Intelligent network attack surface prediction method and system based on deep learning

Abstract

The application relates to an intelligent network attack surface prediction method and system based on deep learning, belonging to the network security and information technology field, which comprises the following steps: obtaining network asset information, vulnerability distribution information and external threat intelligence data in a target network environment, and preprocessing to generate a standardized data set; inputting the standardized data set into a pre-trained deep learning model to extract a feature vector related to network attacks; performing reasoning analysis on potential attack links based on the feature vector and a knowledge graph, in combination with the correlation between network asset nodes, vulnerability nodes and threat intelligence nodes in the knowledge graph; finally, evaluating the intrusion paths that may be used by attackers according to the reasoning analysis result and outputting an attack surface prediction result in the form of an attack path list; the scheme can perform in-depth reasoning analysis on potential attack links, accurately predict the intrusion paths that may be used by attackers, and improve the effectiveness of network security protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security and information technology, in particular to an intelligent network attack surface prediction method and system based on deep learning. BACKGROUND

[0002] In today's digital age, network security is facing unprecedented challenges, and the means and methods of network attacks are becoming increasingly complex and diverse. Network asset management and security protection have become a key sub-technology field. In this field, the collection and analysis of network asset information, vulnerability distribution, and external threat intelligence data are the foundation work to ensure network security. By collecting information such as hardware device types, software versions, and configuration parameters of network assets, understanding the numbers, impact ranges, and repair statuses of known vulnerabilities, and mastering threat intelligence such as attack patterns, attack tools, and attacker behavior records, a preliminary understanding of the security status of the network can be obtained.

[0003] To deal with network attacks, the current common solution is to perform simple correlation analysis on the collected data, and by setting some rules and thresholds, it is determined whether there is a potential attack risk in the network. For example, when a known vulnerability exists in a certain software version, and there is an attack record outside for this vulnerability, it is determined that there is a risk in the network asset.

[0004] However, this solution has a significant technical problem, which is that it cannot perform in-depth reasoning analysis on potential attack links. Simple correlation analysis can only find surface risks, and cannot accurately predict complex intrusion paths that attackers may use, resulting in a large blind area in network security protection, making it difficult to effectively deal with increasingly complex network attacks. SUMMARY

[0005] The main purpose of the present application is to provide an intelligent network attack surface prediction method based on deep learning, which can perform in-depth reasoning analysis on potential attack links, accurately predict intrusion paths that attackers may use, and improve the effectiveness of network security protection.

[0006] To achieve the above purpose, the embodiment of the present application provides an intelligent network attack surface prediction method based on deep learning, which comprises:

[0007] Obtaining network asset information, vulnerability distribution information, and external threat intelligence data in a target network environment, the network asset information including hardware device types, software versions, and configuration parameters, the vulnerability distribution information including known vulnerability numbers, impact ranges, and repair statuses, and the external threat intelligence data including attack patterns, attack tools, and attacker behavior records;

[0008] The network asset information, vulnerability distribution information, and external threat intelligence data are preprocessed to generate a standardized dataset;

[0009] The standardized dataset is input into a pre-trained deep learning model to extract feature vectors related to network attacks from the dataset. The deep learning model is a multi-layer neural network structure.

[0010] Based on the feature vectors and knowledge graph, the potential attack chain is inferred and analyzed to obtain the inference and analysis results. The knowledge graph contains the relationship between network asset nodes, vulnerability nodes and threat intelligence nodes.

[0011] Based on the reasoning and analysis results, the possible intrusion paths that attackers may use are evaluated, and the attack surface prediction results are output. The attack surface prediction results are presented in the form of an attack path list, which includes specific information about the starting node, intermediate nodes and target node for each attack path.

[0012] Accordingly, embodiments of this application also provide an intelligent network attack surface prediction system based on deep learning, the system comprising:

[0013] The acquisition module is used to acquire network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version, and configuration parameters. The vulnerability distribution information includes known vulnerability numbers, impact scope, and remediation status. The external threat intelligence data includes attack patterns, attack tools, and attacker behavior records.

[0014] The preprocessing module is used to preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized dataset.

[0015] The feature extraction module is used to input the standardized dataset into a pre-trained deep learning model and extract feature vectors related to network attacks from the dataset. The deep learning model is a multi-layer neural network structure.

[0016] The reasoning and analysis module is used to perform reasoning and analysis on potential attack links based on the feature vectors and knowledge graphs, and obtain reasoning and analysis results. The knowledge graph contains the relationships between network asset nodes, vulnerability nodes and threat intelligence nodes.

[0017] The prediction module is used to assess the intrusion paths that attackers may use based on the reasoning analysis results, and output attack surface prediction results. The attack surface prediction results are presented in the form of an attack path list, which includes specific information about the starting node, intermediate nodes and target node for each attack path.

[0018] In summary, the technical solution of this application acquires network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment, and preprocesses this data to generate a standardized dataset, providing comprehensive and standardized data for subsequent analysis. The standardized dataset is then input into a pre-trained deep learning model to extract feature vectors related to network attacks. Leveraging the powerful feature extraction capabilities of deep learning, hidden attack-related information is mined from the data. Based on feature vectors and a knowledge graph, potential attack paths are analyzed and reasoned. Combining the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes in the knowledge graph, the potential intrusion paths of attackers can be more accurately identified. Finally, the intrusion paths that attackers may utilize are evaluated based on the reasoning analysis results, and attack surface prediction results are output in the form of an attack path list. This provides network security personnel with a clear and definite direction for prevention, thereby effectively improving network security and resistance to attacks. Therefore, this solution can conduct in-depth reasoning analysis of potential attack paths, accurately predict the intrusion paths that attackers may utilize, and improve the effectiveness of network security protection. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1a This is a schematic diagram of a scenario for the intelligent network attack surface prediction method based on deep learning in the embodiments of this application;

[0021] Figure 1b This is a schematic diagram of the implementation framework of the intelligent network attack surface prediction method based on deep learning in the embodiments of this application;

[0022] Figure 2 A flowchart is provided for an intelligent network attack surface prediction method based on deep learning, which is an embodiment of this application.

[0023] Figure 3 A flowchart illustrating the reasoning and analysis process provided for embodiments of this application;

[0024] Figure 4 This is a schematic diagram illustrating the process of generating candidate attack chains provided in an embodiment of this application;

[0025] Figure 5 A schematic diagram illustrating the process of updating the candidate attack link set provided in the embodiments of this application;

[0026] Figure 6A flowchart illustrating the attack chain sorting process provided in this application embodiment;

[0027] Figure 7 Another schematic diagram illustrating the attack chain sequencing provided in this application embodiment;

[0028] Figure 8 A schematic diagram illustrating the complexity score calculation process provided in this application embodiment;

[0029] Figure 9 A schematic diagram of the structure of an intelligent network attack surface prediction system based on deep learning provided in an embodiment of this application;

[0030] Figure 10 A schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] This application provides an intelligent network attack surface prediction method and system based on deep learning, which will be described in detail below.

[0033] In this embodiment, the network attack surface refers to the collection of all potential pathways and vulnerabilities in a network system that can be exploited by attackers to launch attacks, encompassing multiple dimensions such as hardware, software, network protocols, and human operation. On the hardware side, this may include chip design flaws or firmware vulnerabilities in devices such as servers and routers; on the software side, this may include security vulnerabilities in operating systems and applications, such as remote execution vulnerabilities in Windows systems and SQL injection vulnerabilities in web applications; regarding network protocols, this may include design and implementation defects in network protocols, such as security vulnerabilities in early WEP protocols, which can expose network communication to risks; and unreasonable or improperly configured network topology, such as opening unnecessary ports or using weak passwords, can increase the exposure to attack risks.

[0034] In this embodiment, network assets refer to various resources and entities that have value in the network environment. These can include hardware, software, and related data and services. Hardware includes servers, terminal devices (such as desktop computers, laptops, tablets, etc.), and network devices (such as routers, switches, etc.). Software can include operating systems, applications, database management systems, etc., which provide various functions and services to the network. Data can include enterprise business data, user information, confidential documents, etc.

[0035] In this embodiment, the intelligent network attack surface prediction method based on deep learning is a comprehensive network security analysis method. It involves collecting, processing, and analyzing various types of data in the target network environment, aiming to intelligently predict potential intrusion paths used by attackers using deep learning technology and knowledge graphs. Specifically, it acquires network asset information (including hardware device types, software versions, and configuration parameters), vulnerability distribution information (including known vulnerability numbers, impact ranges, and remediation status), and external threat intelligence data (including attack patterns, attack tools, and attacker behavior records). This data is preprocessed, such as through data cleaning, format standardization, and missing value imputation, to generate a standardized dataset. A pre-trained deep learning model (a multi-layer neural network structure containing convolutional layers, pooling layers, and fully connected layers) extracts feature vectors related to network attacks from the dataset. Then, it combines this with a knowledge graph (containing the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes) to perform reasoning analysis on potential attack chains, assess the potential intrusion paths used by attackers, and finally output the attack surface prediction results in the form of an attack path list. Each attack path includes specific information about the starting node, intermediate nodes, and target node. The entire process is intelligent, based on deep learning, and predictive, which can effectively improve the targeting and effectiveness of network security protection.

