Network security dynamic defense method, system and equipment

Abstract

The invention belongs to the field of network security, particularly relates to a network security dynamic defense method, system and equipment, and aims to solve the problems of single network security risk assessment and insufficient flexibility in a multi-equipment scene. Comprising the following steps: acquiring a standardized data set of network security data of a target server; constructing a Bayesian network based on the standardized data set and outputting a risk assessment result; constructing a knowledge graph based on the entities covered by the target server and the relationship among the entities; based on a preset protocol state machine and a propagation prediction model, simulating a propagation path of the attack behavior between the devices in the knowledge graph, and determining a propagation prediction result; according to the risk assessment result and the propagation prediction result, defense strategies are matched in a preset defense strategy library, and a dynamic defense strategy set comprising multiple defense strategies is generated and executed. According to the invention, dynamic defense can be carried out on the network environment in a multi-device scene, and the network security problem caused by a single or backward defense strategy is avoided.

Description

Technical Field

[0001] The present invention relates to the field of network security, and specifically relates to a network security dynamic defense method, system and device. Background Art

[0002] With the rapid development of Internet technology, network security issues are becoming increasingly serious. In the field of the Internet of Things, network issues involve a wider range of aspects and network security issues are even more complex. In smart factories, a large number of Internet of Things (IoT) devices, such as sensors, controllers, and cameras, are often deployed. These devices are heterogeneous and come from different manufacturers, protocols, and firmware versions. When the network topology changes dynamically and devices are connected and disconnected in real time, the following problems may occur: Lack of risk assessment for heterogeneous devices: Traditional risk assessment solutions are single-minded and based on only a few dimensions (such as IP address and port number). They lack risk assessment for certain dimensions, such as firmware vulnerability versions of IoT devices (e.g., a certain sensor model's firmware has the remote code execution vulnerability CVE-2025-XXXX), communication protocol vulnerabilities (such as the unencrypted Message Queuing Telemetry Transport (MQTT)), and resource constraints (low-computing-power devices cannot run complex encryption algorithms). These factors make it impossible to fully and accurately reflect the security risk status of the network system.

[0003] Static defense strategies: Once a defense strategy is formulated, it is difficult to adjust it in a timely manner according to dynamic changes in the network environment, resulting in poor defense against new and variant attacks.

[0004] Mismatch between defense strategies and device resources: Implementing a full-traffic encryption strategy for low-power sensors can cause device crashes, while implementing only a log monitoring strategy for key controllers is insufficient defense due to the lack of a resource-aware policy adaptation mechanism. Summary of the Invention

[0005] In order to solve the above-mentioned problems in the prior art, namely, the problem of single and insufficient flexibility in network security risk assessment in multi-device scenarios, the first aspect of this application proposes a network security dynamic defense method, including: Obtain the network security data of the target server, extract features from the network security data, and generate a standardized data set; A Bayesian network is constructed using the risk dimensions included in the standardized data set as nodes and the probability relationships between nodes as edges. The Bayesian network is used to output risk assessment results. Build a knowledge graph based on the entities covered by the target server and the relationships between them, where the entities include at least devices, protocols, vulnerabilities, and attack behaviors; Based on the preset protocol state machine and propagation prediction model, the propagation path of attack behavior between devices is simulated in the knowledge graph to determine the propagation prediction results; Based on the risk assessment results and propagation prediction results, defense strategies are matched in the preset defense strategy library to generate a dynamic defense strategy set including multiple defense strategies; Based on the dynamic defense strategy set, the corresponding device communication interface is called to execute the defense strategy.

[0006] As a preferred embodiment, the Bayesian network is used to output risk assessment results, including: Take the risk dimension as the parent node and obtain the indicators reflecting each risk dimension as the child nodes; Based on the logical relationship between parent nodes and child nodes, edges are generated from parent nodes to child nodes to generate a Bayesian network, where edges correspond to conditional probabilities; Obtain the joint probability distribution of each child node through Bayesian network reasoning; Based on the joint probability distribution, determine the risk dimension risk value of each risk dimension at different risk levels, and determine the overall risk value based on the risk dimension risk values; The risk assessment result is composed of the risk value of each risk dimension, the overall risk value and the node probability distribution, among which the node probability distribution is composed of the conditional probability corresponding to each sub-node.

[0007] As a preferred implementation, determining the propagation prediction result includes: Based on the attack status of the device, the security status of the device is divided into susceptible state, infected state and recovery state; According to the impact of the protocol on the propagation probability, the attack propagation probability between different devices is determined, and the propagation probability matrix is ​​generated based on the attack propagation probability between each device; Based on the attack propagation probability and recovery rate corresponding to the device, as well as the number of devices in each security state, the rate of change of the security state over time is obtained. The recovery rate is determined based on the attributes of the device, and the change rate is used to build a propagation prediction model. Construct a propagation prediction model based on the security status, propagation probability matrix, and change rate; Determine the initial threatened node in the knowledge graph, and starting from the initial threatened node, generate one or more propagation paths through the propagation prediction model; The set of threatened devices involved in the propagation path is used as the propagation prediction result.

[0008] As a preferred embodiment, a dynamic defense strategy set including multiple defense strategies is generated, including: For any threatened device in the propagation prediction results, a candidate strategy is selected from the defense strategy library under resource and risk constraints; Obtain a strategy score for the candidate strategy based on its resource consumption, strategy priority, and the risk reduction value that can be achieved after the candidate strategy is executed. Based on the ranking of strategy scores, candidate strategies are selected to generate a defense strategy set.

[0009] As a preferred implementation, selecting candidate strategies includes: When multiple candidate policies act on the same threatened device, if the total resource consumption of each candidate policy exceeds the device capacity, the single policy with the highest policy score is selected as the defense policy set.

[0010] As a preferred embodiment, the method further includes: Collect real-time resource data after each defense strategy in the defense strategy set is executed, and calculate the resource fluctuation value of the real-time resource data; When the resource fluctuation value exceeds the preset fluctuation threshold, a policy rollback is triggered, wherein the policy rollback includes revoking the defense policy and restoring the parameters of the threatened device.

[0011] As a preferred embodiment, the method further includes: Evaluate the effectiveness of defense strategies based on their execution results and real-time network security data; Update the defense strategy library based on the execution results.

[0012] As a preferred implementation, evaluating the effectiveness of the defense strategy includes: Calculate the ratio of the number of attacks successfully blocked by the threatened device to the total number of attacks, which is used as the defense effectiveness of the threatened device. Calculate the ratio of the number of devices with resource limits exceeded to the total number of devices executed after the defense policy is executed, and use this as the resource limit excess rate of the defense policy. The execution effect is composed of defense effectiveness and resource excess rate.

[0013] The second aspect of this application proposes a network security dynamic defense system, comprising: The data acquisition module is used to obtain the network security data of the target server, extract features from the network security data, and generate a standardized data set; A Bayesian network construction module is used to construct a Bayesian network using the risk dimensions included in the standardized data set as nodes and the probability relationships between the nodes as edges, wherein the Bayesian network is used to output risk assessment results; A knowledge graph construction module is used to construct a knowledge graph based on the entities covered by the target server and the relationships between the entities, where the entities include at least devices, protocols, vulnerabilities, and attack behaviors; The propagation prediction module is used to simulate the propagation path of attack behaviors between devices in the knowledge graph based on the preset protocol state machine and propagation prediction model, and determine the propagation prediction results; A defense strategy generation module is used to match defense strategies in a preset defense strategy library based on risk assessment results and propagation prediction results, and generate a dynamic defense strategy set including multiple defense strategies; The defense strategy execution module is used to call the corresponding device communication interface to execute the defense strategy based on the dynamic defense strategy set.

[0014] In a third aspect of the present application, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned network security dynamic defense method.

[0015] Beneficial effects of this application: This application constructs a Bayesian network to evaluate the risk assessment results of the network security data of the target server, considers multiple risk dimensions, and conducts a comprehensive risk assessment. It further uses the knowledge graph constructed for each entity covered by the target server as the basis for simulating propagation, and predicts the propagation path of the attack behavior. It can quantify the influence and propagation trend of each entity based on the knowledge graph, dynamically deduce the propagation path, obtain propagation prediction results, accurately predict the propagation path and intuitively display the propagation chain; further combine the risk assessment results and the propagation prediction results to generate corresponding dynamic defense strategies, and can generate resource-adaptive defense strategies for the predicted propagation results in multi-device scenarios for corresponding defense. Through dynamic defense based on the network environment, network security problems caused by single or backward defense strategies can be avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 This is a flow chart of a network security dynamic defense method provided by an embodiment of the present application; Figure 2 This is a flow chart of a process for obtaining risk assessment results provided by an embodiment of the present application; Figure 3This is a Bayesian network risk dimension node diagram provided by an embodiment of the present application; Figure 4 This is a flowchart of a process for constructing a propagation prediction model provided by an embodiment of the present application; Figure 5 This is a system block diagram of a network security dynamic defense system provided by an embodiment of the present application; Figure 6 It is a structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. DETAILED DESCRIPTION

[0017] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are intended only to illustrate the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the relevant invention are shown in the accompanying drawings.

