Attack link noise reduction method, system and device based on grey correlation analysis
Through grey correlation analysis and multi-source data fusion, combined with the CNN-LSTM-Attention architecture and reinforcement learning, the problems of high computing resource consumption and poor interpretability of deep learning models in network security are solved, and efficient and interpretable attack link generation and defense strategy selection are achieved.
Patent Information
- Application Number
- CN202510935678.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-08
- Publication Date
- 2025-10-14
AI Technical Summary
Existing deep learning models in network security have problems such as uneven noise distribution, resulting in poor generalization ability, high computing resource consumption, high real-time inference latency, untraceable attack link restoration logic, and high false alarm rate in scenarios with mixed multi-type noise.
Grey correlation analysis and adaptive weight adjustment are used, combined with attack link feature extraction and multi-source data fusion. Multi-source fusion feature vectors are generated through grey correlation analysis, and graph neural networks are used to dynamically reconstruct attack links. The CNN-LSTM-Attention three-layer architecture is used to predict attack behaviors, and reinforcement learning is combined to select the optimal defense strategy.
It significantly improves the efficiency of attack link generation, enhances the system's interpretability and the adaptability of defense strategies, reduces computing resource consumption, and improves the integrity and accuracy of attack link restoration.
Smart Images
Figure CN120785593A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a method, system and device for attack link noise reduction based on grey correlation analysis. Background Art
[0002] Existing deep learning noise reduction technologies primarily employ convolutional neural networks (CNNs), recurrent neural networks (RNNs), or generative adversarial networks (GANs) to automatically extract features and reconstruct signals through end-to-end learning. Some security sectors, such as Venustech's intelligent alarm noise reduction engine, have attempted to apply deep learning to alarm noise reduction. Their technical approach includes: a data input layer that uses heterogeneous data such as traffic logs and system processes; a feature engineering layer that uses manually designed statistical features (such as traffic rates and abnormal process behavior); and a model training layer that uses supervised learning based on labeled data (such as LSTM to predict abnormal patterns).
[0003] However, on the one hand, the cost of security data annotation in existing technologies is high, and the uneven distribution of noise leads to poor generalization ability, making it difficult to adapt to new attack scenarios. See "Network Security Research" 2023, 10(2):45-58. The false alarm rate of CNN models in APT scenarios is as high as 42.7%; on the other hand, the computing resource consumption is large, the number of parameters of traditional CNN / RNN reaches millions, and the real-time inference delay exceeds 50ms, which cannot meet the minute-level threat processing requirements; in addition, the black box characteristics of existing deep learning models make the attack link restoration logic untraceable, and security personnel cannot verify the rationality of the noise reduction results. The fixed weight mechanism of existing deep learning models is difficult to cope with mixed scenarios of multiple types of noise, such as the coexistence of DDoS traffic impact and APT covert communication, with a false alarm rate of up to 30%-50%. Summary of the Invention
[0004] In response to the shortcomings of the existing technology, the present invention discloses a method that uses grey relational analysis (GRA) and adaptive weight adjustment, combined with attack link feature extraction and multi-source data fusion, to solve the problems of insufficient dynamic adaptability, high computational consumption, poor interpretability and insufficient multi-source data fusion in existing deep learning models in security data denoising.
[0005] An attack link noise reduction method based on grey correlation analysis includes the following steps:
[0006] The multi-source data set is acquired, the multi-source data set is preprocessed to obtain a standardized data set, feature extraction and feature fusion are performed on the standardized data set, and a multi-source fusion feature vector is generated;
[0007] The gray correlation degree is obtained based on the multi-source fusion feature vector through gray correlation analysis;
[0008] Based on the gray correlation degree, the graph neural network is dynamically reconstructed, the attack link is generated, and the key node is marked;
[0009] A three-layer architecture of CNN-LSTM-Attention is adopted to predict the evolution trend of the attack behavior;
[0010] Based on the reinforcement learning framework, the optimal defense strategy is selected, and the attack link visualization and traceability analysis are realized.
[0011] As an implementable manner, the acquisition of the multi-source data set, the preprocessing of the multi-source data set to obtain the standardized data set, the feature extraction and feature fusion of the standardized data set, and the generation of the multi-source fusion feature vector include the following steps:
[0012] The multi-source data set is constructed by collecting traffic data, system data, process data and application data in real time through a distributed Agent, and is uniformly stored in a time series database;
[0013] The multi-source data set is subjected to mean normalization and standardization processing, and is further subjected to rule filtering to obtain a standardized data set;
[0014] The multi-dimensional feature extraction of the standardized data set is realized by using an attack link feature extraction layer, and traffic feature vectors, system feature vectors, process feature vectors and application feature vectors are obtained to construct a multi-source feature vector set;
[0015] Based on a multi-head attention fusion model, the contribution of the weighted multi-source feature vector set to the attack link is dynamically weighted, and a weighted fusion feature vector is generated;
[0016] The mean normalization processing formula is:
[0017]
[0018] Wherein, X represents an original data sequence, X std represents the data after normalization processing, max(x) represents the maximum value of the sequence X, and min(x) represents the minimum value of the sequence X.