[0036] like Figure 1a and Figure 1b As shown, a scenario for intelligent network attack surface prediction based on deep learning is provided. In this scenario, the network security monitoring system, the target network environment (taking a network system as an example), the external threat intelligence and data analysis platform (such as a data analysis server) are mainly included. The network security monitoring system, the target network environment (taking a network system as an example), the external threat intelligence and data analysis platform (such as a data analysis server) are connected through a network.

[0037] Taking a large enterprise network environment as an example, this scenario involves a large number of network assets, including servers, terminal devices, and network equipment. These devices run various software and applications and interact with external networks. The network security monitoring system plays a crucial role in collecting information on network assets, vulnerability distribution, and external threat intelligence.

[0038] Regarding the collection of network asset information, the network security monitoring system performs a detailed scan and identification of every hardware device within the enterprise, determining its type, such as whether a server is a tower server, rack server, or blade server, and recording its software version and configuration parameters. For example, for a database server, it records its operating system version, database management system version, and database configuration parameters, such as maximum number of connections and memory allocation. Different hardware types and software versions may contain different security vulnerabilities.

[0039] Information on vulnerability distribution can be collected through regular vulnerability scanning tools that perform comprehensive scans of network assets. These tools detect the vulnerability IDs, scope of impact, and remediation status of known vulnerabilities. For example, if a server is found to have a vulnerability with a specific ID that could affect file system access permissions, allowing attackers to illegally obtain sensitive data, the tool will record whether the vulnerability has been patched. If not, it requires close monitoring.

[0040] External threat intelligence data can be collected through data exchange with threat intelligence platforms. These platforms collect information such as attack patterns, attack tools, and attacker behavior logs globally. For example, they might learn that a new attack pattern has recently emerged, where attackers exploit a software vulnerability to gain remote control using specific tools, causing significant damage to other enterprise networks. The network security monitoring system then transmits this collected data to a data analysis platform or stores it in a standardized database.

[0041] After receiving data or extracting data from a database, the data analysis platform first performs preprocessing. Data cleaning removes noise and errors from the data, such as removing duplicate network asset records or incorrect vulnerability information. Format standardization converts data from different sources into a unified format for subsequent analysis. Missing value imputation fills in missing parts of the data appropriately; for example, if a device's configuration parameters are missing, they can be filled in based on the average configuration parameters of similar devices. After preprocessing, a standardized dataset is generated.

[0042] A standardized dataset is input into a pre-trained deep learning model. The deep learning model is a multi-layered neural network structure containing convolutional layers, pooling layers, and fully connected layers. Convolutional layers slide kernels across the data to extract local features, such as identifying specific patterns or features. Pooling layers reduce the dimensionality of the convolutional layer outputs while preserving important feature information. Fully connected layers integrate the extracted features, outputting a feature vector related to network attacks.

[0043] This analysis leverages feature vectors and knowledge graphs to infer and analyze potential attack chains. The knowledge graph contains the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes. For example, a network asset node might be associated with a specific vulnerability node because the software version running that network asset contains the vulnerability; simultaneously, this vulnerability node might be associated with certain threat intelligence nodes because there are records of external attacks exploiting that vulnerability. Through these relationships, potential attack chains can be deduced.

[0044] Finally, based on the inference analysis results, the potential intrusion paths that attackers might use are assessed, and attack surface prediction results are output. These predictions are presented as a list of attack paths, each including detailed information on the starting node, intermediate nodes, and target node. For example, an attack path might involve an attacker from an external network exploiting a vulnerability to compromise a border server (starting node), then using the border server's privileges to access an internal database server (intermediate node), and finally obtaining sensitive data from the database (target node). Enterprise network security administrators can use these attack path lists to take appropriate security measures, such as patching vulnerabilities and strengthening access controls, thereby effectively improving network security.

[0045] refer to Figure 2 , Figure 2 This is a flowchart illustrating an intelligent network attack surface prediction method based on deep learning provided in this application embodiment. The execution entity of this method can be a computer device (which can act as a data analysis server). This computer device can be a single computer device or a cluster of multiple computer devices. The computer device can be a terminal device or a server, etc. The intelligent network attack surface prediction method based on deep learning provided in this application embodiment specifically includes:

[0046] S10: Obtain network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version, and configuration parameters. The vulnerability distribution information includes known vulnerability numbers, impact scope, and remediation status. The external threat intelligence data includes attack patterns, attack tools, and attacker behavior records.

[0047] In this embodiment, network asset information is a comprehensive collection of information describing the characteristics of various hardware and software assets in the target network environment. Hardware device type refers to the category of various physical devices used in the network; for example, servers can be categorized as tower servers, rack servers, and blade servers. Terminal devices can include desktop computers, laptops, tablets, etc. Different hardware device types have different performance and security characteristics. Software version refers to the specific version number of the operating system, applications, and other software installed on the hardware device, such as Windows Server 2019, Office 2016, etc. Different software versions may lead to different security vulnerabilities; newer versions usually fix some known vulnerabilities. Configuration parameters refer to various setting options for hardware devices and software, such as server network configuration parameters and database security configuration parameters. The appropriateness of these configuration parameter settings directly affects the security of network assets.

[0048] Vulnerability distribution information is a collection of detailed information about known vulnerabilities in a network. A known vulnerability number is a unique identifier for each vulnerability, which can be used to retrieve detailed information about that vulnerability in a vulnerability database. The scope of impact refers to the range of network assets that a vulnerability may affect; for example, a vulnerability might affect the database servers of an entire enterprise, or it might only affect the terminal devices of a specific department. The remediation status indicates whether the vulnerability has been patched. If it has not been patched, it requires close attention because attackers may exploit it for attacks.

[0049] External threat intelligence data is a collection of information about cyberattacks obtained from external sources. Attack patterns refer to the attack methods and strategies employed by attackers, such as brute-force attacks, SQL injection, and DDoS attacks. Attack tools are the software or tools used by attackers to carry out attacks, such as hacking tools and malicious scripts. Attacker behavior logs record the actions of attackers on the network, such as the attacker's IP address, attack time, and attack frequency.

[0050] In this embodiment, by acquiring these three types of data, a comprehensive understanding of the security status of the target network environment can be achieved. From a technical perspective, this data provides a rich information foundation for subsequent network attack surface prediction, helping to identify potential security risks.

[0051] In one embodiment, network asset information can be obtained by comprehensively scanning the target network environment using a network scanning tool. The network scanning tool can use the SNMP (Simple Network Management Protocol) to obtain basic device information, including hardware device type and software version. Simultaneously, configuration parameters can be obtained by parsing the device's configuration file. For large enterprise networks, a distributed scanning approach can be used to improve scanning efficiency.

[0052] For vulnerability distribution information, professional vulnerability scanning software such as Nessus and OpenVAS can be used. These software programs regularly update their vulnerability databases and scan network assets to detect the IDs, impact ranges, and remediation status of known vulnerabilities. The scan results generate detailed reports for subsequent analysis.

[0053] For external threat intelligence data, collaboration with professional threat intelligence platforms is possible. These platforms collect information such as attack patterns, attack tools, and attacker behavior logs globally and provide it to enterprises. Enterprises can obtain this data through API interfaces and integrate it into their own cybersecurity monitoring systems.

[0054] S20: Preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized dataset. The preprocessing may include data cleaning, format standardization, and missing value imputation.

[0055] In this embodiment, data cleaning is the process of removing noise and erroneous information from the data. During data collection, duplicate device records and erroneous vulnerability information may occur. For example, due to the inaccuracy of network scanning, information about the same device may be recorded multiple times. Data cleaning can improve the quality and accuracy of the data and avoid the impact of erroneous data on subsequent analysis.

[0056] Standardization involves converting data from different sources into a uniform format. Different data sources may use different data formats, such as date formats or data encoding methods. Standardization makes data easier to process and analyze, improving the efficiency of data analysis.

[0057] Missing value imputation is the process of appropriately supplementing missing parts of data. During data collection, various reasons may lead to missing data, such as equipment failure or data transmission interruption. For example, configuration parameters of a device may be unavailable due to network issues. Missing value imputation ensures data integrity and avoids bias in analysis results caused by missing data.

