Network attack surface intelligent prediction method and system based on multi-source heterogeneous data fusion

Abstract

The invention relates to a network attack surface intelligent prediction method and system based on multi-source heterogeneous data fusion, and belongs to the technical field of network security and information, and the method comprises the steps: obtaining multi-source heterogeneous data, including a network flow log, host operation state data and external threat intelligence information; secondly, performing feature extraction on the data and mapping the data to a unified feature space; analyzing feature relevance and constructing a feature relevance matrix; calculating feature weight distribution values and selecting key features; inputting the key features into a machine learning model for prediction, and utilizing the machine learning model to predict the attack surface possibly faced by the target network system in the future; according to the scheme, multi-source heterogeneous data can be effectively fused, and the accuracy and comprehensiveness of network attack surface prediction are improved.

Description

Technical Field

[0001] The present application relates to the fields of network security and information technology, and in particular to a method and system for intelligently predicting network attack surfaces based on multi-source heterogeneous data fusion. Background Art

[0002] With the rapid development of information technology, networks have become a crucial support for social operations and business development. Network attack surface prediction, a specialized technology in the field of network security, aims to proactively identify potential attack risk points by analyzing network system data. This approach primarily relies on monitoring and analyzing various network data, applying specific algorithms and models to predict network areas and vulnerable links that may be vulnerable to attack. For example, traditional methods might perform a simple statistical analysis of network traffic to detect unusual traffic spikes or connection requests, thereby providing a preliminary assessment of potential attack risks.

[0003] To combat the threat of cyberattacks, some existing solutions utilize a multi-dimensional data collection approach. In addition to network traffic data, they also collect other data, such as CPU usage and memory usage, and analyze this data comprehensively to improve the accuracy of attack predictions. This approach provides a more comprehensive understanding of network system operations, a significant improvement over relying solely on network traffic analysis.

[0004] However, while existing solutions collect diverse data types, they don't fully leverage the advantages of this heterogeneous data source. The inherent correlations between different types of data prevent the full utilization of the data's overall value when predicting attack surfaces, hindering the accuracy and comprehensiveness of predictions. Summary of the Invention

[0005] The main purpose of this application is to provide a network attack surface intelligent prediction method based on multi-source heterogeneous data fusion, which can effectively fuse multi-source heterogeneous data and improve the accuracy and comprehensiveness of network attack surface prediction.

[0006] To achieve the above objectives, an embodiment of the present invention provides a method for intelligently predicting network attack surfaces based on multi-source heterogeneous data fusion, the method comprising: Acquire multi-source heterogeneous data of the target network system during the monitoring period, wherein the multi-source heterogeneous data includes network traffic logs, host operation status data, and external threat intelligence information; Performing feature extraction processing on the multi-source heterogeneous data to generate a feature set corresponding to each data type, and mapping each feature set into a unified feature space, wherein the features in the feature space are represented as numerical vectors; Analyzing the correlation between features in the feature space, constructing a feature correlation matrix to quantify the relationship between different features, wherein the element value of the feature correlation matrix represents the degree of correlation between two features; Based on the feature association matrix, a weight distribution value of each feature is calculated, and features whose weight distribution value is greater than a preset threshold are selected as key features, where the preset threshold is a fixed value determined based on historical data analysis; The key features are input into a pre-trained machine learning model, and the machine learning model is used to predict the future network attack surface of the target network system to generate a prediction result.

[0007] Accordingly, an embodiment of the present application further provides a network attack surface intelligent prediction system based on multi-source heterogeneous data fusion, the system comprising: An acquisition module is used to acquire multi-source heterogeneous data of the target network system during the monitoring period, wherein the multi-source heterogeneous data includes network traffic logs, host operation status data, and external threat intelligence information; A feature extraction module is used to perform feature extraction processing on the multi-source heterogeneous data, generate a feature set corresponding to each data type, and map each feature set into a unified feature space, where the features in the feature space are represented as numerical vectors; An association analysis module is used to analyze the association between features in the feature space and construct a feature association matrix to quantify the relationship between different features, wherein the element value of the feature association matrix represents the degree of correlation between two features; A feature selection module is used to calculate the weight distribution value of each feature based on the feature association matrix, and select features with weight distribution values ​​greater than a preset threshold as key features, where the preset threshold is a fixed value determined based on historical data analysis; The prediction module is used to input the key features into a pre-trained machine learning model, use the machine learning model to predict the future network attack surface of the target network system, and generate a prediction result.

[0008] To sum up, by adopting the technical solution of the present application, we first obtain multi-source heterogeneous data, including network traffic logs, host operation status data and external threat intelligence information, enrich the data dimension, and provide a basis for comprehensively predicting the security situation of the network system; then, we extract features from these data and map them to a unified feature space, so that different types of data can be analyzed under the same framework, which facilitates the discovery of potential connections between data; analyze feature correlations and construct a feature correlation matrix to quantify the relationships between features; calculate feature weight distribution values ​​and select key features, highlighting features that have an important impact on attack surface prediction and reducing the interference of irrelevant information; input key features into the machine learning model for prediction, and use the machine learning model to predict the attack surface that the target network system may face in the future; therefore, this solution can effectively integrate multi-source heterogeneous data, improve the accuracy and comprehensiveness of network attack surface prediction, thereby improving the accuracy and comprehensiveness of network security protection and effectively reducing the risk of network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 Schematic diagram of a scenario of a network attack surface intelligent prediction method based on multi-source heterogeneous data fusion in an embodiment of the present application; Figure 2 A flowchart of a network attack surface intelligent prediction method based on multi-source heterogeneous data fusion is provided for an embodiment of the present application; Figure 3 A schematic diagram of the feature extraction process provided in the embodiment of the present application; Figure 4 A schematic diagram of a feature correlation analysis process is provided for an embodiment of the present application; Figure 5 A schematic diagram of the process of selecting key features provided in the embodiments of the present application; Figure 6 A schematic diagram of the attack surface prediction process provided in an embodiment of the present application; Figure 7 A flowchart illustrating the sorting of key features is provided for an embodiment of the present application; Figure 8 A schematic diagram of a process for predicting the probability of an attack provided in an embodiment of the present application; Figure 9 A schematic diagram of the structure of a network attack surface intelligent prediction system based on multi-source heterogeneous data fusion provided in an embodiment of the present application; Figure 10 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0012] The embodiments of the present application provide a method and system for intelligent prediction of network attack surface based on multi-source heterogeneous data fusion, which will be described in detail below.

[0013] In the embodiments of this application, the network attack surface refers to the collection of all potential paths and weak links in the network system that can be exploited by attackers to launch attacks, encompassing multiple dimensions such as hardware, software, network protocols, and human operations. In terms of hardware, this may include chip design flaws or firmware vulnerabilities in devices such as servers and routers. In terms of software, this may include security vulnerabilities in operating systems and applications, such as remote execution vulnerabilities in Windows systems and SQL injection vulnerabilities in web applications. In terms of network protocols, this may include design and implementation flaws in network protocols, such as security vulnerabilities in the early WEP protocol, which can put network communications at risk. Inappropriate or improperly configured network topology, such as opening unnecessary ports and using weak passwords, can increase attack risk exposure.

[0014] In the embodiment of the present application, the network attack surface intelligent prediction method based on the fusion of multi-source heterogeneous data is a comprehensive network security prediction method. It is based on multi-source heterogeneous data, which includes data of different types and sources such as network traffic logs, host operation status data, and external threat intelligence information. Through a series of data processing steps, such as feature extraction, feature correlation analysis, and feature screening, these multi-source heterogeneous data are fused. Finally, a machine learning model is used to predict the attack surface that the target network system may face in the future, and a prediction result containing an attack possibility probability value and an attack type label is generated, providing a decision-making basis for network security protection personnel, helping them to take measures to prevent network attacks in advance.

[0015] As shown in Figure 1, a scenario for intelligent network attack surface prediction based on multi-source heterogeneous data fusion is provided. This scenario primarily includes a target network system, a data acquisition device, and a data analysis server; the target network system, data acquisition device, and data analysis server are connected via a network. In one embodiment, the data acquisition device and data analysis server can be located within the target network system or independently of it.

