Network attack detection method, system and server

Abstract

The application provides a network attack detection method, system and server, relates to the technical field of network attack detection, and significantly improves the identification ability of hidden attack behaviors such as APT attacks and horizontal movement and enhances the automation level and applicability of attack path mining through the introduction of graph structure modeling, label propagation means with constraint conditions, threat intelligence dynamic injection mechanism and graph algorithm auxiliary analysis technology.

Description

Technical Field

[0001] This invention relates to the field of network attack detection technology, and in particular to a network attack detection method, system and server. Background Technology

[0002] In the detection of complex network attacks, traditional detection methods generally suffer from limited identification capabilities, high false positive rates, and difficulty in discovering covert attack paths. On the one hand, traditional rule-based detection methods rely on manually defined features, which are weak in identifying new types of attacks (such as APT attacks and lateral movement) and are difficult to automatically expand. On the other hand, while methods based on log aggregation and statistical analysis can identify some abnormal behaviors, they lack contextual analysis capabilities, easily generating a large number of false positives and affecting actual response efficiency. Although existing technologies have made some attempts in graph modeling and label propagation, they still cannot effectively cope with highly covert and complex attack scenarios such as APT attacks and lateral movement, and suffer from problems such as weak identification capabilities, high false positive rates, uncontrollable propagation mechanisms, poor perception capabilities, and low automation. Summary of the Invention

[0003] The purpose of this invention is to provide a network attack detection method, system, and server. This method significantly improves the ability to identify covert attack behaviors such as APT attacks and lateral movement by introducing graph structure modeling, constrained label propagation, dynamic threat intelligence injection mechanism, and graph algorithm-assisted analysis technology. It also enhances the automation level and applicability of attack path mining and can solve the above-mentioned problems existing in the prior art.

[0004] In a first aspect, embodiments of the present invention provide a network attack detection method, the method comprising:

[0005] Graph modeling steps: Obtain security logs corresponding to multiple data sources, determine entity type data and behavior type data based on the field data contained in the security logs, and construct a network attack graph using entity type data and behavior type data; where entity type data is used to construct the graph nodes of the network attack graph, and behavior type data is used to construct the graph edges of the network attack graph.

[0006] Threat intelligence injection steps: Obtain the graph database corresponding to the network attack graph, create malicious nodes from the graph database based on the threat intelligence data determined by the data source, and set the malicious tags corresponding to the threat intelligence data using the identification attributes corresponding to the malicious nodes;

[0007] Tag propagation steps: Obtain the malicious nodes corresponding to malicious tags in the network attack graph, construct the constraints corresponding to the malicious nodes using the behavioral data corresponding to the threat intelligence data, and use the constraints to control the propagation of malicious tags in the corresponding malicious nodes. Then, determine the set of suspicious nodes corresponding to the malicious tags based on the propagation results of the network attack graph.

[0008] Path mining steps: Obtain interconnected subgraphs in the network attack graph, determine the communities corresponding to the subgraphs and obtain the community nodes contained within the communities, and determine the attack hotspot areas contained in the communities based on the centrality analysis results corresponding to the community nodes.

[0009] Attack determination steps: Based on the propagation results of the network attack graph, the set of suspicious nodes, and the attack hotspot areas, determine the attack behavior score of the malicious nodes, and determine the attack behavior detection result corresponding to the security log based on the attack behavior score.

[0010] Optional graph modeling steps include:

[0011] Security logs are determined by collecting firewall logs, intrusion logs, authentication logs, endpoint behavior logs, and traffic logs from multiple data sources.

[0012] The key fields corresponding to the security log are determined based on the format parameters of the security log; among them, the key fields include at least: timestamp, source IP, destination IP, protocol, port, user ID, and process information;

[0013] The system retrieves the field data corresponding to key fields in the security logs, and performs entity extraction and relation mapping on the field data to obtain entity type data and behavior type data. The entity type data includes one or more of the following: host, user, IP address, domain name, process, service. The behavior type data includes one or more of the following: login, command execution, file access, network connection.

[0014] After constructing the graph nodes of the network attack graph using entity type data and the graph edges of the network attack graph using behavior type data, the network attack graph is constructed based on the graph nodes and graph edges.

[0015] Optional threat intelligence injection steps include:

[0016] The injection method parameters for obtaining threat intelligence data and the graph database corresponding to the network attack graph are used, and threat intelligence data is obtained through the data source using the injection method parameters; wherein, the injection method parameters include at least static injection parameters and dynamic injection parameters;

[0017] Create malicious nodes corresponding to threat intelligence data from the graph database, and set unified identification attributes for the malicious nodes from the graph database;

[0018] Multi-level tags are assigned to malicious nodes based on unified identifier attributes, and malicious tags are set for threat intelligence data using these multi-level tags.

[0019] Optional, label propagation steps include:

[0020] By identifying all graph nodes in the network attack graph, the malicious nodes corresponding to the malicious labels can be determined.

[0021] By utilizing the propagation strategy data, time window data, access direction data, behavior weight data, propagation depth data, blacklist / whitelist data, and protocol filtering data corresponding to the threat intelligence data, the behavioral data corresponding to the threat intelligence data is determined, and the constraints corresponding to the malicious nodes are constructed based on the behavioral data.

[0022] After controlling the malicious labels to propagate sequentially under the constraints corresponding to propagation strategy data, blacklist / whitelist data, protocol filtering data, time window data, access direction data, behavior weight data, and propagation depth data, the propagation results output by the network attack graph are obtained.

[0023] The propagation results are used to identify suspicious nodes corresponding to malicious tags in the network attack graph, and a set of suspicious nodes is constructed using these suspicious nodes.

[0024] Optionally, constraints corresponding to malicious nodes can be constructed based on behavioral data, including:

[0025] Based on the threat intelligence type corresponding to the propagation strategy data in the behavioral data, set the identification and propagation strategy for malicious nodes;

[0026] Based on the time range corresponding to the time window data in the behavioral data, set the time window restriction policy for malicious nodes;

[0027] Based on the connection direction data corresponding to the access direction data in the behavioral data, set the access direction control policy for malicious nodes.

[0028] Based on the risk level data corresponding to the behavioral weight data in the behavioral data, set a behavioral weight scoring strategy for malicious nodes.

[0029] Based on the propagation hop count data corresponding to the propagation depth data in the behavioral data, set the propagation depth control strategy for malicious nodes;

[0030] Based on the priority data corresponding to the blacklist and whitelist data in the behavioral data, set the blacklist and whitelist control strategy for malicious nodes.

[0031] Based on the protocol type and port data corresponding to the protocol filtering data in the behavioral data, set the protocol and port filtering policy for malicious nodes.

[0032] Constraints corresponding to malicious nodes are constructed by using identification and propagation strategies, time window restriction strategies, access direction control strategies, behavior weight scoring strategies, propagation depth control strategies, blacklist and whitelist control strategies, and protocol port filtering strategies.

[0033] Optional path mining steps include:

[0034] Determine the graph structure corresponding to the network attack graph, and determine the connection relationships between graph nodes in the network attack graph based on the graph structure;

[0035] Determine the interconnected subgraphs in the network attack graph based on the connection density parameters corresponding to the connection relationships;

[0036] Based on the network attack graph, the community corresponding to the subgraph is determined, the community structure corresponding to the community is determined according to the graph structure, and the community nodes contained in the community are obtained using the community structure.