[0058] In this embodiment, a standardized dataset is generated through preprocessing, providing high-quality data input for subsequent deep learning models. A standardized dataset enables deep learning models to better learn the features and patterns in the data, improving model performance and prediction accuracy.

[0059] In one embodiment, data cleaning can utilize data mining algorithms, such as cluster analysis and anomaly detection, to identify and remove duplicate records and erroneous information from the data. Format standardization can be achieved by writing data transformation scripts to convert data in different formats into a unified format. Missing value imputation can be performed using methods such as mean imputation, median imputation, or model-based imputation, depending on the type and characteristics of the data.

[0060] S30: Input the standardized dataset into a pre-trained deep learning model to extract feature vectors related to network attacks from the dataset. The deep learning model is a multi-layer neural network structure. This multi-layer neural network structure may include convolutional layers, pooling layers, and fully connected layers.

[0061] In this embodiment, the deep learning model is a machine learning model based on neural networks, possessing powerful feature extraction and pattern recognition capabilities. The multi-layer neural network structure consists of multiple neuron layers, with each neuron connected to the next layer via weights. Convolutional layers slide convolution kernels across the data to extract local features. A convolution kernel is a small matrix that performs convolution operations on the data, extracting local features. For example, in image recognition, convolutional layers can extract features such as edges and textures from an image. In network attack data, convolutional layers can identify specific attack pattern features within the data.

[0062] Pooling layers reduce the dimensionality of the convolutional layer output, decreasing the data's dimensionality while preserving important feature information. Common pooling operations include max pooling and average pooling. Max pooling selects the maximum value in a local region of the convolutional layer output as the pooling result, while average pooling calculates the average value of the local region. Pooling layers can reduce the computational cost of data processing and improve the model's training efficiency.

[0063] The fully connected layer integrates the features extracted earlier and outputs a feature vector related to network attacks. Each neuron in the fully connected layer is connected to all neurons in the previous layer, and the input features are linearly combined and nonlinearly transformed through weights and biases to finally output a feature vector.

[0064] In this embodiment, a standardized dataset is input into a deep learning model, which can automatically extract feature vectors related to network attacks. These feature vectors can reflect potential attack patterns and characteristics in the data, providing strong support for subsequent attack chain reasoning and analysis.

[0065] In one embodiment, the deep learning model can be trained using a large amount of historical cyberattack data. First, the data is divided into a training set and a test set. The training set is used to train the model, and the test set is used to evaluate the model's performance. During training, the backpropagation algorithm is used to adjust the model's weights and biases so that the model's output is as close as possible to the true labels. After training is complete, the standardized dataset is input into the trained model to extract feature vectors related to cyberattacks.

[0066] S40: Based on the feature vector and knowledge graph, perform reasoning analysis on potential attack links to obtain reasoning analysis results, wherein the knowledge graph contains the association between network asset nodes, vulnerability nodes and threat intelligence nodes.

[0067] In this embodiment, a knowledge graph is a graph structure used to represent relationships between entities. Network asset nodes represent various assets in the network, such as servers and terminal devices. Each node contains relevant information about the network asset, such as hardware device type and software version. Vulnerability nodes represent known vulnerabilities in the network, including vulnerability IDs and impact scope. Threat intelligence nodes represent external threat intelligence, including attack patterns and attack tools. Edges between nodes represent the relationships between them; for example, an edge between a network asset node and a vulnerability node indicates that the network asset has the vulnerability; an edge between a vulnerability node and a threat intelligence node indicates that the vulnerability may be exploited by a certain attack pattern.

[0068] A potential attack chain is an intrusion path that an attacker might exploit from the starting node to the target node. Inference analysis is the process of identifying all possible attack chains based on feature vectors and relationships within a knowledge graph. By analyzing feature vectors, attack-related features in the data can be identified. Combined with relationships in the knowledge graph, vulnerabilities and attack patterns that attackers might exploit can be inferred, thereby identifying potential attack chains.

[0069] In this embodiment, reasoning analysis based on feature vectors and knowledge graphs can uncover potential attack chains. This helps cybersecurity personnel understand possible intrusion paths by attackers in advance, take corresponding preventative measures, and reduce the risk of network attacks.

[0070] In one embodiment, the reasoning analysis can employ graph search algorithms, such as breadth-first search or depth-first search, to search for all possible paths in the knowledge graph. Simultaneously, information from feature vectors is used to filter and evaluate the searched paths. For example, if a vulnerability in a path has already been patched, that path is considered not a valid attack link.

[0071] S50: Based on the reasoning analysis results, assess the intrusion paths that the attacker may use and output the attack surface prediction results. The attack surface prediction results are presented in the form of an attack path list, and each attack path includes specific information about the starting node, intermediate nodes and target node.

[0072] In this embodiment, assessing the intrusion path that an attacker might use is a process of further analyzing and judging the potential attack links obtained from reasoning analysis. Multiple factors need to be considered, such as the success rate of the attack, the cost of the attack, and the importance of the target node. The success rate of the attack refers to the probability that an attacker will successfully launch an attack using this path, which is affected by factors such as the difficulty of exploiting vulnerabilities and network protection measures. The cost of the attack includes the time and resources required by the attacker. The importance of the target node depends on the information and functions it contains; for example, the importance of a core business server is usually higher than that of ordinary terminal devices.

[0073] Attack surface prediction results are presented as a list of attack paths, predicting the scope and paths of potential attacks on the network. Each attack path includes specific information about the starting node, intermediate nodes, and target node. The starting node can be the origin of the attack, a device at the network boundary, or a vulnerable asset. Intermediate nodes are the nodes traversed during the attack, which may be multiple devices or vulnerabilities. The target node is the final target of the attack, typically a node containing important information or functionality.

[0074] The specific information of the starting node can include network attributes (such as IP address, MAC address, and subnet), device type and configuration (such as the operating system and software version of the server and terminal devices), and security status (known vulnerability numbers, patching status, and protective measures). This information reflects the origin and initial conditions of the attack. The specific information of the intermediate nodes can include connection relationships and data transmission (such as connection method, data volume, frequency, and protocol type), device functions and permissions (main functions and access permissions), and security audit information (audit logs and abnormal activity).

[0075] The target node can be the ultimate destination of the attack, and its specific information can include multiple aspects. For example, in terms of hardware, this includes device type (e.g., core server, storage array), hardware configuration (e.g., CPU model, memory size, storage capacity), and the physical location of the device. At the software level, this includes the operating system version, running applications and their versions, database management system and its version, and also software security settings such as access control lists and permission management rules. Data-related information includes the type of data stored (e.g., sensitive customer information, business transaction data, intellectual property documents), data importance classification, data update frequency, and data backup status. Security protection information covers deployed firewall rules, intrusion detection system status, encryption algorithms and key management status, and security vulnerability scanning records and remediation status.

[0076] In this embodiment, the intrusion path is evaluated based on the reasoning analysis results, and the attack surface prediction results are output, which can provide network security personnel with clear defense directions. Network security personnel can then take corresponding protective measures based on the attack path list, such as strengthening the protection of target nodes, patching vulnerabilities, and restricting access, thereby improving network security.

[0077] In one embodiment, a comprehensive score can be assigned to each attack path. This score is calculated by weighting factors such as attack success rate, attack cost, and the importance of the target node. Attack paths are then ranked according to their comprehensive scores, with higher-scoring paths given priority. Simultaneously, the list of attack paths is output to cybersecurity personnel to facilitate their decision-making and prevention efforts.

[0078] In one embodiment, reference Figure 3 Step S20 may include steps S21-S24, which will be described in detail below:

[0079] Step S21: Extract network asset nodes, vulnerability nodes, and threat intelligence nodes that match the feature vector from the knowledge graph to generate a set of candidate attack links.

[0080] In this embodiment, the feature vector contains feature information related to network attacks. By matching it with nodes in the knowledge graph, network asset nodes, vulnerability nodes, and threat intelligence nodes related to the current data features can be identified. Network asset nodes represent actual assets in the network, such as servers and terminal devices; vulnerability nodes represent known network vulnerabilities; and threat intelligence nodes contain information such as external attack patterns and tools. By matching these nodes, possible attack chains can be preliminarily determined.

[0081] From a technical perspective, generating a set of candidate attack links can narrow down the scope of subsequent analysis, improve the efficiency and accuracy of the analysis, and help to quickly locate potential attack paths.