[0016] Take a large e-commerce company, for example. It has a vast and complex network system that supports critical business operations such as daily product sales, user data management, and payment transactions. Within this network environment, it faces a variety of internal and external cybersecurity threats, including malicious hacker attacks and data leaks. Therefore, accurately predicting the network attack surface and taking proactive protective measures are crucial.

[0017] Data collection equipment is used to collect heterogeneous data from multiple sources. Specifically, to collect network traffic logs, professional traffic collection tools are deployed on devices such as routers and firewalls at the enterprise network perimeter. These tools can monitor and record data transmission between various nodes in the network in real time, including information such as protocol type, packet length, transmission time, source IP address, and destination IP address. For example, when a user browses a product and places an order online, the traffic collection tool will record the network traffic generated during this process, such as the HTTP or HTTPS protocol used, packet size, and transmission timestamp. To collect host operating status data, monitoring agents are installed on the enterprise's servers and client devices. These programs can collect real-time information such as CPU utilization, memory usage, and disk I / O operations. For example, when a server is processing a large number of user orders, the monitoring agent will record changes in CPU utilization. An abnormally high CPU utilization rate may indicate that the server is facing abnormal load or is under attack. To collect external threat intelligence information, enterprises can subscribe to the services of professional cybersecurity intelligence service providers. These providers collect the latest cybersecurity threat information through global monitoring and analysis, including threat levels, attack types, and attack sources. For example, when a new DDoS attack method emerges or a hacker group in a certain region launches an attack, enterprises can obtain relevant external threat intelligence information in a timely manner. The data collected through these methods is uploaded to the data analysis server.

[0018] After receiving the multi-source, heterogeneous data uploaded by the data acquisition devices, the data analysis server conducts in-depth analysis and processing. First, feature extraction is performed on the multi-source, heterogeneous data. Next, each feature set is mapped into a unified feature space. Through normalization, different types of eigenvalues ​​are converted into numeric vectors with zero mean and unit variance, and all eigenvectors are mapped into a unified feature space.

[0019] Next, the correlations between features in the feature space are analyzed, and a feature correlation matrix is ​​constructed to quantify the relationships between different features. The initial correlation matrix is ​​obtained by calculating the Pearson correlation coefficient between any two features in the feature matrix. This matrix is ​​then processed and normalized to generate the feature correlation matrix. For example, the analysis found a strong correlation between a sudden increase in network traffic and an increase in host CPU utilization, which may indicate abnormal network activity leading to increased host load.

[0020] Based on the feature correlation matrix, the weight distribution of each feature is calculated, and features with weight distribution values ​​greater than a preset threshold are selected as key features. The initial weight of each feature is obtained by summing the values ​​of each row of the feature correlation matrix and normalizing it. The normalized initial weight is compared with the preset threshold to identify key features. These key features can more centrally reflect the key information of the network attack surface and reduce the interference of irrelevant information.

[0021] Finally, the key features are fed into a pre-trained machine learning model, which then predicts the target network system's future network attack surface and generates a prediction result. The machine learning model uses a support vector machine algorithm for classification prediction. By initializing the kernel parameters of the support vector machine model, calculating the similarity between the feature vector and the support vector, and determining the classification decision boundary, the model classifies the input key features. Based on the classification results, a prediction of the target network system's future network attack surface is generated, including an attack probability value and an attack type label. For example, if the prediction indicates a 70% probability that an enterprise network will be subject to a DDoS attack in the near future, the enterprise needs to take appropriate protective measures, such as increasing network bandwidth and deploying anti-DDoS equipment, to ensure the network's secure and stable operation.

[0022] refer to Figure 2 , Figure 2This is a flow chart of a method for intelligently predicting a network attack surface based on multi-source heterogeneous data fusion, provided in an embodiment of the present application. The method may be executed by a computer device (which may serve as a data analysis server), which may be a single computer device or a cluster of multiple computer devices. The computer device may be a terminal device or a server. The method for intelligently predicting a network attack surface based on multi-source heterogeneous data fusion, provided in an embodiment of the present application, specifically includes: S10: Acquire multi-source heterogeneous data of the target network system within a monitoring period, wherein the multi-source heterogeneous data includes network traffic logs, host operation status data, and external threat intelligence information.

[0023] In the embodiment of the present application, the monitoring period refers to a specific time period for collecting and analyzing data on the target network system, and its length can be set according to actual needs and the characteristics of the network system, for example, it can be one day, one week or one month.

[0024] Network traffic logs record data transmission between various nodes on a network and can contain a wealth of information, such as protocol type, packet length, transmission time, source IP address, and destination IP address. The protocol type reflects the network protocol used for data transmission. Different protocols present different characteristics and risks in terms of network security. For example, HTTP is used for web browsing, while FTP is primarily used for file transfers. Packet length reflects the size of the data; abnormal packet lengths may indicate unusual data transmission behavior. Transmission time can be used to analyze the temporal distribution of network traffic and determine whether there are unusual peaks or valleys in traffic. The source and destination IP addresses can determine the source and destination of data, helping to identify potential attack sources.

[0025] Host operational status data refers to various status information generated by the host device during operation, including CPU utilization, memory usage, and disk I / O operations. CPU utilization reflects host CPU usage. Excessive CPU utilization may indicate that the host is running a large number of computing tasks or is under attack by malicious programs. Memory usage reflects the host's memory usage. Abnormal memory usage may indicate a memory leak or a large amount of memory usage by malicious programs. Disk I / O operations record the host's disk read and write status. Frequent disk I / O operations may affect host performance and may also indicate abnormal data access.

[0026] External threat intelligence information is obtained from external professional organizations or channels regarding current network security threats, including threat level, attack type, and attack source. The threat level helps assess the severity of an attack so that appropriate preventative measures can be taken. Attack type allows network administrators to understand potential attack vectors, such as DDoS attacks, virus infections, and hacker intrusions. The attack source identifies the initiator of the attack, facilitating the implementation of targeted protective measures.

[0027] The comprehensive acquisition of multi-source heterogeneous data in the embodiment of the present application can avoid the limitations of a single data source, reflect the security situation of the network system from multiple perspectives, and improve the accuracy and comprehensiveness of the prediction.

[0028] In one embodiment, to obtain network traffic logs, traffic collection tools such as NetFlow or sFlow can be deployed on network edge devices (such as firewalls and routers). These tools can monitor network traffic in real time and record relevant information. For host operating status data, a monitoring agent can be installed on the host device to regularly collect information such as CPU utilization, memory usage, and disk I / O operations, and send it to a central management server for storage and analysis. For external threat intelligence information, one can subscribe to the services of a professional network security intelligence service provider and regularly obtain the latest threat intelligence information through an API.

[0029] S20: performing feature extraction processing on the multi-source heterogeneous data to generate a feature set corresponding to each data type, and mapping each feature set into a unified feature space, where the features in the feature space are represented in the form of numerical vectors.

[0030] In the embodiments of the present application, feature extraction refers to extracting information that reflects the essential characteristics of data from multi-source, heterogeneous data. For network traffic logs, by parsing the log files, features such as the protocol type field, packet length field, and timestamp field can be extracted. The protocol type field encodes different protocol types and converts them into numerical data for subsequent analysis. The packet length field directly records the size of the packet and is an important feature. The timestamp field reflects the chronological order of data transmission. By processing the timestamp, the temporal characteristics of the traffic can be extracted. For host operating status data, by parsing host monitoring data, features such as the CPU utilization field, memory usage field, and disk I / O operation field can be extracted. These features can intuitively reflect the host's operating status. For external threat intelligence information, by parsing the intelligence data, features such as the threat level field, attack type field, and attack source field can be extracted. The threat level can be quantified, for example, into three levels: low, medium, and high, each represented by a different numerical value. The attack type and attack source can also be encoded and converted into numerical data.

[0031] In the embodiment of the present application, after generating feature sets corresponding to each data type, it is necessary to map these feature sets into a unified feature space. The unified feature space is a multidimensional space, in which each dimension represents a feature. Mapping different types of data features into this space allows features of different data types to be compared and analyzed under the same framework. Representing features as numerical vectors can facilitate processing by machine learning models.

[0032] In one embodiment, for feature extraction, regular expressions and data parsing tools can be used to parse network traffic logs, host operating status data, and external threat intelligence information. For feature space mapping, standardization methods, such as zero-mean unit variance standardization, can be used to adjust the value range of each feature so that all features can be compared on a unified scale.