[0018] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0019] The present application provides a method for dynamic network security defense. The method obtains network security data of a target server, extracts features from the network security data, and generates a standardized data set. The method uses the risk dimensions included in the standardized data set as nodes and the probability relationships between the nodes as edges to construct a Bayesian network, wherein the Bayesian network is used to output risk assessment results. A knowledge graph is constructed based on the entities covered by the target server and the relationships between the entities, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors. Based on a preset protocol state machine and a propagation prediction model, the propagation path of the attack behavior between devices is simulated in the knowledge graph to determine the propagation prediction results. According to the risk assessment results and the propagation prediction results, defense strategies are matched in a preset defense strategy library to generate a dynamic defense strategy set including multiple defense strategies. Based on the dynamic defense strategy set, the corresponding device communication interface is called to execute the defense strategy. The method can generate a defense strategy that adapts resources to the predicted propagation results in a multi-device scenario and perform corresponding defense. By dynamically defending based on the network environment, network security problems caused by a single or backward defense strategy can be avoided.

[0020] In order to more clearly explain the network security dynamic defense method of this application, the following Figure 1 Each step in the embodiments of the present application is described in detail.

[0021] The network security dynamic defense method of the first embodiment of the present application includes steps S10 to S60, each of which is described in detail as follows: Step S10: Acquire network security data of the target server, perform feature extraction on the network security data, and generate a standardized data set.

[0022] Optionally, the network security data of the target server is network data covering all associated entities of the target server, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors.

[0023] As an example, network security data may include: network traffic data, system log data, vulnerability scanning data, attack behavior data, and user behavior data.

[0024] Among them, network traffic refers to all traffic entering and leaving the target server (including mirrored traffic and NetFlow). Network traffic data can include traffic size, source IP address, destination IP address, port number, transmission protocol, data content, etc. of the data packet; system logs refer to system / application logs generated by the target server (such as login records and permission changes). System log data can include server logs, device logs, number of login failures, permission change records, etc.; vulnerability scans refer to scan results for the target server (Nessus / OpenVAS reports). Vulnerability scan data can include system vulnerability information, software vulnerability information, CVE numbers (Common Vulnerabilities & Exposures), CVSS scores, etc.; attack behavior refers to IDS / IPS alarms directed to the target server. Attack behavior data can include attack type, attack time, attack frequency, etc.; user behavior refers to user operations (login records, file downloads) when accessing the target server. User behavior data can include user login time, access frequency, operation path, file download records, abnormal operation instructions, etc.

[0025] In other embodiments, network security data may also include device fingerprints and resource data. The device fingerprint refers to the MAC address, firmware version, and protocol type of the target server itself; the resource data refers to the real-time CPU / memory utilization of the target server.

[0026] Optionally, various collection devices deployed in the network, such as sensors, probes, log collectors, etc., can be used to collect network traffic data, system log data, vulnerability scanning data, attack behavior data, etc. in real time, and user behavior data can be collected by installing monitoring plug-ins on client devices or by recording user operation logs on the server side.

[0027] In some embodiments, the physical address of the device's network card is obtained through network layer protocols (such as the ARP protocol or DHCP log) and directly used as a string identifier to obtain the MAC address. The hardware model is obtained through Simple Network Management Protocol (SNMP) information actively reported by the device, the device API interface (such as the device description register of a Modbus device), or scanning tools (such as Nmap's OUI database matching). For devices that support remote query (such as cameras that support HTTP / HTTPS interfaces), the firmware version string is obtained through API calls. For devices without active reporting capabilities, the firmware version is obtained by parsing the version fingerprint in the device response packet (such as the Server field in the HTTP response header) using vulnerability scanning tools (such as Nessus and OpenVAS). The communication protocol used by the device is identified through traffic analysis (such as Wireshark parsing the TCP / UDP port: Modbus defaults to port 502, MQTT defaults to port 1883). The protocol type is obtained, and the protocol enumeration value is mapped to the device fingerprint library. A unique fingerprint is generated from the device's key information using a hash function.

[0028] Furthermore, the original network security data can be cleaned to remove duplicate, erroneous, and redundant data, and abnormal behavior filtering can be performed on user behavior data.

[0029] As a possible implementation method, invalid data is identified and deleted by checking data integrity, uniqueness constraints and other rules, and the sliding window interpolation method is used to repair missing values ​​of device resource data to avoid duplicate data interfering with analysis. Missing values ​​are filled to ensure data integrity and make subsequent analysis results more accurate.

[0030] Furthermore, feature extraction is performed on the network security data after the cleaning operation to generate a standardized data set.

[0031] As a possible implementation method, categorical data (such as log text, protocol type, and vulnerability level) can be formatted and converted into a standard format that can be recognized and processed by the system. Non-numeric categorical information can be converted into a numerical form that can be processed by a computer through one-hot encoding or label encoding. Discrete categorical information can be converted into numerical features that can be understood by the model, enabling the model to learn the relationship between different categories. For example, unstructured logs can be converted into structured JSON, and the timestamp, device ID, and event type in the log can be extracted.

[0032] As another possible implementation, numeric data (such as CPU utilization and attack frequency) can be normalized using the min-max normalization formula. This maps the numeric data to the same interval (typically [0, 1] or [-1, 1]), eliminating differences in dimension and numerical range between different features. This normalization makes data of different types and magnitudes comparable, meeting the needs of subsequent modeling and analysis.

[0033] As another possible implementation, for user behavior sequences (such as operation paths), a sequence pattern mining algorithm is used to extract key operation sequence features or feature encoding methods, such as word embedding or time series encoding, to convert the behavior sequence into a fixed-dimensional feature vector. Through feature encoding, information such as the temporal relationships and behavioral patterns implicit in the sequence data is converted into recognizable features for the model, thereby extracting valuable behavioral features for subsequent analysis and prediction. For abnormal operation instructions, Boolean features are generated based on preset rules (such as unauthorized user access and high-frequency write operations), and semantic analysis and classification are performed using natural language processing techniques.

[0034] Through the above standardization processing, the data format and range are unified, the dimensional differences are eliminated, and a standardized data set that meets the input requirements of the Bayesian network is generated.

[0035] As an example, a standardized dataset is a standardized feature matrix, including traffic feature vectors, system log feature matrices, vulnerability feature vectors, and user behavior feature triplets. The network traffic feature vector dimensions include size distribution, port activity, and protocol type ratio; these are obtained through normalized statistics after parsing the traffic using Wireshark. The system log feature matrix structure includes rows = time window, columns = log event type (e.g., number of failed logins, number of permission changes); these are obtained through one-hot encoding or frequency statistics after log parsing. The vulnerability feature vector includes the mean CVE score, number of unfixed vulnerabilities, and the highest severity vulnerability level; these are obtained by directly mapping the values ​​after parsing the vulnerability scan report. The user behavior feature triplets consist of an operation sequence vector (e.g., [login → query → download], embedded into a fixed dimension using Word2Vec); an abnormal operation flag (a Boolean value, based on rules such as unauthorized access); and session features (normalized values ​​such as login time and access frequency).

[0036] In step S20 , a Bayesian network is constructed using the risk dimensions included in the standardized data set as nodes and the probability relationships between the nodes as edges, wherein the Bayesian network is used to output risk assessment results.

[0037] Optionally, the Bayesian network is used for multidimensional risk modeling, and each risk dimension is used as a node to construct a multidimensional risk model based on the Bayesian network.

[0038] A Bayesian network is a directed acyclic graph model in which nodes represent various factors related to network security, namely the entities covered by the target server and the various risk factors that may exist in the corresponding network security data as risk dimensions. For example, the device resource risk and asset value risk corresponding to the entity, and the protocol vulnerability risk, firmware vulnerability risk, threat level risk, vulnerability degree risk, and user behavior risk corresponding to the network security data.

