Network security dynamic defense method, system and device

Abstract

The application belongs to the field of network security, and specifically relates to a network security dynamic defense method, system and device, aiming to solve the problems of single network security risk assessment and insufficient flexibility in a multi-device scenario. The method comprises the following steps: obtaining a standardized data set of network security data of a target server; constructing a Bayesian network based on the standardized data set and outputting a risk assessment result; constructing a knowledge graph based on entities covered by the target server and the relationships between the entities; simulating the propagation path of attack behaviors between devices in the knowledge graph based on a preset protocol state machine and a propagation prediction model, and determining a propagation prediction result; matching a defense strategy in a preset defense strategy library according to the risk assessment result and the propagation prediction result, generating a dynamic defense strategy set comprising multiple defense strategies, and executing the dynamic defense strategy set. The application can dynamically defend the network environment in a multi-device scenario, and avoid network security problems caused by single or outdated defense strategies.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network security, and particularly relates to a network security dynamic defense method, system and device. BACKGROUND

[0002] With the rapid development of Internet technology, network security problems are increasingly serious. In the field of Internet of Things (IoT), network problems involve a wider range and network security problems are more complex. In an intelligent factory, a large number of IoT devices such as sensors, controllers and cameras are often deployed. The devices are heterogeneous, and there are different manufacturers, protocols and firmware versions. When the network topology changes dynamically and the devices are connected / disconnected in real time, the following problems may occur:

[0003] Risk assessment of heterogeneous devices is missing. Traditional risk assessment is single and based on only a few dimensions (such as IP address and port number) for risk assessment. Some dimensions are missing, such as firmware vulnerability version of IoT devices (such as remote code execution vulnerability CVE-2025-XXXX of a certain type of sensor), communication protocol vulnerability (such as unencrypted Message Queuing Telemetry Transport (MQTT)), and resource-limited characteristics (low-power devices cannot run complex encryption algorithms), which cannot comprehensively and accurately reflect the security risk status of the network system.

[0004] Defense strategy is static. Once the defense strategy is formulated, it is difficult to adjust in time according to the dynamic changes of the network environment, resulting in poor defense effect on new attacks and variant attacks.

[0005] The defense strategy does not match the device resources. Performing full-flow encryption strategy on low-power sensors will cause the device to crash, while performing only log monitoring strategy on critical controllers is insufficient, lacking a resource-aware strategy adaptation mechanism. SUMMARY

[0006] To solve the above problems in the prior art, i.e., the single network security risk assessment and insufficient flexibility in a multi-device scenario, the present application proposes, in a first aspect, a network security dynamic defense method, comprising:

[0007] Obtaining network security data of a target server, and performing feature extraction on the network security data to generate a standardized data set;

[0008] Constructing a Bayesian network with risk dimensions included in the standardized data set as nodes and probability relationships between the nodes as edges, wherein the Bayesian network is used to output a risk assessment result;

[0009] construct a knowledge graph based on the entities covered by the target server and the relationships between the entities, wherein the entities at least include devices, protocols, vulnerabilities and attack behaviors;

[0010] simulate a propagation path of the attack behaviors between the devices in the knowledge graph based on the preset protocol state machine and the propagation prediction model, and determine a propagation prediction result;

[0011] match a defense strategy in a preset defense strategy library according to the risk assessment result and the propagation prediction result, and generate a dynamic defense strategy set including a plurality of defense strategies;

[0012] invoke a corresponding device communication interface to execute the defense strategies based on the dynamic defense strategy set.

[0013] As a preferred implementation, the Bayesian network is used to output the risk assessment result, including:

[0014] taking the risk dimensions as parent nodes, and obtaining indicators reflecting the risk dimensions as child nodes;

[0015] generating edges from the parent nodes to the child nodes based on the logical relationships between the parent nodes and the child nodes, and generating the Bayesian network, wherein the edges correspond to conditional probabilities;

[0016] obtaining joint probability distributions of the child nodes through Bayesian network reasoning;

[0017] determining risk dimension risk values of the risk dimensions at different risk levels based on the joint probability distributions, and determining an overall risk value based on the risk dimension risk values;

[0018] composing the risk assessment result from the risk dimension risk values, the overall risk value and node probability distributions, wherein the node probability distributions are composed of conditional probabilities corresponding to the child nodes.

[0019] As a preferred implementation, the propagation prediction result is determined, including:

[0020] dividing the security states of the devices into susceptible states, infected states and recovery states based on the attack conditions of the devices;

[0021] determining attack propagation probabilities between different devices according to the influence of the protocols on the propagation probabilities, and generating a propagation probability matrix from the attack propagation probabilities between the devices;

[0022] obtaining a change rate of the security states over time based on the attack propagation probabilities corresponding to the devices, recovery rates and the numbers of the devices in different security states, wherein the recovery rates are determined based on the attributes of the devices, and the change rate is used to construct the propagation prediction model;

[0023] A propagation prediction model is constructed based on the security state, the propagation probability matrix, and the change rate;

[0024] An initial threatened node in the knowledge graph is determined, and one or more propagation paths are generated by the propagation prediction model starting from the initial threatened node;

[0025] A set of threatened devices involved in the propagation paths is taken as the propagation prediction result.

[0026] As a preferred embodiment, a dynamic defense strategy set including multiple defense strategies is generated, including:

[0027] For any threatened device in the propagation prediction result, a candidate strategy is selected from the defense strategy library under the constraints of resources and risks;

[0028] Based on the resource consumption of the candidate strategy, the priority of the strategy, and the risk value that can be reduced after the execution of the candidate strategy, a strategy score of the candidate strategy is obtained;

[0029] Based on the ranking of the strategy score, the candidate strategy is selected to generate the defense strategy set.

[0030] As a preferred embodiment, the selection of the candidate strategy includes:

[0031] In the case where multiple candidate strategies act on the same threatened device, if the total resource consumption of the candidate strategies exceeds the device capacity, the single strategy with the highest strategy score is selected as the defense strategy set.

[0032] As a preferred embodiment, the method further includes:

[0033] Real-time resource data after the execution of each defense strategy in the defense strategy set is collected, and a resource fluctuation value of the real-time resource data is calculated;

[0034] In the case where the resource fluctuation value exceeds a preset fluctuation threshold, a strategy rollback is triggered, wherein the strategy rollback includes revoking the defense strategy and restoring the parameters of the threatened device.

[0035] As a preferred embodiment, the method further includes:

[0036] Based on the execution result of the defense strategy and real-time network security data, the execution effect of the defense strategy is evaluated;

[0037] Based on the execution effect, the defense strategy library is updated.

[0038] As a preferred embodiment, the evaluation of the execution effect of the defense strategy includes:

[0039] A proportion of a number of times that the threatened device successfully intercepts attacks in a total number of attacks is calculated as a defense effectiveness of the threatened device.

[0040] A proportion of a number of times that the resource out-of-limit device after the defense strategy is executed in a total number of devices that are executed is calculated as a resource out-of-limit rate of the defense strategy.

[0041] The execution effect is constituted by the defense effectiveness and the resource out-of-limit rate.

[0042] In a second aspect, the present application provides a network security dynamic defense system, comprising:

[0043] A data acquisition module is configured to acquire network security data of a target server, and perform feature extraction on the network security data to generate a standardized data set.

[0044] A Bayesian network construction module is configured to construct a Bayesian network by taking risk dimensions included in the standardized data set as nodes and taking probability relationships between the nodes as edges, wherein the Bayesian network is configured to output a risk assessment result.

[0045] A knowledge graph construction module is configured to construct a knowledge graph based on entities covered by the target server and relationships between the entities, wherein the entities at least include devices, protocols, vulnerabilities, and attack behaviors.

[0046] A propagation prediction module is configured to simulate a propagation path of an attack behavior between devices in the knowledge graph based on a preset protocol state machine and a propagation prediction model, and determine a propagation prediction result.

[0047] A defense strategy generation module is configured to match a defense strategy in a preset defense strategy library according to the risk assessment result and the propagation prediction result, and generate a dynamic defense strategy set including a plurality of defense strategies.

[0048] A defense strategy execution module is configured to invoke a corresponding device communication interface to execute the defense strategy based on the dynamic defense strategy set.

[0049] In a third aspect, the present application provides an electronic device, comprising:

[0050] at least one processor; and

[0051] a memory communicatively connected to the at least one processor; wherein

[0052] The memory stores instructions executable by the processor, and the instructions are configured to be executed by the processor to implement the network security dynamic defense method described above.