[0033] S30: Analyze the correlation between the features in the feature space, and construct a feature correlation matrix to quantify the relationship between different features. The element value of the feature correlation matrix represents the correlation degree between two features.

[0034] In the embodiments of this application, the correlation between features refers to the mutual influence and dependency between different features. In the field of network security, different features may have inherent connections. For example, there may be a correlation between a host's CPU utilization and network traffic. A sudden increase in network traffic may cause an increase in the host's CPU utilization. Analyzing the correlation between features can help the embodiments of this application better understand the inherent structure of the data and identify feature combinations that have a significant impact on network attack surface prediction.

[0035] Constructing a feature correlation matrix in the embodiments of the present application is a method for quantifying the correlation between features. Each row and column of the matrix represents a feature, and the element values ​​in the matrix represent the degree of correlation between two features. The degree of correlation can be obtained by calculating a correlation coefficient, such as the Pearson correlation coefficient. The Pearson correlation coefficient measures the degree of linear correlation between two variables. Its value range is between -1 and 1, with absolute values ​​closer to 1 indicating a stronger correlation, and absolute values ​​closer to 0 indicating a weaker correlation.

[0036] The embodiment of the present application constructs a feature correlation matrix to intuitively display the relationship between features. Clarifying the correlation between features can help the embodiment of the present application remove redundant features, improve the effectiveness of features and the accuracy of the prediction model.

[0037] In one embodiment, the numerical vector representations of all features are first extracted from the feature space to form a feature matrix. The Pearson correlation coefficient between any two features in the feature matrix is ​​then calculated to obtain an initial correlation matrix. The element values ​​in the initial correlation matrix are then absolute-valued to obtain a preliminary form of a feature correlation matrix. Finally, the element values ​​in the feature correlation matrix are normalized so that all element values ​​are limited to a range between zero and one, facilitating subsequent analysis and comparison.

[0038] S40: Based on the feature association matrix, a weight distribution value of each feature is calculated, and features with weight distribution values ​​greater than a preset threshold are selected as key features. The preset threshold is a fixed value determined based on historical data analysis.

[0039] In the embodiments of the present application, the weight distribution value of a feature reflects the importance of the feature in predicting the network attack surface. The weight distribution value of a feature is calculated based on the feature association matrix, and the correlation between the feature and other features and the position of the feature in the feature association matrix can be considered. For example, the element values ​​of each row of the feature association matrix can be summed to obtain the initial weight value of each feature. This initial weight value represents the comprehensive correlation between the feature and all other features.

[0040] The preset threshold is a fixed value determined based on historical data analysis and is used to screen key features. By comparing the feature weight distribution value with the preset threshold, we can identify those features that have a significant impact on network attack surface prediction. If a feature's weight distribution value is greater than the preset threshold, it indicates that the feature is highly important in the prediction process and is selected as a key feature.

[0041] The benefit of selecting key features is that it reduces interference from irrelevant features, improving the efficiency and accuracy of the prediction model. Excessive irrelevant features increase model complexity and reduce its generalization ability. Key features, on the other hand, can more centrally reflect key information about the network attack surface, helping the model make more accurate predictions.

[0042] In one embodiment, the element values ​​of each row of the feature association matrix are first summed to obtain the initial weight value of each feature. The initial weight values ​​of all features are then normalized so that the value range of all initial weight values ​​is limited to between zero and one. The normalized initial weight value is then compared with a preset threshold. If the initial weight value is greater than the preset threshold, the corresponding feature is marked as a candidate key feature. The number of candidate key features is counted, and it is determined whether the number of candidate key features exceeds a first quantity limit value. If the number of candidate key features exceeds the first quantity limit value, the features are sorted in descending order according to the initial weight value, and the first several features are selected as the final key features.

[0043] S50: Input the key features into a pre-trained machine learning model, use the machine learning model to predict the future network attack surface of the target network system, and generate a prediction result.

[0044] In the embodiments of this application, the pre-trained machine learning model is trained on a large amount of historical data and has already learned the relationship patterns between the network attack surface and key features. Key features are input into this model, and the model predicts the future network attack surface of the target network system based on the learned patterns.

[0045] The prediction results can include an attack probability value and an attack type label. The attack probability value indicates the likelihood of the target network system being attacked within a certain period of time in the future, ranging from 0 to 1, with values ​​closer to 1 indicating a greater likelihood of attack. The attack type label specifies the type of attack that may occur, such as DDoS attacks, virus infections, and hacker intrusions.

[0046] In one embodiment, the features in the key feature set are first arranged in a predefined order to form a feature vector. This predefined order can be determined based on factors such as feature importance or data type. The feature vector is then input into a pretrained machine learning model, which uses a support vector machine algorithm for classification and prediction. The support vector machine algorithm can find the optimal classification hyperplane in high-dimensional space to distinguish different types of attacks. Finally, based on the classification results output by the machine learning model, a prediction of the future network attack surface of the target network system is generated, including an attack probability value and an attack type label.

[0047] In one embodiment, reference Figure 3 Step S20 may include steps S21-S24, which are described in detail below: Step S21: Parse the network traffic log, extract the protocol type field, the data packet length field, and the timestamp field, and generate a first feature set.

[0048] In the embodiments of the present application, the protocol type field indicates the network protocol used by the data packet. Different protocols have different characteristics and uses. For example, the TCP protocol is a connection-oriented, reliable transmission protocol used for applications that require guaranteed data accuracy, such as web browsing and file downloads; the UDP protocol is a connectionless, unreliable transmission protocol used for applications with high real-time requirements, such as video streaming and voice calls. The packet length field records the size of each packet and can reflect the scale of data transmission. The timestamp field records the time when the packet was transmitted. By analyzing the timestamp, we can understand the temporal distribution of network traffic, such as whether there are peaks and valleys in traffic.

[0049] In the embodiment of the present application, accurate extraction of protocol type, packet length and timestamp fields can comprehensively reflect the basic characteristics of network traffic and help discover abnormal traffic patterns in the network, such as abnormal protocol usage, abnormal packet size or abnormal traffic time distribution.

[0050] In one embodiment, regular expressions can be used to parse network traffic logs. Regular expressions can search for fields in the log that meet certain criteria based on predefined patterns. For example, a regular expression pattern can be defined to match the protocol type field, and the protocol type information can be extracted by searching for relevant strings in the log. Similar methods can also be used to extract the packet length and timestamp fields.

[0051] Step S22: parsing the host operation status data, extracting the CPU utilization field, the memory occupancy field, and the disk I / O operation field, and generating a second feature set.

[0052] In an embodiment of the present application, the CPU utilization field indicates the proportion of the host CPU being used at a certain moment, which can reflect the computing load of the host. Excessive CPU utilization may mean that the host is running a large number of computing tasks, or it may be attacked by malicious programs, such as viruses or Trojan programs that occupy a large amount of CPU resources in the background. The memory utilization field indicates the usage of the host memory, reflecting the host's current ability to store data and run programs. Abnormal memory usage may indicate a memory leak or a malicious program occupying a large amount of memory. The disk I / O operation field records the read and write operations of the host disk, including the number of read and write operations, the amount of read and write data, etc. Frequent disk I / O operations may affect the performance of the host, or it may be a sign of abnormal data access. By extracting these fields to generate a second feature set, the operating status of the host can be quantitatively described, providing a basis for determining whether the host has security risks.

[0053] In one embodiment, system monitoring tools can be used to obtain host operating status data. For example, in a Linux system, commands such as top and vmstat can be used to obtain CPU utilization and memory usage information, and the iostat command can be used to obtain disk I / O operation information. The output of these commands is parsed to extract the required field information and generate a second feature set.

[0054] Step S23: parse the external threat intelligence information, extract the threat level field, attack type field, and attack source field, and generate a third feature set.

[0055] In the embodiments of the present application, external threat intelligence information is information about current network security threats obtained from external professional organizations or channels. The threat level field is used to assess the severity of the attack and can generally be divided into three levels: low, medium, and high. Different levels correspond to different preventive measures. The attack type field clarifies the possible attack methods, such as DDoS attacks, virus infections, hacker intrusions, etc. The attack source field can determine the initiator of the attack, which may be a certain IP address, an organization, or a certain region. By extracting these fields to generate a third feature set, the external threat intelligence information can be structured, which is convenient for fusion and analysis with other feature sets.