[0039] As an example, asset value (such as server hardware value and data sensitivity) is obtained from the asset inventory score, threat level (such as attack frequency and attack success rate) comes from the intrusion detection system, vulnerability level (such as vulnerability severity and patch coverage) comes from vulnerability scanning reports, and user behavior risk dimensions (such as identity credibility and abnormal operation frequency) come from user log analysis.

[0040] As a possible implementation method, historical risk event samples are obtained to train a Bayesian network, and the conditional probability distribution between various risk dimensions is learned, thereby realizing a dynamic assessment of network system security risks.

[0041] As an example, network attack events can be recorded in real time using devices such as intrusion detection systems (IDS), intrusion prevention systems (IPS), and firewalls. For example, if an IDS detects an unauthorized access attempt against the Modbus protocol, it will record information such as the attack source IP address, target device, attack type, and attack time, forming the basis for risk event samples. By collecting device operation logs, including system logs and application logs, such as abnormal operation logs recorded by industrial controllers, which contain information such as operation time, operation instructions, and device status changes, these logs can be used to analyze device attacks or anomalies and supplement risk event sample details. Regularly scanning network devices using vulnerability scanning tools (such as Nessus and OpenVAS) can obtain information about device vulnerabilities and, based on vulnerability exploitation, generate risk event samples. For example, if a scan reveals a CVE-2025-XXXX vulnerability in a PLC, and if this vulnerability is actually exploited, causing device anomalies, this vulnerability will be included in the historical risk event sample, recording the vulnerability number, affected device, and exploitation method.

[0042] As another example, security incidents discovered by network security administrators during routine inspections or emergency response are manually entered into the system and added to the historical risk event sample library. For example, if an administrator discovers abnormal data transmission behavior on a device and, after analysis, confirms that it is caused by malware, the administrator will record the details of the incident (including event description, handling process, and scope of impact) as a sample.

[0043] As another example, by accessing a third-party threat intelligence platform, you can obtain common security threat information in the industry, such as new attack methods, lists of known malicious IP addresses, etc., and combine it with the company's internal network environment to filter out risk events related to yourself and enrich the sample library content.

[0044] The information related to historical risk events collected through the above-mentioned multiple channels is integrated into structured historical risk event samples after pre-processing operations such as data cleaning and format conversion. Each sample contains key fields such as event ID, occurrence time, involved devices, attack type, impact, and processing results, providing reliable data support for subsequent risk modeling and strategy optimization.

[0045] By training the Bayesian network with historical risk event samples, the Bayesian network can learn the causal and dependency relationships between the nodes in the historical risk event samples, thereby effectively inferring the risk dimensions of the nodes.

[0046] Further, to construct a Bayesian network and output risk assessment results, please refer to Figure 2 , the specific steps include: Step S201: Taking the risk dimension as the parent node, obtain the indicators reflecting each risk dimension as the child nodes.

[0047] As an example, for device resource risk , parent node: device resource status (Sres), child nodes may include: CPU utilization (C, normalized 0-1), memory utilization (M, normalized 0-1), battery level (B, normalized 0-1, mobile devices only), computing power level (P, enumeration value: low / medium / high, one-hot encoding). It can be expressed by the following formula: ,in, Represents the weighted sum of child nodes, where the weight of each child node is determined by the posterior probability of the Bayesian network.

[0048] As another example, the risk of protocol vulnerability , parent node: protocol vulnerability status (Spro), child nodes include: protocol encryption status (E, unencrypted = 1, encrypted = 0), known vulnerability existence (V, CVE exists = 1, otherwise = 0), protocol authentication mechanism (A, no authentication = 1, weak authentication = 0.5, strong authentication = 0). It can be expressed by the following formula: ,in, Represents a Boolean logic function.

[0049] As another example, the risk of firmware vulnerabilities The parent node is the firmware security status (Sfirm), and its child nodes include the CVE score mapping value (F, 0-1, using the CVSS base score / 10), and the firmware update status (U, not updated = 1, partially updated = 0.5, latest = 0). This can be expressed by the following formula: .

[0050] As another example, asset value risk , parent node: asset criticality (Sasset), child nodes include: hardware value score ( , asset list assignment, 1-5 level mapping 0.2-1.0), data sensitivity level ( , business definition: Public = 0, Confidential = 0.6, Top Secret = 1.0). It can be expressed by the following formula: .

[0051] As another example, the threat level risk , parent node: threat exposure (Sthreat), child nodes include: attack frequency ( , times / hour, normalized to 0-1), attack success rate ( , normalized to 0-1, from IDS logs). It can be expressed by the following formula: .

[0052] As another example, vulnerability risk , parent node: system vulnerability status (Svuln), child nodes include: vulnerability severity average ( , 0-1, average CVSS score of all known vulnerabilities), patch coverage ( , number of fixed vulnerabilities / total number of vulnerabilities, normalized to 0-1). It can be expressed by the following formula: .

[0053] As another example, user behavior risk , parent node: user trust status (Suser), child nodes include: identity credibility score ( , 0-1, based on authentication history: multi-factor authentication = 1, weak password = 0.3), abnormal operation frequency ( , times / day, normalized to 0-1, based on baseline deviation). It can be expressed by the following formula: .

[0054] In the embodiment of the present application, based on the above example, a Figure 3The Bayesian network risk dimension node diagram shown in the figure, in which each risk dimension is the parent node of the parent node, and the overall risk is the parent node of each risk dimension. For example, the device resource risk is the parent node of the device resource status, and the device resource status is the parent node of child nodes such as CPU utilization and memory utilization. The device resource status can be the winning rate, and the device resource risk is directly used as the parent node of child nodes such as CPU utilization and memory utilization.

[0055] Step S202 : Based on the logical relationship between the parent node and the child node, edges are generated from the parent node to the child node, thereby generating a Bayesian network, wherein the edges correspond to conditional probabilities.

[0056] Optionally, the edge relationship is a dependency relationship, which indicates the impact of the risk dimension on the specific indicator. The node dependency is determined through expert knowledge or data mining (such as the K2 algorithm). For example, Sres→C indicates that the device resource status directly affects the CPU utilization.

[0057] It should be noted that the edges only point from parent nodes to child nodes, and there are no reverse edges, to ensure that the independence assumption of conditional probabilities holds.

[0058] Furthermore, using historical data or expert scoring, conditional probabilities are defined for each node, and a conditional probability table (CPT) is automatically generated. The impact of each risk dimension is quantified through probability calculation, and the conditional probability table of each node is output. ,in, represents the i-th child node, Represents the i-th child node The parent node collection.

[0059] Among them, the conditional probability can be calculated by one or more methods such as maximum likelihood estimation, Bayesian estimation, expectation maximization, gradient descent optimization, etc., which will not be repeated in the embodiments of this application.

[0060] It should be noted that any child node in a global Bayesian network may be influenced by multiple parent nodes. Therefore, each child node corresponds to a set of parent nodes. Based on this set of parent nodes, a conditional probability table is generated to describe the probability distribution of the child node's state given the state of the parent node. For scenarios with labeled security event datasets, historical data statistics are used to calculate the frequency of events. For big data scenarios, machine learning methods are used, using an expectation maximization algorithm to learn parameters and smoothing to avoid zero-probability scenarios.

[0061] As a possible implementation method, the conditional probability table for scenarios lacking historical data needs to be initialized, for example, through expert experience, where network security experts assign values ​​based on their experience; for scenarios with labeled security event data sets, historical data statistics are used to count the frequency of events; for big data scenarios, machine learning methods are used, and the expectation maximization algorithm learns parameters, and smoothing is performed to avoid zero-probability scenarios.

[0062] Step S203: Obtain the joint probability distribution of each child node through Bayesian network reasoning.

[0063] Optionally, for each risk dimension, based on the conditional probability of any child node under each parent node, the joint probability distribution of each child node is obtained. The joint probability of n child nodes can be decomposed into the product of the local probabilities of each child node under the condition of the parent node, which can be expressed by the following formula: , represents the joint probability.

[0064] Step S204: determining the risk dimension risk value of each risk dimension at different risk levels based on the joint probability distribution, and determining the overall risk value based on the risk dimension risk values.

[0065] By performing probability calculations on all possible combinations of risk factor states and calculating the joint probability of all risk factors occurring simultaneously, we can obtain the probability that the network system is at different risk levels. This is used as the risk value of the risk dimension, and a causal relationship model of risk factors is constructed, providing a structural basis for subsequent probabilistic reasoning.