[0019] The multi-head attention fusion model is:
[0020]
[0021] wherein Q represents a query matrix, K represents a key matrix, V represents a value matrix, d k represents a dimension of a key vector, K T represents a transpose of the key matrix K.
[0022] As an implementable manner, the gray correlation degree based on the multi-source fusion feature vector comprises the following steps:
[0023] A reference sequence is constructed based on a historical attack data sample library and a provided latest attack feature data threat intelligence library;
[0024] The multi-source fusion feature vector is taken as a comparison sequence;
[0025] A gray correlation coefficient is obtained through gray correlation analysis;
[0026] A gray correlation degree is calculated according to the correlation coefficient;
[0027] The gray correlation coefficient calculation formula is:
[0028]
[0029] wherein X0(k) represents a value of the reference sequence at the kth feature dimension, X i (k) represents a value of the comparison sequence at the kth feature dimension, p represents a resolution coefficient, minᵢ min k |X0(k)-Xᵢ(k)| represents a two-level minimum difference, maxᵢ max k |X0(k)-Xᵢ(k)| represents a two-level maximum difference, represents the correlation coefficient at the feature point k;
[0030] The gray correlation degree calculation formula is:
[0031]
[0032] wherein n represents a total number of feature dimensions, g(E i ) e [0, 1] represents a gray correlation degree of an event E i , represents the correlation coefficient at the feature point k, E i represents the i th security event.
[0033] As an implementable manner, the gray correlation degree is quantified through the gray correlation degree, and the attack link generation and the key node marking are realized through the graph neural network dynamic reconstruction, comprising the following steps:
[0034] The graph neural network dynamic reconstruction is realized based on an attribute graph model;
[0035] The weighted scoring model is used for node comprehensive scoring, and key nodes are marked according to the node comprehensive score;
[0036] Based on the gray correlation quantification and the graph neural network dynamic reconstruction, an attack link is generated through a dynamic pruning strategy, and the optimal path is searched from the attack node and the target node simultaneously by combining a bidirectional Dijkstra algorithm;
[0037] The attribute graph model is:
[0038]
[0039] Wherein, G represents the attribute graph model, V represents the node, E represents the actual interaction relationship between entities, and A represents the unilateral weight;
[0040] The graph neural network dynamic reconstruction formula is:
[0041]
[0042] Wherein, V represents the node, k represents the node level, represents the embedding vector of node v at the kth layer, represents the weight matrix of the kth layer, represents the embedding vector of neighbor node u at the previous layer, u represents the neighbor node of node v, and N(v) represents the neighbor set of node v;
[0043] The node comprehensive scoring formula of the weighted scoring model is:
[0044]
[0045] Wherein, represents the node comprehensive score, Betweenness(v) represents the betweenness centrality, Degree(v) represents the connectivity, and gamma(v) represents the node gray correlation degree;
[0046] The path cost function used by the dynamic pruning strategy is:
[0047]
[0048] Wherein, P represents the candidate attack path, i represents the source node identifier, j represents the target node identifier, e ij represents the edge in the path, A ij represents the unilateral weight, v i represents the source node, v j represents the target node, represents the source node correlation degree, represents the target node correlation degree;
[0049] The optimal path search formula used by the bidirectional Dijkstra algorithm is:
[0050]
[0051] Among them, P represents the set of all possible paths, Paths represents the specific path in P, and P opt represents the optimal attack path.
[0052] As an implementable method, the three-layer architecture of CNN-LSTM-Attention is used to predict the evolution trend of attack behavior, including the following steps:
[0053] Extract the spatial features of the attack sequence through the convolutional layer;
[0054] Use LSTM to capture the temporal dependencies of attack behaviors;
[0055] Dynamically weight and aggregate key attack phase features through soft attention mechanism;
[0056] Predict the evolution of attack behavior.
[0057] As an implementable method, the method of selecting the optimal defense strategy based on the reinforcement learning framework and realizing attack link visualization and traceability analysis includes the following steps:
[0058] Based on the reinforcement learning framework, by defining the network state, action space and reward function;
[0059] Select defense strategies in real time and adjust strategy parameters dynamically;
[0060] Realize attack chain visualization and traceability analysis;
[0061] The calculation formula of the reward function is:
[0062]
[0063] Among them, R represents the reward value, represents the safety benefit coefficient, Indicates the business interruption loss coefficient.
[0064] As an implementable method, the real-time selection of defense strategies and dynamic adjustment of strategy parameters include the following steps:
[0065] Local training of edge nodes is achieved through sparse gradient compression technology, and model parameters are updated using locally collected secure data.
[0066] Use Paillier homomorphic encryption algorithm to protect parameter gradient updates of edge nodes;
[0067] Sparse update after FedAvg weighted aggregation of the center node is performed to realize global update of the model;
[0068] The center server distributes the updated global model to all edge nodes safely and verifies the updated model by federated learning;
[0069] The formula of the sparse gradient compression technique is:
[0070]
[0071] Wherein, k represents the edge node identifier, represents the gradient update of node k, Top represents the sparse gradient selector, W represents the model parameter, D k represents the local data set of node k;
[0072] The parameter gradient update formula is:
[0073]
[0074] Wherein, k represents the edge node identifier, ΔW k represents the gradient update of node k, represents the gradient index operation,
[0075] represents the random mask operation, n 2 represents the modulus square;
[0076] The formula of the center node FedAvg weighted aggregation is:
[0077]
[0078] Wherein, k represents the center node safe aggregation result, represents the aggregation gradient, D k represents the weighted aggregation weight, represents the safe update of node k;
[0079] The formula of the center node sparse update is:
[0080]
[0081] Wherein, represents the new model parameter, represents the current model parameter, represents the learning rate, represents the sparse mask, represents the aggregation gradient.