[0082] In one embodiment, a similarity-based method can be used for node matching. First, a similarity metric function is defined between feature vectors and node attributes (e.g., similarity = sum of matching degrees between feature vectors and node attributes / total number of attributes in the feature vector), such as cosine similarity. For network asset nodes, the similarity between the network asset features in the feature vector and the node's attributes is calculated to identify nodes with high similarity. The same similarity calculation is performed for vulnerability nodes and threat intelligence nodes. Then, the matched nodes are combined according to preset association rules to generate a candidate attack chain set. Association rules can be constructed based on historical attack event statistics. For example, if a vulnerability frequently appears alongside a certain attack pattern in historical attack events, then the corresponding vulnerability node and threat intelligence node are combined when combining nodes.

[0083] In one embodiment, reference Figure 4 Step S20 may include steps S211-S214, which will be described in detail below:

[0084] Step S211: Locate network asset nodes in the knowledge graph based on the network asset features in the feature vector, wherein the network asset features include device identifiers and configuration parameters.

[0085] In this embodiment, network asset features are a set of key information used to accurately describe and identify the characteristics of various assets in the network. These features can include multiple pieces of information, among which device identifiers are unique identifiers for network assets, such as device serial numbers and MAC addresses. Configuration parameters reflect various device settings, such as network configuration and security configuration. Through the network asset features in the feature vector, the corresponding network asset node can be accurately located in the knowledge graph.

[0086] In this embodiment, accurately locating network asset nodes is fundamental to generating candidate attack chains. Only by identifying the relevant network asset nodes can their association with vulnerable nodes and threat intelligence nodes be further analyzed, thereby constructing the attack chain.

[0087] In one embodiment, an index-based lookup method can be used for location. During knowledge graph construction, an index is created for the device identifiers and configuration parameters of network asset nodes. When a node needs to be located, the index is searched based on the network asset features in the feature vector to quickly find a matching network asset node.

[0088] Step S212: Locate the vulnerability node in the knowledge graph based on the vulnerability features in the feature vector, wherein the vulnerability features include the vulnerability number and the scope of impact.

[0089] In this embodiment, vulnerability features are a combination of key information used to clearly identify and define the specific status of known vulnerabilities in the network. The vulnerability number is a unique identifier for each vulnerability, which allows for accurate location of the corresponding vulnerability node in the knowledge graph. The impact scope describes the range of network assets that the vulnerability may affect, helping to further determine the association between vulnerability nodes and network asset nodes.

[0090] In this embodiment of the application, locating vulnerable nodes can clearly identify security risks existing in the network. Combining network asset nodes and threat intelligence nodes can better analyze potential attack paths.

[0091] In one embodiment, the association between a vulnerability database and a knowledge graph can be used for location. First, the vulnerability ID in the feature vector is matched with the vulnerability database to obtain detailed vulnerability information. Then, based on this information, the corresponding vulnerability node is searched in the knowledge graph. Simultaneously, combined with impact scope information, relevant vulnerability nodes are further filtered and identified.

[0092] In one embodiment, reference Figure 5 Step S212 may include steps S2121-S2124, which will be described in detail below:

[0093] Step S2121: Extract key fields of network asset features from the feature vector, including device type, software version and configuration parameters.

[0094] In this embodiment, the key fields are information used to describe the characteristics of network assets. Device type clarifies the physical category of the network asset, such as a server or terminal device; software version reflects the specific version of the software installed on the device; and configuration parameters reflect various device settings. Extracting these key fields from the feature vector helps to accurately locate network asset nodes in the knowledge graph.

[0095] In one embodiment, key fields can be extracted from a feature vector using preset rules. For example, the location and data type of the key fields can be determined based on the format and data structure of the feature vector, and then extracted according to the rules.

[0096] Step S2122: Query the network asset nodes that match the key field in the knowledge graph. If there are multiple matching nodes, calculate the similarity between each matching node and the key field.

[0097] In this embodiment, querying for matching network asset nodes in the knowledge graph aims to find nodes related to the current network asset characteristics. When multiple matching nodes exist, calculating similarity can further determine which node has the highest matching degree with the key field. The similarity calculation can be based on the node's attributes and the content of the key field.

[0098] In this embodiment, calculating similarity helps to select the most relevant node among multiple matching nodes, improves the accuracy of node positioning, and avoids incorrect associations.

[0099] In one embodiment, a cosine similarity algorithm is used to calculate the matching degree. Let the key fields form vector A, and the node attributes form vector B. The similarity Sim can be expressed as: Sim = (A・B) / (|A|×|B|), where A・B is the dot product of vectors A and B, and |A| and |B| are the moduli of vectors A and B, respectively. By calculating the cosine similarity between each matching node and the key fields, the degree of similarity between them can be quantified.

[0100] Step S2123: Sort the matching nodes according to the similarity and select the network asset node with the highest similarity as the location result.

[0101] In this embodiment, sorting the matching nodes and selecting the node with the highest similarity as the location result ensures the accuracy of the location. Sorting clearly shows the degree of matching between each matching node and the key field, allowing for the optimal selection.

[0102] In this embodiment of the application, selecting the node with the highest similarity as the location result can improve the accuracy of subsequent attack chain analysis and reduce the possibility of misjudgment.

[0103] In one embodiment, a sorting algorithm can be used to sort the matching nodes in descending order of similarity. After sorting, the node ranked first is selected as the location result.

[0104] Step S2124: If no network asset node matching the key field is found, a new network asset node is created in the knowledge graph and added to the candidate attack link set.

[0105] In this embodiment, when no matching network asset node is found, it indicates that the knowledge graph may be missing information about that node. Creating a new network asset node can supplement the content of the knowledge graph, making it more complete. Adding the new node to the candidate attack link set can take into account potential new attack paths.

[0106] In this embodiment of the application, creating new nodes and adding them to the candidate attack link set can expand the coverage of attack paths and improve the accuracy of attack surface prediction.

[0107] In one embodiment, key fields related to the characteristics of unmatched network assets, such as device type, software version, and configuration parameters, are first extracted from a standardized dataset. Then, new network asset nodes are generated based on these key fields, each node is assigned a unique identifier, and relevant attribute information is added. Finally, the new nodes are added to the candidate attack link set.

[0108] In one embodiment, step S2124 can be implemented as follows:

[0109] A1: Extract key fields related to the characteristics of unmatched network assets from the standardized dataset. These key fields include device type, software version, and configuration parameters.

[0110] In this embodiment, the standardized dataset is a preprocessed collection of data containing information on network assets, vulnerabilities, and threat intelligence. When no node matching the characteristics of a network asset is found in the knowledge graph, relevant key fields can be extracted from the standardized dataset to obtain detailed information about the unmatched network asset.

[0111] From a technical perspective, accurately extracting key fields ensures that newly created network asset nodes have accurate attribute information, providing a more reliable foundation for subsequent attack chain analysis.

[0112] In one embodiment, key fields related to the characteristics of unmatched network assets can be extracted from a standardized dataset based on predefined field mapping relationships. For example, the field names of device type, software version, and configuration parameters in the dataset can be determined through a data dictionary, and then the extraction operation can be performed.

[0113] A2: Generate a new network asset node based on the key fields. The new node contains a unique device identifier and hardware and software attribute information related to the device.

[0114] In this embodiment, generating new network asset nodes based on extracted key fields is intended to supplement missing network asset information in the knowledge graph. Unique device identifiers are used to distinguish different network asset nodes, while hardware and software attribute information details the characteristics of the network asset.

[0115] In this embodiment of the application, generating new network asset nodes can improve the content of the knowledge graph, making it more comprehensively reflect the actual situation of the network and helping to discover more potential attack paths.

[0116] In one embodiment, a hash algorithm can be used to generate a unique device identifier for the new node. Based on information such as device type, software version, and configuration parameters in the key fields, corresponding hardware and software attribute information is added to the new node. For example, if the device type is a server, hardware attributes such as server model and processor information are added, as well as software attributes such as operating system version and installed applications.

[0117] A3: Perform correlation analysis between the new node and the existing vulnerability nodes and threat intelligence nodes in the knowledge graph to determine its potential contribution to the attack chain.

[0118] In this embodiment, correlation analysis is the process of connecting and analyzing newly created network asset nodes with existing vulnerability nodes and threat intelligence nodes in the knowledge graph. Potential attack link contribution refers to the degree of influence a new node has on a possible attack link. By performing correlation analysis and determining the contribution, the importance of the new node in the attack link can be assessed.

[0119] In this embodiment of the application, determining the potential attack link contribution of a new node can help cybersecurity personnel better understand the impact of the new node on cybersecurity and take targeted preventive measures.

[0120] In one embodiment, the correlation between a new node and its associated vulnerable nodes and threat intelligence nodes can be calculated based on their attribute information. Let the correlation between the new node and the vulnerable node be Rv, and the correlation between the new node and the threat intelligence node be Rt. The potential attack link contribution C can be expressed as: C = α×Rv + β×Rt, where α and β are pre-set weighting coefficients, adjusted according to actual conditions to reflect the importance of different correlation degrees.