[0066] Furthermore, corresponding weights are assigned to the risk values ​​of each risk dimension, and the overall risk value is obtained by weighted summing the risk values ​​of each risk dimension.

[0067] The weights corresponding to the risk values ​​of each risk dimension can be determined based on the importance of each risk dimension, and the sum of the weights corresponding to the risk values ​​of each risk dimension can be ensured to be 1. For example, the weights can be allocated based on the impact of each risk dimension in historical risk events.

[0068] As an example, in the embodiment of the present application, the goal is to minimize the prediction error of historical risk events, and the weighted fitness (W) is calculated by the following formula:

[0069] Where H represents the historical risk event sample set, h represents the historical risk event sample, r(h) represents the actual risk level, |H| represents the size of the historical risk event sample set, and Rtotal(h;W) represents the overall risk value of the historical risk event sample h calculated using the current weight W.

[0070] As an example, the actual risk level r(h) can be manually labeled or generated by an authoritative system, with levels 1-5 mapped to 0.2-1.0 respectively.

[0071] It should be noted that the value range of Fitness(W) is [0,1]. The larger the value, the smaller the deviation between the overall risk value predicted by the model and the actual risk level r(h).

[0072] Furthermore, through iterative optimization through selection, crossover, and mutation until the Fitness (W) value converges, the optimal weight vector W is obtained for subsequent overall risk calculation.

[0073] As an example, a genetic algorithm uses roulette wheel selection, where individuals with higher fitness are more likely to be selected. Single-point crossover swaps some weight genes between two parent individuals. Gaussian mutation adds random perturbations to the weight vector to avoid local optima. Termination conditions are either fitness convergence or reaching a maximum number of iterations (e.g., 100 generations), and the optimal weight vector is output.

[0074] It should be noted that weight optimization is independent of CPT. The genetic algorithm only adjusts the weights of the risk dimension layer and does not change the conditional probability relationship between indicators and risk dimension nodes. Automatically optimizing risk dimension weights through genetic operations avoids the subjectivity of manual weighting and improves model generalization and assessment accuracy.

[0075] Step S205 , the risk assessment result is formed by the risk value of each risk dimension, the overall risk value and the node probability distribution, wherein the node probability distribution is composed of the conditional probability corresponding to each sub-node.

[0076] Optionally, the risk assessment results output by the Bayesian network include the risk value R of each risk dimension i , overall risk value R total And the node probability distribution P, where i represents the dimension identifier of the risk value of the risk dimension.

[0077] Furthermore, risk classification and strategy selection can be performed based on the overall risk value, as shown in Table 1.

[0078] Table 1

[0079] It should be noted that the high risk probability of each node can also be used as a factor affecting the risk level determination.

[0080] Step S30: construct a knowledge graph based on the entities covered by the target server and the relationships between the entities, where the entities include at least devices, protocols, vulnerabilities, and attack behaviors.

[0081] Optionally, a knowledge graph is constructed that includes entities such as devices, protocols, vulnerabilities, and attack behaviors, as well as their relationships (e.g., protocol used, vulnerability present, and attack target). This structured approach integrates various cybersecurity information, visually displays the relationships between devices, protocols, vulnerabilities, and other elements, and provides a knowledge foundation for attack path analysis. Knowledge graph nodes include devices (sensors / controllers / PLCs), protocols (Modbus / MQTT), vulnerabilities (CVE-XXXX), and attack behaviors (register writes / payload injection). Edges represent relationships such as "protocol used," "vulnerabilities present," and "attack targets."

[0082] As a possible implementation, network security data, such as device fingerprints, network traffic, vulnerability scan reports, and user operation logs, is collected to construct the knowledge graph. For example, CVE numbers and related vulnerability information are extracted from vulnerability scan reports, and the protocol type used by the device is obtained from the device fingerprint. Furthermore, natural language processing (NLP) techniques and regular expression matching are used to identify entities from the collected data. For device entities, regular expressions are used to match the device ID format; for vulnerability entities, the fixed format of the CVE number is used for extraction. Furthermore, relationships between entities are determined using a rule engine and machine learning algorithms. For example, the rule "If device A's network traffic contains Modbus protocol packets, then device A uses the Modbus protocol" is used to establish a device-protocol relationship. Graph neural networks (GNNs) are used to analyze network topology data and identify device-device connection relationships. Furthermore, a graph database (such as Neo4j) is used to store the knowledge graph, facilitating efficient querying and reasoning about complex relationships. For example, a quick query can be performed for "devices with high-risk vulnerabilities that use unencrypted protocols and their connected downstream devices."

[0083] Step S40: Based on the preset protocol state machine and propagation prediction model, the propagation path of the attack behavior between devices is simulated in the knowledge graph to determine the propagation prediction result.

[0084] Optionally, a Protocol State Machine (PSM) is a formal model used to describe system behavior (especially communication protocols). It specifies the system's response logic under different conditions by defining states, events, transitions, and actions.

[0085] In the embodiment of the present application, the initial state of the protocol state machine is S0, indicating that the device is waiting for a request and is in a normal communication preparation state; the intermediate states are S1 and S2. When the device receives the function code 0x06 (write register), it enters the S1 state. Based on the S1 state, if a malicious payload is received, it enters the S2 state, indicating that the attack behavior is further implemented; the terminal state is S3. If the attack is successful or blocked by the defense, it enters the corresponding terminal state. The state conditions are the protocol data features and vulnerability exploitation conditions based on the state transition. For example, the transition condition from S0 to S1 is the receipt of a Modbus request with the function code 0x06; the transition from S1 to S2 depends on whether there is an exploitable protocol vulnerability, where the protocol vulnerability is determined by the probability distribution of the "protocol vulnerability" node in the Bayesian network.

[0086] Among them, the terminal state is not explicitly listed in the basic state and can be defined according to actual conditions.

[0087] Furthermore, a propagation prediction model is constructed for all devices covered by the target server. Figure 4 , the specific steps include: Step S401: Based on the attack status of the device, the security status of the device is divided into a susceptible state, an infected state, and a recovered state.

[0088] Susceptible (S): The device is not currently attacked, but may be attacked due to protocol vulnerabilities, firmware updates, etc. For example, a Modbus sensor using the default configuration and no encryption is in the Susceptible state.

[0089] Infected (I): The device has been compromised and has become a new attack vector, potentially spreading threats to other vulnerable devices. For example, a PLC infected with malware may attempt to exploit protocol vulnerabilities to infect other connected devices.

[0090] Recovered (R): The device successfully eliminates the threat by implementing defense strategies (such as vulnerability repair, patch installation, and encryption) and is no longer involved in the attack propagation. For example, a camera enters the recovered state after completing a firmware upgrade to fix a remote code execution vulnerability.

[0091] Step S402 : determining the attack propagation probability between different devices based on the impact of the protocol on the propagation probability, and generating a propagation probability matrix based on the attack propagation probability between the devices.

[0092] It is understandable that if the protocol is fragile and the vulnerability is more likely to be successfully exploited, it is easy to be attacked and, correspondingly, the possibility of spreading is higher. The probability of attack spreading between devices can be calculated using the following formula:

[0093] in, represents the probability of attack propagation from device i to device j, α and β represent propagation coefficients, and α+β=1, represents the success probability of exploiting the protocol vulnerability from device i to device j, Represents the protocol vulnerability risk value of device j.

[0094] It should be noted that the probability of successful exploitation of protocol vulnerabilities is The probability of successfully attacking device j from device i by exploiting the protocol vulnerability is calculated by the conditional probability of the protocol-related nodes in the Bayesian network; the protocol vulnerability risk value Output by the multidimensional risk model (i.e., Bayesian network), the value range is [0,1]. The higher the value, the more vulnerable the protocol of device j is to attack.

[0095] By calculating the attack propagation probability, the possibility of attack propagation between devices is quantified, providing basic probability data for simulating threat propagation paths.

[0096] Furthermore, the propagation probability matrix is ​​constructed with the device identifiers as rows and columns. The propagation probability matrix is ​​an N×N matrix, where N is the number of devices covered by the target server. As the element in the i-th row and j-th column of the propagation probability matrix.

[0097] Step S403, based on the attack propagation probability and recovery rate corresponding to the device and the number of devices in each security state, obtain the rate of change of the security state over time, wherein the recovery rate is determined based on the attributes of the device and the change rate is used to build a propagation prediction model.

