mining technology. These attack steps usually include multiple continuous attack behaviors, such as port scanning, attempting to exploit vulnerabilities, and finally implementing data theft. At the same time, combined with the business logic of the network, the behavior sequence that is continuous in time but has no actual association is filtered out, such as the normal operation and maintenance of an asset and the attack behavior occurring at the same time, which has no direct association. Therefore, it is not included in the candidate attack chain. The attack steps with time sequence correlation are extracted from the network situation graph, and the order of the attack behavior is determined. The candidate objects for subsequent accurate identification of the attack chain are provided, and the attack chain misjudgment caused by the lack of time dimension is avoided.

[0070] The attack steps that are continuous in time may only occur accidentally at the same time, and there is no necessary causal relationship, such as different attacks on the same asset by different attackers at similar times. If only the time sequence relationship is used, it will be misjudged as the same attack chain. Therefore, the internal relationship between the attack steps needs to be verified through causal analysis. In the implementation, the causal relationship between the attack steps in the candidate attack chain is analyzed through the causal discovery algorithm, and it is determined whether the previous step will lead to the occurrence of the next step. Through the analysis of the dependency relationship between the attack steps, such as whether the vulnerability exploitation depends on the information obtained by the previous port scanning, and whether the data theft depends on the successful implementation of the vulnerability exploitation, the causal strength between the attack steps is determined. According to the preset strength threshold, the attack steps with a causal strength greater than the strength threshold are selected as the effective attack chain, and those that are continuous in time but have no causal relationship are removed. Thus, it is ensured that the identified attack chain is composed of attack steps with internal causal relationship, the accuracy and reliability of the attack chain identification are improved, and accidental association of attack behaviors is avoided.

[0071] The attack chain mainly reflects the attack steps directly implemented by the attacker, while there are complex business dependencies and network connection relationships among assets in the network, and after the attack is successful, other assets are indirectly affected through these relationships. If these risk transmission paths are not identified, the impact range of the attack will be underestimated, so it is necessary to analyze the propagation path of the risk in combination with the asset correlation; in specific implementation, the initial attack node in the attack chain is taken as the starting point, the node dependency relationship and node reachability related to the initial attack node in the network situation graph are obtained, wherein the node dependency relationship includes that a server provides services for multiple terminals, and the node reachability information includes the network connection mode and routing relationship among assets; then, the risk transmission directed graph is constructed in combination with the causal strength of the attack chain, the nodes in the risk transmission directed graph are assets, the edges represent the risk transmission relationship between assets, and the risk transmission coefficient of each node is calculated through the page rank algorithm. The risk transmission coefficient considers factors such as the importance, vulnerability and correlation degree of the asset with the attack node, and finally the risk transmission path with higher risk is identified according to the size of the risk transmission coefficient, and the risk transmission coefficient is normalized to give the occurrence probability of the risk transmission path. These risk transmission paths reflect the main direction in which the attack will spread; thereby comprehensively identifying the asset range affected by the attack through direct and indirect ways, not only including the assets involved in the attack chain, but also the assets affected due to the correlation relationship, providing a basis for formulating a comprehensive defense strategy, and the identified risk transmission path provides a threat scenario that needs to be verified for the simulation verification module, so that the simulation verification can evaluate the effectiveness of the defense strategy according to the high-risk path.

[0072] The simulation verification module constructs an isolated simulation environment based on the dynamic mirror of the network situation graph and the attack chain, injects the attack chain into the isolated simulation environment, simulates the defense strategy and evaluates the effectiveness value of the defense strategy to generate a simulation verification result.

[0073] Specifically, the dynamic mirror includes:

[0074] The behavior sequence of the entity is captured in real time by the probe, and the behavior sequence of the entity includes the operation behavior of the asset entity, the network interaction feature and the attack feature of the threat entity;

[0075] The behavior sequence of the entity is reduced in dimension, and a behavior identifier is assigned to each entity to construct a behavior feature library of the entity;

[0076] The dynamic mirror of the entity state at any time point is generated based on the behavior feature library of the entity.

[0077] The behavior of network entities has dynamic evolution characteristics, and attack behavior will vary over time. Static data cannot reflect the real-time state and interaction rules of entities. If only relying on snapshots at fixed time points, the simulation environment will be difficult to reproduce the timing characteristics of real attacks, leading to distorted evaluation of defense strategies. Therefore, a dynamic mirror-based data layer needs to be constructed by real-time capture. In specific implementation, distributed probes are deployed at network core nodes. The probes use a bypass listening mode to avoid interfering with real business. For asset entities, the process life cycle of the operating system layer, metadata changes of the file system, and command sequences of user operations are captured. The process life cycle includes parent process association and memory mapping changes when the process is created. Metadata changes of the file system include permission modification and access timestamp updates. For network interaction, the establishment or termination timing of sessions, protocol field variations of messages, and link quality fluctuations are recorded. Protocol field variations of messages include dynamic adjustment of TCP window size and abnormal combination of HTTP header fields. Link quality fluctuations include the correlation between packet loss rate and retransmission interval. For threat entities, the instruction chain of attack tools, communication fingerprints with C&C servers, and jump paths between different assets are tracked. The instruction chain of attack tools includes scanning module calls, vulnerability detection script loading, and execution sequences of payload generation. Communication fingerprints with C&C servers include key negotiation characteristics of encrypted traffic. All captured data are attached with high-precision timestamps and entity unique identifiers to form multi-dimensional behavior sequences. Thus, the dynamic characteristics and timing association of entity behavior are completely retained, and behavior fragmentation caused by static snapshots is avoided, providing continuous and complete raw data support for subsequent feature extraction.