[0082] The attack link denoising system based on grey correlation analysis comprises a multi-source fusion feature vector acquisition module, a grey correlation analysis module, an attack link generation module, an attack behavior prediction module and an optimal defense strategy selection module.
[0083] The multi-source fusion feature vector acquisition module is configured to acquire a multi-source data set, pre-process the multi-source data set to obtain a standardized data set, extract and fuse features of the standardized data set, and generate a multi-source fusion feature vector.
[0084] The grey correlation analysis module is configured to obtain a grey correlation degree based on the multi-source fusion feature vector through grey correlation analysis.
[0085] The attack link generation module is configured to quantize the grey correlation degree and dynamically reconstruct a graph neural network to generate an attack link and mark a key node.
[0086] The attack behavior prediction module is configured to predict an evolution trend of an attack behavior by using a CNN-LSTM-Attention three-layer architecture.
[0087] The optimal defense strategy selection module is configured to select an optimal defense strategy based on a reinforcement learning framework and realize attack link visualization and traceability analysis.
[0088] A computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following method.
[0089] A multi-source data set is acquired, pre-processed to obtain a standardized data set, and feature extraction and feature fusion are performed on the standardized data set to generate a multi-source fusion feature vector.
[0090] A grey correlation degree is obtained based on the multi-source fusion feature vector through grey correlation analysis.
[0091] The grey correlation degree is quantized and a graph neural network is dynamically reconstructed to generate an attack link and mark a key node.
[0092] A CNN-LSTM-Attention three-layer architecture is used to predict an evolution trend of an attack behavior.
[0093] An optimal defense strategy is selected based on a reinforcement learning framework, and attack link visualization and traceability analysis are realized.
[0094] An attack link denoising device based on grey correlation analysis comprises a memory, a processor and a computer program stored in the memory and running on the processor, and the processor implements the following method when executing the computer program.
[0095] Obtaining a multi-source data set, preprocessing the multi-source data set to obtain a standardized data set, performing feature extraction and feature fusion on the standardized data set, and generating a multi-source fusion feature vector;
[0096] Based on the multi-source fusion feature vector, a gray correlation degree is obtained through gray correlation analysis;
[0097] Based on the gray correlation degree, a dynamic reconstruction of a graph neural network is quantified, and attack link generation and key node marking are realized;
[0098] A three-layer architecture of CNN-LSTM-Attention is adopted to predict the evolution trend of attack behavior;
[0099] Based on a reinforcement learning framework, an optimal defense strategy is selected, and attack link visualization and traceability analysis are realized.
[0100] The present application has the following technical effects:
[0101] 1. The gray correlation analysis flowchart generates a graph reflecting the association relationship of the attack chain by fusing the multi-source data feature matrix and the threat intelligence library, optimizes the weight coefficient by reinforcement learning, and finally generates a graph reflecting the association relationship of the attack chain;
[0102] 2. The bidirectional Dijkstra algorithm is used to search from the attack source node and the target node at the same time, and a dynamic pruning strategy is combined to realize calculation acceleration, significantly improve the path generation efficiency (speed up by 73% compared with the traditional algorithm), and guarantee the integrity of the key attack chain;
[0103] 3. The attack chain correlation degree score is generated by gray correlation degree sorting, and the attack pattern matching explanation based on the threat intelligence library is provided to greatly enhance the explainability of the noise reduction system. BRIEF DESCRIPTION OF DRAWINGS
[0104] Figure 1 is a flowchart of the attack link noise reduction method based on gray correlation analysis of the present application;
[0105] Figure 2 is a schematic diagram of the attack link noise reduction system based on gray correlation analysis of the present application. DETAILED DESCRIPTION
[0106] The present application will be further described below in conjunction with the drawings and examples, and the following examples are an explanation of the present application but the present application is not limited to the following examples.
[0107] Example 1:
[0108] A kind of attack link noise reduction method based on gray correlation analysis, as shown in Figure 1 the following steps are included:
[0109] S100, acquire a multi-source data set, preprocess the multi-source data set to obtain a standardized data set, perform feature extraction and feature fusion on the standardized data set, and generate a multi-source fusion feature vector;
[0110] S200, obtain a grey correlation degree based on the multi-source fusion feature vector through grey correlation analysis;
[0111] S300, quantize and dynamically reconstruct a graph neural network based on the grey correlation degree, and realize attack link generation and key node marking;
[0112] S400, adopt a CNN-LSTM-Attention three-layer architecture to predict the evolution trend of attack behavior;
[0113] S500, select an optimal defense strategy based on a reinforcement learning framework, and realize attack link visualization and traceability analysis.