[0056] In one embodiment, external threat intelligence information can be obtained from professional threat intelligence platforms through an API. These platforms typically provide a structured data interface, and the returned data format complies with certain specifications. The obtained data is parsed using a JSON or XML parsing tool to extract the threat level field, attack type field, and attack source field to generate a third feature set.

[0057] Step S24: converting the eigenvalues ​​in the first feature set, the second feature set, and the third feature set into numerical vectors with zero mean and unit variance through standardization, and mapping all eigenvectors into a unified feature space.

[0058] In the embodiment of the present application, standardization is the process of unifying the eigenvalues ​​in different feature sets. Zero mean unit variance standardization is a standardization method that converts the eigenvalues ​​into a distribution with a mean of zero and a standard deviation of one by subtracting the mean of the feature and dividing it by the standard deviation of the feature. The advantage of doing this is that the dimensional differences between different features can be eliminated, so that all features can be compared at the same scale. A unified feature space is a multidimensional space in which each dimension represents a feature. Mapping the standardized eigenvectors to a unified feature space allows different types of data features to be analyzed under the same framework, making it easier to discover potential connections between the data.

[0059] In one embodiment, step S24 may be implemented by the following steps, which are described in detail below: A1: Obtain the original value range of each feature in the first feature set, the second feature set, and the third feature set.

[0060] In the embodiment of the present application, the first feature set is obtained by parsing the network traffic log, including features such as protocol type, packet length, and timestamp; the second feature set is derived from the host operation status data, including features such as CPU utilization, memory occupancy, and disk I / O operations; the third feature set is extracted from external threat intelligence information, including features such as threat level, attack type, and attack source. Each feature has its own original numerical range, for example, the protocol type may be some discrete string value, the packet length is a positive integer, and the CPU utilization is a percentage value between 0 and 100. In one embodiment, each feature set can be traversed and the minimum and maximum values ​​of each feature can be counted to determine its original value range. For discrete features, all possible values ​​can be recorded; for continuous features, the accurate value range can be obtained through statistical analysis of the data.

[0061] A2: Calculate the mean and standard deviation of all features in each feature set and use them as the statistical parameters of the feature set.

[0062] In the embodiments of the present application, mean and standard deviation are important statistical parameters for describing data distribution characteristics. The mean reflects the central tendency of the data, while the standard deviation reflects the degree of dispersion of the data. For each feature set, calculating the mean and standard deviation of all features within it can provide an understanding of the overall distribution of the data in that feature set. For example, within a feature set of host operating status data, calculating the mean and standard deviation of features such as CPU utilization, memory usage, and disk I / O operations can provide an understanding of the average level and fluctuation range of these features under normal circumstances.

[0063] In one embodiment, statistical analysis methods can be used to calculate the mean and standard deviation. For each feature in a feature set, all sample values ​​are summed and divided by the number of samples to obtain the mean. The standard deviation of the feature is then calculated using the standard deviation calculation formula. These calculations can be performed using statistical software or related functions in a programming language.

[0064] A3: Based on the statistical parameters, perform zero mean and unit variance standardization processing on the eigenvalues ​​in each feature set, so that the distribution mean of each eigenvalue is zero and the standard deviation is one.

[0065] In the embodiment of the present application, zero mean unit variance normalization is a normalization method that adjusts the distribution of feature values ​​to a standard normal distribution with a mean of zero and a standard deviation of one by subtracting the mean of each feature value and then dividing it by the standard deviation of the feature. The advantage of this is that, regardless of the value range and dimension of the original feature, after normalization, all features have the same distribution characteristics, which facilitates analysis and comparison in a unified feature space. For example, for a CPU utilization feature whose original value range is between 0 and 100 and a packet length feature whose value range is between 1 and 1000, after normalization, they will have the same distribution form.

[0066] In the embodiments of this application, zero-mean unit variance normalization can eliminate dimensional differences and data distribution differences between different features, allowing the machine learning model to treat each feature more fairly. During model training, the standardized features can prevent certain features from dominating the model's learning process due to their large numerical range, thereby improving the model's convergence speed and generalization ability, thereby improving the accuracy of network attack surface prediction.

[0067] In one embodiment, each eigenvalue in each feature set is calculated using a zero-mean unit-variance normalization formula. Specifically, the mean of each eigenvalue is subtracted from the mean, and then divided by the standard deviation of the feature to obtain the normalized eigenvalue. A loop can be used to traverse all eigenvalues ​​in each feature set to complete the normalization process.

[0068] A4: Map the normalized feature values ​​into a unified feature space, where the dimension of the feature space is determined by the total number of features in all feature sets.

[0069] In the embodiments of the present application, after normalization, the eigenvalues ​​in each feature set have uniform distribution characteristics. These normalized eigenvalues ​​are mapped into a unified feature space, which is a multidimensional space whose dimensions are equal to the total number of features in all feature sets. For example, if the first feature set has 3 features, the second feature set has 3 features, and the third feature set has 3 features, then the unified feature space is a 9-dimensional space. Each eigenvalue is placed at the corresponding position in the feature space according to its corresponding feature dimension, forming a complete feature vector.

[0070] A unified feature space enables features from different sources and types to be analyzed and processed within the same framework. Within this feature space, machine learning models can more easily perform operations such as feature extraction, feature correlation analysis, and classification prediction. By integrating all features into a unified feature space, potential relationships between features can be discovered, improving the comprehensiveness and accuracy of network attack surface predictions.

[0071] In one embodiment, reference Figure 4 Step S30 may include steps S31-S34, which are described in detail below: Step S31: extracting the numerical vector form of all features from the feature space to form a feature matrix.

[0072] In the embodiments of the present application, the feature space is a multidimensional space containing all features, and each feature can be represented by a numerical vector in this space. The feature matrix is ​​a matrix composed of these feature vectors arranged in columns, with each column of the matrix representing a feature and each row representing a sample. By extracting the numerical vector form of all features from the feature space and forming a feature matrix, the data in the feature space can be structured, which facilitates subsequent calculations and analysis.

[0073] In one embodiment, the numeric vectors for each feature can be stored in a list, and then the numpy array function can be used to convert the list into a matrix. For example, if there are three feature vectors [1, 2, 3], [4, 5, 6], and [7, 8, 9], they can be stored in a list [[1, 2, 3], [4, 5, 6], [7, 8, 9]], and then the feature matrix can be created using numpy.array([[1, 2, 3], [4, 5, 6], [7, 8, 9]])

[0074] Step S32: Calculate the Pearson correlation coefficient between any two features in the feature matrix to obtain an initial correlation matrix.

[0075] In the embodiments of the present application, the Pearson correlation coefficient is a statistical indicator that measures the degree of linear correlation between two variables, and its value range is between -1 and 1. When the correlation coefficient is 1, it indicates that the two variables are completely positively correlated; when the correlation coefficient is -1, it indicates that the two variables are completely negatively correlated; when the correlation coefficient is 0, it indicates that there is no linear correlation between the two variables. By calculating the Pearson correlation coefficient between any two features in the feature matrix, an initial correlation matrix can be obtained, and the elements in the matrix represent the degree of correlation between the corresponding two features.

[0076] In the embodiment of the present application, the Pearson correlation coefficient can accurately quantify the linear correlation between features, and the initial correlation matrix can intuitively display the correlation relationship between features.

[0077] Step S33: Perform absolute value processing on the element values ​​in the initial correlation matrix to generate a feature correlation matrix.

[0078] In the embodiments of the present application, the element values ​​in the initial correlation matrix are processed by absolute value to eliminate the influence of the negative sign, focusing only on the degree of correlation between features without considering the direction of the correlation (positive or negative correlation). Because in some cases, both negative and positive correlations indicate a strong connection between features. The feature correlation matrix generated by absolute value processing has non-negative element values ​​in the matrix, which can more intuitively reflect the degree of correlation between features.

[0079] In the embodiment of the present application, the feature correlation matrix can more clearly show the correlation strength between features, which facilitates the subsequent screening and analysis of features. When selecting key features, the embodiment of the present application pays more attention to the degree of correlation between features. The feature correlation matrix after absolute value processing is more in line with the solution requirements of the embodiment of the present application.