[0121] A4: Based on the contribution of the potential attack links, calculate the influence weight value of the new node on the candidate attack link set.

[0122] In this embodiment, the influence weight value is an indicator that measures the magnitude of a new node's influence on the candidate attack link set. Calculating the influence weight value based on the potential contribution to the attack link allows for the quantification of the new node's importance in the attack link analysis.

[0123] In this embodiment of the application, calculating the influence weight value can provide a basis for subsequent attack link screening and ranking, making the analysis results more accurate and targeted.

[0124] In one embodiment, a linear weighting method is used to calculate the influence weight value. Let the contribution of a potential attack link be C, and the influence weight value W can be expressed as: W = k × C, where k is a weight coefficient that is adjusted according to the network's security policy and actual situation. For example, for networks with high security requirements, the value of k can be appropriately increased to enhance the influence weight of new nodes.

[0125] A5: Add the new node and its influence weight value to the candidate attack link set to expand the coverage of attack paths and improve the accuracy of prediction results.

[0126] In this embodiment, adding new nodes and their influence weight values ​​to the candidate attack path set can take into account the new attack paths that new nodes may bring. Expanding the coverage of attack paths can more comprehensively discover potential attack risks, and improving the accuracy of prediction results can provide a more reliable basis for network security protection decisions.

[0127] In this embodiment of the application, by adding new nodes and their influence weight values, the set of candidate attack links can be made more complete, providing network security personnel with more comprehensive information and helping them to better prevent network attacks.

[0128] In one embodiment, a new node and its influence weight value are added as a new element to the candidate attack link set. During subsequent analysis, the new node is processed accordingly based on its influence weight value, such as considering its weight during sorting and filtering.

[0129] Step S213: Locate the threat intelligence node in the knowledge graph based on the threat intelligence features in the feature vector, wherein the threat intelligence features include attack patterns and attack tools.

[0130] In this embodiment, threat intelligence features are key information for locating threat intelligence nodes. Attack patterns describe the attack methods and strategies employed by the attacker, while attack tools are the software or tools used by the attacker to carry out the attack. Using these features, threat intelligence nodes related to the current attack features can be found in the knowledge graph.

[0131] In this embodiment, locating threat intelligence nodes can help understand external attack trends and methods. By combining network asset nodes and vulnerability nodes, it is possible to analyze potential attack chains more comprehensively.

[0132] In one embodiment, text matching can be used for localization. Attack patterns and tool information from the feature vector are matched with the attributes of threat intelligence nodes in the knowledge graph to identify nodes with high matching degrees. Semantic analysis techniques can be combined to improve the accuracy of the matching.

[0133] Step S214: Combine the network asset nodes, vulnerability nodes and threat intelligence nodes according to preset association rules to generate a candidate attack link set. The association rules are constructed based on historical attack event statistics.

[0134] In this embodiment, the preset association rules are the relationships between nodes summarized from historical attack event statistics. By combining the located network asset nodes, vulnerability nodes, and threat intelligence nodes according to these rules, possible attack chains can be generated.

[0135] In this embodiment of the application, generating a set of candidate attack links can provide a basis for subsequent analysis, help discover potential attack paths, and take preventive measures in advance.

[0136] In one embodiment, association rules can be represented as connection conditions between nodes. For example, if historical data shows that a vulnerability is frequently used in conjunction with a certain attack pattern to attack specific types of network assets, then when combining nodes, the corresponding vulnerability nodes, threat intelligence nodes, and network asset nodes are connected to form an attack chain. All node combinations that conform to the association rules are added to the candidate attack chain set.

[0137] Step S22: For each attack link in the candidate attack link set, calculate its attack success rate and attack cost. The attack success rate is determined based on the vulnerability exploitation difficulty and threat intelligence matching degree, and the attack cost is determined based on resource consumption and time cost.

[0138] In this embodiment, the attack success rate reflects the likelihood that an attacker will successfully launch an attack using the attack chain. Vulnerability exploitation difficulty refers to the ease or difficulty of exploiting a vulnerability. For example, some vulnerabilities require specific technical means or conditions to be exploited, making them more difficult to exploit. Threat intelligence matching degree refers to the degree of matching between the attack patterns and tools in the attack chain and external threat intelligence data. The higher the matching degree, the higher the attack success rate is likely to be. Attack cost is the cost incurred by the attacker in carrying out the attack. Resource consumption includes the computing resources and network bandwidth required by the attacker, while time cost is the time required to complete the attack.

[0139] In this embodiment, calculating the attack success rate and attack cost quantifies the feasibility and cost of each attack chain. Analysis of these two metrics allows for the assessment of attack chain priorities, providing a basis for subsequent ranking and selection.

[0140] In one embodiment, the attack success rate can be calculated by assigning weights to the vulnerability exploitation difficulty and threat intelligence matching degree, and then performing a weighted sum. For example, the weight of vulnerability exploitation difficulty is 0.6, and the weight of threat intelligence matching degree is 0.4. The attack success rate is obtained by adding the scores of the two according to their weights. The attack cost can be estimated based on historical data on resource consumption and time cost. For example, based on the computing resources and time required for similar attacks in the past, combined with the characteristics of the current attack chain, the resource consumption and time cost of this attack can be estimated, and the attack cost is obtained by adding the two together.

[0141] Step S23: Sort the attack links in the candidate attack link set according to the attack success rate and attack cost, and generate a priority attack link list.

[0142] In this embodiment, the purpose of sorting is to prioritize candidate attack links based on attack success rate and attack cost. Attack links with high success rate and low cost have higher priority because these links are more likely to be used by attackers, and the cost to attackers is lower. Generating a priority list of attack links through sorting allows cybersecurity personnel to quickly understand which attack links require the most attention.

[0143] In this embodiment of the application, generating a priority attack chain list helps network security personnel to allocate resources reasonably, prioritize the handling of higher priority attack chains, and improve the efficiency of network security protection.

[0144] In one embodiment, weights can be assigned to attack success rate and attack cost respectively, and a comprehensive score can be calculated for each attack link. For example, the weight of attack success rate is 0.7, and the weight of attack cost is 0.3. The comprehensive score is obtained by multiplying the attack success rate score by 0.7 and adding the attack cost score multiplied by 0.3. Then, the attack links are sorted in descending order according to the comprehensive score, with higher scores ranked first, generating a preliminary sorted list. Next, the attack links in the preliminary sorted list are filtered, and attack links that do not meet security constraints are removed, such as attack path length exceeding the limit or node access permissions not meeting the requirements. Finally, the filtered attack links are reordered to generate a final priority attack link list.

[0145] In one embodiment, reference Figure 6 Step S23 may include S231-S234, which will be described in detail below:

[0146] Step S231: Assign a weight value to each attack link in the candidate attack link set. The weight value is calculated by weighted summation of attack success rate and attack cost.

[0147] In this embodiment, attack success rate and attack cost are indicators for evaluating the feasibility and cost of an attack chain. By assigning weight values ​​to each attack chain through a weighted summation, the impact of these two factors on the attack chain can be comprehensively considered. Attack success rate reflects the probability of the attack chain being successfully implemented, while attack cost reflects the cost incurred by the attacker in carrying out the attack.

[0148] In this embodiment of the application, assigning weight values ​​to the attack chain can quantitatively evaluate the attack chain, which facilitates subsequent sorting and filtering operations and makes the analysis results more objective and accurate.

[0149] In one embodiment, let the attack success rate be P and the attack cost be C. The weight value W can be expressed as: W = λ×P + μ×C, where λ and μ are pre-set weight coefficients that are adjusted according to the network's security policy and actual situation. For example, for networks with high security requirements, the value of λ can be increased to focus more on the attack success rate; for networks with limited resources, the value of μ can be increased to focus more on the attack cost. For example, the weight coefficient for the attack success rate is 0.7, and the weight coefficient for the attack cost is 0.3. The attack success rate of each attack link is multiplied by 0.7, and the attack cost is multiplied by 0.3. Then, the two are added together to obtain the weight value of that attack link.

[0150] Step S232: Sort the attack links in the candidate attack link set in descending order according to the weight values ​​to generate a preliminary sorting list.

[0151] In this embodiment, descending order sorting arranges the attack chains in descending order of their weight values. Attack chains with higher weight values ​​have higher overall evaluation priority and are more likely to be used by attackers. Generating a preliminary sorted list allows cybersecurity personnel to quickly understand the priority order of the attack chains.

[0152] In this embodiment of the application, generating a preliminary sorting list can provide a basis for subsequent filtering and adjustment, enabling cybersecurity personnel to focus on the most threatening attack chains.