[0053] The present application has the following beneficial effects:

[0054] The application evaluates the risk assessment result of the network security data of the target server by constructing a Bayesian network, considers multiple risk dimensions, performs comprehensive risk assessment, further constructs a knowledge graph of each entity covered by the target server as a simulation propagation basis, predicts the propagation path of the attack behavior, can quantify the influence and propagation trend of each entity based on the knowledge graph, dynamically deduces the propagation path, obtains the propagation prediction result, can accurately predict the propagation path and intuitively display the propagation chain, further combines the risk assessment result and the propagation prediction result, generates the corresponding defense dynamic strategy, can generate the defense strategy of adaptive resources in the multi-device scene for the predicted propagation result for corresponding defense, avoids the network security problem caused by the single or lagging defense strategy through the dynamic defense based on the network environment. BRIEF DESCRIPTION OF DRAWINGS

[0055] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings:

[0056] Figure 1 is a flowchart of a network security dynamic defense method provided by an embodiment of the application;

[0057] Figure 2 is a flowchart of a risk assessment result acquisition process provided by an embodiment of the application;

[0058] Figure 3 is a Bayesian network risk dimension node diagram provided by an embodiment of the application;

[0059] Figure 4 is a flowchart of a propagation prediction model construction process provided by an embodiment of the application;

[0060] Figure 5 is a system block diagram of a network security dynamic defense system provided by an embodiment of the application;

[0061] Figure 6 is a structural schematic diagram of a computer system of a server for implementing the method, system and device embodiments of the application. DETAILED DESCRIPTION

[0062] The application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, for the convenience of description, only the parts related to the application are shown in the drawings.

[0063] It should be noted that the embodiments in the application and the features in the embodiments can be combined with each other without conflict. The application will be described in detail below with reference to the accompanying drawings and embodiments.

[0064] The application provides a network security dynamic defense method. The method obtains network security data of a target server, extracts features of the network security data, and generates a standardized data set. A Bayesian network is constructed by taking risk dimensions included in the standardized data set as nodes and taking probability relationships between the nodes as edges. The Bayesian network is used to output a risk assessment result. A knowledge graph is constructed based on entities covered by the target server and relationships between the entities. The entities include at least devices, protocols, vulnerabilities, and attack behaviors. An attack behavior propagation path between devices is simulated in the knowledge graph based on a preset protocol state machine and a propagation prediction model, and a propagation prediction result is determined. A defense strategy is matched in a preset defense strategy library according to the risk assessment result and the propagation prediction result, and a dynamic defense strategy set including multiple defense strategies is generated. Corresponding device communication interfaces are called based on the dynamic defense strategy set to execute the defense strategies. The method can generate adaptive defense strategies for predicted propagation results in a multi-device scenario, and can avoid network security problems caused by single or outdated defense strategies through dynamic defense based on a network environment.

[0065] To more clearly illustrate the network security dynamic defense method of the application, the following describes the network security dynamic defense method of the application with reference to the accompanying drawings. Figure 1 The steps in the embodiments of the application are described in detail.

[0066] The network security dynamic defense method of the first embodiment of the application includes steps S10-S60, which are described in detail as follows.

[0067] In step S10, network security data of a target server is obtained, and features of the network security data are extracted to generate a standardized data set.

[0068] Optionally, the network security data of the target server is network data covering all associated entities of the target server, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors.

[0069] As an example, the network security data can include network traffic data, system log data, vulnerability scanning data, attack behavior data, and user behavior data.

[0070] Among them, network traffic refers to all traffic (including mirror traffic, NetFlow) in and out of the target server, network traffic data can be traffic size, source IP address, destination IP address, port number, transmission protocol, data content, etc. of the packet; system log refers to the system / application log (such as login record, permission change) generated by the target server, system log data can be server log, device log, login failure times, permission change record, etc.; vulnerability scanning refers to the scanning result (Nessus / OpenVAS report) of the target server, vulnerability scanning data can be system vulnerability information, software vulnerability information, CVE number (Common Vulnerabilities&Exposures, Common Vulnerabilities&Exposures), CVSS score, etc.; attack behavior refers to the IDS / IPS alarm directed to the target server, attack behavior data can be attack type, attack time, attack frequency, etc.; user behavior refers to the user operation (login record, file download) of accessing the target server, user behavior data can be user login time, access frequency, operation path, file download record, abnormal operation instruction, etc.

[0071] In other embodiments, network security data can also include device fingerprint and resource data, device fingerprint refers to the MAC address, firmware version, protocol type of the target server itself; resource data refers to the real-time CPU / memory utilization rate of the target server.

[0072] Optionally, through various collection devices deployed in the network, such as sensors, probes, log collectors, etc., real-time collection of network traffic data, system log data, vulnerability scanning data, attack behavior data, etc., through installation of monitoring plug-ins on client devices or through recording of user operation logs on server side, etc. to collect user behavior data.

[0073] In some embodiments, the physical address of the device network card is obtained through a network layer protocol (such as the ARP protocol, the DHCP log), directly as a string type identifier, and the MAC address is obtained. The hardware model is obtained through the Simple Network Management Protocol (SNMP) information actively reported by the device, the device API interface (such as the device description register of the Modbus device) or the scanning tool (such as the OUI database matching of Nmap). For devices that support remote query (such as cameras that support HTTP / HTTPS interface), the firmware version string is obtained through API calling to obtain the firmware version; for devices without active reporting capability, the firmware version is obtained by parsing the version fingerprint (such as the Server field in the HTTP response header) in the device response packet through a vulnerability scanning tool (such as Nessus, OpenVAS). The communication protocol used by the device is identified through traffic analysis (such as Wireshark parsing TCP / UDP port: Modbus default 502 port, MQTT default 1883 port), the protocol type is obtained, the protocol enumeration value is mapped through the device fingerprint library, and a unique fingerprint is generated for the device key information through a hash function.

[0074] Further, the original network security data can be cleaned to remove duplicate, error, and redundant data, and abnormal behavior filtering can be performed on user behavior data.

[0075] As a possible implementation, invalid data is identified and deleted by checking the integrity, uniqueness constraints and other rules of the data, the missing values of the device resource data are repaired by using the sliding window interpolation method, the repeated data interference analysis is avoided, the missing values are filled to ensure the data integrity, and the subsequent analysis result is more accurate.

[0076] Further, the network security data after the cleaning operation is subjected to feature extraction to generate a standardized data set.

[0077] As a possible implementation, the category type data (such as log text, protocol type, vulnerability level) is subjected to format conversion, different sources and different formats of the category type data are uniformly converted into a standard format that can be recognized and processed by the system, the non-numeric category information is converted into a numerical form that can be processed by a computer through One-Hot Encoding or Label Encoding, the discrete category information is converted into a numerical feature that can be understood by the model, the model can learn the relationship between different categories, for example, unstructured logs are converted into structured JSON, and the timestamp, device ID and event type in the log are extracted.

[0078] As another possible implementation, for numerical data (such as CPU utilization, attack frequency), normalization is performed using the min-max normalization formula to map numerical data to the same interval (usually [0, 1] or [-1, 1]), eliminating the differences in dimensions and numerical ranges of different features. Through the normalization operation, different types and different magnitudes of data are comparable, meeting the needs of subsequent modeling and analysis.

[0079] As another possible implementation, for user behavior sequences (such as operation paths), sequence pattern mining algorithms are used to extract key operation sequence features or feature encoding methods such as word embedding (Word Embedding) or time series encoding, and behavior sequences are converted into fixed-dimensional feature vectors. Through feature encoding operations, the time sequence relationship, behavior patterns and other information implied in sequence data are converted into features that can be recognized by the model, so as to extract valuable behavior features for subsequent analysis and prediction. For abnormal operation instructions, Boolean features are generated based on preset rules (such as unauthorized user access and high-frequency write operations), and semantic analysis and classification are performed through natural language processing techniques.

[0080] Through the above standardization processing, the data format and range are unified, the dimensional differences are eliminated, and a standardized data set that meets the input requirements of the Bayesian network is generated.

[0081] As an example, the standardized data set is a standardized feature matrix, including a traffic feature vector, a system log feature matrix, a vulnerability feature vector, and a user behavior feature triple. Among them, the network traffic feature vector dimension includes: size distribution, port activity, protocol type proportion, etc.; the traffic is normalized and statistically obtained after being analyzed by Wireshark. The system log feature matrix structure includes: row = time window, column = log event type (such as the number of login failures, the number of permission changes); the log is one-hot encoded or frequency counted after being parsed. The vulnerability feature vector content includes: CVE score average, number of unpatched vulnerabilities, highest-risk vulnerability level; the values are directly mapped after parsing the vulnerability scanning report. The user behavior feature triple constitutes: operation sequence vector (such as [login→query→download], embedded into a fixed dimension by Word2Vec); abnormal operation label (Boolean value, based on rules such as unauthorized access); session features (login period, access frequency, etc. normalized values).

[0082] In step S20, the risk dimensions included in the standardized data set are taken as nodes, and the probability relationship between each node is taken as an edge to construct a Bayesian network, wherein the Bayesian network is used to output a risk assessment result.

[0083] Optionally, the Bayesian network is used for multi-dimensional risk modeling, taking each risk dimension as a node to construct a multi-dimensional risk model based on the Bayesian network.

[0084] The Bayesian network is a directed acyclic graph model, and the nodes represent various factors related to network security, i.e., entities covered by target servers and various risk factors that may exist in corresponding network security data as risk dimensions, such as device resource risk and asset value risk corresponding to entities, protocol vulnerability risk, firmware vulnerability risk, threat level risk, vulnerability degree risk, and user behavior risk corresponding to network security data, etc.