[0078] The original behavior sequence contains a large amount of redundant information and noise data, and directly using it for mirror generation will cause a surge in resource consumption and make it difficult to achieve accurate matching of entity behavior. Therefore, the core features need to be extracted through feature dimension reduction, and a structured feature library needs to be constructed to support efficient generation of dynamic mirrors. In specific implementation, the behavior sequence is reduced in dimension through a time sequence feature extraction algorithm. For the operation behavior of the asset entity, a reference template of periodic operation and a key turning point of abnormal operation are extracted through sequence pattern mining. The reference template includes a daily early morning database backup process, and the key turning point of abnormal operation includes permission elevation during non-working hours. For network interaction features, statistical features and abnormal patterns of sessions are extracted through sliding window technology. The statistical features of sessions include the packet volume fluctuation range every 5 minutes, and the abnormal patterns include a sudden SYN packet storm. For attack features, the dependency relationship of attack steps is decomposed through a behavior tree model. For example, a vulnerability exploit must be based on a successful port scan. At the same time, a unique behavior identifier is assigned to each entity. The extracted features are classified and stored according to normal behavior baseline, abnormal behavior pattern and attack feature template to form a behavior feature library of the entity. The behavior feature library supports fast retrieval based on the behavior identifier, and can update the feature template through incremental learning, such as adding features of new attack variants. Thus, redundant information is eliminated, and core features reflecting the essence of entity behavior are extracted, reducing data storage and processing costs. At the same time, the structured feature library provides a unified reference for cross-scene matching of entity behavior.

[0079] The simulation verification needs to reproduce the triggering conditions and entity states of the attack chain at a specific time point, such as the asset configuration and the version of the attack tool at the time of vulnerability exploitation. However, the entity state changes dynamically over time. If the historical or real-time state mirror cannot be generated on demand, the simulation scenario will have a time deviation from the real attack scenario, resulting in a loss of reference value for the evaluation results of the defense strategy. In specific implementation, based on the entity behavior feature library, the behavior features of the target time point are located through the time axis index. The hardware resource occupation state, software configuration parameters and association relationship with other entities of the asset entity at the time point are extracted, including the inflection point of the CPU load curve, the effective version of the firewall rule, and the network connection topology at that time. The feature parameters and attack path progress of the attack tool at the time point are extracted for the threat entity, including the encryption algorithm version of the payload and the number of successfully invaded assets. The key features are stored in a lightweight structure instead of replicating the full amount of data of the entity, and the evolution track of the state before and after the timestamp is associated, such as the transition features from the normal state to the invaded state. At the same time, the state backtracking function is supported, which can restore the entity state before the attack based on the mirror, and is used to compare the effect difference before and after the defense strategy takes effect. Thus, the on-demand generation and time backtracking of the entity state are realized, ensuring that the simulation environment can accurately reproduce the triggering conditions of each link of the attack chain. At the same time, the lightweight structure reduces the resource consumption of mirror storage and transmission. The dynamic mirror provides the entity state benchmark consistent with the real environment for the isolated simulation environment, so that the construction of the simulation environment can focus on the key time points and entity features involved in the attack chain, ensuring the authenticity and pertinence of the simulation scenario.

[0080] Further, the construction sub-logic of the isolated simulation environment includes:

[0081] According to the behavior feature library of the entity in the dynamic mirror, the behavior features of the to-be-simulated entity and the association rules of the attack chain are extracted, and resources are allocated and an isolated network domain is created through a virtualized resource pool;

[0082] The network topology and protocol parameters of the attack chain are reproduced through the minimum spanning tree algorithm, and the security rules are adapted in the isolated network domain to construct the isolated simulation environment;

[0083] The entities matching the real environment are integrated into the isolated simulation environment, and the behavior feature library of the entity is implanted, and the function and performance error between the isolated simulation environment and the real environment is calibrated to adjust the isolated simulation environment.

[0084] The network environment contains a large number of entities irrelevant to the current attack chain, such as office terminals and non-core servers. If all entities are simulated, it will cause waste of resources and confusion of simulation logic, so it is necessary to screen the core entities related to the attack chain from the dynamic mirror and extract the association rules between the behavior characteristics and the attack steps to clarify the simulation range and logical basis. In specific implementation, based on the behavior characteristic library of the entities in the dynamic mirror, the entities to be simulated are screened through rule matching, the entities directly participating in the attack chain, the entities indirectly supporting the attack propagation and the core business entities affected by the attack are identified, wherein the entities directly participating in the attack chain include the attacked database server and the malicious IP initiating the attack, the entities indirectly supporting the attack propagation include the routers necessary in the attack path, and the core business entities affected by the attack include the payment system dependent on the attacked server. At the same time, the association rules between the behavior characteristics of these entities and the attack chain are extracted, such as the weak password configuration characteristics of a certain Web server and the triggering association of the brute force cracking step in the attack chain, and the dependence relationship between the port forwarding rule of the router and the attack chain propagation path. These rules and entity lists are stored in association to form the core basis for building an isolated simulation environment. Thus, the simulation range is accurately defined, irrelevant entity interference is excluded, and simulation resource consumption is reduced. At the same time, the clear association rules provide logical constraints for subsequent topology replication and entity deployment, ensuring that the isolated simulation environment focuses on the key link of the attack chain.