[0080] Step S34: normalize the element values ​​in the feature correlation matrix so that the value range of all element values ​​is limited to between zero and one.

[0081] In the embodiment of the present application, the normalization process is to scale the element values ​​in the feature association matrix so that the value range of all element values ​​is between zero and one. The advantage of doing so is that the dimensional differences in the correlation coefficients between different features can be eliminated, so that the degree of association between different features can be compared on the same scale. The normalized feature association matrix is ​​more convenient for subsequent analysis and processing, such as determining the weight distribution value of the feature.

[0082] In the embodiment of the present application, the normalized feature correlation matrix can improve the comparability of the feature correlation degree, so that the embodiment of the present application can more accurately judge the relative importance between features and improve the reliability of key feature selection.

[0083] In one embodiment, reference Figure 5 Step S40 may include steps S41-S45, which are described in detail below: Step S41: summing the values ​​of the elements in each row of the feature association matrix to obtain an initial weight value for each feature.

[0084] In the embodiment of the present application, the feature correlation matrix describes the degree of mutual correlation between each feature in the feature space. Each row of the matrix corresponds to a feature, and the element value of the row reflects the correlation strength of the feature with other features. Summing the element values ​​of each row is actually a comprehensive consideration of the degree of correlation between the feature and all other features. For example, if a feature has a strong positive or negative correlation with multiple other features, the initial weight value obtained by summing up will be larger, which indicates that the feature has a greater influence in the entire feature system and is more closely related to the potential connection with the network attack surface.

[0085] In the present embodiment, by calculating the initial weight value, the importance of each feature in the feature system can be preliminarily quantified. This helps to identify features that may play a key role in network attack surface prediction from among many features, avoids averaging the weight of all features in subsequent processing, and improves the targetedness and efficiency of processing.

[0086] In one embodiment, the sum of the values ​​of each row of the feature correlation matrix can be achieved manually or using spreadsheet software (such as Excel). By entering the feature correlation matrix data into a spreadsheet and applying a sum function to each row, the initial weight value of each feature can be quickly obtained.

[0087] Step S42: Normalize the initial weight values ​​of all features so that the value range of all initial weight values ​​is limited to between zero and one.

[0088] In the embodiment of the present application, the initial weight value is calculated based on the feature association matrix, and the initial weight values ​​of different features may have large differences due to the differences in their association characteristics. Normalization is to eliminate the difference in dimension and numerical range so that the weight values ​​of all features are on a unified scale. Through normalization, the weight value of each feature can more intuitively reflect its relative importance in the overall feature system, which is convenient for subsequent screening of key features according to a unified standard.

[0089] In one embodiment, a linear normalization method can be used. First, the maximum and minimum values ​​of all initial weights are found. Then, for each initial weight, the minimum value is subtracted from the initial weight, and then divided by the difference between the maximum and minimum values ​​to convert the weight to a range of zero to one. For example, if the initial weight of a feature is E, the minimum value of all initial weights is M, and the maximum value is N, then the normalized weight value is (E - M) / (N - M).

[0090] Step S43: Compare the normalized initial weight value with a preset threshold value. If the initial weight value is greater than the preset threshold value, mark the corresponding feature as a candidate key feature.

[0091] In the embodiments of the present application, the preset threshold is a fixed value determined based on historical data analysis. It represents the critical value at which a feature is considered sufficiently important in network attack surface prediction. By comparing the normalized initial weight value with the preset threshold, features with high weights that may have a significant impact on network attack surface prediction can be screened out and marked as candidate key features. These candidate key features deserve further attention in subsequent analysis and prediction.

[0092] In the embodiments of the present application, the setting of the preset threshold provides a clear screening criterion, which can effectively and quickly identify potential key features from a large number of features and reduce the interference of irrelevant features. Marking candidate key features provides a narrower range for subsequent final key feature selection, improving the efficiency and accuracy of key feature selection.

[0093] In one embodiment, a manual comparison can be used to compare the normalized initial weight values ​​against a preset threshold one by one. Features with values ​​greater than the threshold are marked in the relevant records. Alternatively, a simple rule program can be written using data processing software to automatically complete the comparison and marking process.

[0094] Step S44: Count the number of candidate key features and determine whether the number of candidate key features exceeds a first quantity limit.

[0095] In the embodiments of the present application, the first quantity limit is a pre-set upper limit for controlling the number of candidate key features. The purpose of counting the number of candidate key features and comparing it with this limit is to avoid an excessive number of candidate key features, which would significantly increase the complexity of subsequent processing. It also prevents the introduction of excessive features that may not be truly critical, which would affect the performance and accuracy of the prediction model.

[0096] In the embodiments of the present application, by controlling the number of candidate key features, it is possible to ensure that the selected features are of high quality and representativeness. A reasonable number of features helps the model better learn and capture the relationship between features and network attack surfaces, improving the model's generalization ability and prediction effect.

[0097] In one embodiment, a counting tool (such as a counting function of a spreadsheet) may be used to count the number of candidate key features, and then the number may be compared with a first quantity limit value manually or through a simple program judgment to determine whether the limit is exceeded.

[0098] Step S45: If the number of candidate key features exceeds the first quantity limit, the features are sorted in descending order according to the initial weight values, and the first several features are selected as the final key features.

[0099] In the embodiment of the present application, when the number of candidate key features exceeds the first quantity limit value, it means that more features are preliminarily considered to be of certain importance, but not so many features are actually needed for network attack surface prediction. Arranged in descending order according to the initial weight value, features with larger weight values ​​are given priority because these features are more closely related to other features in the entire feature system and have greater potential contribution to network attack surface prediction. Selecting the first several features as the final key features can retain features that play an important role in prediction to the greatest extent while controlling the number of features.

[0100] In the embodiments of this application, through sorting and screening, the most representative and influential features can be selected from a plethora of candidate key features as the final key features. This not only reduces the complexity of subsequent processing, but also improves the efficiency and accuracy of the prediction model, avoiding the overfitting problem caused by too many features, and enabling the model to more accurately predict the network attack surface.

[0101] In one embodiment, a sorting algorithm can be used to sort the candidate key features in descending order according to their initial weights. In a spreadsheet, a sorting function can be used; in a programming language, a corresponding sorting function can be used. After the sorting is completed, the corresponding number of features ranked at the top, based on the first quantity limit, are selected as the final key features.

[0102] In one embodiment, step S50 may include steps S51-S53, which are described in detail below: Step S51: Arrange the features in the key feature set in a predefined order to form a feature vector.

[0103] In the embodiment of the present application, the predefined order is a feature arrangement rule determined after comprehensive consideration of multiple factors. The network traffic log-related features, the host operation status data-related features, and the external threat intelligence information-related features each have different properties and importance to the prediction of the network attack surface. The network traffic log directly reflects the data transmission situation in the network and is a direct reflection of the traces that network attacks may leave, so its related features are prioritized. The host operation status data reflects the internal working conditions of the host and may be indirectly related to network attacks, so the priority of its related features is second. External threat intelligence information provides threat clues from the macro external environment and has a relatively low priority. Arranging the features in the key feature set according to such a predefined order can make the structure of the feature vector more reasonable and more in line with the data processing logic of the machine learning model.

[0104] In the embodiments of this application, a standardized feature vector arrangement helps machine learning models more efficiently identify and process input data, reducing model learning errors caused by chaotic data arrangement, thereby improving the accuracy and stability of the model's prediction of the network attack surface. By organizing key features into feature vectors in an orderly manner, the model can more clearly capture the relationships and patterns between different features, thereby better performing classification and prediction.

[0105] In one embodiment, reference Figure 7 Step S51 may include steps S511-S513, which are described in detail below: Step S511: Determine a feature sorting rule based on the type field of each key feature in the key feature set, wherein network traffic log-related features take precedence over host operation status data-related features, and host operation status data-related features take precedence over external threat intelligence information-related features.

[0106] In the embodiment of the present application, the type field of the key feature can reflect its source and nature. The network traffic log related features directly record the data transmission in the network and are the most direct manifestation of network attacks. For example, an abnormal network traffic pattern may be a signal that an attack is occurring. The host operation status data related features reflect the internal working status of the host and are indirectly related to network attacks. For example, abnormal CPU usage may indicate that the host is under attack. The external threat intelligence information related features are information about potential threats obtained from the outside. Although they have important reference value for network security, they are less directly related to the current network system than the first two. Based on such characteristics, determining the above-mentioned feature sorting rules can make the structure of the feature vector more consistent with the logic of data processing and analysis.