[0153] In one embodiment, a quicksort algorithm can be used to sort the attack links in the candidate attack link set in descending order according to their weight values. After sorting, a preliminary sorted list is obtained.

[0154] Step S233: Filter the attack links in the preliminary sorting list and remove attack links that do not meet the security constraints, including attack path length restrictions and node access permission restrictions.

[0155] In this embodiment, the security constraints are designed to ensure that the selected attack paths conform to the network's security policies and actual conditions. The attack path length limit means that the number of nodes in the attack path cannot exceed a certain threshold; excessively long attack paths may be impractical or difficult to implement. The node access permission limit means that nodes in the attack path must have the appropriate access permissions; otherwise, the attack cannot proceed.

[0156] In this embodiment of the application, filtering attack links that do not meet security constraints can improve the effectiveness of attack link analysis, avoid analyzing unrealistic attack paths, and save analysis resources.

[0157] In one embodiment, each attack path in the initial sorting list is traversed to check whether it meets the security constraints. Let the attack path length be L, and the node access permission satisfaction status be A (1 for satisfaction, 0 for non-satisfaction). If L > a preset length threshold or A = 0, then the attack path is removed from the list.

[0158] Step S234: Reorder the filtered attack links to generate the final priority attack link list.

[0159] In this embodiment, the re-sorting involves re-sorting the remaining attack links after filtering out those that do not meet security constraints. Generating a final priority list of attack links provides cybersecurity personnel with the most accurate and valuable attack link information, enabling them to formulate more precise cybersecurity defense strategies.

[0160] In this embodiment, the final priority attack chain list focuses on attack paths that meet security constraints and have a high overall priority. This helps cybersecurity personnel concentrate their efforts on preventing and handling these high-risk attack chains, thereby improving the efficiency and targeting of cybersecurity protection.

[0161] In one embodiment, a sorting algorithm (such as merge sort) is used again to sort the filtered attack links in descending order according to their weight values. After sorting, a final priority attack link list is formed, in which the attack links are arranged from high to low priority, making it convenient for network security personnel to process them sequentially according to priority.

[0162] Step S24: Select an attack link that meets the preset conditions from the priority attack link list and output it as the reasoning analysis result. The preset conditions include an attack success rate greater than a first threshold and an attack cost less than a second threshold.

[0163] In this embodiment, the preset conditions are used to further filter out the most threatening attack links. The first threshold and the second threshold are set according to the network's security policy and actual situation. An attack success rate greater than the first threshold means that the attack link is highly likely to be used by the attacker, and an attack cost less than the second threshold means that the cost required for the attacker to carry out the attack is low. By filtering attack links that meet the preset conditions, the most dangerous attack paths can be focused on.

[0164] In this embodiment, attack chains that meet preset conditions are output as inference analysis results, providing cybersecurity personnel with clear defense targets. Cybersecurity personnel can then take corresponding protective measures against these attack chains to reduce the risk of network attacks.

[0165] In one embodiment, the priority attack chain list is traversed. For each attack chain, its attack success rate is checked to see if it is greater than a first threshold and its attack cost is less than a second threshold. If the conditions are met, the attack chain is added to the inference analysis results. Finally, the inference analysis results are output in a clear format, such as a list, for easy viewing and processing by cybersecurity personnel.

[0166] In one embodiment, reference Figure 7 The method of this application, after generating a priority attack chain list based on the attack success rate and attack cost in step S24, may further include:

[0167] Step S26: For each attack link, calculate its attack path complexity score, which is determined by the number of nodes, node types, and complexity of relationships between nodes in the attack path.

[0168] In this embodiment, the attack path complexity score is a quantitative assessment of the complexity of the attack chain. The number of nodes reflects the length of the attack path; the more nodes, the more complex the attack path may be. Node types include network asset nodes, vulnerability nodes, and threat intelligence nodes, etc. Different types of node combinations increase the complexity of the attack path. The complexity of the relationships between nodes reflects the dependencies and interactions between nodes; complex relationships make the attack path more difficult to predict and prevent.

[0169] In this embodiment of the application, calculating the complexity score of the attack path can help cybersecurity personnel further understand the characteristics of the attack chain and pay more attention to and prevent attack chains with higher complexity.

[0170] In one embodiment, different weighting coefficients can be set for the number of nodes, node types, and the complexity of relationships between nodes. In one embodiment, let the number of nodes be N, the node type complexity score be T, and the relationship complexity score be R. The complexity score S can be expressed as: S = γ×N + δ×T + ε×R, where γ, δ, and ε are pre-set weighting coefficients that can be adjusted according to the actual situation to reflect the degree of influence of different factors on the complexity score.

[0171] For example, the weighting coefficient for the number of nodes is 0.3, the weighting coefficient for the node type is 0.3, and the weighting coefficient for the complexity of the relationships between nodes is 0.4. The number of nodes, the diversity of node types, and the complexity of the relationships between nodes are each quantified and scored. Then, each score is multiplied by its corresponding weighting coefficient and summed to obtain the attack path complexity score.

[0172] In one embodiment, reference Figure 8 Step S26 may include steps S261-S265, which will be described in detail below:

[0173] Step S261: Determine the number of nodes in the attack path, including the total number of network asset nodes, vulnerability nodes, and threat intelligence nodes.

[0174] In this embodiment, the number of nodes in the attack path is a fundamental indicator of the attack path's complexity. Network asset nodes represent actual devices and resources in the network, vulnerability nodes reflect existing security risks, and threat intelligence nodes contain external attack information. The number of nodes directly reflects the length and scope of the attack path.

[0175] In this embodiment, determining the number of nodes provides foundational data for subsequently calculating the complexity score of the attack path. A larger number of nodes may result in a more complex attack path, requiring more resources and effort to defend against.

[0176] In one embodiment, the total number of nodes can be obtained by traversing all nodes in the attack path, counting the number of network asset nodes, vulnerability nodes, and threat intelligence nodes respectively, and then adding them together.

[0177] Step S262: Assign a complexity weight value to each node according to the node type. The complexity weight value is determined based on the risk level of the node type and the tightness of the association relationship.

[0178] In this embodiment, different types of nodes have different risk levels and relationships. For example, important network asset nodes such as core servers have higher risk levels, and they may be associated with more vulnerability nodes and threat intelligence nodes, thus having a greater impact on the attack path; while some ordinary terminal device nodes have relatively lower risk levels. Assigning a complexity weight value to each node according to its type can more accurately reflect the importance of the node in the attack path.

[0179] In this embodiment of the application, the reasonable allocation of complexity weight values ​​can make the attack path complexity score more accurate, which helps network security personnel to better assess the risk of attack paths.

[0180] In one embodiment, risk level assessment and correlation analysis are first performed on different types of nodes. Nodes with high risk levels and strong correlations are assigned higher complexity weight values; nodes with low risk levels and weak correlations are assigned lower complexity weight values. For example, if a node's risk level score is Rr and its correlation strength score is Rc, the complexity weight value Wn of that node can be expressed as: Wn = κ×Rr + λ×Rc, where κ and λ are pre-set weight coefficients, and their values ​​are adjusted according to the actual situation to highlight the importance of different factors.

[0181] For example, the complexity weight value of the core server node can be set to 0.8, and the complexity weight value of the ordinary terminal device node can be set to 0.2.

[0182] Step S263: Calculate the weighted sum of the complexity weights of all nodes in the attack path to obtain a preliminary complexity score.

[0183] In this embodiment, by calculating the weighted sum of the complexity weights of all nodes, the contribution of each node to the attack path can be comprehensively considered, resulting in a preliminary complexity score. This score reflects the overall complexity of the nodes in the attack path.

[0184] In this embodiment of the application, the preliminary complexity score can serve as a preliminary measure of the complexity of the attack path, providing a basis for subsequent adjustments.

[0185] In one embodiment, the complexity weight of each node in the attack path is multiplied by the number of that node (if there are multiple nodes of the same type), and then all results are summed to obtain a preliminary complexity score. For example, if there are n nodes in the attack path and the complexity weight of the i-th node is Wn_i, the preliminary complexity score Sp can be expressed as: Sp = Σ(Wn_i) (i from 1 to n).

[0186] Step S264: Adjust the preliminary complexity score according to the complexity of the relationships between nodes, which is determined by the dependencies and interaction frequency between nodes.

[0187] In this embodiment, the complexity of relationships between nodes is a crucial factor influencing the complexity of the attack path. Node dependencies indicate the degree to which the state of one node affects other nodes, while interaction frequency reflects the frequency of information transmission and interaction between nodes. By adjusting the initial complexity score based on the complexity of relationships between nodes, the actual complexity of the attack path can be assessed more accurately.