[0085] The network topology and protocol parameters directly affect the propagation path of the attack chain and the effectiveness of the defense strategy, where the network topology includes node connection relationship and routing strategy, the protocol parameters include TCP timeout retransmission mechanism and MTU value, and the effectiveness includes the blocking range of firewall rules in a specific topology. If the topology of the isolated simulation environment differs greatly from the real environment, the evaluation results of the defense strategy will lose reference value, and malicious traffic will be generated during the simulation process, which needs to be prevented from affecting the real network through the isolated domain. In specific implementation, based on the behavior characteristics of the entity to be simulated and the association rules of the attack chain, the core link is extracted from the real network topology through the minimum spanning tree algorithm, the node connection that the attack chain must pass through is retained, such as the path from the malicious IP to the border firewall, through the web server to the database, and the branch unrelated to the attack chain is ignored, such as the connection of the employee office terminal; the network topology is copied in the virtualization resource pool, the protocol parameters consistent with the real environment are configured, such as the OSPF routing priority of the router and the VLAN (Virtual Local Area Network) division rule of the switch, and an independent isolated network domain is created through virtualization technology, where the independent IP address space and network namespace are used in the isolated network domain, the virtual firewall is deployed to prohibit the domain traffic from interacting with the real network, and the security rules of the real environment are converted into executable rules of the virtual security device in the isolated domain to ensure the consistency of the rule logic, such as the strategy of prohibiting external IP access to port 3306, which also takes effect in the virtual firewall, where the security rules include the detection feature library of IDS (Intrusion Detection System) and the protection strategy of WAF (Web Application Firewall); thereby simplifying the topology and reducing the simulation complexity on the premise of ensuring the authenticity of the propagation path of the attack chain, and the isolated network domain prevents the malicious traffic in the simulation process from overflowing, while avoiding the fluctuation of the real network from interfering with the simulation results.

[0086] Even if the topology is consistent with the rules, the behavior of entities in the isolated simulation environment will still deviate from the real environment, for example, the CPU performance of a virtual server is different from that of a physical machine, and the behavior of entities includes the response delay of an application and the exploitability of a vulnerability. If these errors are not calibrated, the performance evaluation of the defense strategy will be distorted. In specific implementation, entities consistent with the real environment configuration are deployed to the corresponding nodes of the isolated network domain, where the entities include virtual servers with the same version of the operating system and database applications of the same version, and then the behavior feature library of the entities in the dynamic image is implanted into each entity, so that the entities can reproduce the real behavior mode in the isolated simulation environment, such as the response time distribution of a web server to a specific request and the query execution efficiency of a database. By comparing the key indicators of the isolated simulation environment and the real environment to calibrate the deviation, the configuration parameters of the entities are adjusted for functional errors, such as starting a specific service that exists in the real environment, where the functional errors include a vulnerability that is not triggered in the isolated simulation environment. The performance errors are simulated by the QoS mechanism of the virtual network to simulate the bandwidth limitation and delay characteristics of the real link, where the performance errors include that the transmission delay of attack traffic in the isolated simulation environment is too low. The calibration process is iterated until the behavior features of the entities in the isolated simulation environment are consistent with the real environment, where the behavior features of the entities include the trigger probability of attack steps and the response time of services. Thus, the functional and performance deviations between the isolated simulation environment and the real environment are eliminated, ensuring that the behavior of entities in the isolated simulation environment is close to reality, laying a foundation for accurate evaluation of defense strategies. The calibrated isolated simulation environment can truly reproduce the trigger conditions of attack chains and entity responses, so that the injection of attack behavior sequences and the simulation results of defense strategies have credibility.

[0087] Specifically, as shown in Figure 2 the generation logic of the simulation verification result includes:

[0088] Based on the behavior feature library of the entities in the dynamic image, the attack behavior sequence is injected in the isolated simulation environment according to the timestamp of the attack chain, where the attack behavior sequence is associated with the behavior identifier and the behavior feature of the entity.

[0089] In the isolated simulation environment, multiple groups of defense strategies are simulated and deployed, and the attack blocking success rate, business interruption time, resource consumption and false positive rate under different defense strategies are obtained by comparing the behavior features of the entities.

[0090] The attack blocking success rate, business interruption time, resource consumption and false positive rate are associated with the causal strength of the attack chain to calculate the performance value of different defense strategies.

[0091] According to the performance value, the defense strategy is screened, and the simulation verification result including the adaptation degree of the defense strategy to the behavior features of different entities, the coverage degree of the associated rules of the attack chain and the execution cost is generated.

[0092] The timing and correlation of attack behaviors directly affect the effectiveness of defense strategies. If the injected attack chain does not match the timing or characteristics of the real attack, the evaluation of the defense strategy's effectiveness will be meaningless. In specific implementation, the attack behavior sequence of the attack chain is extracted from the behavioral feature library of entities in the dynamic image and injected into the isolated simulation environment in timestamp order. For each attack step, the corresponding entity's behavioral identifier is associated. For example, scanning behavior is associated with the behavioral characteristics of malicious IPs, and vulnerability exploitation is associated with the vulnerability characteristics of the attacked assets. During the injection process, it is ensured that the triggering conditions of the attack behavior are consistent with the real environment. For example, the vulnerability exploitation step must be triggered after the port scan identifies the target vulnerability, and the same payload characteristics as the real attack are used, such as encryption algorithms and field structures. At the same time, the interaction logic between the attack sequence and the environment is ensured to be real by comparing entity behavioral characteristics. For example, the routing path of attack traffic in the simulation topology is consistent with the real environment. In this way, the timing characteristics and triggering logic of the real attack are accurately reproduced in the simulation environment, ensuring that the attack scenario faced by the defense strategy is consistent with the real environment, and providing a reliable benchmark for subsequent evaluation.