[0085] As an example, asset value (such as server hardware value, data sensitivity) is obtained by asset inventory scoring, threat level (such as attack frequency, attack success rate) is obtained from an intrusion detection system, vulnerability degree (such as vulnerability severity, patch coverage) is obtained from a vulnerability scan report, and user behavior risk dimension (such as identity credibility, abnormal operation frequency) is obtained from user log analysis.

[0086] As a possible implementation, the Bayesian network is trained by obtaining historical risk event samples to learn the conditional probability distribution between various risk dimensions, thereby realizing dynamic assessment of network system security risks.

[0087] As an example, through intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, and other devices, attack events occurring in the network are recorded in real time. For example, IDS detects an illegal access attempt against the Modbus protocol, records attack source IP, target device, attack type, attack time, and other information, forming the basis data of the risk event sample. By collecting device's own operation logs, including system logs, application program logs, etc. For example, abnormal operation logs recorded by industrial controllers contain operation time, operation instructions, device state changes, etc., which can be used to analyze the situation of device under attack or abnormality, and supplement the details of the risk event sample. By regularly scanning network devices using vulnerability scanning tools (such as Nessus, OpenVAS), obtain the vulnerability information of the device, and form the risk event sample by combining the vulnerability exploitation situation. For example, scanning finds that a PLC has a CVE-2025-XXXX vulnerability, if the vulnerability is actually exploited to cause device abnormality, it will be included in the historical risk event sample, and the vulnerability number, affected device, and exploitation method are recorded.

[0088] As another example, security events found by network security administrators during routine inspection or emergency response are supplemented to the historical risk event sample library through manual entry into the system. For example, the administrator finds that a device has abnormal data transmission behavior, and after analysis confirms that it is caused by malicious software, the detailed information of the event (including event description, handling process, impact scope, etc.) is recorded as a sample.

[0089] As another example, by accessing a third-party threat intelligence platform, security threat information commonly used in the industry, such as new attack methods, known malicious IP lists, etc., can also be obtained, combined with the internal network environment of the enterprise, and the risk events related to itself are screened out to enrich the sample library content.

[0090] The information related to the historical risk events collected through the above-mentioned multiple channels is preprocessed through data cleaning, format conversion, etc., and is uniformly integrated into structured historical risk event samples. Each sample contains event ID, occurrence time, involved device, attack type, impact caused, processing result, etc. Key fields provide reliable data support for subsequent risk modeling and strategy optimization.

[0091] By training the Bayesian network through the historical risk event samples, the Bayesian network can learn the causal relationship and dependency relationship between the nodes in the historical risk event samples, thereby effectively reasoning the risk dimensions as nodes.

[0092] Further, the Bayesian network is constructed and the risk assessment result is output, please refer to Figure 2 , the specific steps include:

[0093] Step S201, taking the risk dimension as the parent node, and obtaining the indicators reflecting each risk dimension as the child node.

[0094] As an example, for the device resource risk , the parent node is the device resource state (Sres), and the child nodes can include: CPU utilization (C, normalized to 0-1), memory utilization (M, normalized to 0-1), battery power (B, normalized to 0-1, only for mobile devices), computing power level (P, enumerated values: low / medium / high, one-hot encoding). It can be represented by the following formula: , wherein, represents the weighted sum of the child nodes, and the weight of each child node is determined by the Bayesian network posterior probability.

[0095] As another example, the protocol vulnerability risk , the parent node is the protocol vulnerability state (Spro), and the child nodes include: protocol encryption state (E, unencrypted = 1, encrypted = 0), known vulnerability existence (V, CVE exists = 1, otherwise = 0), protocol authentication mechanism (A, no authentication = 1, weak authentication = 0.5, strong authentication = 0). It can be represented by the following formula: , wherein, represents a Boolean logic function.

[0096] As another example, the firmware vulnerability risk Parent node: Firmware security status (Sfirm), child nodes include: CVE score mapping value (F, 0-1, using CVSS base score / 10), firmware update status (U, not updated=1, partially updated=0.5, latest=0). This can be represented by the following formula: .

[0097] As another example, asset value risk Parent node: Asset criticality (Sasset); child nodes include: Hardware value score (…). Asset list assignment, mapping from level 1 to 5 (0.2-1.0), data sensitivity level ( Business definition: Public = 0, Confidential = 0.6, Top Secret = 1.0). This can be expressed by the following formula: .

[0098] As another example, threat level risk Parent node: Threat exposure level (Sthreat), child nodes include: attack frequency ( (times / hour, normalized 0-1), attack success rate () (Normalized values ​​are 0-1, from IDS logs). This can be represented by the following formula: .

[0099] As another example, vulnerability level risk Parent node: System vulnerability state (Svuln), child nodes include: average vulnerability severity ( 0-1, average CVSS score of all known vulnerabilities, patch coverage ( The ratio of fixed vulnerabilities to total vulnerabilities (normalized to 0-1) can be expressed by the following formula: .

[0100] As another example, user behavior risk Parent node: User trust status (Suser), child nodes include: Identity trust score ( , 0-1, based on authentication history: multi-factor authentication = 1, weak password = 0.3), abnormal operation frequency ( (times / day, normalized to 0-1, based on baseline deviation). This can be expressed by the following formula: .

[0101] In this application embodiment, based on the above example, a result such as Figure 3The Bayesian network risk dimension node diagram is shown, wherein each risk dimension is a parent node of a parent node, and the overall risk is a parent node of each risk dimension, for example, the device resource risk is a parent node of the device resource state, the device resource state is a parent node of the CPU utilization rate, the memory utilization rate and the like, and the device resource state can be directly taken as the parent node of the CPU utilization rate, the memory utilization rate and the like.

[0102] In step S202, an edge from the parent node to the child node is generated based on the logical relationship between the parent node and the child node, and a Bayesian network is generated, wherein the edge corresponds to a conditional probability.

[0103] Optionally, the edge relationship is a dependency relationship, which represents the influence of the risk dimension on the specific index, and the node dependency relationship is determined through expert knowledge or data mining (such as a K2 algorithm), for example, Sres→C represents that the device resource state directly influences the CPU utilization rate.

[0104] It should be noted that the edge is only from the parent node to the child node, and there is no reverse edge, so that the independence assumption of the conditional probability is ensured.

[0105] Further, the conditional probability of each node is defined by using historical data or expert scoring, a conditional probability table (CPT) is automatically generated, the influence degree of each risk dimension is quantified through probability calculation, and the conditional probability table of each node is output. wherein, represents the i th child node, represents the parent node set of the i th child node.

[0106] The conditional probability can be calculated by one or more of maximum likelihood estimation, Bayesian estimation, expectation maximization, gradient descent optimization and the like, and will not be described herein again.

[0107] It should be noted that any child node can be influenced by multiple parent nodes in the global Bayesian network, and therefore any child node corresponds to a parent node set, and a conditional probability table is generated based on the parent node set, which is used to describe the probability distribution of the state of the child node under the given parent node state. For a scenario of a labeled security event data set, a historical data statistical method is adopted to statistically count the event frequency; for a big data scenario, a machine learning method is adopted, and an expectation maximization algorithm is used to learn parameters, and for a zero probability avoidance scenario, smoothing processing is performed.

[0108] ​As a possible implementation, the conditional probability table needs to be initialized for the scenario of lacking historical data, for example, by expert experience method, by network security experts to assign values according to experience; for the scenario of labeled security event data set, the historical data statistical method is adopted to count the frequency of event occurrence; for the big data scenario, the machine learning method is adopted, and the expectation maximization algorithm is used to learn the parameters, and smoothing processing is adopted to avoid the zero probability scenario.

[0109] Step S203, the joint probability distribution of each sub-node is obtained through Bayesian network inference.

[0110] Optionally, for each risk dimension, the joint probability distribution of each sub-node is obtained based on the conditional probability of any sub-node in the respective parent node, the joint probability of n sub-nodes can be decomposed into the product of local probability of each sub-node under the condition of parent node, which can be represented by the following formula: , represents the joint probability.

[0111] Step S204, based on the joint probability distribution, the risk dimension risk value of each risk dimension in different risk levels is determined, and the overall risk value is determined based on the risk dimension risk value.

[0112] By calculating the probability of all possible risk factor state combinations, the joint probability of all risk factors occurring at the same time is calculated, the probability of the network system being in different risk levels is obtained, which is used as the risk dimension risk value, and the causal relationship model of the risk factor is constructed, providing a structural basis for subsequent probability inference.

[0113] Further, the corresponding weight is assigned to each risk dimension risk value, and the overall risk value is obtained by weighted summation of each risk dimension risk value.

[0114] Wherein, the weight corresponding to each risk dimension risk value can be determined based on the importance of each risk dimension, and the sum of the weights corresponding to each risk dimension risk value is ensured to be 1. For example, the weight distribution can be performed by the impact of each risk dimension in the historical risk event.