[0114] In the embodiment, step S100 acquires a multi-source data set, preprocesses the multi-source data set to obtain a standardized data set, performs feature extraction and feature fusion on the standardized data set, and generates a multi-source fusion feature vector, and specifically includes the following steps:
[0115] S110: Real-time collection of traffic data, system data, process data, and application data through distributed Agent to construct a multi-source data set, and unified storage to a time series database, and the specific collection range and security detection targets are as follows:
[0116] Data Type Specific Source Security Detection Target Traffic Data NetFlow / IPFIX, DNS logs DDoS attacks, port scanning System Data Syslog, / proc file system Privilege escalation attacks, malicious processes Process Data Process behavior logs, memory exception signals Lateral movement, memory escape APP Data HTTP request headers, API call records RCE exploit
[0117] The collection mechanism has the following core features: first, a distributed deployment architecture is adopted, and Agent supports horizontal expansion capability to ensure that the single-node data collection delay is less than 10 ms; second, it has multi-protocol compatibility, and the network layer supports NetFlow v5 / v9 and IPFIX standard protocols, and the application layer covers modern protocols such as HTTP / 1.1-2.0, gRPC, and GRAphQL; third, efficient storage optimization strategies are implemented, time series database sharding storage is used (each shard retains 30 days of historical data), and a storage compression rate of ≥70% is achieved through the Snappy compression algorithm, significantly reducing storage resource consumption.
[0118] S120: Mean normalization, standardization processing, and further rule filtering are performed on the multi-source data set to obtain a standardized data set, and the data quality is improved;
[0119] The mean normalization processing formula is:
[0120]
[0121] wherein X represents the original data sequence, X std represents the data after normalization processing, max(x) represents the maximum value of the sequence X, and min(x) represents the minimum value of the sequence X.
[0122] In the data cleaning phase, a dynamic rule filtering mechanism based on a security baseline is implemented to accurately identify abnormal data by a preset threshold: for traffic data, when the real-time traffic rate exceeds 10,000 packets / s, it is automatically marked as DDoS attack data, and the threshold is set based on historical attack peak statistical analysis (covering 95% of DDoS attack events), and after triggering, a traffic mirroring shunting operation is immediately performed, and the attack sample is retained in a sandbox environment for in-depth analysis; for process behavior data, when it is detected that the process CPU usage rate is continuously lower than 5% for more than 60 seconds, it is marked as an abnormal process, and the threshold is determined according to the behavior baseline modeling of 10,000+ normal process samples, and after triggering an abnormal alarm, the process tree topology analysis is automatically associated to detect orphan processes without a parent process, and the memory signature library is compared to identify known malicious code features, and a process behavior sandbox dynamic detection mechanism is started. The rule execution adopts a hierarchical verification process, the original data stream is first subjected to traffic rate threshold detection (>10,000 packets / s), the abnormal traffic is directly shunted to the attack analysis sandbox, the normal traffic is subjected to process CPU usage rate threshold detection (<5% for 60 seconds), the abnormal process triggers behavior dynamic detection, and the normal data finally enters the feature extraction layer. This mechanism has dynamic threshold adjustment capability, automatically updates the threshold based on sliding window statistics every week (referring to the data of the last 30 days), and realizes effective control of false positive rate through multi-dimensional verification requirements (abnormal data needs to match at least 2 associated dimensional features such as traffic anomaly + protocol anomaly) and whitelist mechanism (integrating trusted process signature library).
[0123] S130: Multi-dimensional feature extraction of the standardized data set is realized by using the attack link feature extraction layer to obtain a traffic feature vector, a system feature vector, a process feature vector, and an application feature vector, and a multi-source feature vector set is constructed;
[0124] S140: Based on a multi-head attention fusion model, the contribution of the dynamic weighted multi-source feature vector set to the attack link is generated to generate a weighted fusion feature vector;
[0125] The multi-head attention fusion model is:
[0126]
[0127] wherein Q represents a query matrix, K represents a key matrix, V represents a value matrix, d k represents the dimension of the key vector, K T represents the transpose of the key matrix K.
[0128] In the attack chain analysis, a feature fusion model based on multi-head attention mechanism is used to realize dynamic weighted aggregation of multi-source heterogeneous data. The core is to automatically learn the contribution weight of different feature dimensions to the attack chain through the self-attention layer in the Transformer architecture. In the specific implementation, four types of heterogeneous data, including traffic features, system features, process features and APP features, are respectively mapped into 256-dimensional feature vectors as input matrices, and three 256-dimensional parameter matrices, including query matrix (Q), key matrix (K) and value matrix (V), are generated through independent linear transformation layers. A 4-head attention mechanism is used for parallel calculation. Each attention head divides the input features into 64-dimensional subspaces, respectively calculates the attention weight matrix: first, the similarity between the query vector and the key vector is evaluated through the dot product operation, then the scaling processing (divided by the square root of the dimension √64) and the Softmax normalization are performed, and the attention weight in the form of probability distribution is generated, and finally the feature information of the value matrix (V) is weighted and aggregated. The outputs of the four attention heads are reorganized into 256-dimensional feature vectors through the splicing layer, and then the layer normalization and residual connection are performed to eliminate the training deviation, and finally the 256-dimensional weighted fusion feature vector is output.