[0093] A single defense strategy may be insufficient to handle complex attack chains. A particular strategy might block scanning but not vulnerability exploitation, and different strategies have varying impacts on business operations. A blanket block can lead to service disruption, while precise interception has minimal impact. Therefore, parallel simulation using multiple defense strategies is necessary to comprehensively obtain data on defense effectiveness and business impact. In practice, the isolated simulation environment is divided into multiple independent sub-environments. Each sub-environment deploys a set of differentiated defense strategies, including passive, active, and hybrid strategies. Passive defense strategies include vulnerability patching and privilege tightening; active defense strategies include attack traffic blocking and honeypot enticement; and hybrid strategies involve blocking first and then patching. Then, the attack blocking success rate and service interruption rate are obtained through entity behavioral feature comparison. The data includes time, resource consumption, and false positive rate. It records the interception rate of each defense strategy at different steps of the attack chain, such as the success rate of blocking scans and vulnerability exploits. It also records the interruption duration of core business operations during the execution of defense strategies, such as the unavailability time of the payment system. Resource consumption includes additional CPU and memory usage. Furthermore, it records the number of times a defense strategy incorrectly identifies normal business behavior as an attack, such as mistakenly blocking legitimate user login requests. All data is associated with the behavioral identifiers of entities; for example, the resource consumption of a defense strategy is associated with the behavioral characteristics of the protected server, ensuring data traceability. This allows for the simultaneous evaluation of the comprehensive performance of multiple defense strategies, not only obtaining defense effectiveness but also recording the interference and resource consumption of the strategies on business operations, providing multi-dimensional evidence for subsequent performance evaluation.

[0094] The pros and cons of the defense strategy need to be comprehensively evaluated in combination with the threat degree of the attack chain and the business demand, wherein the threat degree includes the importance of the core attack steps, and the business demand includes the interruption tolerance of the core business. If only a single defense effectiveness index is used to screen the strategy, it will lead to the selected defense strategy having a good blocking effect but seriously affecting the business or being unable to cover the key attack steps. In the specific implementation, the attack blocking success rate, the business interruption time, the resource consumption and the false positive rate are associated with the causal strength of the attack chain to calculate the effectiveness value. For the attack steps with high causal strength, the blocking success rate is given a higher weight in the effectiveness value, wherein the attack steps with high causal strength include the core links that directly lead to data leakage. For the business interruption time, the weight is adjusted in combination with the importance of the affected entities, wherein the importance of the affected entities refers to that the interruption weight of the core database is higher than that of the ordinary terminal. The resource consumption and the false positive rate are set with a penalty coefficient according to the resource threshold and the security demand of the business. For example, in the resource-constrained scenario, the strategy with high resource consumption is deducted more points. Then, the strategy with better comprehensive performance is selected according to the effectiveness value, and the simulation verification result including the adaptation degree of the defense strategy to different entity behavior characteristics, the coverage degree of the defense strategy to the association rules of the attack chain and the execution cost is generated, wherein the adaptation degree of the defense strategy to different entity behavior characteristics refers to the less interference to the normal operation of a certain server, the coverage degree of the defense strategy to the association rules of the attack chain refers to how many key attack steps can be intercepted, and the execution cost refers to the manpower and time cost required for deployment. Thus, the multi-dimensional comprehensive evaluation of the defense strategy is realized, the limitations of a single index are avoided, and it is ensured that the selected defense strategy can effectively defend against attacks and adapt to the actual demand of the business. The adaptation degree, the coverage degree and the execution cost contained in the simulation verification result provide accurate optimization direction for the reinforcement learning of the response feedback module, so that the optimization of the defense strategy can take into account the defense effect and the business adaptability.

[0095] The response feedback module is used to receive the attack chain, the risk transmission path and the simulation verification result, take the effectiveness value of the defense strategy as the reward function, optimize the defense strategy through reinforcement learning, and issue it to the operation and maintenance system through the automatic and semi-automatic interfaces for execution. The actual effect after the execution of the defense strategy is monitored, and the network situation map, the attack behavior knowledge base and the isolation simulation environment are updated and fed back.

[0096] Further, as shown in Figure 3 , the optimization sub-logic of the defense strategy includes:

[0097] The causal strength of the attack chain, the occurrence probability of the risk transmission path and the adaptation degree and the coverage degree in the simulation verification result are taken as state variables to form the state space of the reinforcement learning;

[0098] The defense strategy is divided into defense actions, and each defense action is associated with an execution cost to form the action space of the reinforcement learning;

[0099] The effectiveness of the defense strategy is used as the reward function. A Monte Carlo tree search is used to search for a sequence of defense actions in the state space. In each iteration, the reward function is adjusted based on the actual effect monitored by the operation and maintenance system to optimize the defense strategy.