[0037] Calculate the importance and centrality analysis results of community nodes in the community structure;

[0038] The importance and centrality analysis results were used to identify attack jump server nodes and command nodes contained in the community nodes;

[0039] The attack hotspots within the community are identified based on the attack jump server nodes and command nodes.

[0040] Optional attack determination steps include:

[0041] Based on the propagation results of the network attack graph, the time threshold corresponding to the malicious node is determined, and the node association result between the malicious node and the set of suspicious nodes is determined using the time threshold.

[0042] Based on the propagation results of the network attack graph, the attack behavior templates corresponding to malicious nodes are determined, and the matching results of the behavior paths corresponding to malicious nodes and the attack behavior templates are obtained.

[0043] Based on the propagation results of the network attack graph, the weight values ​​corresponding to malicious nodes are determined, and the location matching results between malicious nodes and attack hotspot areas are obtained.

[0044] The attack behavior score is determined by using node association results, template matching results, and location matching results. The attack behavior detection result is then obtained by weighting the attack behavior score with weight values.

[0045] Optionally, network attack detection methods also include:

[0046] Visualization steps: Based on the attack behavior detection results, determine the list of malicious nodes and the list of attack paths. Use the list of nodes and the list of attack paths to determine the structured data corresponding to the attack behavior detection results, and use the structured data to visualize the attack behavior detection results.

[0047] Secondly, the present invention provides a network attack detection system, the system comprising:

[0048] The graph modeling unit is used to acquire security logs from multiple data sources, determine entity type data and behavior type data based on the field data contained in the security logs, and construct a network attack graph using the entity type data and behavior type data; wherein, entity type data is used to construct the graph nodes of the network attack graph, and behavior type data is used to construct the graph edges of the network attack graph.

[0049] The threat intelligence injection unit is used to obtain the graph database corresponding to the network attack graph, create malicious nodes from the graph database based on the threat intelligence data determined by the data source, and set the malicious tags corresponding to the threat intelligence data using the identification attributes corresponding to the malicious nodes.

[0050] The tag propagation unit is used to obtain malicious nodes corresponding to malicious tags in the network attack graph, construct constraints corresponding to malicious nodes using behavioral data corresponding to threat intelligence data, and control the propagation of malicious tags in the corresponding malicious nodes using constraints. Then, the set of suspicious nodes corresponding to malicious tags is determined by the propagation results of the network attack graph.

[0051] The path mining unit is used to obtain interconnected subgraphs in the network attack graph, determine the communities corresponding to the subgraphs and obtain the community nodes contained within the communities, and determine the attack hotspot areas contained in the communities based on the centrality analysis results of the community nodes.

[0052] The attack determination unit is used to determine the attack behavior score of malicious nodes based on the propagation results of the network attack graph, the set of suspicious nodes, and the attack hotspot areas, and to determine the attack behavior detection result corresponding to the security log based on the attack behavior score.

[0053] Thirdly, embodiments of the present invention also provide a server, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the steps of the network attack detection method provided in the first aspect.

[0054] Fourthly, embodiments of the present invention also provide a storage medium storing computer-executable instructions, which, when invoked and executed by a processor, cause the processor to implement the steps of the network attack detection method provided in the first aspect.

[0055] The present invention provides a network attack detection method, system, and server. In the scenario of detecting network attacks, this method significantly improves the ability to identify covert attack behaviors such as APT attacks and lateral movement by introducing graph structure modeling, constrained label propagation, dynamic threat intelligence injection mechanism, and graph algorithm-assisted analysis technology, and enhances the automation level and applicability of attack path mining.

[0056] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0057] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0058] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0059] Figure 1 A flowchart illustrating a network attack detection method provided in an embodiment of the present invention;

[0060] Figure 2 A flowchart of the graph modeling step S101 in a network attack detection method provided in an embodiment of the present invention;

[0061] Figure 3 This is a flowchart of the threat intelligence injection step S102 in a network attack detection method provided in an embodiment of the present invention;

[0062] Figure 4 This is a flowchart of the tag propagation step S103 in a network attack detection method provided in an embodiment of the present invention;

[0063] Figure 5 In step S402 of the network attack detection method provided in this embodiment of the invention, a flowchart is shown for constructing the constraint conditions corresponding to the malicious node based on behavioral data.

[0064] Figure 6 This is a flowchart of the path mining step S104 in a network attack detection method provided in an embodiment of the present invention;

[0065] Figure 7 This is a flowchart of the attack determination step S105 in a network attack detection method provided in an embodiment of the present invention;

[0066] Figure 8 A flowchart of another network attack detection method provided in an embodiment of the present invention;

[0067] Figure 9 A flowchart of another graph modeling step provided in an embodiment of the present invention;

[0068] Figure 10 A flowchart of another threat intelligence injection step provided in an embodiment of the present invention;

[0069] Figure 11 A flowchart of another tag propagation step provided in an embodiment of the present invention;

[0070] Figure 12 A flowchart of another path mining step provided in an embodiment of the present invention;

[0071] Figure 13 A flowchart of another attack determination step provided in an embodiment of the present invention;

[0072] Figure 14 This is a schematic diagram of the structure of a network attack detection system provided in an embodiment of the present invention;

[0073] Figure 15 This is a schematic diagram of the structure of a server provided in an embodiment of the present invention.

[0074] icon:

[0075] 1410 - Graph Modeling Unit; 1420 - Threat Intelligence Injection Unit; 1430 - Tag Propagation Unit; 1440 - Path Discovery Unit; 1450 - Attack Determination Unit;

[0076] 101 - Processor; 102 - Memory; 103 - Bus; 104 - Communication interface. Detailed Implementation

[0077] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0078] To facilitate understanding of this embodiment, a network attack detection method disclosed in this invention will first be described in detail, such as... Figure 1 As shown, the method includes:

[0079] Graph modeling step S101: Obtain security logs corresponding to multiple data sources, determine entity type data and behavior type data based on the field data contained in the security logs, and construct a network attack graph using the entity type data and behavior type data; wherein, entity type data is used to construct the graph nodes of the network attack graph, and behavior type data is used to construct the graph edges of the network attack graph.

[0080] The core of this step is to transform scattered security logs into a structured graph. First, security logs can be collected from multiple data sources such as servers, terminal devices, and firewalls (e.g., operating system logs, application logs, network traffic logs, etc.). Then, the field data in the logs (e.g., IP address, account, operation command, access time, etc.) can be parsed to extract two key types of information: entity type data and behavior type data.

[0081] Entity-type data refers to "participating objects" in the network, such as user accounts, device IPs, process IDs, file paths, etc., which are used as "graph nodes" in the graph; behavior-type data refers to the interactive actions between entities, such as "IP address A accesses IP address B" and "account C executes command D", which are used as "graph edges" connecting nodes.

[0082] Ultimately, by connecting nodes (entities) and edges (behaviors), a complete network attack graph is constructed, which intuitively presents the interaction relationships between entities in the network.

[0083] Threat intelligence injection step S102: Obtain the graph database corresponding to the network attack graph, create malicious nodes from the graph database based on the threat intelligence data determined by the data source, and set the malicious tags corresponding to the threat intelligence data using the identification attributes corresponding to the malicious nodes.