[0129] This mechanism can dynamically increase the weight of key attack features (such as burst traffic peak and abnormal process tree topology) to more than 0.8, and suppress the weight of irrelevant features (such as normal background traffic) to less than 0.2. Through the visualization heat map, it can be observed that the model gives significantly higher attention weight (>0.7) to the typical feature combination of the attack chain such as "port scanning followed by privilege escalation", so as to accurately capture the correlation pattern of multi-stage attacks.
[0130] In this embodiment, the gray correlation degree is obtained based on the multi-source fusion feature vector described in step S200 through gray correlation analysis, including the following steps:
[0131] S210: Constructing a reference sequence based on a historical attack data sample library and a provided latest attack feature data threat intelligence library;
[0132] In the grey correlation analysis model, the construction of the reference sequence is the benchmark framework for attack chain identification, and the core data source integrates multi-dimensional threat intelligence: on the one hand, based on the annotated historical attack data sample library, covering the typical behavior mode feature vector of APT attack (such as the stage features of the "lateral penetration-privilege escalation-data stealing" attack chain), these samples are structured by security experts through deep analysis of real attack events (including network traffic patterns, system call sequences, process behavior trajectories, etc.), forming a standardized feature vector containing attack stages, technical means, and impact range dimensions; on the other hand, real-time access to the latest attack feature data provided by threat intelligence libraries (such as VirusTotal's malicious file feature library, CISA's vulnerability exploitation feature library) to convert unstructured threat reports into standardized behavior feature vectors through an automatic analysis engine.
[0133] S220: taking the multi-source fusion feature vector as a comparison sequence;
[0134] S230: obtaining a grey correlation coefficient through grey correlation analysis;
[0135] The grey correlation coefficient calculation formula is:
[0136]
[0137] wherein X0(k) represents the value of the reference sequence at the kth feature dimension, X i (k) represents the value of the comparison sequence at the kth feature dimension, p represents the resolution coefficient, minᵢ min k |X0(k)-Xᵢ(k)| represents the two-level minimum difference, maxᵢ max k |X0(k)-Xᵢ(k)| represents the two-level maximum difference, represents the correlation coefficient at the feature point k;
[0138] S240: calculating a grey correlation degree according to the correlation coefficient;
[0139] The grey correlation degree calculation formula is:
[0140]
[0141] wherein n represents the total number of feature dimensions, γ(E i ) ∈ [0, 1] represents the grey correlation degree of event E i , and represents the correlation coefficient at the feature point k, and E i represents the i th security event.
[0142] In the embodiment, the attack link generation and key node marking are realized by quantifying the gray correlation and dynamically reconstructing the graph neural network in step S300, including the following steps.
[0143] S310: dynamically reconstructing the graph neural network based on the attribute graph model;
[0144] The attribute graph model is:
[0145]
[0146] Wherein, G represents the attribute graph model, V represents the node, E represents the actual interaction relationship between entities, and A represents the unilateral weight.
[0147] The dynamic reconstruction formula of the graph neural network is:
[0148]
[0149] Wherein, V represents the node, k represents the node level, represents the embedding vector of node v at the kth layer, represents the weight matrix of the kth layer, represents the embedding vector of neighbor node u at the previous layer, u represents the neighbor node of node v, and N(v) represents the neighbor set of node v.
[0150] S320: performing node comprehensive scoring by using the weighted scoring model, and marking the key nodes according to the node comprehensive score;
[0151] The formula for performing node comprehensive scoring by using the weighted scoring model is:
[0152]
[0153] Wherein, represents the node comprehensive score, Betweenness(v) represents the betweenness centrality, Degree(v) represents the connectivity, and γ(v) represents the node gray correlation degree.
[0154] S330: based on the gray correlation quantification and the dynamic reconstruction of the graph neural network, generating the attack link through the dynamic pruning strategy, and combining the bidirectional Dijkstra algorithm to search the optimal path from the attack node and the target node;
[0155] The path cost function used by the dynamic pruning strategy is:
[0156]
[0157] Wherein, P represents the candidate attack path, i represents the source node identifier, j represents the target node identifier, and e ij represents the edge in the path, Aij represents a unilateral weight, v i represents a source node, v j represents a target node, represents a source node correlation degree, represents a target node correlation degree;
[0158] The optimal path search formula used by the bidirectional Dijkstra algorithm is:
[0159]
[0160] Wherein, P represents a set of all possible paths, Paths represents a specific path in P, P opt represents an optimal attack path.
[0161] In this embodiment, step S400 adopts a CNN-LSTM-Attention three-layer architecture to predict the evolution trend of attack behavior, including the following steps:
[0162] S410: Extract the spatial features of the attack sequence through the convolution layer;
[0163] S420: Capture the time-dependent relationship of the attack behavior using LSTM;
[0164] S430: Dynamically weight and aggregate the key attack phase features through the soft attention mechanism;
[0165] S440: Predict the evolution trend of the attack behavior.
[0166] In this embodiment, step S500 selects the optimal defense strategy based on the reinforcement learning framework, and realizes attack link visualization and traceability analysis, including the following steps:
[0167] S510: Based on the reinforcement learning framework, define the network state, action space and reward function;
[0168] Wherein, the state space refers to the traffic anomaly value, the attack signature matching degree, the node correlation degree, the action space: blocking the attack source, isolating the host, adjusting the firewall, and the weight adjustment amplitude (such as ±0.1).