[0100] Optimizing defense strategies requires considering the multi-dimensional characteristics of the attack scenario. The threat levels of different steps in the attack chain vary; for example, the threat of core data theft is higher than that of probing scans. The propagation probability of risk transmission paths also differs; for instance, the path through the core switch is more dangerous than the path through the edge terminal. Furthermore, the adaptability and coverage of the defense strategy in simulation verification directly affect the actual effect. If only a single feature is relied upon to construct the state, the optimized defense strategy will be unable to adapt to complex scenarios. By using the causal strength of the attack chain as the core state variable, links with high causal strength reflect the inevitable progression of the attack and are the focus of the strategy defense. The probability of occurrence of the risk transmission path is also incorporated, which reflects the actual threat propagation trend of the path. For example, paths involving closely dependent business systems are more easily exploited. At the same time, the adaptability and coverage in the simulation verification results are integrated, and these variables are mapped into the state space of reinforcement learning through feature association algorithms. This allows reinforcement learning to fully perceive the complexity of the attack scenario, avoids deviations in defense strategy optimization caused by one-sided state information, and ensures that the optimization direction simultaneously considers threat priority and the applicability of the defense strategy.

[0101] A defense strategy is a collection of coordinated operations. Adjusting a single defense strategy is insufficient to address the multi-step nature of an attack chain. For example, simply blocking scans cannot prevent subsequent vulnerability exploitation. Furthermore, the execution costs and business impacts of different operations vary significantly. For instance, while patching vulnerabilities offline is thorough, it disrupts business operations; temporary traffic filtering has a smaller impact but lacks sustainability. Without decomposing defense actions and correlating their costs, optimized defense strategies may fail due to uncontrolled costs or poor action coordination. In practical implementation, defense strategies are broken down into defense actions, including network layer actions, host layer actions, and application layer actions. Network layer actions include dynamically adjusting firewall rules and modifying routing paths; host layer actions include updating process whitelists and deploying vulnerability patches; and application layer actions include… API access permissions are tightened and input validation logic is strengthened. Each defense action is associated with an execution cost, including time cost, resource cost, and business impact cost. The time cost includes the time required for business interruption during vulnerability patching, the resource cost includes the CPU resources consumed by traffic filtering, and the business impact cost includes the degree of restriction on normal operations due to tightened permissions. These actions and execution costs are integrated into an action space. The combination of actions must meet synergy constraints. For example, patch deployment must be accompanied by temporary blocking to prevent attacks during deployment. This enables fine-grained optimization of defense strategies, allowing reinforcement learning to flexibly select combination schemes in the action space, balancing defense effectiveness and execution cost, and avoiding resource waste or business interruption caused by overall strategy adjustments.

[0102] The defense strategy optimization in reinforcement learning needs to balance between exploring new action combinations and utilizing known effective actions. Over-reliance on known actions can lead to local optimization, while blind exploration can result in resource waste. Moreover, there is a deviation between simulation verification results and actual environment, which needs to be dynamically corrected through actual feedback to optimize the direction. In specific implementation, the reward function is designed based on the performance value of the defense strategy. The strategy with high performance value obtains positive reward. At the same time, a cost penalty term is introduced. If the execution cost of the defense action exceeds the business tolerance threshold, for example, the core business interruption exceeds 10 minutes, the reward value is deducted in proportion. Then, the Monte Carlo tree search is used to simulate the defense action sequence in the state space. Starting from the current state, the possible results of different action combinations are explored. Based on the reward function, the expected return of each action combination is evaluated, and the action sequence with the highest return is selected as the candidate defense strategy. After the candidate defense strategy is issued to the operation and maintenance system, the actual execution effect is monitored in real time, for example, whether the attack is blocked as expected and whether the business is running normally. If the deviation between the actual effect and the simulation expectation exceeds the set range, the weight of the corresponding state in the reward function is corrected, and the iteration optimization is performed until the effect of the defense strategy is stable. Thus, the optimized defense strategy can not only perform well in the simulation scenario, but also adapt to the dynamic changes of the actual environment. At the same time, through action combination exploration, local optimization is avoided, and the defense effect, execution cost and business adaptability are considered. The optimized strategy provides accurate input for the automatic and semi-automatic interface issuance, ensuring that the executed defense strategy is highly matched with the actual attack scenario.

[0103] Specifically, the feedback updating logic of the network situation map includes:

[0104] Monitoring the actual effect after the execution of the defense strategy, adjusting the attributes of the entities in the multi-source data, and marking the time stamp and change reason of the entity state change;

[0105] Judging the change amount of the relationship before and after the execution of the defense strategy, and adjusting the weight allocated to the confidence of the relationship according to the proportion of the change amount;

[0106] When the defense strategy intercepts new attack behaviors, automatically adding new attack nodes and new relationships, and assigning initial confidence to the new relationships, to feedback update the network situation map.

[0107] The execution of the defense strategy directly changes the state characteristics of the entity. After vulnerability patching, the vulnerability of the asset is reduced. After adjusting the authority, the operation range of the account is reduced. After traffic blocking, the active state of the attack source changes. If the attributes of the entity in the network situation map are not updated synchronously, it will cause the subsequent attack chain identification to be based on outdated information, for example, the asset with a patched vulnerability is still marked as high risk, which affects the accuracy of situation awareness. In specific implementation, the state of the entity after the execution of the defense strategy is monitored in real time through the operation and maintenance system: the vulnerability attribute, configuration attribute and running state of the asset entity are checked, wherein the vulnerability attribute includes whether the CVE vulnerability state changes from unpatched to patched, the configuration attribute includes whether the open port is closed, and the running state includes whether the CPU / memory occupation returns to normal; the attack capability attribute and the interaction attribute of the threat entity are tracked, wherein the attack capability attribute includes whether the malicious IP is added to the blacklist and cannot initiate new attacks, and the interaction attribute includes whether the communication of the C&C server is interrupted; the attributes of the entity are adjusted according to the monitoring result, and a time stamp and a change reason label are added for each attribute change; so as to ensure that the attributes of the entity in the network situation map are consistent with the actual state, and avoid threat misjudgment due to outdated attributes, and provide accurate entity feature basis for subsequent attack chain identification.