[0098] Optionally, the attack propagation probability reflects the likelihood of an attack spreading from one device to another and can be used as the infection rate B in the propagation prediction model. The recovery rate γ is determined based on the device's own attributes, specifically the effectiveness of the defense strategy and the device's responsiveness. For example, for a device implementing the "vulnerability remediation" strategy, if the historical success rate of vulnerability remediation is 90%, the recovery rate γ is set to 0.9. For the "full traffic encryption" strategy, considering the encryption deployment and effectiveness time, if there is a 70% probability of achieving effective defense within a unit of time, the recovery rate is set to 0.7.

[0099] Furthermore, the SIR model is mathematically described using differential equations to characterize the dynamic changes of the device between different states:

[0100]

[0101]

[0102] Where S(t) represents the number of devices in the susceptible state at time t, I(t) represents the number of devices in the infected state at time t, R(t) represents the number of devices in the recovered state at time t, and S(t)+I(t)+R(t)=N. represents the rate of change of the number of susceptible devices over time, Indicates the rate of change of the number of infected devices over time, Indicates the rate of change of the number of devices in the recovery state over time.

[0103] It is understandable that It can reflect the changes in the number of susceptible devices that change to infected state after contacting infected devices with infection rate B, resulting in a decrease in the number of susceptible devices; It can reflect the changes in how infected devices infect susceptible devices at an infection rate B, increasing the number of infected devices, and how they recover to normal at a recovery rate γ, decreasing the number of infected devices. It can reflect the changes in the number of infected devices that are transformed into the recovered state at the recovery rate γ, which increases the number of recovered devices.

[0104] Step S404: construct a propagation prediction model based on the safety status, the propagation probability matrix, and the change rate.

[0105] Furthermore, combining the protocol state machine, the propagation probability matrix and the above-mentioned change rate, a propagation prediction model is constructed. Based on the SIR model, the protocol state machine is introduced to simulate the propagation details of the attack at the protocol level. Determine the propagation relationship between devices and realize attack propagation simulation from the macro network level to the micro protocol level. Determine whether device i can spread the attack to device j, and at the same time combine the protocol state machine to determine whether the attack complies with the protocol process and vulnerability exploitation conditions.

[0106] In some embodiments, a propagation path weight can also be set for the propagation prediction model, and possible propagation paths can be sorted according to the propagation path weight. Paths with higher weights are explored more preferentially, thereby determining the main propagation direction and key paths of the threat in the network.

[0107] As an example, the sum of the overall risk values ​​of all devices on the propagation path is used as the propagation path weight of the propagation path.

[0108] The propagation prediction model uses a propagation probability matrix to determine the likelihood of propagation between devices, while propagation path weights comprehensively assess the risk level of propagation paths. The propagation prediction model uses propagation path weights to optimize search strategies, prioritizing high-risk paths. This ensures simulation results are more consistent with actual threat propagation, improving prediction accuracy and efficiency.

[0109] Step S405: determine the initial threatened node in the knowledge graph, and starting from the initial threatened node, generate one or more propagation paths through the propagation prediction model.

[0110] Optionally, the initial threatened node is determined based on the risk assessment result. For example, the device with the largest risk value is selected as the initial threatened node.

[0111] Furthermore, a breadth-first search is adopted, starting from the initial threatened node, and possible propagation paths are generated according to the simulation of the propagation prediction model until no new nodes are reachable, and one or more propagation paths are obtained.

[0112] As a possible implementation method, the initial threatened node is marked as infected (I) as the starting point of propagation. By recording the current timestamp, overall risk value, associated protocol type and vulnerability information (from the knowledge graph) of the initial threatened node, the state parameters are initialized to provide basic data for subsequent propagation probability calculation and protocol status verification.

[0113] Furthermore, based on the connection relationships between devices in the knowledge graph, such as physical topology and communication links, the direct adjacent devices of the initial threatened node, i.e., first-level neighbors, are screened as potential propagation targets.

[0114] Furthermore, the attack propagation probability from the initial threatened node to each first-level neighbor is obtained through the propagation probability matrix , where i is the initial threatened node and j is the first-level neighbor of the initial threatened node. < the preset propagation probability threshold, the first-level neighbor is judged as "unreachable" and excluded from the current propagation path; if ≥ the preset propagation probability threshold, then proceed to the next step of protocol status verification.

[0115] It should be noted that the preset propagation probability is determined based on parameters such as the attack propagation probability, recovery rate, and the initial number of infections, and needs to be determined in combination with specific scenarios and is not limited here.

[0116] If the attack propagation probability is greater than or equal to the preset propagation probability threshold, the pre-set protocol state machine checks whether the attack behavior meets the vulnerability exploitation criteria of the protocol used by the first-level neighbor. For example, if the first-level neighbor uses the Modbus protocol, the protocol state machine verifies whether the attack behavior contains exploitable function codes and whether the device has the corresponding vulnerability. If the attack behavior does not meet the vulnerability exploitation criteria of the protocol state machine, such as if the protocol is encrypted and has no known vulnerabilities, the propagation is terminated and the first-level neighbor is not infected. If the protocol state verification passes, the first-level neighbor transitions from susceptible state (S) to infected state (I), becoming a new source of infection.

[0117] Starting from the initial threatened node, the attack is traversed layer by layer in the order of "first-level neighbors → second-level neighbors → ... → N-level neighbors". Each expansion repeats the screening and verification process of attack propagation probability verification and protocol status verification. When all neighbor devices at a certain level are judged as "unreachable", such as If the threshold or protocol verification fails, or the preset maximum propagation depth is reached, the expansion stops.

[0118] During the expansion process, each time a new device is successfully infected, the complete device sequence from the initial compromised node to that device is recorded, such as device A → device B → device C, forming a propagation path. If a device infects multiple neighboring devices, multiple propagation paths are formed by recording the complete device sequence from the initial compromised node to different neighboring devices until the expansion stops, such as device A → device B → device C and device A → device B → device D, each forming a propagation path.

[0119] In some embodiments, if a propagation path weight is set for the propagation prediction model, a breadth-first search combined with a propagation path weight priority strategy is used to generate a corresponding propagation path starting from the initial threatened node.

[0120] It can be understood that the higher the propagation path weight is, the greater the risk impact on the corresponding propagation path is, and the propagation path should be searched first.

[0121] As a possible implementation, during each level of neighbor screening, the current weight of each potential transmission path is calculated. The paths with the highest weight are then expanded first, meaning the next level of neighbors along that path are infected first. For example, if, among the first-level neighbors of the initially threatened node A, the transmission path weight of neighbor B (A→B) is 0.8 and the transmission path weight of neighbor C (A→C) is 0.5, the A→B path is expanded first, followed by the A→C path.

[0122] In some embodiments, low-weight paths can also be pruned to reduce invalid calculations. For example, if the propagation path weight of a certain propagation path is lower than a preset weight threshold, the expansion of the propagation path is directly terminated.

[0123] It should be noted that the preset weight threshold can be determined by setting a specific numerical value or based on the lowest value of a certain proportion of all propagation path weights. It needs to be determined in combination with the specific scenario and is not limited here.

[0124] Furthermore, all the extended propagation paths are deduplicated, completely repeated device sequences are removed, and partially overlapping paths are merged, such as A→B→C and A→B→D, which can be retained as two independent paths.

[0125] Step S406: taking a set of threatened devices involved in the propagation path as a propagation prediction result.

[0126] Optionally, after obtaining the propagation path through the above steps, each propagation path corresponds to a set of threatened devices. For example, the threatened device set corresponding to the propagation path A→B→C is {device A, device B, device C}. The final generated propagation path set contains all possible attack diffusion trajectories, which serves as the basis for generating subsequent defense strategies.

[0127] In the embodiment of the present application, the output propagation prediction results include the threat propagation path set P = {p1, p2, ..., pm} and the affected range device list D affected , where p1, p2, …, pm represent different propagation paths. Each propagation path is a device sequence. These paths are simulated by the propagation prediction model and reflect the possible propagation trajectory of the threat in the network. affected It includes all devices that may be affected by the threat, and is obtained by removing duplicates from all devices in the threat propagation path set.

[0128] D affected It clarifies the range of devices that may be affected by the threat, provides a target device set for dynamic defense strategy generation, and ensures that the defense strategy can cover all threatened devices.

[0129] Step S50 , matching defense strategies in a preset defense strategy library according to the risk assessment results and the propagation prediction results, and generating a dynamic defense strategy set including multiple defense strategies.

[0130] Optionally, the risk assessment results and propagation prediction results can be used to determine the threatened devices and the corresponding risks, and then filter out defense strategies based on the device resource characteristics and security requirements of the threatened devices.