[0107] In the embodiments of this application, a reasonable feature sorting rule helps the machine learning model process input data more efficiently. According to this priority sorting, the model can first focus on the features that most directly reflect the network attack situation, gradually deepen the analysis of relevant information, and improve the model's ability to identify network attack patterns and the accuracy of prediction. At the same time, it also facilitates subsequent data processing and feature engineering operations, making the entire prediction process more orderly and efficient.

[0108] In one embodiment, a mapping table can be created that maps type fields to priorities, with network traffic log-related features having the highest priority, host health data-related features having the second highest priority, and external threat intelligence information-related features having the lowest priority. For each feature in the key feature set, the corresponding priority is searched in the mapping table based on its type field, and the features are then sorted by priority.

[0109] Step S512: sorting all features in the key feature set according to the feature sorting rule, and filling the sorted feature values ​​into the feature vector in sequence.

[0110] In the embodiment of the present application, after determining the feature sorting rules, all features in the key feature set are sorted. The sorting process will strictly follow the previously determined priority order, with network traffic log-related features at the front, host operation status data-related features in the middle, and external threat intelligence information-related features at the end. After the sorting is completed, the feature values ​​corresponding to each feature are sequentially filled into the feature vector. The feature vector is a one-dimensional array structure that organizes all key features according to the sorting rules to form an ordered feature sequence, which is convenient for subsequent input into the machine learning model for processing.

[0111] In the embodiments of the present application, the feature vectors formed by sorting and filling have a clear structure and order, which can accurately convey the priority relationship between features to the machine learning model. This helps the model better capture the inherent connections and patterns between features, improving the model's learning efficiency and prediction accuracy. At the same time, the unified feature vector structure also makes different data samples comparable, facilitating batch processing and analysis by the model.

[0112] In one embodiment, a sorting algorithm in a programming language can be used to sort the key feature set. For example, in Python, the sorted function can be used in conjunction with a custom sorting rule function to sort features based on the priority of their type fields. After sorting, a loop is used to traverse the sorted feature list, and the value of each feature is sequentially added to the feature vector.

[0113] Step S513: for each dimension in the feature vector, check whether there are missing values. If there are missing values, use the nearest neighbor interpolation method to fill in the missing values ​​to ensure the integrity of the feature vector.

[0114] In the embodiments of the present application, in the actual data collection and processing process, missing values ​​may appear in certain dimensions of the feature vector due to various reasons. The presence of missing values ​​will affect the training and prediction effects of the machine learning model, because the model usually requires complete feature data to learn and recognize patterns. The nearest neighbor interpolation method is a method for dealing with missing values. Its basic idea is to find other samples that are most similar to the sample where the missing value is located, and then fill the missing values ​​with the values ​​of the corresponding dimensions of these similar samples. In this way, the integrity of the feature vector can be restored as much as possible without introducing too much deviation.

[0115] In the embodiments of this application, the feature vectors after missing values ​​are supplemented can provide more accurate and complete data for machine learning models, thereby improving the performance and reliability of the models. Complete feature vectors enable the models to better learn the true patterns and regularities in the data, reduce the errors and uncertainties caused by missing values, and thus improve the accuracy and stability of network attack surface predictions.

[0116] In one embodiment, each dimension in the feature vector is checked for missing values. Missing values ​​can be indicated by setting a specific marker value, such as -1 or NaN in a dataset. When missing values ​​are found, the similarity between the sample and other samples is calculated. This similarity can be calculated based on a distance metric, such as Euclidean distance, between the feature vectors. The missing values ​​are then filled in by finding the most similar samples. The average or median of the feature values ​​in the corresponding dimensions is then taken as the fill value.

[0117] Step S52: inputting the feature vector into the pre-trained machine learning model, and the machine learning model adopts the support vector machine algorithm to perform classification prediction.

[0118] In the embodiments of the present application, the support vector machine algorithm is a powerful classification method based on statistical learning theory. In the scenario of network attack surface prediction, the core of the support vector machine algorithm is to separate data samples of different attack types by finding an optimal classification hyperplane. This hyperplane can maximize the intervals between data of different categories, so that when unknown data is input, it can accurately determine the attack type category to which it belongs. The pre-trained machine learning model has been learned and optimized on a large amount of historical data and has a good grasp of the characteristic patterns of various attack types. When the feature vector is input into this model, the model will perform calculations and judgments based on the support vector machine algorithm according to the previously learned pattern.

[0119] In the embodiments of the present application, the support vector machine algorithm has excellent generalization and classification accuracy, and is capable of finding the optimal classification boundary in a high-dimensional feature space. Even in complex network attack scenarios with a large number of features and different types of attack patterns, the support vector machine algorithm can effectively perform classification predictions. By using pre-trained models, it is possible to leverage historical data experience to quickly and accurately classify new feature vectors, providing reliable results for predicting the network attack surface.

[0120] In one embodiment, step S52 can be implemented as follows: B1: Initialize the kernel function parameters of the support vector machine model, where the kernel function is a radial basis function.

[0121] In the embodiment of the present application, the kernel function can map the input feature vector from the original low-dimensional space to the high-dimensional space, so that the data that was originally linearly inseparable in the low-dimensional space becomes linearly separable in the high-dimensional space. The radial basis function is a kernel function with good local characteristics and generalization ability. The kernel function parameters are initialized to determine the specific form and characteristics of the radial basis function. Different parameter settings will affect the shape and scope of the kernel function, and thus affect the classification performance of the support vector machine model.

[0122] In the embodiments of this application, appropriate kernel function parameter initialization enables the support vector machine model to better adapt to different data distributions and classification tasks. By adjusting the parameters of the radial basis function, the model's ability to find the classification hyperplane in high-dimensional space can be controlled, enabling the model to more accurately classify data of different attack types, improving the model's prediction accuracy and generalization capabilities.

[0123] In one embodiment, a cross-validation method can be used to initialize kernel function parameters. Cross-validation is a method for evaluating model performance. It divides a dataset into multiple subsets, trains and validates on each subset, and selects kernel function parameters that optimize model performance. Specifically, a series of possible parameter values ​​are iterated over, and multiple cross-validation experiments are performed for each parameter value. Performance indicators such as the model's classification accuracy are recorded, and the parameter value with the optimal performance indicator is ultimately selected as the initial kernel function parameter.

[0124] Step B2: inputting the feature vector into the support vector machine model, and calculating the similarity between the feature vector and the support vector based on the radial basis function.

[0125] In the embodiments of the present application, support vectors are data points that play a key role in the classification hyperplane determined during the training process. After the feature vectors are input into the support vector machine model, the similarity between the feature vectors and these support vectors is calculated based on the radial basis function. The characteristic of the radial basis function is that when the distance between the feature vector and the support vector in space is close, the calculated similarity value is large; when the distance is far, the similarity value is small. By calculating the similarity, the degree of association between the feature vector and the categories represented by different support vectors can be measured.

[0126] In the embodiments of the present application, similarity calculation can provide a basis for the support vector machine model's classification decisions. Based on the similarity between the feature vector and the support vector, the model determines which support vector represents the category to which the feature vector is closer, thereby providing a basis for the subsequent determination of the classification decision boundary. This similarity-based calculation method can fully utilize the information of the support vector and improve the accuracy of the model's classification of the feature vector.

[0127] In one embodiment, for each eigenvector, all support vectors are traversed, and the similarity between the eigenvector and each support vector is calculated using the radial basis function formula. The calculated similarity values ​​are stored for subsequent classification decisions. For example, an array can be used to store the similarity values ​​corresponding to each support vector, with the array index corresponding to the support vector number.

[0128] B3: Determine a classification decision boundary based on the similarity calculation result, where the classification decision boundary is used to distinguish different attack types.