[0108] The strength of the relationship between entities dynamically changes with the execution of the defense strategy. After the defense strategy blocks a communication link, the interaction relationship between the attack source and the target asset will weaken. After vulnerability patching, the utilization relationship between the threat entity and the asset vulnerability will be invalid. If the weight assigned to the relationship remains unchanged, the network situation map will not be able to reflect the actual threat propagation path, for example, misjudging that the blocked path is still high risk, which affects the accuracy of risk assessment. In specific implementation, the activity level of the relationship between entities before and after the execution of the defense strategy is compared. For the core relationship in the attack chain, such as the vulnerability exploitation of the malicious IP leading to the web server, the change amount of the occurrence frequency, duration and influence range of the relationship is counted. For the business dependency relationship, such as the query interaction from the application server to the database, the interference degree of the defense strategy execution on the normal interaction is evaluated. The confidence weight of the relationship is adjusted according to the proportion of the change amount. If the activity level of the relationship decreases, for example, the number of uses decreases, the weight is reduced in proportion. If a new association is triggered by the defense strategy, for example, the defense strategy execution causes the alarm interaction of the log auditing system, a new relationship is added and an initial weight is assigned. The adjusted weight needs to be associated with the attribute change of the entity, for example, the relationship weight decrease caused by vulnerability patching needs to be associated with the vulnerability attribute label of the asset. Thus, the network situation map can dynamically reflect the actual association strength between entities, ensure that the identification of the risk transmission path is based on the current latest relationship state, and improve the real-time and accuracy of threat assessment.

[0109] The network attack has dynamic evolution characteristics, and the defense strategy can intercept unknown attack behaviors, such as new virus variants and 0day exploit, which correspond to entities and relationships not included in the network situation graph. If not added in time, the network situation graph will have a coverage blind area, which will cause the subsequent attack chain identification to fail to capture new threat paths. In specific implementation, when the defense strategy intercepts new attack behaviors, the new entities involved are located through behavior feature analysis, including new attack sources, new attack tools or new affected assets. The new attack sources include unknown malicious IP, the new attack tools include uncollected malware families, and the new affected assets include previously unattacked edge devices. New attack nodes are created for these entities, and their core attributes are labeled, such as the propagation method of the attack tool and the business role of the new asset. The association between entities in the new attack behavior is extracted, and the weight distribution of similar known relationships and the threat level of the new attack are combined to assign an initial confidence to the new relationship. The new attack nodes and relationships are integrated into the corresponding level of the network situation graph, such as the attack source node joining the threat layer, using the relationship to associate the threat layer and the vulnerability layer, and associating the interception label of the defense strategy. Thus, the network situation graph expands the coverage of new threats, ensuring that the graph can fully reflect the state of entities and relationships in the current network, providing complete input for the perception fusion module, improving the system's perception of unknown threats, and providing raw materials for the update of the attack behavior knowledge base.

[0110] Specifically, the feedback update logic of the attack behavior knowledge base includes:

[0111] Compare the actual attack behavior sequence intercepted by the defense strategy with the attack chain pattern in the attack behavior knowledge base, identify the mutation point of the attack chain pattern through a sequence comparison algorithm, generate a new attack chain pattern and mark the mutation probability;

[0112] Based on the changes in the risk transmission path after the execution of the defense strategy, the strength threshold of the cause-effect rule in the attack behavior knowledge base is corrected;

[0113] Based on the coverage in the simulation verification result, extract the uncovered attack behaviors to generate candidate rules to update the attack behavior knowledge base.

[0114] Attackers will constantly mutate attack chain patterns to evade defense strategies. The original attack behavior knowledge base attack chain patterns will not match the mutated sequence. If the mutation is not identified and the attack chain pattern is not updated, the defense strategy optimization will be based on outdated attack features, resulting in interception failure. In specific implementation, the actual intercepted attack behavior sequence of the defense strategy is collected, and the sequence is compared with the standard attack chain pattern in the attack behavior knowledge base. The dynamic time warping algorithm is used to align sequences of different lengths, for example, the mutated sequence has one more encryption step than the standard sequence. The steps of insertion, deletion or replacement, i.e. mutation points, are identified. The motivation of the mutation point is analyzed, for example, encrypted communication is to evade traffic detection. A new attack chain pattern is generated based on the complete mutated sequence, and its mutation type and trigger condition are labeled. The mutation type includes step insertion type and tool replacement type, and the trigger condition includes specific target asset type and specific network environment. The new pattern is stored in association with the original pattern, for example, marked as a variant of the traditional pattern, to facilitate the identification of the evolution relationship between patterns during subsequent defense strategy optimization. Thus, the attack behavior knowledge base can dynamically track the evolution trend of the attack chain, ensure that the stored pattern is synchronized with the current attack method, and provide the latest attack feature reference for defense strategy optimization.