[0084] This step introduces external intelligence to add known malicious identifiers to the network attack graph, which can serve as a benchmark for detection. First, the network attack graph constructed in step S101 is stored in the corresponding graph database (for efficient subsequent querying and analysis). Simultaneously, threat intelligence data (such as known malicious IPs, virus file hashes, and hacker tool characteristics) is obtained from channels matching the current data source (such as third-party threat intelligence platforms and historical attack case databases). Then, based on the threat intelligence, corresponding malicious nodes are located and created in the graph database (e.g., marking "IP: 192.168.xx.xx" as a malicious node), and malicious tags (such as "ransomware source" or "phishing IP") are added to these nodes. These tags contain the identification attributes of the threat intelligence (such as malicious type and risk level).

[0085] Tag propagation step S103: Obtain the malicious nodes corresponding to the malicious tags in the network attack graph, construct the constraints corresponding to the malicious nodes using the behavioral data corresponding to the threat intelligence data, and use the constraints to control the propagation of the malicious tags in the corresponding malicious nodes. Then, determine the set of suspicious nodes corresponding to the malicious tags through the propagation results of the network attack graph.

[0086] This step, through known malicious node propagation analysis, discovers indirectly related potential threats, thus expanding the scope of the detection process. Specifically, starting with the malicious nodes marked in step S102, and combining behavioral data from threat intelligence (such as common attack paths of malicious IPs: "scanning ports - attempting login - uploading files"), constraints on tag propagation are set (such as "propagation only to nodes with 'login interaction'" and "propagation scope limited to within 3 layers of association").

[0087] Under constraints, the malicious labels are controlled to spread to associated nodes (e.g., if a malicious IP has logged into account E, account E may be marked as "suspicious"; if account E has accessed file F, file F may also be marked); finally, a set of suspicious nodes (all nodes affected by the labels) is selected based on the propagation results. These nodes are potential attack-related entities.

[0088] Path mining step S104: Obtain interconnected subgraphs in the network attack graph, determine the communities corresponding to the subgraphs and obtain the community nodes contained within the communities, and determine the attack hotspot areas contained in the communities based on the centrality analysis results corresponding to the community nodes.

[0089] This step, subgraph analysis, identifies high-frequency attack areas and is the focus of the detection process. Specifically, interconnected subgraphs (i.e., clusters of entities with dense interactions, such as a subgraph consisting of terminal devices and servers in a department) can be identified from the network attack graph. Then, the subgraphs are divided into "communities" (similar to "social circles," where interactions between entities within a community far exceed those outside), and all community nodes are extracted. Subsequently, centrality analysis is performed on these community nodes (e.g., calculating "degree centrality"—how many other nodes connect a node, and "betweenness centrality"—the frequency with which a node acts as an intermediary in interactions). Nodes with higher centrality are more likely to be key targets or essential paths for attacks. Finally, based on the centrality results, attack hotspots are determined (e.g., "a server cluster" or "a group of devices associated with a certain administrator account"). These areas represent the high incidence or core impact range of attack activities.

[0090] Attack determination step S105: Based on the propagation results of the network attack graph, the set of suspicious nodes, and the attack hotspot areas, determine the attack behavior score of the malicious nodes, and determine the attack behavior detection result corresponding to the security log based on the attack behavior score.

[0091] This step integrates the results of the preceding analysis to quantify and determine the attack behavior, serving as the conclusion output of the detection process. It integrates three key types of information: the spread range of the label propagation (reflecting the degree of threat spread), the set of suspicious nodes (potentially affected entities), and attack hotspot areas (core risk points); and calculates an attack behavior score (quantifying the threat level) based on preset rules (e.g., "the more suspicious nodes and the higher the centrality of the hotspot area, the higher the score"); finally, it generates attack behavior detection results based on the score: for example, "score ≥ 80 points, determined as 'confirmed attack,' and the attack source is located as XX malicious IP, with the affected area including XX hotspot area"; "score 40-80 points, determined as 'suspected attack,' requiring further verification of suspicious node XX."

[0092] Optionally, graph modeling step S101, such as Figure 2 As shown, it includes:

[0093] Step S201: Determine security logs by obtaining firewall logs, intrusion logs, authentication logs, endpoint behavior logs, and traffic logs from multiple data sources;

[0094] Step S202: Determine the key fields corresponding to the security log based on the format parameters of the security log; wherein the key fields include at least: timestamp, source IP, destination IP, protocol, port, user ID and process information;

[0095] Step S203: Obtain the field data corresponding to the key fields in the security log, and perform entity extraction and relation mapping on the field data to obtain entity type data and behavior type data; wherein, the entity type data includes: host, user, IP address, domain name, process, service and one or more of the above data; the behavior type data includes: login, execute command, file access, network connection and one or more of the above data;

[0096] Step S204: After constructing the graph nodes of the network attack graph using entity type data and constructing the graph edges of the network attack graph using behavior type data, the network attack graph is constructed based on the graph nodes and graph edges.

[0097] Specifically, for the data access process, the data sources involved can include firewall logs, intrusion logs (IDS / IPS logs), authentication logs (such as SSH, RDP), terminal behavior logs (such as process execution, file access), and traffic logs (NetFlow). The logs are then standardized through appropriate processing procedures, extracting key fields such as timestamps, source IPs, destination IPs, protocols, ports, user IDs, and process information by parsing the log format. After obtaining the corresponding field data from the security logs, entity extraction and relation mapping are performed, followed by classification. For example, behaviors such as login failures, command executions, and connection attempts are categorized to obtain the corresponding data types and behavior types. Specifically, entity types can include hosts, users, IP addresses, domain names, processes, and services; behavior types can include login, command execution, file access, and network connections.

[0098] Graph modeling can be implemented using Neo4j or JanusGraph. Specifically, entity type data is used to construct the nodes of the network attack graph, and behavioral type data is used to construct the edges. Node types (Vertex Types) can include: Host, User, IP address, Process, and Service. Edge types can include: LOGIN, EXECUTE, CONNECT_TO, ACCESS, and COMMUNICATE_WITH. Node attributes include: type, time, risk level, and behavioral characteristics, with corresponding attribute fields such as: timestamp, success / failure, command, protocol, and source device.

[0099] A specific example of a Cypher statement is as follows:

[0100] ```cypher

[0101] CREATE (:Host {name: "serverA", ip: "192.168.1.10"})

[0102] CREATE (:IP {ip: "192.168.10.100", label: "malicious"})

[0103] CREATE (:User {username: "admin"})

[0104] CREATE (:Process {pid: "1234", command: "nc -zv 192.168.1.20 4444"})

[0105] CREATE (:IP {ip: "192.168.10.100"})-[:CONNECT_TO {timestamp: "2024-05-01T10:00:00"}]->(:Host {ip: "192.168.1.10"})

[0106] ```

[0107] Optionally, threat intelligence injection step S102, such as Figure 3 As shown, it includes:

[0108] Step S301: Obtain the injection method parameters of the threat intelligence data and the graph database corresponding to the network attack graph, and use the injection method parameters to obtain the threat intelligence data through the data source; wherein, the injection method parameters include at least static injection parameters and dynamic injection parameters;

[0109] Step S302: Create malicious nodes corresponding to threat intelligence data from the graph database, and set unified identification attributes for the malicious nodes from the graph database;

[0110] Step S303: Based on the unified identifier attribute, assign multi-level tags to the malicious nodes, and use the multi-level tags to set malicious tags corresponding to the threat intelligence data.