[0115] As an example, in the embodiment of the present application, the prediction error minimization of historical risk events is taken as the target, and the weight fitness Fitness(W) is calculated by the following formula:

[0116]

[0117] Wherein, H represents the historical risk event sample set, h represents the historical risk event sample, r(h) represents the actual risk level, |H| represents the size of the historical risk event sample set, and Rtotal(h;W) represents the overall risk value of the historical risk event sample h calculated using the current weight W.

[0118] As an example, the actual risk level r(h) can be generated by manual annotation or by an authoritative system, and levels 1-5 are mapped to 0.2-1.0, respectively.

[0119] It should be noted that the Fitness(W) value range is [0, 1], and the larger the value, the smaller the deviation between the overall risk value predicted by the model and the actual risk level r(h).

[0120] Further, by selecting, crossing, and mutating iterative optimization, the optimal weight vector W is obtained until the Fitness(W) value converges, which is used for subsequent overall risk calculation.

[0121] As an example, a genetic algorithm is used to select by roulette selection, and the higher the fitness of the individual, the greater the probability of being selected; by single-point crossover, the partial weight genes of two parent individuals are exchanged; by Gaussian mutation, random disturbance is added to the weight vector to avoid local optimum. The termination condition is that the fitness value converges or the maximum number of iterations (such as 100 generations) is reached, and the optimal weight vector is output.

[0122] It should be noted that the weight optimization is independent of the CPT, and the genetic algorithm only adjusts the risk dimension layer weight without changing the conditional probability relationship between the indicators and the risk dimension nodes. By automatically optimizing the risk dimension weight through genetic operations, the subjectivity of manual weighting is avoided, and the model generalization ability and evaluation accuracy are improved.

[0123] Step S205, the risk assessment result is composed of the risk value of each risk dimension, the overall risk value, and the node probability distribution, wherein the node probability distribution is composed of the conditional probability corresponding to each subnode.

[0124] Optionally, the risk assessment result output by the Bayesian network includes the risk value R i of each risk dimension, the overall risk value R total and the node probability distribution P, wherein i represents the dimension identifier of the risk value of each risk dimension.

[0125] Further, according to the overall risk value, risk classification and strategy selection can be performed, as shown in Table 1.

[0126] Table 1

[0127]

[0128] It should be noted that the high-risk probability of each node can also be used as a factor for determining the risk level.

[0129] Step S30, based on the entities covered by the target server and the relationships between the entities, a knowledge graph is constructed, wherein the entities at least include devices, protocols, vulnerabilities, and attack behaviors.

[0130] Optionally, a knowledge graph containing entities such as devices, protocols, vulnerabilities, attack behaviors, and their relationships (such as using protocols, existing vulnerabilities, attack targets) is constructed to integrate various information in the field of network security in a structured manner, and to intuitively display the associations between devices, protocols, vulnerabilities, and other elements, providing a knowledge base for attack path analysis. The nodes of the knowledge graph include devices (sensors / controllers / PLCs), protocols (Modbus / MQTT), vulnerabilities (CVE-XXXX), and attack behaviors (writing registers / injecting payloads), and the edges represent relationships such as "using protocols", "existing vulnerabilities", and "attack targets".

[0131] As a possible implementation, network security data such as fingerprint data, network traffic, vulnerability scan reports, and user operation logs are obtained as data for constructing the knowledge graph. For example, CVE numbers and related vulnerability information are extracted from vulnerability scan reports, and protocol types used by devices are obtained from device fingerprints. Further, natural language processing (NLP) techniques and regular expression matching are used to identify entities from the collected data. For device entities, regular expression matching is used to match device ID formats; for vulnerability entities, the fixed format of CVE numbers is used for extraction. Further, rule engines and machine learning algorithms are used to determine the relationships between entities. For example, the rule "if device A's network traffic contains Modbus protocol data packets, then device A uses Modbus protocol" is used to establish device-protocol relationships; graph neural networks (GNN) are used to analyze network topology data to identify device-device connection relationships. Further, a graph database (such as Neo4j) is used to store the knowledge graph, facilitating efficient querying and complex relationship reasoning. For example, a quick query can be made to find devices that have high-risk vulnerabilities and use unencrypted protocols and their connected downstream devices.

[0132] Step S40, based on the pre-set protocol state machine and propagation prediction model, simulates the propagation path of attack behaviors between devices in the knowledge graph, and determines the propagation prediction result.

[0133] Optionally, a protocol state machine (Protocol State Machine) is a formal model used to describe system behavior (especially communication protocols), which specifies the response logic of the system under different conditions by defining states, events, transitions, and actions.

[0134] In the embodiments of the present application, the initial state of the protocol state machine is S0, indicating that the device is waiting for a request and is in a normal communication preparation state; the intermediate states are S1 and S2, when the device receives a function code 0x06 (write register) to enter the S1 state, and on the basis of the S1 state, if a malicious payload is received, the S2 state is entered, indicating that the attack behavior is further implemented; the terminal state is S3, if the attack is successful or blocked by the defense, the corresponding terminal state is entered. The state condition is the protocol data feature and the vulnerability exploitation condition on which the state transition is based. For example, the transition condition from S0 to S1 is to receive a Modbus request with a function code 0x06; the transition from S1 to S2 depends on whether there is an exploitable protocol vulnerability, wherein the protocol vulnerability is determined by the probability distribution of the “protocol vulnerability” node in the Bayesian network.

[0135] wherein the terminal state is not explicitly listed in the basic state, and can be defined according to the actual situation.

[0136] Further, a propagation prediction model is constructed for all devices covered by the target server, please refer to Figure 4 , and the specific steps include:

[0137] Step S401, based on the attack situation of the device, the security state of the device is divided into susceptible state, infected state and recovered state.

[0138] Susceptible state (S): the device is currently not attacked, but has the possibility of being attacked due to the existence of protocol vulnerabilities, un-updated firmware, etc. For example, a Modbus sensor using default configuration and without encryption is in a susceptible state.

[0139] Infected state (I): the device has been attacked and becomes a new attack source, which can propagate threats to other susceptible devices. For example, a PLC implanted with malicious software will try to exploit protocol vulnerabilities to infect other devices connected thereto.

[0140] Recovered state (R): the device successfully removes threats by implementing defense strategies (such as vulnerability repair, installation of patches, and enabling encryption), and no longer participates in attack propagation. For example, a camera that has completed firmware upgrade to repair remote code execution vulnerabilities enters the recovered state.

[0141] Step S402, according to the influence of the protocol on the propagation probability, the attack propagation probability between different devices is determined, and a propagation probability matrix is generated from the attack propagation probability between devices.

[0142] It can be understood that if the protocol is relatively vulnerable and the vulnerability exploitation success probability is high, the device is easy to be attacked, and the corresponding propagation probability is high. The attack propagation probability between devices can be calculated by the following formula:

[0143]

[0144] wherein, represents the attack propagation probability from device i to device j, and a and β represent the propagation coefficients, and a + β = 1, represents the protocol exploit success probability from device i to device j, represents the protocol vulnerability risk value of device j.

[0145] It should be noted that the protocol exploit success probability is the probability of successfully attacking device j by device i using protocol vulnerability, which is calculated by the conditional probability of the protocol related node in the Bayesian network; the protocol vulnerability risk value is output by the multi-dimensional risk model (i.e., the Bayesian network), and the value range is [0, 1], and the higher the value, the more vulnerable the protocol of device j is to attack.

[0146] By calculating the attack propagation probability, the possibility of attack propagation between devices is quantified, which provides basic probability data for simulating threat propagation paths.

[0147] Further, a propagation probability matrix is constructed with device identifiers as rows and columns, wherein the propagation probability matrix is an N x N matrix, N is the number of devices covered by the target server, as the element in the i-th row and the j-th column of the propagation probability matrix.

[0148] In step S403, based on the attack propagation probability corresponding to the device, the recovery rate and the number of devices in each security state, the change rate of the security state over time is obtained, wherein the recovery rate is determined based on the attributes of the device, and the change rate is used to construct a propagation prediction model.

[0149] Optionally, the attack propagation probability reflects the possibility of attack behavior propagating from one device to another device, which can be used as the infection rate B in the propagation prediction model. The recovery rate γ is determined according to the attributes of the device, and is specifically the defense strategy execution effect and the device response capability. For example, for a device executing a “vulnerability repair” strategy, if the historical statistics of the vulnerability repair success rate is 90%, the recovery rate γ is set to 0.9; for the “full flow encryption” strategy, considering the encryption deployment and the effective time, if 70% probability can complete effective defense in unit time, the recovery rate is set to 0.7.

[0150] Further, a differential equation is used to mathematically describe the SIR model to depict the dynamic change of the device between different states:

[0151]

[0152]

[0153]

[0154] wherein S(t) represents the number of devices in the susceptible state at time t, I(t) represents the number of devices in the infected state at time t, R(t) represents the number of devices in the recovered state at time t, and S(t) + I(t) + R(t) = N, represents the rate of change of the number of devices in the susceptible state over time, represents the rate of change of the number of devices in the infected state over time, represents the rate of change of the number of devices in the recovered state over time.