[0169] The calculation formula of the reward function is:
[0170]
[0171] Wherein, R represents the reward value, represents the security benefit coefficient, represents the business interruption loss coefficient.
[0172] S520: Real-time selection of defense strategy and dynamic adjustment of strategy parameters.
[0173] The optimal defense strategy is selected based on the QLearning algorithm, and the collaborative update of the edge node and the center model is realized through federated learning, so as to ensure that the model adapts to new attack modes (such as directional attack).
[0174] The real-time selection of the defense strategy and the dynamic adjustment of the strategy parameters include the following steps:
[0175] S521: Local training of the edge node is realized through sparse gradient compression technology, and the model parameters are updated using the locally collected security data;
[0176] The formula of the sparse gradient compression technology is:
[0177]
[0178] Wherein, k represents the edge node identifier, represents the gradient update of node k, Top represents the sparse gradient selector, W represents the model parameter, D k represents the local data set of node k;
[0179] S522: The parameter gradient update of the edge node is protected using the Paillier homomorphic encryption algorithm;
[0180] The formula of the parameter gradient update of the edge node is:
[0181]
[0182] Wherein, k represents the edge node identifier, ΔW k represents the gradient update of node k, represents the gradient index operation,
[0183] represents the random mask operation, n 2 represents the modulus square;
[0184] S523: After the FedAvg weighted aggregation of the center node is performed, sparse update is performed, and then global update of the model is realized.
[0185] The formula of the FedAvg weighted aggregation of the center node is:
[0186]
[0187] Wherein, k represents the center node security aggregation result, represents the aggregation gradient, D k represents the weighted aggregation weight, represents the security update of node k;
[0188] The formula of the center node sparse update is:
[0189]
[0190] wherein, denotes a new model parameter, denotes a current model parameter, denotes a learning rate, denotes a sparse mask, denotes an aggregated gradient.
[0191] S524: The center server safely distributes the updated global model to all edge nodes, and verifies the updated model by using federated learning;
[0192] The core model (such as an attack chain prediction engine) of the application adopts a center-edge architecture, and a safe and efficient model updating mechanism is designed. The core process includes two key links:
[0193] Safe model distribution: the center server safely distributes the updated global model to all edge nodes. This process uses a secure encrypted transmission channel (such as TLS1.3) to ensure that the model is not stolen or tampered with during transmission. The data flow direction in the figure should be clear: center server -> encrypted transmission -> edge node.
[0194] Federated learning verification and update: after receiving the new model, the edge node verifies the model using the latest secure data (such as traffic and process logs in the past 2 hours) generated locally. The verification process simulates the attack detection task in the real environment, and calculates the key performance indicators (such as new attack detection rate and false positive rate). The verification results (performance indicators and necessary gradient updates) are protected by homomorphic encryption (such as Paillier algorithm) and fed back to the center server. The figure should show: edge node (local data verification -> performance evaluation) -> encrypted feedback -> center server (aggregated analysis).
[0195] S530: Realize attack chain visualization and traceability analysis.
[0196] Attack chain multi-dimensional display:
[0197] Space-time dimension: show the evolution of attack chain with time axis, and display the attack hot area (such as the period of abnormal traffic concentration) with heat map.
[0198] Subject dimension: dynamically display the associated data flow (such as the traffic path from the attack source IP to the infected host) with host / attack source as the center.
[0199] Traceability analysis: Based on dynamic ontology technology to build attacker behavior knowledge graph, correlate attack features with known methods of attack organizations (such as APT groups), and provide traceability reports.
[0200] Test environment and data:
[0201] 1. Attack chain restoration completeness rate increased by 40%: based on CIC-IDS2018 dataset (containing 35,000 attack logs)
[0202] 2. Model update delay < 50ms: measured on Xeon Gold 6248@2.5GHz platform
[0203] 3. New attack detection rate increased by 37%: tested using CIC-IDS2018 new attack samples
[0204] The data fusion capability of the embodiment of the application is improved: supporting dynamic correlation of structured, time series, and unstructured data, the attack chain restoration completeness rate is increased by 40%; defense response efficiency is improved: attack chain prediction accuracy rate reaches 85%, threat disposal time is shortened to minutes; adaptive capacity is enhanced: can identify unknown attack patterns (such as targeted attacks), defense coverage is improved by 30%; explainability is enhanced: based on the quantitative results of grey correlation analysis and attack pattern library matching, attack chain credibility score (01) and key node explanation are provided.