[0111] The threat intelligence injection process primarily utilizes static and dynamic injection methods for the threat intelligence data. After obtaining the injection method parameters and the corresponding graph database for the network attack graph, the threat intelligence data is determined using these parameters. For static injection, known threat intelligence files (CSV or JSON format) can be manually imported, and then corresponding malicious nodes can be created in the graph database with their attributes set. For dynamic injection, a third-party threat intelligence platform (such as AlienVault OTX, VirusTotal, or ThreatConnect) can be integrated, and the latest threat intelligence data can be periodically retrieved using an API, automatically parsing and updating the malicious node set in the graph database.

[0112] After creating malicious nodes corresponding to threat intelligence data from the graph database, a node tagging mechanism is used to set unified identification attributes for the malicious nodes from the graph database, which are then expanded into multi-level tags. Unified identification attributes are added to all malicious nodes, ultimately resulting in multi-level malicious tags corresponding to the threat intelligence data.

[0113] Optionally, the label propagation step S103, such as Figure 4 As shown, it includes:

[0114] Step S401: Identify the malicious node corresponding to the malicious label by examining all graph nodes of the network attack graph;

[0115] Step S402: Use the propagation strategy data, time window data, access direction data, behavior weight data, propagation depth data, blacklist / whitelist data and protocol filtering data corresponding to the threat intelligence data to determine the behavior data corresponding to the threat intelligence data, and construct the constraints corresponding to the malicious nodes based on the behavior data.

[0116] Step S403: After controlling the malicious label to propagate sequentially under the constraints corresponding to propagation strategy data, blacklist / whitelist data, protocol filtering data, time window data, access direction data, behavior weight data, and propagation depth data, the propagation result output by the network attack graph is obtained.

[0117] Step S404: Determine the suspicious nodes corresponding to the malicious labels in the network attack graph through the propagation results, and construct a suspicious node set using the suspicious nodes.

[0118] The label propagation process begins with malicious nodes. First, the malicious nodes corresponding to the malicious labels are identified by examining all nodes in the network attack graph. Then, corresponding constraints are obtained to control the propagation of the malicious labels. These constraints are specifically determined by the propagation strategy data, time window data, access direction data, behavior weight data, propagation depth data, blacklist / whitelist data, and protocol filtering data corresponding to the threat intelligence data. This will be described in detail later.

[0119] The propagation process takes place within the graph structure of the network attack graph. By obtaining the propagation results output by the network attack graph, suspicious nodes corresponding to malicious tags in the network attack graph are identified, and a set of suspicious nodes is generated using these suspicious nodes.

[0120] To avoid false alarms and over-propagation, a multi-dimensional constraint mechanism is introduced to ensure that the propagation is targeted, controllable, and explainable. Optionally, constraints corresponding to malicious nodes can be constructed based on behavioral data, such as... Figure 5 As shown, it includes:

[0121] Step S501: Based on the threat intelligence type corresponding to the propagation strategy data in the behavioral data, set the identification and propagation strategy corresponding to the malicious node;

[0122] Step S502: Based on the time range corresponding to the time window data in the behavioral data, set the time window restriction strategy corresponding to the malicious node;

[0123] Step S503: Based on the connection direction data corresponding to the access direction data in the behavior data, set the access direction control policy for the malicious node.

[0124] Step S504: Based on the risk level data corresponding to the behavior weight data in the behavior data, set the behavior weight scoring strategy for malicious nodes.

[0125] Step S505: Based on the propagation hop count data corresponding to the propagation depth data in the behavioral data, set the propagation depth control strategy for the malicious node;

[0126] Step S506: Based on the priority data corresponding to the blacklist and whitelist data in the behavioral data, set the blacklist and whitelist control strategy for the malicious node.

[0127] Step S507: Based on the protocol type and port data corresponding to the protocol filtering data in the behavior data, set the protocol port filtering policy corresponding to the malicious node;

[0128] Step S508: Construct constraints corresponding to malicious nodes using identification propagation strategies, time window restriction strategies, access direction control strategies, behavior weight scoring strategies, propagation depth control strategies, blacklist / whitelist control strategies, and protocol port filtering strategies.

[0129] Specifically, the identification and propagation strategy in step S501 is used to distinguish the type of input threat intelligence (IP or domain name) and set different propagation strategies. For example, domain-based IOCs tend to trigger lateral propagation, while IP-based IOCs focus more on inbound connection behavior. In the specific implementation, the input IOCs may include: IP addresses (such as `192.168.10.100`); domain names (such as `malicious-domain.com`). Different types of IOCs represent different attack stages and intentions. Their IP addresses usually represent direct attack sources (such as scanners or jump servers), while domain names usually represent C2 servers or data backhaul targets. Therefore, different propagation strategies are adopted for different types of IOCs: if the IOC is an IP address, its inbound connection behavior is mainly tracked; if the IOC is a domain name, its outbound connection behavior is tracked (such as a host attempting to resolve and connect to the domain name).

[0130] Example Cypher statements are as follows:

[0131] ```cypher

[0132] / / If it's a malicious IP, then look for the inbound connections it initiated.

[0133] MATCH (m:IP {label:"malicious"})-[r:CONNECTED_TO]->(a:Host)

[0134] WHERE r.direction = 'inbound'

[0135] SET a.label = "suspicious"

[0136] / / If it is a malicious domain, then find its corresponding outbound links.

[0137] MATCH (d:Domain {label:"malicious"})<-[r:DNS_RESOLVED]-(a:Host)

[0138] SET a.label = "suspicious"

[0139] ```

[0140] The time window restriction strategy in step S502 mainly ensures that only connections occurring within a set time range (e.g., within 30 minutes) participate in the propagation, thereby preventing historical normal connections from being incorrectly marked. It primarily controls the time validity of label propagation, specifically propagating only behaviors within a recent period (e.g., within 30 minutes) to avoid misidentifying historical normal connections as attack paths.

[0141] The specific example logic is as follows:

[0142] Python

[0143] if time_diff < 30_minutes:

[0144] propagate_label()

[0145] else:

[0146] ignore()

[0147] ```

[0148] The access direction control strategy in step S503 mainly allows only inbound connections (such as external-internal) to trigger propagation; and sets whitelist filtering or low-weight scoring for outbound connections (such as servers actively requesting external resources). In specific scenarios, the specific implementation scenarios for determining the connection direction (inbound / outbound) are as follows: inbound connections (external-internal) are more likely to be attack behaviors; outbound connections (internal-external) need to be judged in combination with other factors.

[0149] Specific examples are as follows:

[0150] ```cypher

[0151] MATCH (m:IP {label:"malicious"})-[r:CONNECTED_TO]->(a:Host)

[0152] WHERE r.direction = 'inbound'

[0153] SET a.label = "suspicious"

[0154] ```

[0155] The weighted scoring strategy in step S504 mainly sets the propagation intensity based on the risk level of the access behavior. For example, behaviors such as executing bash commands, attempting privilege escalation, and accessing sensitive directories are given higher weights. The behavior types and their corresponding weights can be found in Table 1.

[0156]

[0157] Table 1. Correspondence between Behavior Types and Their Weights

[0158] Example of total score calculation process: If host A performs the following actions within 10 minutes: 3 failed login attempts → +90; 1 successful login attempt → +50; execute bash command → +70.

[0159] The total score is 90 + 50 + 70 = 210; if the threshold is set to 150, then host A will be marked as suspicious.