[0131] In this embodiment, the pre-defined defense policy library S = {sk|k = 1, 2, ..., K} stores a collection of various defense policies, where K represents the total number of defense policies. Each policy sk includes core attributes such as the policy name, execution operation, resource consumption value C, risk reduction value ΔR, applicable device type, and policy priority.

[0132] As an example, basic policies might include: Log Monitoring Policy s1, which records device operation logs, has a resource consumption of C = 0.1, a risk reduction of ΔR = 0.3, applies to all devices, and has a low priority. Full Traffic Encryption Policy s2, which encrypts device network traffic, has a C of 0.8, a ΔR of 0.7, applies to high-computing devices, and has a high priority.

[0133] In the early stages of the defense strategy library, experts are required to define basic strategies and parameters. The initialization methods of the defense strategy library include: manual preset: basic attributes such as strategy name, operation type, and applicable equipment are defined by experts; parameter assignment: the initial resource consumption value C and risk reduction value ΔR are set based on historical experience or simulation tests.

[0134] In some embodiments, the defense policy library can be expanded according to the device resource characteristics and security requirements, and lightweight policies (suitable for low-resource devices) and protocol-level policies (for specific protocol vulnerabilities) can be added to enrich the content of the policy library, so that the policy library can meet the needs of different types of devices and security scenarios, and improve the adaptability of the policy.

[0135] As an example, the defense policy library can be extended in the following ways: Lightweight policies are designed for low-resource devices (such as sensors) and feature low resource consumption and fast execution. For example, lightweight encryption policy s3 uses a simplified encryption algorithm, with a resource consumption of C = 0.4 and a risk reduction of ΔR = 0.6. It is only applicable to devices with CPU utilization ≤ 50%.

[0136] Protocol-level policies focus on protecting against specific protocol vulnerabilities. For example, Modbus function code filtering policy s4 prohibits the dangerous function code 0x06, with a C value of 0.2, reducing the protocol vulnerability risk by 0.5. MQTT encryption upgrade policy s5 upgrades the unencrypted MQTT protocol to MQTT over TLS, with a C value of 0.8, applicable to devices with memory usage ≥ 60%.

[0137] Rule Supplementation: Dynamically add defense rules based on emerging threat types, vulnerability characteristics, or device features. For example, when a new malicious payload attack pattern is discovered, a targeted traffic detection policy is added.

[0138] Parameter Optimization: Based on historical defense effectiveness data, adjust the strategy's resource consumption and risk reduction parameters. If a log monitoring strategy's actual risk reduction effect is poor, reduce its ΔR value.

[0139] The expanded policy library content is as follows: Lightweight strategy: including log monitoring and lightweight encryption; Protocol-level policies: including Modbus function code filtering and MQTT encryption upgrades; General strategies: including full traffic encryption and vulnerability hot patch deployment.

[0140] The sources of historical defense effectiveness data include: policy execution results: policy status (success / failure / rollback) reported by edge nodes; resource monitoring logs: CPU / memory fluctuation time series before and after policy execution; and attack event changes: changes in attack frequency / type detected by the IDS system.

[0141] Among them, parameter optimization can be automatically adjusted, and the process includes: First, defense effectiveness data and resource adaptability data are collected. Defense effectiveness data includes: The system compares attack event changes before and after policy execution in real time: The number of attacks suffered by the target device within the time window T after policy execution (from IDS / IPS logs) is collected, and the actual attack interception rate is calculated: interception rate = (original number of attacks - residual number of attacks) / original number of attacks. Resource adaptability data includes: real-time monitoring of device resources after policy execution: recording CPU / memory fluctuations ΔC = |post-execution utilization - pre-execution utilization|; and calculating the percentage of devices with resource over-limits: over-limit rate = (number of devices with ΔC > threshold 0.3) / total number of devices executing the policy.

[0142] Next, adjust the parameters: (1) Risk reduction value ΔR adjustment: ΔR new =ΔR old × (1 + δ × (actual interception rate - expected interception rate)) Where, ΔR new represents the updated risk reduction value, ΔR old It represents the risk reduction value before the update, δ represents the learning rate (default δ = 0.2), which controls the adjustment range; the expected interception rate is the theoretical value preset in the policy library (for example, the expected interception rate of the full traffic encryption policy = 0.85).

[0143] (2) Resource consumption value C adjustment: C new =C old × (1 + μ × overlimit rate) Among them, C new Indicates the updated resource consumption value, C old Indicates the resource consumption value before the update, μ is the penalty coefficient (default μ=0.5). The higher the overlimit rate, the greater the resource consumption increase.

[0144] Finally, automatic validation and verification.

[0145] Instant update strategy library: the new parameter ΔR new、C new The policy database is written in real time, and the next round of policy generation takes effect immediately.

[0146] Effect tracking feedback: Continuously monitor the effect of three consecutive executions of the updated policy. If the resource excess rate is still greater than 0.4 or the interception rate is less than 0.5, the policy is marked as a policy to be optimized. After five cumulative markings, the policy is automatically frozen and an alarm is triggered.

[0147] Anti-oscillation protection: The single adjustment range is limited to ±20% to avoid drastic fluctuations in parameters.

[0148] Furthermore, for any threatened device in the propagation prediction results, candidate strategies are selected from the defense strategy library under the constraints of resources and risks; the strategy scores of the candidate strategies are obtained based on the resource consumption, strategy priority and the risk value that can be reduced after the execution of the candidate strategies; the candidate strategies are selected based on the ranking of the strategy scores to generate a defense strategy set.

[0149] In the embodiment of the present application, for any threatened device in the propagation prediction result, the screening conditions of the candidate strategies are as follows: Resource constraints: The total resource consumption (such as CPU and memory usage) of the selected candidate policies must not exceed the available resource capacity of the device. Risk constraints: The total risk reduction capability of the selected candidate policies must cover the current risk value of the device (that is, the sum of the risk reduction values ​​of each candidate policy must be greater than or equal to the risk value of the risk dimension of any threatened device).

[0150] Traverse each strategy from the defense strategy library, compare the resource consumption of any strategy with the preset remaining resource threshold, and if it is less than or equal to the remaining resource threshold, add the strategy to the candidate strategy set.

[0151] For each threatened device, candidate policies that meet the resource consumption requirements are screened out based on the device's remaining resource threshold, narrowing the policy selection range to ensure that the selected policy is within the device's resource tolerance range, thereby avoiding device resource overload caused by policy execution.

[0152] Furthermore, the candidate strategy scores are calculated, taking into account the risk reduction value, resource consumption and priority of the strategy, and the candidate strategies are ranked by quantitative scoring to select the strategy with the best overall performance in terms of risk reduction and resource consumption.

[0153] As an example, the strategy score Score(s) of strategy s can be calculated using the following formula:

[0154] Among them, ΔR(s) represents the risk value that can be reduced after the execution of strategy s, λ represents the resource sensitivity coefficient, and C(S) represents the resource consumption of strategy s.

[0155] It should be noted that ΔR(s) ranges from [0,1] and is predefined by the policy library. λ∈[0,1] is used to balance resource consumption and risk reduction. Low-resource devices typically use λ=0.8, prioritizing low-resource consumption policies. High-computing-power devices can use λ=0.5. Policy priority (s) is a manually preset policy priority and can range from [1,5]. A larger value indicates a higher priority. For example, protocol-level policies are typically set to 4, while lightweight policies are set to 2.

[0156] Candidate policies are ranked by Score(s). A higher score indicates a policy with better overall performance in reducing risk and resource consumption. Policies with higher Score(s) are prioritized to ensure the generated defense policy is efficient and adaptable to device resources. For example, the top V policies that meet resource and risk constraints are selected as the defense policy set.

[0157] Furthermore, during the policy selection process, multiple policies may be applied to the same device, requiring conflict detection and elimination.

[0158] In an embodiment of the present application, when multiple candidate policies act on the same threatened device, resource conflict detection is first performed: if the total resource consumption of each candidate policy exceeds the device capacity, the single policy with the highest policy score is selected as the defense policy set.

[0159] It is understandable that when the total resource consumption of each candidate strategy exceeds the device capacity, it indicates that there is a resource conflict; otherwise, there is no resource conflict. In the case of a resource conflict, other strategies are discarded and only the single strategy with the highest strategy score is selected as the defense strategy set.

[0160] In some embodiments, if there is no resource conflict but a target conflict (i.e., multiple candidate policies apply to the same threatened device), protocol-level policies are prioritized. This is because protocol-level policies are highly targeted and can effectively block attacks based on protocol vulnerabilities. For example, if a Modbus function code filtering policy conflicts with a general policy, the Modbus function code filtering policy takes precedence.