[0205] Embodiment 2:
[0206] A kind of attack chain link noise reduction system based on grey correlation analysis, as shown in Figure 2 It includes: multi-source fusion feature vector acquisition module 100, grey correlation analysis module 200, attack chain link generation module 300, attack behavior prediction module 400, optimal defense strategy selection module 500;
[0207] The multi-source fusion feature vector acquisition module 100 is used to obtain a multi-source data set, pre-processes the multi-source data set to obtain a standardized data set, extracts and fuses features of the standardized data set, and generates a multi-source fusion feature vector;
[0208] The grey correlation analysis module 200 is used to obtain a grey correlation degree based on the multi-source fusion feature vector through grey correlation analysis;
[0209] The attack chain link generation module 300 is used to quantize based on the grey correlation degree and dynamically reconstruct a graph neural network to realize attack chain link generation and key node marking;
[0210] The attack behavior prediction module 400 is used to predict the evolution trend of attack behavior using a CNN-LSTM-Attention three-layer architecture;
[0211] The optimal defense strategy selection module 500 is configured to select an optimal defense strategy based on a reinforcement learning framework, and to realize attack link visualization and traceability analysis. Various changes and modifications made within the spirit and scope of the application will be apparent to those skilled in the art, and all equivalent technical solutions belong to the scope of the application.
[0212] Each of the embodiments in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other.
[0213] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device or computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
[0214] The present application is described with reference to flowcharts and / or block diagrams of the method, terminal device (system) and computer program product according to the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device produce a means for implementing the functions specified in the flowchart and / or block diagram. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks
[0215] These computer program instructions can also be stored in a computer readable storage medium that can guide the computer or other programmable data processing terminal device to work in a specific way, so that the instructions stored in the computer readable storage medium produce a product including instruction means, which implements the functions specified in the flowchart and / or block diagram. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks
[0216] These computer program instructions can also be loaded into a computer or other programmable data processing terminal device, so that a series of operation steps are performed on the computer or other programmable terminal device to produce a computer implemented process, so that the instructions executed on the computer or other programmable terminal device provide a means for implementing the functions specified in the flowchart and / or block diagram. Figure 1a process or multiple processes and / or boxes A step that specifies a function in one or more boxes.
[0217] It should be noted that:
[0218] References in this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Therefore, appearances of the phrases "one embodiment" or "an embodiment" in various places throughout this specification do not necessarily refer to the same embodiment.
[0219] In addition, it should be noted that the shapes and names of the components of the specific embodiments described in this specification may vary. Any equivalent or simple variation based on the structure, features, and principles described in the patent concept of the present invention is included within the scope of protection of the patent. Those skilled in the art of the present invention may make various modifications, additions, or substitutions to the described specific embodiments, and these modifications, as long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, shall fall within the scope of protection of the present invention.
Claims
1. A method for attack link noise reduction based on grey correlation analysis, characterized in that: The following steps are involved: Acquire a multi-source data set, preprocess the multi-source data set to obtain a standardized data set, perform feature extraction and feature fusion on the standardized data set, and generate a multi-source fusion feature vector; Obtaining a grey relational degree through grey relational analysis based on the multi-source fusion feature vector; Based on grey correlation quantification and graph neural network dynamic reconstruction, attack link generation and key node marking are achieved; Uses a CNN-LSTM-Attention three-layer architecture to predict the evolution trend of attack behavior; Select the optimal defense strategy based on the reinforcement learning framework, and implement attack chain visualization and traceability analysis.
2. The attack link noise reduction method based on grey correlation analysis according to claim 1 is characterized in that: The method of obtaining a multi-source data set, preprocessing the multi-source data set to obtain a standardized data set, performing feature extraction and feature fusion on the standardized data set, and generating a multi-source fusion feature vector includes the following steps: Use distributed agents to collect traffic data, system data, process data, and application data in real time to build multi-source data sets and store them uniformly in a time series database. Perform mean normalization and standardization on multi-source data sets, and further perform rule filtering to obtain standardized data sets; Utilizing the attack link feature extraction layer to extract multi-dimensional features from the standardized data set, obtaining traffic feature vectors, system feature vectors, process feature vectors, and application feature vectors, and constructing a multi-source feature vector set; Based on the multi-head attention fusion model, the contribution of multiple source feature vector sets to the attack link is dynamically weighted to generate a weighted fusion feature vector; The mean normalization processing formula is: Among them, X represents the original data sequence, X std Represents the normalized data, max(x) represents the maximum value of sequence X, and min(x) represents the minimum value of sequence X. The multi-head attention fusion model is: Among them, Q represents the query matrix, K represents the key matrix, V represents the value matrix, and d k represents the dimension of the key vector, K T represents the transpose of the key matrix K.
3. The attack link noise reduction method based on grey correlation analysis according to claim 1 is characterized in that: The step of obtaining the grey relational degree through grey relational analysis based on the multi-source fusion feature vector comprises the following steps: Build a reference sequence based on the historical attack data sample library and the latest attack feature data threat intelligence library provided; Taking the multi-source fusion feature vector as a comparison sequence; The grey correlation coefficient is obtained through grey correlation analysis; Calculate the grey relational degree according to the correlation coefficient; The grey relational coefficient calculation formula is: Among them, X0(k) represents the value of the reference sequence on the kth feature dimension, X i (k) represents the value of the comparison sequence on the kth feature dimension, ρ represents the discrimination coefficient, minᵢ min k |X0(k)-Xᵢ(k)| represents the minimum difference between the two levels, maxᵢ max k |X0(k)-Xᵢ(k)| represents the maximum difference between the two levels, Represents the correlation coefficient at feature point k; The grey relational degree calculation formula is: Among them, n represents the total number of feature dimensions, γ(E i )∈[0, 1] represents the event E i The grey relational degree of Represents the correlation coefficient at feature point k, E i Represents the i-th security event.