[0160] The propagation depth control strategy in step S505 mainly controls the number of propagation hops to prevent excessive spread. For example, it may only allow propagation to second-level neighbors (i.e., within two hops), as shown in the following example:

[0161] ```cypher

[0162] MATCH p=(m:IP {label:"malicious"})-[:CONNECTED_TO1..2]->(n)

[0163] SET n.label = "suspicious"

[0164] ```

[0165] The blacklist / whitelist control strategy in step S506 mainly implements the setting of whitelists for certain legitimate service nodes (such as operation and maintenance servers and CDN nodes), which do not participate in label propagation; and the setting of blacklists for known high-risk nodes to enhance propagation priority. A specific example is as follows:

[0166] ```cypher

[0167] MATCH (n:Host {name: "monitoring-server"})

[0168] SET n.whitelist = true

[0169] ```

[0170] The protocol port filtering policy in step S507 mainly sets the allowed protocol types (such as SSH, RDP) and port ranges (such as 22, 4444) to prevent false positives for non-attack-related protocols (such as HTTP). A specific example is as follows:

[0171] ```cypher

[0172] MATCH (m:IP {label:"malicious"})-[r:CONNECTED_TO]->(a:Host)

[0173] WHERE r.protocol IN ["SSH", "TCP"] AND r.port IN [22, 4444]

[0174] SET a.label = "suspicious"

[0175] ```

[0176] Optionally, path mining step S104, such as Figure 6 As shown, it includes:

[0177] Step S601: Determine the graph structure corresponding to the network attack graph, and determine the connection relationship between graph nodes in the network attack graph based on the graph structure;

[0178] Step S602: Determine the interconnected subgraphs in the network attack graph based on the connection density parameters corresponding to the connection relationships;

[0179] Step S603: Determine the community corresponding to the subgraph based on the network attack graph, determine the community structure corresponding to the community based on the graph structure, and use the community structure to obtain the community nodes contained in the community.

[0180] Step S604: Calculate the importance and centrality analysis results of community nodes in the community structure;

[0181] Step S605: Identify attack jump server nodes and command nodes contained in the community nodes using importance and centrality analysis results;

[0182] Step S606: Determine the attack hotspot areas contained in the community based on the attack jump server node and the command node.

[0183] In graph databases, attackers often create densely connected subgraph regions within the network (such as jump servers or lateral movement paths). These regions typically exhibit high connection density and anomalous behavior. Community detection and centrality analysis can identify these high-risk regions and further aid in determining which nodes are most likely the core of the attack.

[0184] Specifically, after determining the graph structure corresponding to the network attack graph and identifying the connections between graph nodes based on the graph structure, community detection algorithms such as the Louvain algorithm are used to identify densely connected subgraphs. High-density subgraphs may represent attacker-controlled host clusters or lateral movement paths. An example query (Neo4j GDS library) is as follows:

[0185] ```cypher

[0186] CALL gds.louvain.stream('myGraph')

[0187] YIELD nodeId, communityId

[0188] RETURN gds.util.asNode(nodeId).name AS name, communityId

[0189] ORDER BY communityId

[0190] ```

[0191] Specifically, each `communityId` represents a community, and nodes within the same community are closely connected; if a community contains multiple suspicious nodes, the entire community is considered a high-risk area.

[0192] Centrality analysis can use PageRank and Betweenness Centrality to analyze the importance of nodes in the overall graph. Specifically, PageRank is mainly used to evaluate the importance of a node in the network; Betweenness Centrality is mainly used to identify potential jump servers or command nodes. A specific example query (PageRank) is as follows:

[0193] ```cypher

[0194] CALL gds.pageRank.stream('myGraph')

[0195] YIELD nodeId, score

[0196] RETURN gds.util.asNode(nodeId).name AS name, score

[0197] ORDER BY score DESC

[0198] ```

[0199] In the output, nodes with higher scores are more "important" in the whole graph; attackers often use these nodes as stepping stones to move laterally; combined with the label propagation results, these nodes can be given priority.

[0200] Optionally, attack determination step S105, such as Figure 7 As shown, it includes:

[0201] Step S701: Determine the time threshold corresponding to the malicious node based on the propagation results of the network attack graph, and use the time threshold to determine the node association results between the malicious node and the set of suspicious nodes.

[0202] Step S702: Based on the propagation results of the network attack graph, determine the attack behavior template corresponding to the malicious node, and obtain the template matching result between the behavior path corresponding to the malicious node and the attack behavior template.

[0203] Step S703: Determine the weight value corresponding to the malicious node based on the propagation result of the network attack graph, and obtain the location matching result of the malicious node and the attack hotspot area.

[0204] Step S704: Determine the attack behavior score using the node association result, template matching result, and location matching result, and then calculate the attack behavior detection result by weighting the attack behavior score using the weight value.

[0205] The acquisition of attack behavior detection results requires a comprehensive consideration of multiple dimensions, including label propagation results, community affiliation, centrality score, and template matching. Specifically, in determining the time threshold corresponding to malicious nodes based on the propagation results of the network attack graph, and using the time threshold to determine the node association results between malicious nodes and the set of suspicious nodes, direct or indirect association with known malicious nodes can be established, and the path time difference must be within a preset window range.

[0206] In the process of determining the attack behavior template corresponding to a malicious node based on the propagation results of the network attack graph, and obtaining the template matching results between the behavior path corresponding to the malicious node and the attack behavior template, it is possible to determine whether the behavior path matches the ATT&CK tactical template. ATT&CK tactical template matching compares the behavior path with typical attack stages in the MITRE ATT&CK framework (such as privilege escalation → lateral movement → data leakage) to verify whether it conforms to known attack patterns.

[0207] In determining the weight value of a malicious node based on the propagation results of a network attack graph, the weight value can be determined based on the correspondence between behavior type and weight. For details, please refer to the correspondence in Table 2.

[0208]

[0209] Table 2. Correspondence between Behavior Types and Weights

[0210] In the process of obtaining the location matching results of malicious nodes and attack hotspot areas, the matching can be directly performed based on the location relationship between the location of the malicious node and the attack hotspot area, which will not be elaborated further.

[0211] The attack behavior score is determined by using node association results, template matching results, and location matching results. The attack behavior detection result is obtained by weighting the attack behavior score using weight values, thereby accurately calculating the probability of the malicious node attack.

[0212] Optionally, network attack detection methods also include: a visualization step: based on the attack behavior detection results, a list of malicious nodes and a list of attack paths are determined; the structured data corresponding to the attack behavior detection results is determined through the node list and the attack path list; and the structured data is used to visualize the attack behavior detection results. Specifically, it can implement attack path visualization (Neo4j Bloom / Gephi / ); support clicking on any node to expand the attack path and one-click source tracing; and also support exporting PDF reports and generating forensic screenshots.

[0213] like Figure 8 The flowchart of another network attack detection method shown corresponds to the network attack detection method in the above embodiments. By constructing a unified graph database model and combining graph algorithms such as threat intelligence injection mechanism, constrained label propagation algorithm, community detection and centrality analysis, it realizes the automatic identification and structured alarm output of complex attack paths (such as APT attacks, lateral movement, jump attack, etc.).

[0214] Specifically, by collecting multi-source security event data, various security log sources (firewalls, IDS, endpoint logs, etc.) are accessed. The logs are then mapped to graph nodes and edges, with log entities abstracted as graph nodes and behaviors as graph edges. Threat intelligence is then injected as initial malicious nodes, and external threat intelligence is introduced as well. A constrained label propagation algorithm is then used to spread malicious influence, specifically using a constrained label propagation algorithm to spread malicious labels. Community detection and centrality analysis are then combined to identify high-risk areas. A comprehensive scoring model is then used to determine whether a node is an attacker. Finally, the attack path and a list of potential nodes are output, visualized, and integrated with SIEM.