[0129] In the embodiments of this application, the classification decision boundary is the boundary used by the support vector machine model to classify different attack types in feature space. This boundary is determined using algorithms and rules based on the similarity calculation results between feature vectors and support vectors. In the support vector machine algorithm, the classification decision boundary is a hyperplane that maximizes the separation between data of different categories. By calculating similarity, we can understand the position of feature vectors in feature space and their relationship to support vectors of different categories, thereby determining an appropriate hyperplane as the classification decision boundary.

[0130] In this embodiment, accurate classification decision boundaries can clearly separate data of different attack types, allowing the model to accurately determine the attack type when faced with a new feature vector. This helps improve the accuracy of network attack surface predictions and provides network security managers with more reliable information so that they can take targeted preventative measures.

[0131] In one embodiment, an optimization algorithm is used to find the optimal classification decision boundary based on the similarity calculation results. For example, a gradient descent algorithm can be used to continuously adjust the parameters of the classification hyperplane to maximize the separation between data of different categories. During each iteration, the hyperplane parameters are updated based on the similarity calculation results until convergence conditions are met. The resulting hyperplane is the classification decision boundary.

[0132] B4: Based on the classification decision boundary, generate a classification result of the input feature vector.

[0133] In this embodiment of the present application, after the classification decision boundary is determined, the input feature vector is compared with this boundary. Based on the feature vector's position in the feature space, it is determined which side of the classification decision boundary it lies on, thereby determining the attack type category it belongs to. If the feature vector lies within the region corresponding to a certain attack type category, it is classified as that attack type.

[0134] In the embodiments of the present application, accurate classification results are generated by classifying decision boundaries, providing clear information for network attack surface prediction. Based on the classification results, network security managers can take timely preventive measures, such as strengthening monitoring and protection against specific attack types, to improve the security of the network system.

[0135] In one embodiment, the distance and direction of an input feature vector to the classification decision boundary are calculated. If the distance is positive and the direction points to a certain attack type category, the feature vector is classified as that attack type. This judgment process can be implemented using a classification function, which performs calculations based on the coordinates of the feature vector and the parameters of the classification decision boundary and outputs the classification result.

[0136] Step S53: Generate a future network attack surface prediction result of the target network system based on the classification result output by the machine learning model, wherein the prediction result includes an attack possibility probability value and an attack type label.

[0137] In the embodiments of the present application, the classification results output by the machine learning model typically include multiple category labels and their corresponding confidence values. Category labels represent different attack types, such as DDoS attacks, virus infections, and hacker intrusions. The confidence value indicates the model's degree of certainty that the input feature vector belongs to that category. The attack likelihood probability value is a numerical value calculated by comprehensively considering all category labels and their confidence values, which reflects the likelihood of the target network system being attacked in the future. The attack type label selects the most likely attack type from multiple category labels.

[0138] In the embodiments of the present application, by generating prediction results that include attack probability values ​​and attack type labels, network security managers can be provided with intuitive and clear decision-making basis. The attack probability values ​​can help managers assess the risk level facing the network system and allocate security resources appropriately. The attack type labels can guide managers in taking targeted preventative measures, such as strengthening network bandwidth management and traffic filtering for DDoS attacks, and strengthening the deployment and updating of antivirus software for virus infections.

[0139] In one embodiment, all category labels and their confidence values ​​output by the model are first obtained. The category label with the highest confidence value is selected from these category labels as the primary attack type label. Then, based on the primary attack type label and combined with other category labels and their confidence values, a specific calculation method is used to determine an attack likelihood probability value. For example, the confidence value of the primary attack type label can be used as a basis, and then the confidence values ​​of other related category labels can be weighted to perform a calculation to ultimately determine the attack likelihood probability value. Combining the primary attack type label and the attack likelihood probability value generates a prediction of the future network attack surface of the target network system.

[0140] In one embodiment, reference Figure 8 Step S53 may include steps S531-S534, which are described in detail below: Step S531: Obtain the classification result output by the machine learning model, where the classification result includes multiple category labels and their corresponding confidence values.

[0141] In the embodiment of the present application, after the machine learning model classifies and predicts the input feature vector, it will output a series of category labels and corresponding confidence values. The category labels represent different types of attacks, such as common malware attacks, phishing attacks, distributed denial of service attacks, etc. The confidence value reflects the model's degree of certainty that the feature vector belongs to that category, based on the feature patterns and data distribution learned by the model during training. The higher the confidence value, the more likely the model believes that the feature vector belongs to that category.

[0142] In one embodiment, classification results can be directly obtained through the model's output interface. Different machine learning frameworks may have different output formats, but they generally include category labels and confidence values. For example, in some models, the output may be a dictionary with the key being the category label and the value being the corresponding confidence value. By parsing this output format, the required category label and confidence value can be extracted.

[0143] Step S532: Selecting a category label with the highest confidence value from the multiple category labels as the main attack type label.

[0144] In this embodiment, among multiple category labels and their confidence values, the category label with the highest confidence value represents the attack type that the model believes the feature vector most likely corresponds to. Selecting this label as the primary attack type can highlight the most likely attack scenario and provide a clear focus for network security protection. In actual network security management, it is necessary to prioritize the most likely attack types so that targeted preventative measures can be taken in a timely manner.

[0145] In the embodiments of this application, clearly labeling the primary attack type helps network security personnel quickly understand the primary threats that the target network system may face and concentrate resources on prevention. Compared to considering multiple possible attack types simultaneously, focusing on the primary attack type can improve the efficiency and pertinence of protection and reduce the risk of network attacks.

[0146] In one embodiment, the acquired category labels and confidence values ​​can be sorted, arranged from high to low confidence values. The category label ranked first is then selected as the primary attack type label. A sorting algorithm can be used to sort the confidence values ​​while recording the corresponding category labels, ultimately obtaining the category label with the highest confidence value.

[0147] Step S533: Calculate the attack possibility probability value based on the main attack type label and in combination with other category labels and their confidence values ​​in the classification result.

[0148] In the embodiments of this application, the attack probability value is an indicator that comprehensively considers the primary attack type as well as other possible attack types, more comprehensively reflecting the likelihood of a future attack on the target network system. Considering only the primary attack type may overlook other potential attack risks. However, combining the calculation with other category labels and their confidence values ​​can more accurately assess the overall attack risk. When calculating the attack probability value, methods such as weighted averaging can be used, assigning weights to the confidence values ​​of different category labels.

[0149] In the embodiments of the present application, accurate attack probability values ​​can provide a more scientific basis for network security decision-making. Based on these probability values, network security managers can rationally allocate security resources, such as adjusting firewall policies and increasing intrusion detection system monitoring. Furthermore, based on the changing trends of the probability values, changes in network security trends can be detected in a timely manner, allowing for proactive preventative measures.

[0150] In one embodiment, the confidence value of the primary attack type label can be used as a base value, and then the confidence values ​​of other category labels can be weighted and summed. The weights can be set based on factors such as the severity and historical frequency of different attack types. For example, attack types with higher severity and higher historical frequency can be assigned higher weights. Finally, the weighted summation result is combined with the base value to calculate the attack likelihood probability value.

[0151] Step S534: combining the main attack type label and the attack possibility probability value to generate a future network attack surface prediction result of the target network system.

[0152] In this embodiment, the primary attack type label and the attack likelihood probability value are combined to form a complete prediction result. The primary attack type label clearly identifies the most likely attack type, while the attack likelihood probability value quantifies the likelihood of the attack occurring. This combination provides network security managers with clear and comprehensive information, allowing them to intuitively understand the future network attack surface of the target network system.

[0153] In the embodiments of this application, the prediction results generated are highly practical and instructive. Network security managers can use these results to formulate specific network security protection strategies. For example, if the attack probability value is high and the primary attack type is a distributed denial of service attack, network bandwidth can be increased in advance, anti-DDoS equipment can be deployed, and so on. In this way, the security and anti-attack capabilities of the network system can be improved.

[0154] In one embodiment, the primary attack type label and attack likelihood probability value can be stored in a data structure, such as an object or a dictionary. This data structure can be easily transferred and used between different system modules. For example, the primary attack type label can be used as the key and the attack likelihood probability value can be used as the value in a dictionary. The subsequent network security management system can directly read this dictionary to obtain the prediction results and perform corresponding processing.