[0155] It can be understood that, can reflect the change that the susceptible devices are converted to the infected state after contacting the infected devices at the infection rate B, resulting in a decrease in the number of susceptible devices; can reflect the change that the infected devices are increased in number on the one hand by infecting the susceptible devices at the infection rate B, and on the other hand by recovering to the normal state at the recovery rate γ, resulting in a decrease in the number of infected devices; can reflect the change that the infected devices are converted to the recovered state at the recovery rate γ, resulting in an increase in the number of recovered devices.

[0156] Step S404, constructing a propagation prediction model based on the security state, the propagation probability matrix, and the change rates.

[0157] Further, a propagation prediction model is constructed in combination with the protocol state machine, the propagation probability matrix, and the change rates described above. On the basis of the SIR model, the protocol state machine is introduced to simulate the propagation details of the attack at the protocol level. The attack propagation probability matrix is used to determine the propagation relationship between devices, and the attack propagation simulation is realized from the macro network level to the micro protocol level. For example, in the simulation process, according to the protocol state machine, it is determined whether the device i can propagate the attack to the device j, and whether the attack conforms to the protocol flow and the vulnerability exploitation condition. determines the propagation relationship between devices, and realizes the attack propagation simulation from the macro network level to the micro protocol level. For example, in the simulation process, according to whether the device i can propagate the attack to the device j, and whether the attack conforms to the protocol flow and the vulnerability exploitation condition.

[0158] In some embodiments, a propagation path weight can also be set for the propagation prediction model, and the possible propagation paths are sorted according to the propagation path weight, and the path with a higher weight is preferentially explored, so as to determine the main propagation direction and the key path of the threat in the network.

[0159] As an example, the sum of the overall risk values of all devices on the propagation path is taken as the propagation path weight of the propagation path.

[0160] The propagation prediction model determines the propagation possibility between devices through a propagation probability matrix, and the propagation path weight overall evaluates the risk degree of the propagation path. The propagation prediction model optimizes the search strategy by using the propagation path weight, preferentially explores the high-risk path, makes the simulation result more consistent with the actual threat propagation situation, and improves the accuracy and efficiency of the prediction.

[0161] In step S405, an initial threatened node in the knowledge graph is determined, and one or more propagation paths are generated by the propagation prediction model starting from the initial threatened node.

[0162] Optionally, the initial threatened node is determined according to the risk assessment result, for example, the device with the maximum risk value is selected as the initial threatened node.

[0163] Further, the breadth-first search is adopted to generate possible propagation paths starting from the initial threatened node according to the simulation of the propagation prediction model until no new node is reachable, and one or more propagation paths are obtained.

[0164] As a possible implementation, the initial threatened node is marked as an infected state (I) as a propagation starting point, and the current timestamp, the overall risk value, the associated protocol type and the vulnerability information (from the knowledge graph) of the initial threatened node are recorded to perform state parameter initialization, thereby providing basic data for subsequent propagation probability calculation and protocol state verification.

[0165] Further, based on the connection relationship between devices in the knowledge graph, such as physical topology and communication link, the direct adjacent devices of the initial threatened node, i.e., the first neighbors, are selected as potential propagation targets.

[0166] Further, the attack propagation probability of the initial threatened node to each first neighbor is obtained through the propagation probability matrix where i is the initial threatened node, and j is the first neighbor of the initial threatened node. If the preset propagation probability threshold, the first neighbor is determined as “propagation unreachable” and is excluded from the current propagation path; if the preset propagation probability threshold, the first neighbor is determined as “propagation unreachable” and is excluded from the current propagation path; if

[0167] It should be noted that the preset propagation probability is determined based on parameters such as attack propagation probability, recovery rate and initial infection quantity, and needs to be determined in combination with specific scenes, which is not limited herein.

[0168] In the case that the attack propagation probability is greater than or equal to the preset propagation probability threshold, based on the preset protocol state machine, it is checked whether the attack behavior conforms to the exploit condition of the protocol used by the first-level neighbor. For example, if the first-level neighbor uses the Modbus protocol, the protocol state machine needs to verify whether the attack behavior contains an exploitable function code and the device has a corresponding vulnerability. If the attack behavior does not conform to the exploit condition of the protocol state machine, such as the protocol being encrypted and having no known vulnerabilities, the propagation is terminated, and the first-level neighbor is not infected. If the protocol state check passes, the first-level neighbor is converted from the susceptible state (S) to the infected state (I) and becomes a new propagation source.

[0169] From the initial threatened node, the devices are traversed layer by layer in the order of "first-level neighbor→second-level neighbor→…→N-level neighbor", and each expansion repeats the screening and checking processes of the attack propagation probability verification and the protocol state verification. When all neighbor devices of a certain level are determined to be "propagation unreachable", such as <Threshold or protocol check fails, or the preset maximum propagation depth is reached, then stop expanding.

[0170] In the above expansion process, each time a new device is successfully infected, the complete device sequence from the initial threatened node to the device is recorded, such as device A→device B→device C, forming a propagation path. If a device infects multiple neighbor devices, multiple propagation paths are formed by recording the complete device sequence from the initial threatened node to different neighbor devices until the expansion is stopped, such as device A→device B→device C and device A→device B→device D, each forming a propagation path.

[0171] In some embodiments, if the propagation path weight is set for the propagation prediction model, a breadth-first search combined with a propagation path weight priority strategy is used to generate the corresponding propagation path from the initial threatened node.

[0172] It can be understood that the higher the propagation path weight, the greater the risk impact on the corresponding propagation path, and the propagation path should be searched first.

[0173] As a possible implementation, in each layer of neighbor screening, the current weight of each potential propagation path is calculated first, and the path with the highest propagation path weight is expanded first, i.e., the next-level neighbor on the propagation path is infected first. For example, among the first-level neighbors of the initial threatened node A, the propagation path weight of neighbor B (A→B) is 0.8, and the propagation path weight of neighbor C (A→C) is 0.5. Therefore, the path A→B is expanded first, and then the path A→C is processed.

[0174] In some embodiments, low-weight paths can also be pruned to reduce invalid calculations. For example, if the propagation path weight of a certain propagation path is lower than a preset weight threshold, the expansion of the propagation path is terminated directly.

[0175] It should be noted that the preset weight threshold can be determined by setting a specific value or based on the minimum value of a certain proportion of all propagation path weights, and needs to be determined in combination with specific scenarios, which is not limited here.

[0176] Further, all the extended propagation paths are de-duplicated, and completely repeated device sequences are removed, and partially overlapping paths, such as A→B→C and A→B→D, can be retained as two independent paths.

[0177] Step S406, taking the set of each threatened device involved in the propagation path as the propagation prediction result.

[0178] Optionally, after obtaining the propagation path through the above steps, each propagation path corresponds to a set of threatened device sets, such as the threatened device set corresponding to the propagation path A→B→C is {device A, device B, device C}, and the final generated propagation path set contains all possible attack diffusion trajectories, which serves as the basis for subsequent defense strategy generation.

[0179] In the embodiments of the present application, the output propagation prediction result includes a threat propagation path set P={p1, p2, …, pm} and an impact range device list D affected , wherein p1, p2, …, pm respectively represent different propagation paths. Each propagation path is a device sequence, and these paths are simulated by a propagation prediction model, reflecting the possible propagation trajectory of the threat in the network, D affected contains all possible devices affected by the threat, obtained by de-duplicating all devices in the threat propagation path set.

[0180] D affected The range of devices that may be affected by the threat is determined, providing a target device set for dynamic defense strategy generation, ensuring that the defense strategy can cover all threatened devices.

[0181] Step S50, according to the risk assessment result and the propagation prediction result, matching the defense strategy in the preset defense strategy library to generate a dynamic defense strategy set including multiple defense strategies.

[0182] Optionally, through the risk assessment result and the propagation prediction result, the threatened device and the corresponding risk can be determined, and then the defense strategy is selected based on the device resource characteristics and security requirements of the threatened device.

[0183] In the embodiments of the present application, the preset defense strategy library S={sk|k=1,2,…,K} is a set of storage of various defense strategies, and K represents the total number of defense strategies. Each strategy sk contains core attributes such as strategy name, execution operation, resource consumption value C, risk reduction value ΔR, applicable device type, and strategy priority.

[0184] As an example, the basic strategies can include: log monitoring strategy: s1, the operation content is to record the device running log, resource consumption C=0.1, risk reduction ΔR=0.3, applicable to all devices, low priority. Full flow encryption strategy: s2, encrypt the device network flow, C=0.8, ΔR=0.7, applicable to high-performance devices, high priority.

[0185] The defense strategy library initially needs experts to define basic strategies and parameters. The initialization mode of the defense strategy library includes: manual preset: the basic attributes such as strategy name, operation type, and applicable device are defined by experts; parameter assignment: the initial resource consumption value C and the risk reduction value ΔR are set based on historical experience or simulation test.