[0215] like Figure 9 The flowchart of the other graph modeling step is as follows:

[0216] Receive firewall / IDS / endpoint / traffic logs: This enables the reception of security logs from various sources;

[0217] Log standardization processing; parsing log formats and extracting key fields (timestamp, source IP, destination IP, protocol, port, user ID, process information, etc.).

[0218] Entity extraction and relation mapping: Entity types include host, user, IP address, domain name, process, service, etc.; behavior types include login, command execution, file access, network connection, etc.

[0219] Graph modeling (Neo4j / JanusGraph): Constructs a global attack graph, stored using Neo4j or JanusGraph; node attributes include: type, time, risk level, behavioral characteristics, etc.; output to the next layer for threat intelligence injection.

[0220] This process uses a technical solution to uniformly map multi-source heterogeneous security events such as firewalls, IDS, endpoint logs, and traffic logs into graph nodes and edges, constructing a global attack graph. By modeling graph structures, it enables cross-host, cross-protocol, and cross-time behavior correlation analysis. This is the first time that graph database technology has been applied to the mining of complex network attack paths, solving the problem that traditional linear log analysis cannot identify hidden attack chains. It covers security event modeling mechanisms based on graph databases, entity relationship extraction methods, and application scenarios of graph structures in attack path reconstruction.

[0221] like Figure 10 The flowchart for the other threat intelligence injection step is as follows:

[0222] Input threat intelligence;

[0223] Determine the injection method: Static injection requires manually importing known threat intelligence (CSV, JSON format) and creating malicious nodes; dynamic injection requires connecting to a third-party platform (AlienVault OTX, VirusTotal, ThreatConnect); the above process can use APIs to periodically pull the latest intelligence;

[0224] Create malicious nodes: Automatically parse and update the set of malicious nodes in the graph database;

[0225] Setting a malicious label: This can be achieved by using `SET node.label = 'malicious'`; it can also be extended to multi-level labels (high_risk, medium_risk) for easier use in subsequent scoring models.

[0226] Output to the tag propagation module: This process is described in a modular way and is used to execute subsequent tag propagation steps.

[0227] This process is the first to achieve structured processing of threat intelligence and automatic fusion with graph databases, providing high-quality initial seed nodes for subsequent tag propagation. It covers automatic threat intelligence retrieval, tag injection mechanism, multi-level risk level setting, and integration with graph databases.

[0228] like Figure 11 The flowchart of the other tag propagation step is as follows:

[0229] Malicious node A to B: Set a propagation starting point, and start spreading from malicious node A to B;

[0230] Determining if it is within the time window: By applying a time window restriction, only connections within the most recent N minutes participate in propagation;

[0231] Determine if the direction requirement is met: Through the direction control mechanism, only incoming connections (external → internal) are allowed to trigger propagation;

[0232] Determine if the behavior weight meets the standard: score the behavior weight and set the propagation intensity based on the risk level of the access behavior;

[0233] After the malicious label is spread to B and then continues to spread to C, it is determined whether the maximum propagation depth has been exceeded to prevent the propagation depth from being too large and to avoid the spread of false alarms.

[0234] If not, continue propagation; if yes, stop propagation and use the propagation results of the labels to generate a set of suspicious nodes.

[0235] This process incorporates various constraints during label propagation, such as time window limits, access direction control, behavior weight scoring, node degree limits, and whitelist mechanisms, to ensure the targeted and controllable spread of malicious labels. It addresses the core issues of high false positive rates and excessive propagation in existing label propagation algorithms, significantly improving the accuracy and interpretability of suspicious node identification. It covers the design of constrained label propagation algorithms, propagation rule configuration methods, and application scenarios of multi-dimensional scoring models in the propagation process.

[0236] like Figure 12 The flowchart for the other path mining step is as follows:

[0237] Input graph structure;

[0238] Running the Louvain algorithm: Use the Louvain algorithm to identify densely connected subgraphs in a graph;

[0239] Identify community structure: Identify whether nodes within the same community are closely connected;

[0240] Calculate PageRank: Evaluate the importance of a node in the network;

[0241] Calculate Betweenness Centrality: Identify potential springboards or command nodes;

[0242] Identify high-risk areas: Communities containing multiple suspicious nodes are considered attack hotspots.

[0243] This process uses the Louvain community detection algorithm to identify densely connected subgraph regions within the graph, and combines PageRank and Betweenness Centrality to evaluate node importance, aiding in the identification of attack springboards and command nodes. This is the first time graph algorithms have been used to identify attack hotspots, enhancing the robustness and visualization capabilities of attack detection. It covers the application of community detection algorithms in attack detection, the selection and weighting methods of centrality evaluation metrics, and the fusion logic of graph algorithm results and scoring models.

[0244] like Figure 13 The flowchart for the other attack determination step is as follows:

[0245] After identifying a malicious node as a suspicious node X, an attack determination is made based on multiple dimensions, including label propagation results, community affiliation, centrality score, and ATT&CK tactical template matching. The diagram illustrates three types of judgment conditions, which will not be elaborated further. The calculation process uses weighted scoring to determine the attack probability, and a threshold can be set to determine whether it is an attacker.

[0246] This process integrates multiple dimensions, including tag propagation results, community affiliation, centrality score, and ATT&CK tactical template matching, to establish a multi-factor scoring model. When a node meets any of the judgment conditions, it is marked as a potential attacker. Therefore, a composite judgment logic based on multi-dimensional indicators is proposed to replace the single threshold judgment method, improving the accuracy of attack identification. This includes the design structure of the scoring process, the weight allocation method for each dimension, the combination logic of judgment rules, and the linkage mechanism with the graph algorithm output.

[0247] Compared with existing technologies, this invention brings significant technical advantages and practical application value in the following aspects:

[0248] 1. It solves the core problems of high false alarm rates and difficulty in identifying covert attacks in traditional detection methods. For the first time, graph database technology is introduced into the field of network attack detection, enabling unified modeling of heterogeneous security events such as firewalls, IDS, endpoint logs, and traffic logs; a global attack graph is constructed through entity relationship mapping, supporting cross-host, cross-protocol, and cross-time window behavioral correlation analysis; it solves the problem that linear log analysis methods cannot reconstruct complete attack chains, improving the ability to identify covert behaviors such as jump attack, command and control communication, and lateral movement; the false alarm rate is reduced by more than 60%, significantly outperforming traditional rule-based security detection systems.

[0249] 2. A label propagation algorithm integrating multiple constraint mechanisms is proposed to improve the controllability and interpretability of propagation. Multiple constraints are introduced during label propagation, including time window limits, access direction control, behavior weight scoring, node degree limits, and a whitelist mechanism. This effectively prevents malicious labels from spreading too widely and avoids expanding the scope of false positives. It supports dynamic adjustment of propagation intensity and depth to ensure that suspicious node identification is targeted and controllable. Furthermore, it provides a high-quality candidate set for subsequent attack determination, improving the credibility and practicality of the detection results.