[0115] The execution of the defense strategy will change the causal relationship between the attack steps. If the strength threshold of the causal rule in the attack behavior knowledge base remains unchanged, it will lead to misjudgment of the dependency relationship between the steps during attack chain identification, for example, still considering that the patched vulnerability has high utilization possibility. In specific implementation, the change of the risk transmission path after the execution of the defense strategy is analyzed. If the occurrence probability of a certain risk transmission path decreases significantly, the corresponding causal rule is traced back. The mapping relationship between the strength threshold of the causal rule and the occurrence probability of the risk transmission path is determined through correlation analysis, for example, the decrease of the occurrence probability of the risk transmission path is positively correlated with the decrease of the strength threshold of the causal rule. The strength threshold of the causal rule is corrected according to the change ratio of the risk transmission path probability. The corrected strength threshold needs to be associated with the defense strategy execution label, for example, the strength threshold of the causal rule is adjusted due to vulnerability patching, to facilitate the tracing of the adjustment reason. Thus, the causal rule can dynamically adapt to the network environment after the execution of the defense strategy, ensuring that the causal judgment between the steps during attack chain identification is based on the current actual situation, and reducing misjudgment and omission.

[0116] The coverage deficiency record in the simulation verification result, such as a certain attack step not being effectively intercepted by any defense strategy, often corresponds to the missing defense rules in the attack behavior knowledge base. These defense rule blind spots will lead to the lack of pertinence of defense strategy optimization and the inability to effectively respond to the whole-link threat of the attack chain. In specific implementation, attack links with coverage less than a set standard are extracted from the simulation verification result, such as a certain defense strategy with an interception rate of 0 for the permission maintenance step. The attack characteristics and preconditions of this link are analyzed, including unrecorded exploit conditions, unidentified attack tool characteristics, or unassociated business scenarios. The unrecorded exploit conditions include configuration defects of specific version software, the unidentified attack tool characteristics include unique function calls of malicious scripts, and the unassociated business scenarios include attack trigger rules in specific time periods. Based on these characteristics, candidate rules are generated, which explicitly include attack trigger conditions, involved entities, and the logic chain of consequences. After comparing and deduplicating the candidate rules with the existing rules in the attack behavior knowledge base, their applicable scenarios and confidence are labeled, and they are included in the to-be-verified area of the attack behavior knowledge base, which will be upgraded to formal rules after being confirmed by subsequent actual interception data. Thus, the rule blind spots of the attack behavior knowledge base are filled, enabling the defense strategy optimization to cover the whole link of the attack chain and improving the defense depth and breadth of the system against complex attacks. The updated knowledge base provides more comprehensive attack patterns and rules for the perception fusion module, enabling the construction of the network situation graph to incorporate the latest attack semantic logic.

[0117] Embodiment 2

[0118] As Figure 4 shown, a step flowchart of a network situation monitoring method is provided for the embodiments of the present application, which includes:

[0119] Multiple source data are acquired, entities and relationships of the multiple source data are extracted, and an attack behavior knowledge base storing attack chain patterns and causal rules is combined to construct a network situation graph. Meanwhile, the network situation graph is processed and analyzed by time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths.

[0120] Based on the dynamic mirroring of the network situation graph and the attack chain, an isolated simulation environment is constructed. Attack chains are injected into the isolated simulation environment, defense strategies are simulated, and the effectiveness of the defense strategies is evaluated to generate simulation verification results.

[0121] The attack chain, the risk transmission path, and the simulation verification result are received. The effectiveness of the defense strategy is taken as a reward function, the defense strategy is optimized through reinforcement learning, and the defense strategy is automatically or semi-automatically issued to the operation and maintenance system for execution.

[0122] The actual effect after the execution of the defense strategy is monitored, and the network situation graph, the attack behavior knowledge base, and the isolated simulation environment are updated.

[0123] The method in the embodiments of the present application solves the problem in the principle similar to the system described above, and the implementation of the method refers to the implementation of the system, and the repeated parts will not be described here.

Claims

1. A network situation monitoring system, characterized in that, include: The module consists of a perception fusion module, a simulation verification module, and a response feedback module. The perception fusion module is used to acquire multi-source data including network traffic logs, asset configuration databases, and threat intelligence, extract entities and relationships from the multi-source data, and combine them with an attack behavior knowledge base that stores attack chain patterns and causal rules to construct a network situation map. At the same time, the network situation map is processed and analyzed through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths. The extracted entities are semantically mapped to attack chain patterns, and the extracted relationships are matched with causal rules to obtain the confidence and causal strength of the relationships, and weights are assigned to the edges of the network situation map. The identification logic for the attack chain and risk transmission path includes: The relationships between entities in the network situation map are constructed into a time-series subgraph through time-series analysis, and attack steps are identified in the time-series subgraph as candidate attack chains. The causal discovery algorithm is used to perform causal analysis on the relationships in the candidate attack chains, calculate the causal strength between attack steps, and filter out attack chains with causal strength greater than the strength threshold. Starting from the initial attack node in the attack chain, a directed graph of risk transmission is constructed by combining the reachability and dependency relationships of nodes in the network situation map. The risk transmission coefficient of each node is calculated by the page-level algorithm to identify the risk transmission path and the probability of occurrence. The simulation verification module constructs an isolated simulation environment based on a dynamic mirror of the network situation map and attack chain. It then injects the attack chain into the isolated simulation environment, simulates defense strategies, and evaluates the effectiveness of the defense strategies to generate simulation verification results. The response feedback module is used to receive attack chains, risk transmission paths, and simulation verification results. It uses the effectiveness value of the defense strategy as a reward function, optimizes the defense strategy through reinforcement learning, and sends it to the operation and maintenance system for execution via automated and semi-automated interfaces. It monitors the actual effect of the defense strategy after execution and provides feedback to update the network situation map, attack behavior knowledge base, and isolation simulation environment.