[0186] In some embodiments, the defense strategy library can be expanded according to the device resource characteristics and security needs, adding lightweight strategies (applicable to low-resource devices) and protocol-level strategies (targeting specific protocol vulnerabilities), etc., to enrich the content of the strategy library and make the strategy library meet the needs of different types of devices and security scenarios, improving the adaptability of the strategy.

[0187] As an example, the defense strategy library can be expanded in the following ways:

[0188] Lightweight strategy: designed for low-resource devices (such as sensors), characterized by low resource consumption and fast execution speed. For example, lightweight encryption strategy s3, using a simplified encryption algorithm, resource consumption C=0.4, risk reduction ΔR=0.6, only applicable to devices with CPU utilization ≤ 50%.

[0189] Protocol-level strategy: focuses on specific protocol vulnerability defense. For example, Modbus function code filtering strategy s4, prohibits dangerous function code 0x06, C=0.2, targets protocol vulnerability risk reduction 0.5; MQTT encryption upgrade strategy s5, upgrades the unencrypted MQTT protocol to MQTToverTLS, C=0.8, applicable to devices with memory ≥ 60%.

[0190] Rule supplement: dynamically add defense rules according to new threat types, vulnerability characteristics, or device characteristics. For example, when a new type of malicious payload attack pattern is found, a targeted flow detection strategy is added.

[0191] Parameter optimization: based on historical defense effect data, adjust the resource consumption and risk reduction parameters of the strategy. For example, if the actual risk reduction effect of a log monitoring strategy is not good, reduce its ΔR value.

[0192] The expanded strategy library content is as follows:

[0193] Lightweight strategy: includes log monitoring, lightweight encryption;

[0194] Protocol-level strategies: including Modbus function code filtering, MQTT encryption upgrade;

[0195] General strategies: including full-flow encryption, vulnerability hot patch deployment.

[0196] Among them, the source of historical defense effect data is: policy execution result: policy state (success / failure / rollback) reported by edge node; resource monitoring log: CPU / memory fluctuation time series before and after policy execution; attack event change: attack frequency / type change detected by IDS system.

[0197] Among them, parameter optimization can be automatically adjusted, and the process includes:

[0198] First, collect defense effectiveness data and resource adaptability data. Defense effectiveness data includes: real-time comparison of attack event changes before and after policy execution: collect the number of attacks (from IDS / IPS logs) suffered by target devices within T time window after policy execution, calculate the actual attack interception rate: interception rate = (original attack number - residual attack number) / original attack number. Resource adaptability data includes: real-time monitoring of device resources after policy execution: record CPU / memory fluctuation value ΔC = |utilization after execution - utilization before execution|; statistics of resource over-limit device proportion: over-limit rate = (number of devices with ΔC > threshold 0.3) / total number of devices executing the policy.

[0199] Second, adjust parameters:

[0200] (1) Risk reduction value ΔR adjustment:

[0201] ΔR new = ΔR old × (1 + δ × (actual interception rate - expected interception rate))

[0202] Among them, ΔR new represents the updated risk reduction value, ΔR old represents the risk reduction value before updating, δ represents the learning rate (default δ = 0.2), which controls the adjustment range; the expected interception rate is the theoretical value preset in the policy library (e.g. the expected interception rate of full-flow encryption policy = 0.85).

[0203] (2) Resource consumption value C adjustment:

[0204] C new = C old × (1 + μ × over-limit rate)

[0205] Among them, C new represents the updated resource consumption value, C oldRnew = Rold + ΔR, where Rold represents the resource consumption value before the update, μ is a penalty coefficient (default μ = 0.5), and the higher the overrun rate, the more the resource consumption is increased.

[0206] Finally, automatic activation and verification.

[0207] Instantly update the policy library: add new parameters ΔR new , C new Real-time writing of the policy library, and the next round of policy generation is immediately activated.

[0208] Effect tracking feedback: continuously monitor the effect of the updated policy in 3 consecutive executions: if the resource overrun rate is still > 0.4 or the interception rate is < 0.5, mark it as a to-be-optimized policy; if it is marked for 5 times, automatically freeze the policy and trigger an alarm.

[0209] Anti-oscillation protection: the single adjustment amplitude is limited within ±20% to avoid dramatic fluctuations in parameters.

[0210] Further, for any threatened device in the propagation prediction result, a candidate policy is selected in the defense policy library under the constraints of resources and risks; based on the resource consumption of the candidate policy, the policy priority, and the risk value that can be reduced after the execution of the candidate policy, a policy score of the candidate policy is obtained; based on the ranking of the policy score, the candidate policy is selected to generate a defense policy set.

[0211] In the embodiments of the present application, for any threatened device in the propagation prediction result, the selection conditions of the candidate policy are as follows:

[0212] Resource constraint: the total resource consumption (such as CPU and memory occupation) of the selected candidate policy must not exceed the available resource capacity of the device; risk constraint: the total risk reduction ability of the selected candidate policy needs to cover the current risk value of the device (i.e., the sum of the risk reduction values of each candidate policy must be greater than or equal to the risk value of the risk dimension of the any threatened device).

[0213] From the defense policy library, each policy is traversed, and the resource consumption of any policy is compared with the preset residual resource threshold. If it is less than or equal to the residual resource threshold, the policy is added to the candidate policy set.

[0214] For each threatened device, the candidate policy whose resource consumption meets the condition is selected according to the device residual resource threshold, the policy selection range is narrowed, and it is ensured that the selected policy is within the range of device resources that can be tolerated, avoiding overloading of device resources due to policy execution.

[0215] Further, the candidate policy score is calculated, the risk reduction value, resource consumption, and priority of the policy are comprehensively considered, the candidate policy is ranked through quantitative scoring, and the policy with the best comprehensive performance in reducing risks and resource consumption is selected.

[0216] As an example, the strategy score Score(s) of a strategy s can be calculated by the following formula:

[0217]

[0218] wherein AR(s) represents the risk value that can be reduced after the execution of the strategy s, λ represents a resource sensitivity coefficient, and C(S) represents the resource consumption of the strategy s.

[0219] It should be noted that the value range of AR(s) is [0, 1], which is predefined by the strategy library; λ ∈ [0, 1], which is used to balance the weight of resource consumption and risk reduction, and λ = 0.8 is usually taken for low-resource devices, emphasizing the priority selection of low-resource consumption strategies; λ = 0.5 can be set for high-performance devices; the strategy priority (s) is the artificially preset strategy priority, and the value range can be set as [1, 5], and the larger the value, the higher the priority. For example, the protocol-level strategy priority is usually set to 4, and the lightweight strategy is set to 2.

[0220] The candidate strategies are ranked by Score(s), and the higher the score, the better the comprehensive performance of the strategy in reducing risk and resource consumption. The strategies with high scores are preferentially selected to ensure that the generated defense strategies are efficient and adapt to device resources. For example, the top V strategies that meet the resource constraints and risk constraints are selected as the defense strategy set.

[0221] Further, in the process of strategy selection, multiple strategies may act on the same device, and conflict detection and elimination are needed.

[0222] In the embodiments of the present application, in the case that multiple candidate strategies act on the same threatened device, resource conflict detection is first performed: if the total resource consumption of the candidate strategies exceeds the device capacity, the single strategy with the highest strategy score is selected as the defense strategy set.

[0223] It can be understood that when the total resource consumption of the candidate strategies exceeds the device capacity, it indicates that there is a resource conflict; otherwise, there is no resource conflict. In the case of resource conflict, the other strategies are discarded, and only the single strategy with the highest strategy score is selected as the defense strategy set.

[0224] In some embodiments, if there is no resource conflict but there is a target conflict (i.e., multiple candidate strategies act on the same threatened device), the protocol-level strategy is preferentially selected. Because the protocol-level strategy is highly targeted and can effectively block attacks based on protocol vulnerabilities. For example, when the Modbus function code filtering strategy conflicts with a certain general strategy, the Modbus function code filtering strategy is preferentially retained.

[0225] Through the above strategy library management, candidate strategy screening and conflict processing mechanism, the system can generate conflict-free and efficient dynamic defense strategies according to the device risk and resource state, and improve the network security protection capability of the intelligent factory. Output device-level defense strategy mapping table and conflict-free dynamic defense strategy set.

[0226] As a preferred embodiment, real-time resource data after execution of each defense strategy in the defense strategy set is collected, and a resource fluctuation value of the real-time resource data is calculated; in the case that the resource fluctuation value exceeds a preset fluctuation threshold, a strategy rollback is triggered, wherein the strategy rollback includes revoking the defense strategy and restoring the parameters of the threatened device.

[0227] The strategy rollback operation includes: revoking the current strategy: the system immediately stops executing the running defense strategy, and restores the device to the state before the strategy execution. For example, if the execution of the full-flow encryption strategy causes the CPU utilization of the device to rise sharply and exceed the threshold, the running of the encryption strategy is stopped, and the related encryption processes and services are closed; state recovery: the configuration parameters, running state and the like of the threatened device are restored to the original state before the strategy execution, so as to ensure that the device can normally and stably run. For example, the network communication parameters, system service settings and the like are restored, so as to avoid the continuous impact of the residual strategy on the device.