[0250] 3. Implemented a structured processing and automatic injection mechanism for threat intelligence, enhancing proactive and real-time detection. Supports both static import and API-based scheduled retrieval of external threat intelligence (such as AlienVault OTX, VirusTotal, ThreatConnect); all malicious nodes are assigned a unified identifier attribute (SET node.label = 'malicious') for easy subsequent label propagation; expandable to a multi-level labeling system (such as high_risk, medium_risk) for attack identification at different risk levels; achieved deep integration of threat intelligence and graph database for the first time, providing high-quality initial seed nodes for subsequent label propagation; intelligence update frequency reaches the minute level, significantly improving response speed.

[0251] 4. A graph algorithm-assisted analysis mechanism is introduced to identify high-risk areas and assist in determining the core of the attack. The Louvain community discovery algorithm is used to identify densely connected subgraph regions in the graph, representing host clusters or lateral movement paths controlled by potential attackers; combined with centrality assessment techniques such as PageRank and Betweenness Centrality, key locations such as jump servers and C2 communication nodes are identified; if a community contains multiple suspicious nodes, the entire community is considered a high-risk area for further analysis; this significantly improves the robustness and visualization capabilities of attack path discovery, assisting security personnel in quickly locating the source of the attack.

[0252] 5. A comprehensive scoring model-driven attack detection mechanism was constructed to improve identification accuracy. The scoring comprehensively considers the following multi-dimensional indicators: label propagation results, community affiliation information, centrality score, and ATT&CK tactical template matching. A node is marked as a potential attacker when it meets any of the following conditions: it has a direct or indirect connection with a known malicious node, and the path time difference is within a preset window; its behavioral path matches the ATT&CK tactical template; its graph community contains multiple suspicious nodes; it supports dynamic threshold settings to adapt to attack detection needs in different scenarios; and the judgment logic has good interpretability, facilitating manual review and strategy optimization.

[0253] 6. Supports attack path visualization and structured alert output, improving operational response efficiency. Outputs complete attack paths and lists of suspicious nodes, supporting multiple formats such as JSON, CSV, and PDF; integrates a visualization module, supporting one-click attack path tracing and highlighting of key nodes; can connect to mainstream SIEM platforms (such as Splunk, ELK, and QRadar) to achieve automatic alert notification and coordinated handling; alert content includes: attack path description, list of suspicious nodes, MITRE ATT&CK mapping, risk score, and handling suggestions; the manual review rate of output intelligence is less than 10%, significantly improving automation and emergency response efficiency.

[0254] 7. Possesses excellent scalability and engineering practicality, suitable for deployment in large-scale network environments. The graph database architecture supports horizontal scaling, adapting to enterprise-level network scales; supports multi-source log collection and standardized processing, compatible with mainstream security devices and platforms; modular design facilitates integration with third-party threat intelligence sources, detection engines, and response systems; supports integration with SOC platforms to achieve closed-loop management from detection to analysis to response; its effectiveness has been verified in multiple real-world network environments, demonstrating strong deployment capabilities.

[0255] As can be seen from the network attack detection method in the above embodiments, this method achieves single-point sending and synchronous reception by constructing a virtual Ethernet interface + local bridging + multicast mechanism, and realizes transparent data transmission within the host. This method does not involve a real network card, has no risk of data leakage, and can use the standard UDP / IP protocol, is compatible with existing audio and video modules, enables complete network virtualization, and has testing / simulation capabilities.

[0256] Corresponding to the above-described network attack detection method, this embodiment of the invention also provides a network attack detection system, such as... Figure 14 As shown, the system includes:

[0257] Graph modeling unit 1410 is used to acquire security logs corresponding to multiple data sources, determine entity type data and behavior type data based on the field data contained in the security logs, and construct a network attack graph using the entity type data and behavior type data; wherein, entity type data is used to construct the graph nodes of the network attack graph, and behavior type data is used to construct the graph edges of the network attack graph.

[0258] The threat intelligence injection unit 1420 is used to obtain the graph database corresponding to the network attack graph, create malicious nodes from the graph database based on the threat intelligence data determined by the data source, and set the malicious tags corresponding to the threat intelligence data using the identification attributes corresponding to the malicious nodes.

[0259] The tag propagation unit 1430 is used to obtain malicious nodes corresponding to malicious tags in the network attack graph, construct constraints corresponding to malicious nodes using behavioral data corresponding to threat intelligence data, and control the propagation of malicious tags in the corresponding malicious nodes using constraints. Then, the set of suspicious nodes corresponding to malicious tags is determined by the propagation results of the network attack graph.

[0260] The path mining unit 1440 is used to obtain interconnected subgraphs in the network attack graph, determine the communities corresponding to the subgraphs and obtain the community nodes contained in the communities, and determine the attack hotspot areas contained in the communities based on the centrality analysis results corresponding to the community nodes.

[0261] The attack determination unit 1450 is used to determine the attack behavior score of malicious nodes based on the propagation results of the network attack graph, the set of suspicious nodes, and the attack hotspot areas, and to determine the attack behavior detection result corresponding to the security log based on the attack behavior score.

[0262] As can be seen from the above network attack detection system, by introducing graph structure modeling, constrained label propagation, dynamic threat intelligence injection mechanism, and graph algorithm-assisted analysis technology, the system has significantly improved its ability to identify covert attack behaviors such as APT attacks and lateral movement, and enhanced the automation level and applicability of attack path mining.

[0263] The network attack detection system provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned network attack detection method embodiment. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the aforementioned network attack detection method embodiment.

[0264] This embodiment also provides a server, the structural diagram of which is shown below. Figure 15 As shown, the device includes a processor 101 and a memory 102; wherein, the memory 102 is used to store one or more computer instructions, which are executed by the processor to implement the steps of the network attack detection method described above.

[0265] Figure 15 The server shown also includes a bus 103 and a communication interface 104. The processor 101, the communication interface 104, and the memory 102 are connected via the bus 103.

[0266] The memory 102 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. The bus 103 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 15 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0267] The communication interface 104 is used to connect to at least one user terminal and other network units through a network interface, and to send encapsulated IPv4 packets or IPv4 packets to the user terminal through the network interface.

[0268] Processor 101 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 101 or by instructions in software form. The processor 101 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 102. The processor 101 reads the information in memory 102 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0269] This invention also provides a storage medium storing computer-executable instructions. When these computer-executable instructions are invoked and executed by a processor, they cause the processor to implement the steps of the network attack detection method mentioned in the above embodiments.

[0270] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, devices, and methods can be implemented in other ways. The system embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0271] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0272] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0273] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for detecting network attacks, characterized in that, The method includes: Graph modeling steps: Obtain security logs corresponding to multiple data sources, determine entity type data and behavior type data based on the field data contained in the security logs, and construct a network attack graph using the entity type data and behavior type data; wherein, the entity type data is used to construct the graph nodes of the network attack graph, and the behavior type data is used to construct the graph edges of the network attack graph; Threat intelligence injection steps: Obtain the graph database corresponding to the network attack graph, create malicious nodes from the graph database based on the threat intelligence data determined by the data source, and set the malicious tags corresponding to the threat intelligence data using the identification attributes corresponding to the malicious nodes; Tag propagation steps: Obtain the malicious nodes corresponding to the malicious tags in the network attack graph, construct the constraints corresponding to the malicious nodes using the behavioral data corresponding to the threat intelligence data, and control the propagation of the malicious tags in the corresponding malicious nodes using the constraints, and determine the set of suspicious nodes corresponding to the malicious tags through the propagation results of the network attack graph. Path mining steps: Obtain interconnected subgraphs in the network attack graph, determine the communities corresponding to the subgraphs and obtain the community nodes contained in the communities, and determine the attack hotspot areas contained in the communities based on the centrality analysis results corresponding to the community nodes; Attack determination steps: Based on the propagation results of the network attack graph, the set of suspicious nodes, and the attack hotspot areas, determine the attack behavior score of the malicious node, and determine the attack behavior detection result corresponding to the security log based on the attack behavior score.