[0161] Through the aforementioned policy library management, candidate policy screening, and conflict resolution mechanisms, the system can generate conflict-free, efficient dynamic defense strategies based on device risk and resource status, enhancing the security and protection capabilities of smart factory networks. It also outputs a device-level defense policy mapping table and a conflict-free dynamic defense strategy set.

[0162] As a preferred implementation method, real-time resource data is collected after the execution of each defense strategy in the defense strategy set, and the resource fluctuation value of the real-time resource data is calculated; when the resource fluctuation value exceeds the preset fluctuation threshold, the policy rollback is triggered, wherein the policy rollback includes revoking the defense strategy and restoring the parameters of the threatened device.

[0163] Policy rollback operations include: Revoking the current policy: The system immediately stops executing the current defense policy and restores the device to its pre-policy state. For example, if executing a full-traffic encryption policy causes the device's CPU utilization to rise sharply and exceed a threshold, the encryption policy is stopped and the related encryption processes and services are shut down. Restoring the state: This restores the configuration parameters and operating status of the threatened device to their original state before policy execution, ensuring normal and stable operation. This includes restoring network communication parameters and system service settings to prevent any lingering impact from policy remnants.

[0164] Furthermore, when the policy rollback operation is executed, logs and feedback notifications can also be recorded.

[0165] Logging: During a policy rollback, detailed information about the rollback event is recorded, including the rollback time, the device ID that triggered the rollback, the policy name that caused the rollback, and resource fluctuations, forming a policy execution result log. This log data provides important evidence for subsequent feedback and evaluation, helping to analyze the causes of policy execution failures.

[0166] Feedback Notification: This notification sends a policy rollback notification to system administrators or relevant operations and maintenance personnel, alerting them to any unusual defense policy execution and providing detailed information about the rollback event, allowing for further troubleshooting and policy adjustments. The rollback event is also fed back to the feedback evaluation module, which updates risk models and optimizes the defense policy library to prevent similar issues from recurring.

[0167] Furthermore, if a policy rollback event occurs, the conditional probability table of the relevant nodes in the Bayesian network can be updated, and the policy execution effect can be analyzed through multi-dimensional indicators to trigger the update of weights and parameters in the Bayesian network and defense policy library.

[0168] As an example, a parameter automatic adjustment mechanism can be set for the defense policy library. For example, the initial resource consumption value C of the full-traffic encryption policy is 0.8. If three executions all result in CPU overload, it is automatically adjusted to 0.85.

[0169] Step S60: Based on the dynamic defense strategy set, call the corresponding device communication interface to execute the defense strategy.

[0170] In this embodiment of the present application, the device communication interface list is obtained in the following manner: Device registration phase: When a new device is connected to the network, it actively reports the communication interface information it supports during the registration process, including the interface type (such as ModbusTCP, MQTT, OPCUA, etc.), communication port number, data transmission protocol format, etc. The system records this information and integrates it into the device communication interface list.

[0171] Network scanning and detection: Use network scanning tools (such as Nmap and Zabbix) to regularly scan devices on the network, identify the communication ports and protocol types open on the devices, and supplement or update the device communication interface list. For example, if a scan finds that a device has port 502 open and uses the Modbus protocol, the corresponding Modbus communication interface information will be added to the list.

[0172] The defense strategy is sent to the target device through the edge computing node, the policy execution effect is monitored in real time, abnormal situations caused by policy execution are handled, and the policy execution results are output.

[0173] Policy execution methods are determined based on device resource status (such as CPU utilization and remaining memory) and device type (sensor, controller, PLC, etc.). For low-resource devices (such as sensors), due to their limited computing and storage capabilities, lightweight policies such as log monitoring and lightweight encryption are prioritized for local execution on edge computing nodes to avoid latency associated with cloud transmission. For high-resource devices (such as controllers and PLCs), complex policies such as full-traffic encryption and vulnerability hotfix deployment are centrally distributed through the cloud.

[0174] In some embodiments, after executing the defense strategy, the execution effect of the defense strategy is evaluated based on the execution result of the defense strategy and real-time network security data; and the defense strategy library is updated based on the execution effect.

[0175] In the embodiments of the present application, the execution effect of the defense strategy is quantified from multiple angles, the performance of the defense strategy in resisting attacks and adapting device resources is comprehensively evaluated, feedback information is collected, and an adjustment basis is provided for subsequent risk modeling and strategy generation, forming a closed-loop management.

[0176] As an example, the ratio of the number of successful attacks intercepted by the threatened device to the total number of attacks is calculated as the defense effectiveness of the threatened device; the ratio of the number of devices with resource excess after the defense strategy is executed to the total number of executed devices is calculated as the resource excess rate of the defense strategy; the defense effectiveness and the resource excess rate constitute the execution effect.

[0177] It should be noted that the defense effectiveness value ranges from [0, 1]. Values ​​closer to 1 indicate a stronger defense strategy's ability to intercept attacks. For example, a result of 0.8 means the system successfully intercepted 80% of attacks, indicating that the defense strategy performed well in defending against external threats. A value close to 0 indicates poor defense strategy effectiveness, necessitating investigation of policy vulnerabilities, misjudgments, or policy reformulation. The resource excess rate value ranges from [0, 1]. Lower values ​​indicate a better defense strategy's adaptability to device resources. A resource excess rate of 0.2 indicates that 20% of devices experienced resource overload after executing the policy. Optimize the policy's resource consumption parameters or adjust the policy allocation scheme to prevent excessive resource consumption from impacting device normal operation.

[0178] Furthermore, the defense strategy library can be optimized based on the execution effect.

[0179] As an example, policies in the policy library are categorized based on metrics such as defense effectiveness (attack interception rate) and resource adaptability (resource excess rate) calculated during the feedback evaluation phase. For example, policies with high attack interception rates and low resource excess rates are labeled "efficient policies," while policies with low attack interception rates and high resource excess rates are labeled "inefficient and high-consumption policies."

[0180] Inefficient strategy optimization: Parameter Adjustment: For policies marked as "inefficient," analyze their execution data and adjust resource consumption and risk reduction parameters. For example, if a log monitoring policy's actual risk reduction effect falls short of expectations, increase its risk reduction value, ΔR, based on historical execution data. If an encryption policy's resource consumption is excessive but its defensive effectiveness is average, reduce its resource consumption value, C, or optimize the encryption algorithm to reduce resource usage.

[0181] Rule Improvement: Modify policy enforcement rules based on emerging threat signatures and device characteristics. For example, when a new malicious payload attack pattern is discovered, add a rule to the traffic detection policy to identify that pattern; and adjust the applicable conditions of the corresponding policy for newly connected device types.

[0182] Elimination and addition: Elimination strategy: Strategies that have failed to execute three times in a row or that still cannot achieve the expected results after multiple optimizations will be deleted from the strategy library to prevent invalid strategies from interfering with subsequent screening.

[0183] New policies: New policies are added promptly based on industry security trends, new attack methods, and the needs of enterprises for new equipment. For example, dedicated vulnerability repair or protection policies are added for newly emerging IoT device vulnerabilities; as enterprises introduce new industrial protocols, corresponding protocol security policies are added.

[0184] Policy Priority Adjustment: Dynamically adjust policy priorities based on policy execution effectiveness and changes in enterprise security needs. For example, if attacks targeting a specific protocol occur frequently over a period of time, the priority of the defense policy associated with that protocol will be increased. If the enterprise prioritizes protecting a certain type of high-value asset, the priority of the defense policy targeting that asset will be increased.

[0185] After the feedback evaluation, a feedback signal is output. The feedback signal includes the Bayesian network update parameters and the policy library adjustment instructions, so that the defense system can continuously optimize and improve according to the actual situation. The system can continuously learn and adapt to changes in the network security environment, and continuously improve the accuracy of risk assessment and the effectiveness of defense strategies.

[0186] By collecting real-time data on the effectiveness of defense strategies, comparing network data before and after implementation, and calculating indicators such as risk value changes and reductions in the number of attacks, the system then conducts a comprehensive assessment based on user feedback and system log information. This feedback is used to adjust the parameters of the multi-dimensional risk modeling module and the strategy generation rules of the dynamic defense strategy generation module, forming a closed-loop feedback mechanism that enables continuous optimization and improvement of the system, better matching defense strategies with device resources, and enhancing both adaptability and intelligence.