[0228] Further, when the strategy rollback operation is executed, log recording and feedback notification can also be performed.

[0229] Log recording: during the strategy rollback process, relevant information of the rollback event is recorded in detail, including rollback time, device ID triggering rollback, strategy name causing rollback, resource fluctuation, and the like, to form a strategy execution result log. These log data provide an important basis for subsequent feedback evaluation, helping to analyze the reasons for the failure of strategy execution.

[0230] Feedback notification: sending a strategy rollback notification to the system administrator or relevant operation and maintenance personnel, prompting that the defense strategy execution has an abnormal situation, and providing detailed information of the rollback event, so as to manually intervene to further troubleshoot problems and adjust the strategy. At the same time, the rollback event is fed back to the feedback evaluation module, which is used to update the risk model and optimize the defense strategy library, so as to avoid similar problems from occurring again.

[0231] Further, if a strategy rollback event occurs, the conditional probability table of the related nodes in the Bayesian network can also be updated, the strategy execution effect is analyzed through multi-dimensional indicators, and the update of the weights and parameters in the Bayesian network and the defense strategy library is triggered.

[0232] As an example, an automatic parameter adjustment mechanism can be set for the defense strategy library, for example, the initial resource consumption value C of the full-flow encryption strategy is 0.8, and if the CPU exceeds the limit for three times, it is automatically adjusted to 0.85.

[0233] Step S60, based on the dynamic defense strategy set, calling the corresponding device communication interface to execute the defense strategy.

[0234] In the embodiments of the present application, the device communication interface list is obtained by the following methods:

[0235] Device registration phase: When a new device accesses the network, it actively reports its supported communication interface information during the registration process, including interface type (such as Modbus TCP, MQTT, OPCUA, etc.), communication port number, data transmission protocol format, etc. The system records and integrates these information into the device communication interface list.

[0236] Network scanning and detection: Use network scanning tools (such as Nmap, Zabbix, etc.) to periodically scan the devices in the network, identify the open communication ports and protocol types of the devices, and supplement or update the device communication interface list. For example, if a scan discovers that a device has opened port 502 and uses Modbus protocol, the corresponding Modbus communication interface information is added to the list.

[0237] Through the edge computing node, the defense strategy is distributed to the target device, the execution effect of the strategy is monitored in real time, the abnormal situation caused by the execution of the strategy is handled, and the execution result of the strategy is output.

[0238] According to the device resource state (such as CPU utilization, memory remaining amount) and the device type (sensor, controller, PLC, etc.), the execution mode of the strategy is determined. For low-resource devices (such as sensors), due to their limited computing and storage capabilities, to avoid the delay caused by cloud transmission, lightweight strategies such as log monitoring and lightweight encryption are preferentially executed locally through the edge computing node; while for high-resource devices (controllers, PLCs, etc.), complex strategies such as full-flow encryption and vulnerability hot patch deployment are uniformly issued through the cloud.

[0239] In some embodiments, after executing the defense strategy, the execution effect of the defense strategy is evaluated based on the execution result of the defense strategy and real-time network security data; and the defense strategy library is updated based on the execution effect.

[0240] In the embodiments of the present application, the execution effect of the defense strategy is quantified from multiple angles, the performance of the defense strategy in resisting attacks and adapting to device resources is comprehensively evaluated, feedback information is collected, adjustment basis is provided for subsequent risk modeling and strategy generation, and a closed-loop management is formed.

[0241] As an example, the proportion of the number of times that the threatened device successfully intercepts attacks in the total number of attacks is calculated as the defense effectiveness of the threatened device; the proportion of the number of devices that exceed the resource limit after the execution of the defense strategy in the total number of executed devices is calculated as the resource over-limit rate of the defense strategy; and the execution effect is constituted by the defense effectiveness and the resource over-limit rate.

[0242] It should be noted that the defense effectiveness has a value range of [0, 1]. The closer the value is to 1, the stronger the interception ability of the defense strategy against attacks. For example, if the calculation result is 0.8, it means that the system successfully intercepts 80% of the attacks, and the defense strategy performs well in resisting external threats; if the result is close to 0, it means that the defense strategy is ineffective, and the strategy loopholes, misjudgment, or re-planning needs to be checked. The resource over-limit rate has a value range of [0, 1]. The lower the value, the better the adaptability of the defense strategy to device resources. If the resource over-limit rate is 0.2, it means that 20% of the devices have resource overload problems after executing the strategy, and the resource consumption parameters of the strategy need to be optimized, or the strategy allocation scheme needs to be adjusted to prevent the normal operation of the device from being affected due to excessive resource consumption.

[0243] Further, the defense strategy library can also be optimized based on the execution effect.

[0244] As an example, according to the defense effectiveness (attack interception rate) and resource adaptability (resource over-limit rate) calculated in the feedback evaluation stage, the strategies in the strategy library are classified. For example, the strategy with high attack interception rate and low resource over-limit rate is marked as "efficient strategy"; the strategy with low attack interception rate and high resource over-limit rate is marked as "inefficient high-consumption strategy".

[0245] Inefficient strategy optimization:

[0246] Parameter adjustment: For the strategy marked as "inefficient", analyze its execution data and adjust the resource consumption and risk reduction parameters. For example, if the actual risk reduction effect of a certain log monitoring strategy does not meet the expectation, appropriately increase its risk reduction value AR according to historical execution data; if the resource consumption of a certain encryption strategy is too high but the defense effect is general, reduce its resource consumption value C or optimize the encryption algorithm to reduce resource occupation.

[0247] Rule improvement: Modify the strategy execution rules in combination with newly emerging threat characteristics and device characteristics. For example, when a new type of malicious payload attack pattern is found, add a recognition rule for this pattern in the traffic detection strategy; adjust the applicable conditions of the corresponding strategy for newly connected device types.

[0248] Elimination and addition:

[0249] Eliminate the strategy: For the strategy that fails to execute continuously for three times or still cannot achieve the expected effect after multiple optimizations, delete it from the strategy library to avoid interference of invalid strategies in subsequent screening.

[0250] New policy: According to the industry security dynamics, new attack means and enterprise new equipment demand, new policy is supplemented in time. For example, for the newly emerging Internet of Things device vulnerabilities, add special vulnerability repair or protection policy; With the introduction of new industrial protocols by enterprises, increase the corresponding protocol security policy.

[0251] Policy priority adjustment: According to the policy execution effect and the change of enterprise security demand, the priority of the policy is dynamically adjusted. For example, in a certain period of time, if the attack events of a specific protocol occur frequently, the priority of the defense policy related to the protocol is increased; If the enterprise focuses on protecting a certain type of high-value assets, the priority of the defense policy for the assets is increased.

[0252] The feedback signal includes the Bayesian network update parameter and the policy library adjustment instruction, so that the defense system can be continuously optimized and improved according to the actual situation. The system can continuously learn and adapt to changes in the network security environment, and continuously improve the accuracy of risk assessment and the effectiveness of defense policy.

[0253] By collecting the execution effect of the defense policy in real time, comparing the network data before and after the implementation of the defense policy, calculating the risk value change, the number of attack reduction, etc. Index, combined with user feedback and system log information comprehensive evaluation. According to the evaluation results, the feedback information is formed, which is used to adjust the parameters of the multi-dimensional risk modeling module and the strategy generation rules of the dynamic defense strategy generation module, forming a closed-loop feedback mechanism, so that the system can be continuously optimized and improved, the matching degree of the defense policy and the equipment resources is better, and the self-adaptability and intelligent level are improved.

[0254] Although the steps in the above embodiments are described in the above order, those skilled in the art can understand that, in order to achieve the effect of the embodiment, different steps do not have to be executed in such an order, they can be executed at the same time (in parallel) or in a reversed order, and these simple changes are within the protection scope of the present application.

[0255] Please refer to Figure 5 , the network security dynamic defense system of the second embodiment of the present application includes a data acquisition module 100, a Bayesian network construction module 200, a knowledge graph construction module 300, a propagation prediction module 400, a defense strategy generation module 500 and a defense strategy execution module 600.

[0256] The data acquisition module 100 is used for acquiring network security data of a target server, and performing feature extraction on the network security data to generate a standardized data set;

[0257] The Bayesian network construction module 200 is configured to construct a Bayesian network by taking the risk dimensions included in the standardized data set as nodes and taking the probability relationship between the nodes as edges, wherein the Bayesian network is configured to output a risk assessment result.

[0258] The knowledge graph construction module 300 is configured to construct a knowledge graph based on entities covered by the target server and the relationship between the entities, wherein the entities at least include devices, protocols, vulnerabilities and attack behaviors.

[0259] The propagation prediction module 400 is configured to simulate the propagation path of the attack behavior between the devices in the knowledge graph based on a preset protocol state machine and a propagation prediction model, and determine a propagation prediction result.