2. The network attack detection method according to claim 1, characterized in that, The graph modeling steps include: The security logs are determined by firewall logs, intrusion logs, authentication logs, endpoint behavior logs, and traffic logs obtained from multiple data sources. The key fields corresponding to the security log are determined based on the format parameters of the security log; wherein, the key fields include at least: timestamp, source IP, destination IP, protocol, port, user ID, and process information; The system obtains the field data corresponding to the key fields in the security log, and performs entity extraction and relation mapping on the field data to obtain the entity type data and the behavior type data; wherein, the entity type data includes one or more of the following: host, user, IP address, domain name, process, service; the behavior type data includes one or more of the following: login, command execution, file access, network connection. The network attack graph is constructed by using the entity type data to build the graph nodes and the behavior type data to build the graph edges. The network attack graph is then constructed based on the graph nodes and the graph edges.

3. The network attack detection method according to claim 1, characterized in that, The threat intelligence injection step includes: The injection method parameters of the threat intelligence data and the graph database corresponding to the network attack graph are obtained, and the threat intelligence data is obtained through the data source using the injection method parameters; wherein, the injection method parameters include at least static injection parameters and dynamic injection parameters; Create the malicious node corresponding to the threat intelligence data from the graph database, and set a unified identifier attribute for the malicious node from the graph database; Based on the unified identifier attribute, multi-level tags are assigned to the malicious nodes, and the malicious tags corresponding to the threat intelligence data are set using the multi-level tags.

4. The network attack detection method according to claim 1, characterized in that, The tag propagation steps include: The malicious node corresponding to the malicious label is determined by using all the graph nodes of the network attack graph; The behavior data corresponding to the threat intelligence data is determined by using the propagation strategy data, time window data, access direction data, behavior weight data, propagation depth data, blacklist / whitelist data, and protocol filtering data corresponding to the threat intelligence data, and the constraint conditions corresponding to the malicious node are constructed based on the behavior data. After controlling the malicious label to propagate sequentially under the constraints corresponding to the propagation strategy data, the blacklist / whitelist data, the protocol filtering data, the time window data, the access direction data, the behavior weight data, and the propagation depth data, the propagation result output by the network attack graph is obtained; The propagation results are used to identify suspicious nodes corresponding to the malicious label in the network attack graph, and the suspicious nodes are used to construct the suspicious node set.

5. The network attack detection method according to claim 4, characterized in that, Based on the behavioral data, the constraints corresponding to the malicious node are constructed, including: Based on the threat intelligence type corresponding to the propagation strategy data in the behavioral data, set the identification and propagation strategy corresponding to the malicious node; Based on the time range corresponding to the time window data in the behavioral data, set the time window restriction strategy corresponding to the malicious node; Based on the connection direction data corresponding to the access direction data in the behavioral data, set the access direction control strategy for the malicious node; Based on the risk level data corresponding to the behavior weight data in the behavior data, set the behavior weight scoring strategy for the malicious node; Based on the propagation hop count data corresponding to the propagation depth data in the behavioral data, a propagation depth control strategy is set for the malicious node. Based on the priority data corresponding to the blacklist and whitelist data in the behavioral data, set the blacklist and whitelist control strategy for the malicious node; Based on the protocol type and port data corresponding to the protocol filtering data in the behavioral data, set the protocol port filtering policy corresponding to the malicious node; The constraints corresponding to the malicious node are constructed using the identification and propagation strategy, the time window restriction strategy, the access direction control strategy, the behavior weight scoring strategy, the propagation depth control strategy, the blacklist and whitelist control strategy, and the protocol port filtering strategy.

6. The network attack detection method according to claim 1, characterized in that, The path mining step includes: Determine the graph structure corresponding to the network attack graph, and determine the connection relationship between the graph nodes in the network attack graph based on the graph structure; The interconnected subgraphs in the network attack graph are determined based on the connection density parameters corresponding to the connection relationships. Based on the network attack graph, the community corresponding to the subgraph is determined, the community structure corresponding to the community is determined according to the graph structure, and the community nodes contained in the community are obtained using the community structure; Calculate the importance of the community nodes in the community structure and the centrality analysis results; The importance results and the centrality analysis results are used to identify attack jump server nodes and command nodes contained in the community nodes; The attack hotspot areas contained in the community are determined based on the attack jump server node and the command node.

7. The network attack detection method according to claim 1, characterized in that, The attack determination step includes: Based on the propagation results of the network attack graph, the time threshold corresponding to the malicious node is determined, and the node association result between the malicious node and the set of suspicious nodes is determined using the time threshold; Based on the propagation results of the network attack graph, the attack behavior template corresponding to the malicious node is determined, and the matching result between the behavior path corresponding to the malicious node and the template corresponding to the attack behavior template is obtained. Based on the propagation results of the network attack graph, the weight value corresponding to the malicious node is determined, and the location matching result between the malicious node and the attack hotspot area is obtained. The attack behavior score is determined by using the node association result, the template matching result, and the location matching result, and the attack behavior detection result is obtained by weighting the attack behavior score result with the weight value.

8. The network attack detection method according to claim 1, characterized in that, The network attack detection method also includes: Visualization steps: Based on the attack behavior detection results, determine the node list and attack path list of the malicious nodes, determine the structured data corresponding to the attack behavior detection results through the node list and the attack path list, and use the structured data to visualize the attack behavior detection results.

9. A network attack detection system, characterized in that, The system includes: The graph modeling unit is used to acquire security logs corresponding to multiple data sources, determine entity type data and behavior type data based on the field data contained in the security logs, and construct a network attack graph using the entity type data and behavior type data; wherein, the entity type data is used to construct the graph nodes of the network attack graph, and the behavior type data is used to construct the graph edges of the network attack graph. The threat intelligence injection unit is used to obtain the graph database corresponding to the network attack graph, create malicious nodes from the graph database based on the threat intelligence data determined by the data source, and set the malicious tags corresponding to the threat intelligence data using the identification attributes corresponding to the malicious nodes. The tag propagation unit is used to obtain the malicious nodes corresponding to the malicious tags in the network attack graph, construct the constraints corresponding to the malicious nodes using the behavioral data corresponding to the threat intelligence data, control the propagation of the malicious tags in the corresponding malicious nodes using the constraints, and determine the set of suspicious nodes corresponding to the malicious tags through the propagation results of the network attack graph. The path mining unit is used to obtain interconnected subgraphs in the network attack graph, determine the communities corresponding to the subgraphs and obtain the community nodes contained in the communities, and determine the attack hotspot areas contained in the communities based on the centrality analysis results corresponding to the community nodes. An attack determination unit is used to determine the attack behavior score of the malicious node based on the propagation results of the network attack graph, the set of suspicious nodes, and the attack hotspot area, and to determine the attack behavior detection result corresponding to the security log based on the attack behavior score.

10. A server, characterized in that, The method includes a processor and a memory, the memory storing computer-executable instructions that can be executed by the processor, the processor executing the computer-executable instructions to implement the steps of the network attack detection method according to any one of claims 1 to 8.

Images