[0187] Although the various steps in the above embodiment are described in the above-mentioned order, those skilled in the art will understand that in order to achieve the effect of this embodiment, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple changes are within the scope of protection of this application.

[0188] See also Figure 5 The network security dynamic defense system of the second embodiment of the present application includes a data acquisition module 100, a Bayesian network construction module 200, a knowledge graph construction module 300, a propagation prediction module 400, a defense strategy generation module 500 and a defense strategy execution module 600.

[0189] The data acquisition module 100 is used to acquire the network security data of the target server, extract features from the network security data, and generate a standardized data set; A Bayesian network construction module 200 is configured to construct a Bayesian network using the risk dimensions included in the standardized data set as nodes and the probability relationships between the nodes as edges, wherein the Bayesian network is configured to output a risk assessment result; A knowledge graph construction module 300 is configured to construct a knowledge graph based on entities covered by the target server and the relationships between the entities, where the entities include at least devices, protocols, vulnerabilities, and attack behaviors; The propagation prediction module 400 is used to simulate the propagation path of the attack behavior between devices in the knowledge graph based on the preset protocol state machine and propagation prediction model, and determine the propagation prediction result; The defense strategy generation module 500 is used to match defense strategies in a preset defense strategy library based on risk assessment results and propagation prediction results, and generate a dynamic defense strategy set including multiple defense strategies; The defense strategy execution module 600 is used to call the corresponding device communication interface to execute the defense strategy based on the dynamic defense strategy set.

[0190] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process and related instructions of the system described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0191] It should be noted that the network security dynamic defense system provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present application can be decomposed or combined. For example, the modules in the above embodiment can be combined into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present application are only for distinguishing the modules or steps and are not considered to be improper limitations of the present application.

[0192] An electronic device according to a third embodiment of the present application includes: at least one processor; and a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned network security dynamic defense method.

[0193] A fourth embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned network security dynamic defense method.

[0194] A computer program product according to a fifth embodiment of the present application enables the electronic device to execute the above-mentioned network security dynamic defense method when the computer program product is run on the electronic device.

[0195] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes and related instructions of the electronic device, computer-readable storage medium, and computer program product described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0196] Those skilled in the art should be aware that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, and the programs corresponding to the software modules and method steps can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. In order to clearly illustrate the interchangeability of electronic hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0197] Reference below Figure 6 , which shows a structural diagram of a computer system of a server for implementing the method, system, and device embodiments of the present application. Figure 6 The server shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0198] like Figure 6 As shown, the computer system includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 602 or the program loaded from the storage part 608 into the random access memory (RAM) 603. Various programs and data required for system operation are also stored in the RAM 603. The CPU 601, ROM 602 and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0199] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, and the like; an output section 607 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. Removable media 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like, are installed in the drive 610 as needed so that computer programs read therefrom can be installed into the storage section 608 as needed.

[0200] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on a computer-readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0201] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0202] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0203] The terms "first", "second", etc. are used to distinguish similar objects, rather than to describe or indicate a particular order or sequence.

[0204] The term "comprise" or any other similar term is intended to cover non-exclusive inclusion such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0205] Thus far, the technical solutions of the present application have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of the present application is obviously not limited to these specific embodiments. Without departing from the principles of the present application, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present application.

Claims

1. A network security dynamic defense method, characterized in that: include: Obtaining network security data of the target server, and performing feature extraction on the network security data to generate a standardized data set; Constructing a Bayesian network using the risk dimensions included in the standardized data set as nodes and the probability relationships between the nodes as edges, wherein the Bayesian network is used to output a risk assessment result; Construct a knowledge graph based on the entities covered by the target server and the relationships between the entities, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors; Based on a preset protocol state machine and propagation prediction model, the propagation path of the attack behavior between devices is simulated in the knowledge graph to determine the propagation prediction result; Matching defense strategies in a preset defense strategy library according to the risk assessment result and the propagation prediction result to generate a dynamic defense strategy set including multiple defense strategies; Based on the dynamic defense strategy set, a corresponding device communication interface is called to execute the defense strategy.

2. The network security dynamic defense method according to claim 1, characterized in that: The Bayesian network is used to output risk assessment results, including: Taking the risk dimension as the parent node, obtaining the indicators reflecting each risk dimension as the child nodes; Based on the logical relationship between the parent node and the child node, generating an edge from the parent node to the child node, thereby generating the Bayesian network, wherein the edge corresponds to a conditional probability; Obtaining the joint probability distribution of each child node through the Bayesian network reasoning; Determining risk dimension risk values ​​for each risk dimension at different risk levels based on the joint probability distribution, and determining an overall risk value based on the risk dimension risk values; The risk assessment result is composed of the risk value of each risk dimension, the overall risk value and the node probability distribution, wherein the node probability distribution is composed of the conditional probability corresponding to each sub-node.

3. The network security dynamic defense method according to claim 1, characterized in that: Determining the propagation prediction result includes: Based on the attack status of the device, the security status of the device is divided into a susceptible state, an infected state, and a recovered state; Determine the attack propagation probability between different devices based on the impact of the protocol on the propagation probability, and generate a propagation probability matrix based on the attack propagation probability between the devices; Obtaining a rate of change of the security state over time based on the attack propagation probability and recovery rate corresponding to the device and the number of devices in each security state, wherein the recovery rate is determined based on the attributes of the device, and the change rate is used to construct a propagation prediction model; Constructing a propagation prediction model based on the safety status, the propagation probability matrix, and the change rate; Determine an initial threatened node in the knowledge graph, and starting from the initial threatened node, generate one or more propagation paths using the propagation prediction model; A set of threatened devices involved in the propagation path is used as the propagation prediction result.

4. The network security dynamic defense method according to claim 3, characterized in that: The generating of a dynamic defense strategy set including a plurality of defense strategies includes: For any threatened device in the propagation prediction result, selecting a candidate strategy from the defense strategy library under resource and risk constraints; Obtaining a policy score for the candidate policy based on resource consumption, policy priority, and a risk value that can be reduced after execution of the candidate policy; Based on the ranking of the strategy scores, the candidate strategies are selected to generate the defense strategy set.

5. The network security dynamic defense method according to claim 4, characterized in that: The selecting of the candidate strategies includes: In the case where multiple candidate policies act on the same threatened device, if the total resource consumption of the candidate policies exceeds the device capacity, a single policy with the highest policy score is selected as the defense policy set.

6. The network security dynamic defense method according to claim 4, characterized in that: The method further comprises: collecting real-time resource data after execution of each defense strategy in the defense strategy set, and calculating resource fluctuation values ​​of the real-time resource data; When the resource fluctuation value exceeds a preset fluctuation threshold, a policy rollback is triggered, wherein the policy rollback includes revoking the defense policy and restoring the parameters of the threatened device.

7. The network security dynamic defense method according to claim 1, characterized in that: The method further comprises: Evaluate the effectiveness of the defense strategy based on the defense strategy execution results and real-time network security data; Based on the execution effect, the defense strategy library is updated.

8. The network security dynamic defense method according to claim 7, characterized in that: The evaluating the execution effect of the defense strategy includes: Calculate the ratio of the number of attacks successfully blocked by the threatened device to the total number of attacks, which is used as the defense effectiveness of the threatened device. Calculate the ratio of the number of devices with excessive resources to the total number of devices executing the defense strategy after the strategy is executed, as the resource excess rate of the defense strategy; The execution effect is composed of the defense effectiveness and the resource excess rate.

9. A network security dynamic defense system, characterized in that: include: A data acquisition module is used to obtain network security data of the target server, perform feature extraction on the network security data, and generate a standardized data set; A Bayesian network construction module, configured to construct a Bayesian network using the risk dimensions included in the standardized data set as nodes and the probability relationships between the nodes as edges, wherein the Bayesian network is used to output a risk assessment result; A knowledge graph construction module, configured to construct a knowledge graph based on entities covered by the target server and the relationships between the entities, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors; a propagation prediction module, configured to simulate the propagation path of the attack behavior between devices in the knowledge graph based on a preset protocol state machine and a propagation prediction model, and determine a propagation prediction result; a defense strategy generation module, configured to match defense strategies in a preset defense strategy library based on the risk assessment result and the propagation prediction result, and generate a dynamic defense strategy set including a plurality of defense strategies; The defense strategy execution module is used to call the corresponding device communication interface to execute the defense strategy based on the dynamic defense strategy set.

10. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the network security dynamic defense method described in any one of claims 1-8.

Images