[0188] In this embodiment of the application, adjusting the initial complexity score can make the complexity score of the attack path more consistent with the actual situation, providing network security personnel with a more accurate basis for decision-making.

[0189] In one embodiment, dependency relationships and interaction frequency data among all nodes in the attack path are first extracted from the knowledge graph. Then, the complexity coefficient of the relationships between nodes is calculated based on this data, and the complexity coefficient is multiplied by the initial complexity score to obtain the adjusted complexity score. For example, in one embodiment, if the complexity coefficient of the relationships between nodes is Cr, the adjusted complexity score Sa can be expressed as: Sa = Sp × Cr, where Cr is determined by the frequency distribution of the dependency depth and interaction frequency among the nodes.

[0190] In one embodiment, step S264: adjusting the preliminary complexity score based on the complexity of the relationships between nodes may specifically include:

[0191] B1: Extract the dependency relationships and interaction frequency data between all nodes in the attack path from the knowledge graph.

[0192] In this embodiment, the knowledge graph stores the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes, including dependencies and interaction frequencies. Extracting this data from the knowledge graph provides a comprehensive understanding of the interactions between nodes in the attack path. Dependencies reflect the impact of a node's state on other nodes, and interaction frequencies reflect the frequency of information transfer and interaction between nodes.

[0193] In this embodiment, the extraction of dependency and interaction frequency data provides basic data for calculating the complexity coefficient of relationships between nodes, which helps to more accurately assess the complexity of attack paths.

[0194] In one embodiment, a graph query language (such as Cypher) can be used to query the dependency relationships and interaction frequency data between all nodes in the attack path from the knowledge graph. Based on the identifiers of the nodes in the attack path, relevant nodes are located in the knowledge graph, and the dependency relationships and interaction frequency information represented by the edges between them are extracted.

[0195] B2: Calculate the complexity coefficient of the relationship between nodes based on the dependency relationship and interaction frequency data. The complexity coefficient is determined by the depth of the dependency relationship and the frequency distribution of the interaction frequency.

[0196] In this embodiment, the depth of dependency describes the hierarchy and complexity of dependencies between nodes, while the frequency distribution of interaction reflects the regularity and frequency of interactions between nodes. By comprehensively considering these two factors, a complexity coefficient of the relationships between nodes can be calculated, which can more accurately measure the complexity of the relationships between nodes.

[0197] In this embodiment of the application, calculating the complexity coefficient can provide an accurate basis for adjusting the initial complexity score, making the complexity score of the attack path more consistent with the actual situation.

[0198] In one embodiment, different weighting coefficients can be assigned to the depth of dependencies and the frequency distribution of interactions. Assuming, in one embodiment, the dependency depth score is Dd, the interaction frequency distribution score is If, and the complexity coefficient Cr of the inter-node relationship can be expressed as: Cr = η×Dd + θ×If, where η and θ are pre-set weighting coefficients, adjusted according to actual conditions to reflect the importance of different factors. For example, the weighting coefficient for dependency depth is 0.6, and the weighting coefficient for interaction frequency distribution is 0.4. The dependency depth and interaction frequency distribution are quantified and scored, and then the scores of each part are multiplied by their corresponding weighting coefficients and summed to obtain the complexity coefficient of the inter-node relationship.

[0199] B3: Multiply the complexity coefficient by the initial complexity score to obtain the adjusted complexity score.

[0200] In this embodiment, multiplying the complexity coefficient by the initial complexity score incorporates the complexity of inter-node relationships into the attack path complexity assessment. The adjusted complexity score comprehensively considers the number of nodes, node types, and the complexity of inter-node relationships in the attack path, more accurately reflecting the actual complexity of the attack path.

[0201] In this embodiment of the application, the adjusted complexity score can provide cybersecurity personnel with more accurate attack path complexity information, which helps them to formulate more reasonable cybersecurity defense strategies.

[0202] In one embodiment, the calculated complexity coefficient is directly multiplied by the initial complexity score to obtain the adjusted complexity score, which is then used as the new complexity score for the attack path in subsequent analysis.

[0203] Step S265: Use the adjusted complexity score as the final complexity score of the attack path.

[0204] In this embodiment, the adjusted complexity score comprehensively considers the number of nodes, node types, and the complexity of relationships between nodes in the attack path, thus more accurately reflecting the actual complexity of the attack path. Using this score as the final complexity score can provide cybersecurity personnel with a reliable evaluation metric.

[0205] In this embodiment, the final complexity score can help cybersecurity personnel accurately assess the risks of attack paths, take targeted preventative measures, and improve the effectiveness of cybersecurity protection.

[0206] In one embodiment, the adjusted complexity score is directly used as the final complexity score of the attack path and recorded for subsequent sorting and analysis.

[0207] Step S27: Sort the attack links in the priority attack link list a second time according to the complexity score to generate an adjusted attack link list.

[0208] In this embodiment, the secondary sorting is based on the priority attack link list, and the attack links are reordered according to the complexity score of the attack path. The resulting adjusted attack link list prioritizes more complex attack links, allowing cybersecurity personnel to address these complex attack paths first.

[0209] In this embodiment, the adjusted attack chain list can help network security personnel allocate resources reasonably, prioritize defense against complex and high-priority attack chains, and improve the effectiveness of network security protection.

[0210] In one embodiment, a sorting algorithm (such as heap sort) is used to sort the attack links in the priority attack link list in descending order according to their complexity scores. After sorting, an adjusted attack link list is obtained.

[0211] Step S28: Select attack links that meet preset security constraints from the adjusted attack link list. The security constraints include the shortest path limit for the attack path and the minimum permission requirements for node access.

[0212] In this embodiment, the preset security constraints are to ensure that the selected attack links conform to the network's security policies and actual conditions. The shortest path limit for the attack path means that the length of the attack link cannot be too short, as an excessively short attack path may not conform to the actual attack logic; the minimum permission requirement for node access means that nodes in the attack link must have certain access permissions, otherwise the attack cannot proceed normally.

[0213] In this embodiment of the application, screening attack links that meet security constraints can further improve the effectiveness of attack link analysis, eliminate attack paths that do not meet the requirements, and enable network security personnel to focus on truly threatening attack links.

[0214] In one embodiment, each attack link in the adjusted attack link list is traversed, and each link is checked to see if it meets preset security constraints. If the attack path length is less than the shortest path limit or the node access permission is lower than the minimum permission requirement, the attack link is removed from the list.

[0215] Step S29: Reorder the filtered attack links to generate the final attack link list.

[0216] In this embodiment, the re-sorting involves re-sorting the remaining attack links after filtering out those that do not meet the security constraints. Generating a final attack link list provides cybersecurity personnel with the most accurate and valuable attack link information, enabling them to formulate more precise cybersecurity defense strategies.

[0217] In this embodiment, the final attack chain list focuses on attack paths that meet security constraints and have high complexity and priority. This helps cybersecurity personnel concentrate their efforts on preventing and handling these high-risk attack chains, thereby improving the efficiency and targeting of cybersecurity protection.

[0218] In one embodiment, a sorting algorithm (such as insertion sort) is used again to comprehensively sort the filtered attack chains according to their complexity score and priority. After sorting, a final attack chain list is formed, in which the attack chains are arranged from high to low according to the comprehensive evaluation priority, so that network security personnel can handle them in order of priority.

[0219] In summary, the intelligent network attack surface prediction method based on deep learning provided in this application, at the data processing level, ensures the comprehensiveness, accuracy, and consistency of the data by acquiring network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment and preprocessing them to generate a standardized dataset. This provides high-quality data for subsequent deep learning models, enabling the models to more effectively learn and mine the potential information in the data, thereby improving the ability to extract network attack features.

[0220] In attack chain analysis and prediction, deep learning models are used to extract feature vectors, and combined with knowledge graphs for reasoning analysis of potential attack chains, enabling accurate identification of intrusion paths that attackers may exploit. Through comprehensive evaluation and analysis of multiple factors such as attack success rate, attack cost, and attack path complexity, accurate attack surface prediction results are generated. This helps cybersecurity personnel understand network security risks in advance, develop targeted prevention strategies, rationally allocate security resources, improve network security and resilience, and effectively respond to increasingly complex and ever-changing network attack threats.

[0221] Accordingly, to better implement the above methods, embodiments of this application also provide an intelligent network attack surface prediction system based on deep learning. For example... Figure 9 As shown, the intelligent network attack surface prediction system 80 based on deep learning includes:

[0222] The acquisition module 801 is used to acquire network asset information, vulnerability distribution information and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version and configuration parameters. The vulnerability distribution information includes known vulnerability number, scope of impact and remediation status. The external threat intelligence data includes attack mode, attack tools and attacker behavior records.

[0223] The preprocessing module 802 is used to preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized dataset.