4. The attack link noise reduction method based on grey correlation analysis according to claim 1 is characterized in that: The generation of attack links and marking of key nodes are achieved through grey correlation quantification and dynamic reconstruction of graph neural networks, including the following steps: Dynamic reconstruction of graph neural network based on attribute graph model; A weighted scoring model is used to comprehensively score nodes, and key nodes are marked based on the comprehensive scores. Based on the quantification of grey correlation and dynamic reconstruction of graph neural networks, the attack chain is generated through a dynamic pruning strategy, and the bidirectional Dijkstra algorithm is combined to simultaneously search for the optimal path from the attack node and the target node. The attribute graph model is: Among them, G represents the attribute graph model, V represents the node, E represents the actual interaction relationship between entities, and A represents the unilateral weight; The dynamic reconstruction formula of the graph neural network is: Among them, V represents the node, k represents the node level, represents the embedding vector of node v at the kth layer, represents the weight matrix of the kth layer, Represents the embedding vector of neighbor node u in the previous layer, u represents the neighbor node of node v, and N(v) represents the neighbor set of node v; The weighted scoring model performs node comprehensive scoring formula as follows: in, represents the comprehensive score of the node, Betweenness(v) represents the betweenness centrality, Degree(v) represents the connectivity, and γ(v) represents the grey correlation degree of the node; The path cost function used by the dynamic pruning strategy is: Among them, P represents the candidate attack path, i represents the source node identifier, j represents the target node identifier, and e ij represents the edge in the path, A ij represents the unilateral weight, v i represents the source node, v j represents the target node, represents the source node association degree, Indicates the target node association degree; The optimal path search formula used by the bidirectional Dijkstra algorithm is: Among them, P represents the set of all possible paths, Paths represents the specific path in P, and P opt represents the optimal attack path.
5. The attack link noise reduction method based on grey correlation analysis according to claim 1 is characterized in that: The three-layer CNN-LSTM-Attention architecture is used to predict the evolution trend of attack behaviors, including the following steps: Extract the spatial features of the attack sequence through the convolutional layer; Use LSTM to capture the temporal dependencies of attack behaviors; Dynamically weight and aggregate key attack phase features through soft attention mechanism; Predict the evolution of attack behavior.
6. The attack link noise reduction method based on grey correlation analysis according to claim 1 is characterized in that: The method of selecting the optimal defense strategy based on the reinforcement learning framework and implementing attack chain visualization and traceability analysis includes the following steps: Based on the reinforcement learning framework, by defining the network state, action space and reward function; Select defense strategies in real time and adjust strategy parameters dynamically; Realize attack chain visualization and traceability analysis; The calculation formula of the reward function is: Among them, R represents the reward value, represents the safety benefit coefficient, Indicates the business interruption loss coefficient.
7. The attack link noise reduction method based on grey correlation analysis according to claim 6 is characterized in that: The real-time selection of defense strategies and dynamic adjustment of strategy parameters include the following steps: Local training of edge nodes is achieved through sparse gradient compression technology, and model parameters are updated using locally collected secure data. Use Paillier homomorphic encryption algorithm to protect parameter gradient updates of edge nodes; Perform FedAvg weighted aggregation on the central node and then perform sparse update to achieve global model update; The central server securely distributes the updated global model to all edge nodes and uses federated learning to verify the updated model. The calculation formula of the sparse gradient compression technology is: Among them, k represents the edge node identifier, represents the gradient update of node k, Top represents the sparse gradient selector, W represents the model parameters, and D k represents the local dataset of node k; The parameter gradient update formula is: Where k represents the edge node identifier, ΔW k represents the gradient update of node k, represents the gradient exponential operation, Represents random mask operation, n 2 represents the modulus square; The formula for weighted aggregation of the central node FedAvg is: Among them, k represents the security aggregation result of the central node, represents the aggregation gradient, D k represents the weighted aggregation weight, represents the security update of node k; The formula for the central node sparse update is: in, represents the new model parameters, represents the current model parameters, represents the learning rate, represents a sparse mask, represents the aggregation gradient.
8. An attack link noise reduction system based on grey correlation analysis, characterized in that: include: Multi-source fusion feature vector acquisition module, grey correlation analysis module, attack link generation module, attack behavior prediction module, and optimal defense strategy selection module; The multi-source fusion feature vector acquisition module is used to acquire a multi-source data set, pre-process the multi-source data set to obtain a standardized data set, perform feature extraction and feature fusion on the standardized data set, and generate a multi-source fusion feature vector; The grey relational analysis module is configured to obtain a grey relational degree through grey relational analysis based on the multi-source fusion feature vector; The attack link generation module is used to realize attack link generation and key node marking based on grey correlation quantification and graph neural network dynamic reconstruction; The attack behavior prediction module is used to predict the evolution trend of attack behavior using a three-layer CNN-LSTM-Attention architecture; The optimal defense strategy selection module is used to select the optimal defense strategy based on the reinforcement learning framework and realize attack link visualization and traceability analysis.
9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.
10. An attack link noise reduction device based on grey relational analysis, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.