[0260] The defense strategy generation module 500 is configured to match a defense strategy in a preset defense strategy library according to the risk assessment result and the propagation prediction result, and generate a dynamic defense strategy set including a plurality of defense strategies.

[0261] The defense strategy execution module 600 is configured to invoke a corresponding device communication interface to execute the defense strategy based on the dynamic defense strategy set.

[0262] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related description of the system described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0263] It should be noted that the network security dynamic defense system provided in the above embodiments is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the modules or steps in the embodiments of the present application are further divided or combined, for example, the modules of the above embodiments can be combined into one module, or can be further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present application are only for distinguishing the modules and steps, and should not be considered as an improper limitation of the present application.

[0264] The electronic device of the third embodiment of the present application comprises:

[0265] at least one processor; and

[0266] a memory connected in communication with the at least one processor; wherein

[0267] The memory stores instructions executable by the processor, and the instructions are configured to be executed by the processor to implement the network security dynamic defense method described above.

[0268] The fourth embodiment of the application is a computer readable storage medium storing computer instructions for being executed by a computer to implement the network security dynamic defense method.

[0269] The fifth embodiment of the application is a computer program product, which, when running on an electronic device, causes the electronic device to perform the network security dynamic defense method.

[0270] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes and related descriptions of the electronic device, the computer readable storage medium and the computer program product described above can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0271] Those skilled in the art should realize that the modules and method steps of each example described in connection with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. The programs corresponding to the software modules and method steps can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM or any other form of storage medium known in the art. In order to clearly illustrate the interchangeability of electronic hardware and software, the components and steps of each example have been generally described in the foregoing description. Whether the functions are performed by electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the application.

[0272] Reference is made below to Figure 6 which shows a structural schematic diagram of a computer system of a server for implementing the method, system and device embodiments of the application. Figure 6 The server shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the application.

[0273] As Figure 6As shown, the computer system includes a central processing unit (CPU) 601 which can perform various appropriate actions and processes in accordance with programs stored in a read only memory (ROM) 602 or programs loaded from a storage section 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0274] Connected to the I / O interface 605 are an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as required. A removable recording medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 610 as required, so that a computer program read out therefrom is installed in the storage section 608 as required.

[0275] In particular, the processes described above with reference to the flow charts can be implemented as a computer software program in accordance with embodiments of the present application. For example, embodiments of the present application include a computer program product which includes a computer program tangibly embodied on a computer readable medium, the computer program containing program code for executing the methods illustrated by the flow charts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 609 and / or installed from the removable media 611. When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the methods of the present application are performed. Note that the computer readable medium of the present application described above can be either a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the foregoing. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal that is propagated in baseband or that is propagated as part of a carrier wave, in which the computer readable program code is contained. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable medium can be transmitted using any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0276] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0277] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0278] The terms "first", "second", etc. are used to distinguish between similar objects, and are not used to describe or indicate a particular order or sequence among or between the objects.

[0279] The terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0280] The technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical schemes after the changes or replacements will all fall within the protection scope of the present application.

Claims

1. A dynamic network security defense method, characterized in that, include: Obtain network security data from the target server, extract features from the network security data, and generate a standardized dataset; Using the risk dimensions included in the standardized dataset as nodes and the probability relationships between nodes as edges, a Bayesian network is constructed, wherein the Bayesian network is used to output risk assessment results. Based on the entities covered by the target server and the relationships between them, a knowledge graph is constructed, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors; Based on a preset protocol state machine and propagation prediction model, the propagation path of attack behavior between devices is simulated in the knowledge graph to determine the propagation prediction result; Based on the risk assessment results and the propagation prediction results, defense strategies are matched in the preset defense strategy library to generate a dynamic defense strategy set including multiple defense strategies. Based on the dynamic defense strategy set, the corresponding device communication interface is invoked to execute the defense strategy; The Bayesian network is used to output risk assessment results, including: Using the aforementioned risk dimensions as the parent node, obtain the indicators that reflect each risk dimension as child nodes; Based on the logical relationship between the parent node and the child node, an edge is generated from the parent node to the child node, thus generating the Bayesian network, wherein the edge corresponds to a conditional probability; The joint probability distribution of each child node is obtained through the Bayesian network inference. Based on the joint probability distribution, the risk value of each risk dimension at different risk levels is determined, and the overall risk value is determined based on the risk value of each risk dimension. The risk assessment result is composed of the risk values ​​of each risk dimension, the overall risk value, and the node probability distribution, wherein the node probability distribution is composed of the conditional probabilities corresponding to each sub-node.

2. The network security dynamic defense method according to claim 1, characterized in that, The determination of the propagation prediction result includes: Based on the attack situation of the device, the security status of the device is divided into vulnerable status, infected status and recovered status. Based on the impact of the protocol on the propagation probability, the attack propagation probability between different devices is determined, and a propagation probability matrix is ​​generated from the attack propagation probabilities between each device. Based on the attack propagation probability, recovery rate, and number of devices under each security state corresponding to the device, the rate of change of security state over time is obtained, wherein the recovery rate is determined based on the attributes of the device, and the rate of change is used to construct a propagation prediction model; A propagation prediction model is constructed based on the security status, the propagation probability matrix, and the rate of change. Identify the initial threatened node in the knowledge graph, and starting from the initial threatened node, generate one or more propagation paths through the propagation prediction model; The propagation prediction result is the set of all threatened devices involved in the propagation path.

3. The network security dynamic defense method according to claim 2, characterized in that, The generation includes a dynamic set of defense strategies comprising multiple defense strategies, including: For any threatened device in the propagation prediction results, a candidate strategy is selected from the defense strategy library under the constraints of resources and risks. Based on the resource consumption, strategy priority, and risk reduction value that can be achieved after the candidate strategy is executed, the strategy score of the candidate strategy is obtained. Based on the ranking of the strategy scores, the candidate strategies are selected to generate the defense strategy set.

4. The network security dynamic defense method according to claim 3, characterized in that, The selection of the candidate strategies includes: When multiple candidate strategies are applied to the same threatened device, if the total resource consumption of all candidate strategies exceeds the device capacity, the single strategy with the highest strategy score is selected as the set of defense strategies.

5. The network security dynamic defense method according to claim 3, characterized in that, The method further includes: Collect real-time resource data after the execution of each defense strategy in the set of defense strategies, and calculate the resource fluctuation value of the real-time resource data; If the resource fluctuation value exceeds a preset fluctuation threshold, a policy rollback is triggered, wherein the policy rollback includes revoking the defense policy and restoring the parameters of the threatened device.

6. The network security dynamic defense method according to claim 1, characterized in that, The method further includes: Based on the execution results of the defense strategy and real-time network security data, evaluate the effectiveness of the defense strategy. Based on the execution results, update the defense strategy library.

7. The network security dynamic defense method according to claim 6, characterized in that, The evaluation of the effectiveness of the defense strategy includes: The proportion of attacks successfully intercepted by the threatened device out of the total number of attacks is calculated as the defensive effectiveness of the threatened device. The proportion of the number of devices exceeding resource limits after the defense strategy is executed to the total number of executing devices is calculated as the resource over-limit rate of the defense strategy. The execution effect is determined by the effectiveness of the defense and the resource overrun rate.

8. A dynamic network security defense system, characterized in that, include: The data acquisition module is used to acquire network security data of the target server, extract features from the network security data, and generate a standardized dataset. A Bayesian network construction module is used to construct a Bayesian network using the risk dimensions included in the standardized dataset as nodes and the probability relationships between the nodes as edges, wherein the Bayesian network is used to output risk assessment results. The knowledge graph construction module is used to construct a knowledge graph based on the entities covered by the target server and the relationships between the entities, wherein the entities include at least devices, protocols, vulnerabilities, and attack behaviors; The propagation prediction module is used to simulate the propagation path of attack behavior between devices in the knowledge graph based on a preset protocol state machine and propagation prediction model, and determine the propagation prediction result. The defense strategy generation module is used to match defense strategies in a preset defense strategy library based on the risk assessment results and the propagation prediction results, and generate a dynamic defense strategy set including multiple defense strategies. The defense strategy execution module is used to execute the defense strategy by calling the corresponding device communication interface based on the dynamic defense strategy set; The Bayesian network is used to output risk assessment results, including: Using the aforementioned risk dimensions as the parent node, obtain the indicators that reflect each risk dimension as child nodes; Based on the logical relationship between the parent node and the child node, an edge is generated from the parent node to the child node, thus generating the Bayesian network, wherein the edge corresponds to a conditional probability; The joint probability distribution of each child node is obtained through the Bayesian network inference. Based on the joint probability distribution, the risk value of each risk dimension at different risk levels is determined, and the overall risk value is determined based on the risk value of each risk dimension. The risk assessment result is composed of the risk values ​​of each risk dimension, the overall risk value, and the node probability distribution, wherein the node probability distribution is composed of the conditional probabilities corresponding to each sub-node.

9. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor to implement the network security dynamic defense method according to any one of claims 1-7.

Images