[0224] The feature extraction module 803 is used to input the standardized dataset into a pre-trained deep learning model and extract feature vectors related to network attacks from the dataset. The deep learning model is a multi-layer neural network structure.

[0225] The reasoning analysis module 804 is used to perform reasoning analysis on potential attack links based on the feature vector and knowledge graph to obtain reasoning analysis results, wherein the knowledge graph contains the association relationship between network asset nodes, vulnerability nodes and threat intelligence nodes;

[0226] The prediction module 805 is used to evaluate the intrusion paths that the attacker may use based on the reasoning analysis results, and output the attack surface prediction results. The attack surface prediction results are presented in the form of an attack path list, which includes specific information about the starting node, intermediate nodes and target node for each attack path.

[0227] The implementation details of each module are provided in the preceding method embodiments and will not be repeated here. The technical effects achieved by each module and device are described in the foregoing method embodiments.

[0228] like Figure 10 As shown, this application embodiment also provides a computer device 90, which includes a processor 901 and a memory 902, wherein the memory 902 stores a computer program, and when the computer program is executed by the processor 901, the processor 901 performs the steps of any of the methods described above.

[0229] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or otherwise.

[0230] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application are still within the scope of this application.

Claims

1. A deep learning-based intelligent network attack surface prediction method, characterized in that, Includes the following steps: The system acquires network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version, and configuration parameters. The vulnerability distribution information includes known vulnerability numbers, impact scope, and remediation status. The external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. The network asset information, vulnerability distribution information, and external threat intelligence data are preprocessed to generate a standardized dataset; The standardized dataset is input into a pre-trained deep learning model to extract feature vectors related to network attacks from the dataset. The deep learning model is a multi-layer neural network structure. Based on the feature vectors and knowledge graph, potential attack chains are analyzed and reasoned to obtain the reasoning results. The knowledge graph contains the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes. The reasoning analysis of potential attack chains includes extracting network asset nodes, vulnerability nodes, and threat intelligence nodes matching the feature vectors from the knowledge graph to generate a candidate attack chain set. For each attack chain in the candidate attack chain set, its attack success rate and attack cost are calculated. The attack success rate is determined based on vulnerability exploitation difficulty and threat intelligence matching degree, and the attack cost is determined based on resource consumption and time cost. The attack chains in the candidate attack chain set are sorted according to the attack success rate and attack cost to generate a priority attack chain list. Attack chains that meet preset conditions are selected from the priority attack chain list as the reasoning analysis results output. The preset conditions include an attack success rate greater than a first threshold and an attack cost less than a second threshold. Based on the reasoning and analysis results, the possible intrusion paths that attackers may use are evaluated, and the attack surface prediction results are output. The attack surface prediction results are presented in the form of an attack path list, which includes specific information about the starting node, intermediate nodes and target node for each attack path.

2. The method according to claim 1, characterized in that, The step of extracting network asset nodes, vulnerability nodes, and threat intelligence nodes that match the feature vector from the knowledge graph to generate a candidate attack link set includes: Based on the network asset features in the feature vector, the network asset nodes in the knowledge graph are located, and the network asset features include device identifiers and configuration parameters. Based on the vulnerability features in the feature vector, the vulnerability nodes in the knowledge graph are located, where the vulnerability features include the vulnerability number and the scope of impact. Based on the threat intelligence features in the feature vector, the threat intelligence nodes in the knowledge graph are located, and the threat intelligence features include attack patterns and attack tools. The network asset nodes, vulnerability nodes, and threat intelligence nodes are combined according to preset association rules to generate a set of candidate attack links. The association rules are constructed based on historical attack event statistics.

3. The method according to claim 2, characterized in that, The step of locating network asset nodes in the knowledge graph based on the network asset features in the feature vector includes: Key fields for network asset characteristics are extracted from the feature vector, including device type, software version, and configuration parameters; Query the network asset nodes in the knowledge graph that match the key field. If there are multiple matching nodes, calculate the similarity between each matching node and the key field. The matching nodes are sorted according to the similarity, and the network asset node with the highest similarity is selected as the location result. If no network asset node matching the key field is found, a new network asset node is created in the knowledge graph and added to the candidate attack link set.

4. The method according to claim 3, characterized in that, The step of creating new network asset nodes in the knowledge graph and adding them to the candidate attack link set includes: Extract key fields related to the characteristics of unmatched network assets from a standardized dataset. These key fields include device type, software version, and configuration parameters. New network asset nodes are generated based on the key fields. The new nodes contain a unique device identifier and hardware and software attribute information related to the device. The new node is correlated with existing vulnerability nodes and threat intelligence nodes in the knowledge graph to determine its potential contribution to the attack chain. Based on the contribution of the potential attack links, calculate the influence weight value of the new node on the candidate attack link set; The new node and its influence weight value are added to the candidate attack link set.

5. The method according to claim 1, characterized in that, The step of sorting the attack links in the candidate attack link set according to the attack success rate and attack cost to generate a priority attack link list includes: A weight value is assigned to each attack link in the candidate attack link set, and the weight value is calculated by weighted sum of attack success rate and attack cost; The attack links in the candidate attack link set are sorted in descending order according to the weight values ​​to generate a preliminary sorting list; The attack links in the preliminary sorting list are filtered out, and attack links that do not meet the security constraints are removed. The security constraints include attack path length limits and node access permission limits. The filtered attack chains are reordered to generate a final priority attack chain list.

6. The method according to any one of claims 1 to 5, characterized in that, After generating a priority attack chain list based on the attack success rate and attack cost, the method further includes: For each attack chain, a complexity score is calculated for its attack path. The complexity score is determined by the number of nodes, node types, and complexity of relationships between nodes in the attack path. The attack links in the priority attack link list are sorted a second time according to the complexity score to generate an adjusted attack link list. The attack links that meet the preset security constraints are selected from the adjusted attack link list. The security constraints include the shortest path limit for the attack path and the minimum permission requirements for node access. The filtered attack chains are reordered to generate the final list of attack chains.

7. The method according to claim 6, characterized in that, Calculating the complexity score of an attack path includes the following steps: Determine the number of nodes in the attack path, including the total number of network asset nodes, vulnerability nodes, and threat intelligence nodes; Each node is assigned a complexity weight value based on its type, and the complexity weight value is determined based on the risk level of the node type and the tightness of the association relationship. Calculate the weighted sum of the complexity weights of all nodes in the attack path to obtain a preliminary complexity score; The initial complexity score is adjusted based on the complexity of the relationships between nodes, which is determined by the dependencies and interaction frequency between nodes. The adjusted complexity score will be used as the final complexity score for the attack path.

8. The method according to claim 7, characterized in that, The adjustment of the initial complexity score based on the complexity of the relationships between nodes includes: Extract the dependency relationships and interaction frequency data between all nodes in the attack path from the knowledge graph; Based on the dependency and interaction frequency data, the complexity coefficient of the relationship between nodes is calculated. The complexity coefficient is determined by the depth of the dependency and the frequency distribution of the interaction. The adjusted complexity score is obtained by multiplying the complexity coefficient by the initial complexity score.

9. A deep learning-based intelligent network attack surface prediction system, characterized in that, The system includes: The acquisition module is used to acquire network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version, and configuration parameters. The vulnerability distribution information includes known vulnerability numbers, impact scope, and remediation status. The external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. The preprocessing module is used to preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized dataset. The feature extraction module is used to input the standardized dataset into a pre-trained deep learning model and extract feature vectors related to network attacks from the dataset. The deep learning model is a multi-layer neural network structure. The reasoning and analysis module is used to perform reasoning and analysis on potential attack links based on the feature vectors and knowledge graph, and obtain reasoning and analysis results. The knowledge graph contains the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes. The reasoning and analysis of potential attack links based on the feature vectors and knowledge graph includes extracting network asset nodes, vulnerability nodes, and threat intelligence nodes that match the feature vectors from the knowledge graph to generate a candidate attack link set. For each attack link in the candidate attack link set, the module calculates its attack success rate and attack cost. The attack success rate is determined based on vulnerability exploitation difficulty and threat intelligence matching degree, and the attack cost is determined based on resource consumption and time cost. The module sorts the attack links in the candidate attack link set according to the attack success rate and attack cost to generate a priority attack link list. The module selects attack links that meet preset conditions from the priority attack link list as the reasoning and analysis results output. The preset conditions include an attack success rate greater than a first threshold and an attack cost less than a second threshold. The prediction module is used to assess the intrusion paths that attackers may use based on the reasoning analysis results, and output attack surface prediction results. The attack surface prediction results are presented in the form of an attack path list, which includes specific information about the starting node, intermediate nodes and target node for each attack path.

Images