[0155] Accordingly, in order to better implement the above method, the embodiment of the present application also provides a network attack surface intelligent prediction system based on multi-source heterogeneous data fusion. Figure 9 As shown, the network attack surface intelligent prediction system 90 based on multi-source heterogeneous data fusion includes: Acquisition module 901 is used to acquire multi-source heterogeneous data of the target network system during the monitoring period, wherein the multi-source heterogeneous data includes network traffic logs, host operation status data, and external threat intelligence information; A feature extraction module 902 is configured to perform feature extraction processing on the multi-source heterogeneous data, generate a feature set corresponding to each data type, and map each feature set into a unified feature space, where features in the feature space are represented as numerical vectors; The correlation analysis module 903 is used to analyze the correlation between the features in the feature space and construct a feature correlation matrix to quantify the relationship between different features. The element value of the feature correlation matrix represents the correlation degree between two features. A key feature selection module 904 is configured to calculate a weight distribution value for each feature based on the feature association matrix and select features whose weight distribution value is greater than a preset threshold as key features, where the preset threshold is a fixed value determined based on historical data analysis; The prediction module 905 is used to input the key features into a pre-trained machine learning model, use the machine learning model to predict the future network attack surface of the target network system, and generate a prediction result.

[0156] The implementation of each of the above modules can be specifically referred to the above method embodiments, which will not be described in detail here. The technical effects achieved by each module and device can be referred to the description of the above method embodiments.

[0157] like Figure 10 As shown, an embodiment of the present application further provides a computer device 100, which includes a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program, and when the computer program is executed by the processor 1001, the processor 1001 performs the steps of any of the methods described above.

[0158] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection of some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0159] The above disclosure is only a preferred embodiment of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope of the present application.

Claims

1. A network attack surface intelligent prediction method based on multi-source heterogeneous data fusion, characterized by: The following steps are involved: Acquire multi-source heterogeneous data of the target network system during the monitoring period, wherein the multi-source heterogeneous data includes network traffic logs, host operation status data, and external threat intelligence information; Performing feature extraction processing on the multi-source heterogeneous data to generate a feature set corresponding to each data type, and mapping each feature set into a unified feature space, wherein the features in the feature space are represented as numerical vectors; Analyzing the correlation between features in the feature space, constructing a feature correlation matrix to quantify the relationship between different features, wherein the element value of the feature correlation matrix represents the degree of correlation between two features; Based on the feature association matrix, a weight distribution value of each feature is calculated, and features whose weight distribution value is greater than a preset threshold are selected as key features, where the preset threshold is a fixed value determined based on historical data analysis; The key features are input into a pre-trained machine learning model, and the machine learning model is used to predict the future network attack surface of the target network system to generate a prediction result.

2. The method according to claim 1, characterized in that Performing feature extraction on the multi-source heterogeneous data to generate feature sets corresponding to each data type, and mapping each feature set into a unified feature space, including: Parsing the network traffic log, extracting a protocol type field, a data packet length field, and a timestamp field, and generating a first feature set; Parsing the host operation status data, extracting a CPU utilization field, a memory occupancy field, and a disk I / O operation field, and generating a second feature set; Parse external threat intelligence information, extract threat level fields, attack type fields, and attack source fields, and generate a third feature set; The eigenvalues ​​in the first feature set, the second feature set, and the third feature set are converted into numerical vectors with zero mean and unit variance through standardization, and all eigenvectors are mapped into a unified feature space.

3. The method according to claim 2, characterized in that Analyze the correlation between features in the feature space and construct a feature correlation matrix to quantify the relationship between different features, including: Extracting the numerical vector form of all features from the feature space to form a feature matrix; Calculate the Pearson correlation coefficient between any two features in the feature matrix to obtain the initial correlation matrix; Perform absolute value processing on the element values ​​in the initial correlation matrix to generate a feature correlation matrix; The element values ​​in the feature correlation matrix are normalized so that the value range of all element values ​​is limited to between zero and one.

4. The method according to claim 3, characterized in that Based on the feature association matrix, the weight distribution value of each feature is calculated, and features with weight distribution values ​​greater than a preset threshold are selected as key features, including: Sum the element values ​​of each row of the feature association matrix to obtain the initial weight value of each feature; Normalize the initial weights of all features so that the range of all initial weights is limited to between zero and one; Compare the normalized initial weight value with the preset threshold. If the initial weight value is greater than the preset threshold, the corresponding feature is marked as a candidate key feature. Counting the number of candidate key features and determining whether the number of candidate key features exceeds a first quantity limit value; If the number of candidate key features exceeds the first quantity limit, the features are sorted in descending order according to the initial weight values, and the first several features are selected as the final key features.

5. The method according to claim 4, characterized in that The key features are input into a pre-trained machine learning model, and the machine learning model is used to predict the future network attack surface of the target network system to generate prediction results, including: Arranging the features in the key feature set in a predefined order to form a feature vector; Inputting the feature vector into the pre-trained machine learning model, wherein the machine learning model uses a support vector machine algorithm to perform classification prediction; Based on the classification results output by the machine learning model, a future network attack surface prediction result of the target network system is generated, and the prediction result includes an attack possibility probability value and an attack type label.

6. The method according to claim 5, characterized in that The feature vector is input into the pre-trained machine learning model, and the machine learning model uses a support vector machine algorithm to perform classification prediction, including: Initializing kernel function parameters of a support vector machine model, where the kernel function is a radial basis function; Inputting the feature vector into the support vector machine model, and calculating the similarity between the feature vector and the support vector based on the radial basis function; Determining a classification decision boundary based on the similarity calculation result, wherein the classification decision boundary is used to distinguish different attack types; Based on the classification decision boundary, a classification result of the input feature vector is generated.

7. The method according to claim 5, characterized in that Based on the classification results output by the machine learning model, a prediction result of the future network attack surface of the target network system is generated, including: Obtaining a classification result output by the machine learning model, the classification result including a plurality of category labels and their corresponding confidence values; Selecting a category label with the highest confidence value from the multiple category labels as the main attack type label; Calculate the attack possibility probability value based on the main attack type label and in combination with other category labels and their confidence values ​​in the classification result; The main attack type label and the attack possibility probability value are combined to generate a future network attack surface prediction result of the target network system.

8. The method according to claim 5, characterized in that Arrange the features in the key feature set in a predefined order to form a feature vector, including: Determining a feature sorting rule based on the type field of each key feature in the key feature set, wherein network traffic log-related features take precedence over host operation status data-related features, and host operation status data-related features take precedence over external threat intelligence information-related features; Sorting all features in the key feature set according to the feature sorting rule, and filling the sorted feature values ​​into the feature vector in sequence; For each dimension in the feature vector, check whether there are missing values. If there are missing values, use the nearest neighbor interpolation method to fill in the missing values ​​to ensure the integrity of the feature vector.

9. The method according to any one of claims 2 to 8, characterized in that The multi-source heterogeneous data is standardized to generate a unified feature space, including: Obtaining an original value range of each feature in the first feature set, the second feature set, and the third feature set; Calculate the mean and standard deviation of all features in each feature set as the statistical parameters of the feature set; Based on the statistical parameters, performing zero mean and unit variance normalization processing on the eigenvalues ​​in each feature set so that the distribution mean of each eigenvalue is zero and the standard deviation is one; The normalized eigenvalues ​​are mapped into a unified feature space, where the dimension of the feature space is determined by the total number of features in all feature sets.

10. A network attack surface intelligent prediction system based on multi-source heterogeneous data fusion, characterized by: The system comprises: An acquisition module is used to acquire multi-source heterogeneous data of the target network system during the monitoring period, wherein the multi-source heterogeneous data includes network traffic logs, host operation status data, and external threat intelligence information; A feature extraction module is used to perform feature extraction processing on the multi-source heterogeneous data, generate a feature set corresponding to each data type, and map each feature set into a unified feature space, where the features in the feature space are represented as numerical vectors; An association analysis module is used to analyze the association between features in the feature space and construct a feature association matrix to quantify the relationship between different features, wherein the element value of the feature association matrix represents the degree of correlation between two features; A feature selection module is used to calculate the weight distribution value of each feature based on the feature association matrix, and select features with weight distribution values ​​greater than a preset threshold as key features, where the preset threshold is a fixed value determined based on historical data analysis; The prediction module is used to input the key features into a pre-trained machine learning model, use the machine learning model to predict the future network attack surface of the target network system, and generate a prediction result.

Images