2. The network situation monitoring system as described in claim 1, characterized in that, The sub-logic for constructing the network situation map includes: Layered preprocessing is performed on the acquired multi-source data, including network traffic logs, asset configuration databases, and threat intelligence. Entities from multi-source data are extracted using graph convolutional networks, and relationships between entities are extracted based on long short-term memory networks and conditional random fields. At the same time, entities from multi-source data are aligned based on attribute similarity and relationship consistency. Extract attack chain patterns and causal rules stored in the attack behavior knowledge base, perform semantic mapping between the extracted entities and attack chain patterns, and match the extracted relations with causal rules to obtain the confidence and causal strength of the relations. A network situational graph is constructed using entities as nodes and relationships as edges between nodes, and weights are assigned to the edges based on the confidence and causal strength of the relationships.

3. The network situation monitoring system as described in claim 2, characterized in that, The dynamic image includes: The probe captures the behavioral sequence of entities in real time, including the operational behavior of asset entities, network interaction characteristics, and attack characteristics of threat entities. The behavioral sequences of entities are subjected to feature dimensionality reduction, and each entity is assigned a behavioral identifier to construct a behavioral feature library of entities; Dynamic mirror images of entity states at any point in time are generated based on the entity's behavioral feature library.

4. The network situation monitoring system as described in claim 3, characterized in that, The logic for generating the simulation verification results includes: Based on the behavioral feature library of entities in the dynamic image, attack behavior sequences are injected into the isolated simulation environment according to the timestamp of the attack chain, where the attack behavior sequence is associated with the behavioral identifier and behavioral features of the entity. Multiple defense strategies are deployed in an isolated simulation environment. By comparing the behavioral characteristics of entities, the attack blocking success rate, business interruption time, resource consumption and false alarm rate under different defense strategies are obtained. The effectiveness values ​​of different defense strategies are obtained by correlating attack blocking success rate, business interruption time, resource consumption and false alarm rate with the causal strength of the attack chain. Defense strategies are selected based on performance values, and simulation verification results are generated, including the adaptability of the defense strategy to the behavioral characteristics of different entities, the coverage of the association rules of the attack chain, and the execution cost.

5. The network situation monitoring system as described in claim 4, characterized in that, The sub-logic for constructing the isolated simulation environment includes: Based on the behavioral feature library of entities in the dynamic image, the association rules between the behavioral features of the entity to be simulated and the attack chain are extracted. Resources are allocated through the virtualization resource pool and an isolated network domain is created. The network topology and protocol parameters of the attack chain are replicated using the minimum spanning tree algorithm, and security rules are adapted in an isolated network domain to construct an isolated simulation environment. Entities matching the real environment are integrated into the isolated simulation environment, and the behavioral feature library of the entities is embedded. At the same time, the functional and performance errors between the isolated simulation environment and the real environment are calibrated to adjust the isolated simulation environment.

6. The network situation monitoring system as described in claim 5, characterized in that, The feedback update logic of the network situation map includes: Monitor the actual effects of the defense strategy after its execution, adjust the attributes of entities in multi-source data, and mark the timestamps and reasons for changes in entity status. Determine the change in the relationship before and after the implementation of the defense strategy, and adjust the weights assigned to the confidence level of the relationship according to the proportion of the change; When the defense strategy intercepts a new attack, it automatically adds new attack nodes and new relationships, and assigns an initial confidence level to the new relationships to update the network situation map.

7. A network situation monitoring system as described in claim 6, characterized in that, The feedback update logic of the attack behavior knowledge base includes: By comparing the attack behavior sequences actually intercepted by the defense strategy with the attack chain patterns in the attack behavior knowledge base, the mutation points of the attack chain patterns are identified through sequence alignment algorithms to generate new attack chain patterns and mark the mutation probability. Based on the changes in the risk transmission path after the execution of the defense strategy, the strength threshold of the causal rules in the attack behavior knowledge base is adjusted. Based on the coverage in the simulation verification results, uncovered attack behaviors are extracted to generate candidate rules, which are then used to update the attack behavior knowledge base.

8. The network situation monitoring system as described in claim 7, characterized in that, The optimization sub-logic of the defense strategy includes: The causal strength of the attack chain, the probability of occurrence of the risk transmission path, and the fit and coverage in the simulation verification results are used as state variables to form the state space of reinforcement learning. The defense strategy is decomposed into defense actions, and each defense action is associated with an execution cost, forming an action space for strength learning. The effectiveness of the defense strategy is used as the reward function. A Monte Carlo tree search is used to search for a sequence of defense actions in the state space. In each iteration, the reward function is adjusted based on the actual effect monitored by the operation and maintenance system to optimize the defense strategy.

9. A network situation monitoring method, implemented based on the network situation monitoring system according to any one of claims 1-8, characterized in that, include: Acquire multi-source data, extract entities and relationships from the multi-source data, and combine them with an attack behavior knowledge base that stores attack chain patterns and causal rules to construct a network situation map. At the same time, process and analyze the network situation map through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths. An isolated simulation environment is constructed based on a dynamic mirror of the network situation map and attack chain. The attack chain is injected into the isolated simulation environment to simulate defense strategies and evaluate the effectiveness of the defense strategies in order to generate simulation verification results. It receives attack chains, risk propagation paths, and simulation verification results, uses the effectiveness of defense strategies as a reward function, optimizes defense strategies through reinforcement learning, and distributes them to the operation and maintenance system for execution via automated and semi-automated interfaces. Monitor the actual effects of the defense strategy after its implementation, and provide feedback to update the network situation map, attack behavior knowledge base, and isolation simulation environment.

Images