Big data-based network security threat assessment and tracing system

Abstract

The application relates to the technical field of network security, in particular to a network security threat evaluation and tracing system based on big data, which comprises a node behavior monitoring module, a function deviation identification module, a path variation screening module, a behavior track comparison module and a threat tracing judgment module. According to the application, the node with the dramatic fluctuation of behavior characteristics is identified through the behavior vector change angle and frequency difference of multiple time periods, the communication frequency and interaction direction change are analyzed, the node link with the abnormal communication characteristics is screened in combination with the time interval difference of the abnormal path, the number of deviation items is mapped and the suspicious communication starting point is traced according to the comparison result of the static access template and the dynamic operation log, the comprehensive evaluation and attack source positioning of the node function role change, the communication path mutation and the operation behavior abnormality are realized, the precision of threat identification is effectively improved, and the credibility of attack path reconstruction and attacker judgment is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security threat assessment and tracing system based on big data. Background Technology

[0002] Network security technology refers to a collection of security protection and risk control technologies for computer network systems. Its core objective is to ensure that data, communications, and system resources within the network are not accessed, tampered with, damaged, or leaked without authorization. This field encompasses multiple specific technical areas, including but not limited to access control mechanisms, authentication protocols, data encryption and decryption algorithms, malicious code detection technologies, security auditing, network intrusion detection and prevention systems, security policy management, vulnerability scanning and patch management, network behavior analysis, and attack modeling and simulation. Network security technology not only needs to protect static resources but also requires dynamic threat identification capabilities, as well as incident response and forensics capabilities, to ensure that the network system possesses comprehensive proactive defense and emergency response capabilities.

[0003] Among them, the network security threat assessment and tracing system is a system solution used to identify, assess, and analyze potential or existing security threats in the network environment, and to locate the source of attacks. Its main purpose is to quantify the threat level faced in the network environment through multi-dimensional risk assessment, attack path reasoning, and tracing data chain construction technologies, assisting security managers in adjusting protection strategies and deploying resources. Simultaneously, after a security incident occurs, the system can locate the attack path and the attacker based on attack chain analysis and evidence correlation mechanisms, providing technical support for emergency response, legal evidence collection, and accountability.

[0004] Traditional attribution systems rely on multi-dimensional risk assessment and attack path reasoning to identify and trace network threats. They lack quantitative analysis methods for the evolution of node behavior over time, making it difficult to detect changes in functional roles and abnormal behavior during the incubation period. When there are slight shifts in periodic behavior patterns, traditional systems tend to ignore potential threat signals. In addition, the identification of communication links often relies on static communication topology or overall traffic threshold judgment, making it difficult to accurately screen node pairs whose communication characteristics have changed significantly before and after the attack. This limits the ability to reconstruct attack paths with high precision. In real-world complex network environments, if attackers use legitimate privileges to conceal their operational trajectory, it will lead to the breakdown of the attribution path or the failure to identify the attack source, affecting the completeness and efficiency of subsequent emergency response and legal evidence collection. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing a big data-based network security threat assessment and tracing system.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a big data-based network security threat assessment and tracing system, the system comprising:

[0007] The node behavior monitoring module obtains the unique identifier and audit log of the node within the specified monitoring period. It collects the occurrence frequency and time distribution of event types for each node through the node identifier and behavior timestamp, constructs a behavior feature data table with the node as the key and the behavior type as the field, and generates a periodic behavior feature form.

[0008] Based on the periodic behavior feature form, the functional offset identification module calculates the sum of the absolute values ​​of the frequency differences of each behavior type, obtains the magnitude of the behavior vector change of each node, and generates the functional role offset evaluation result.

[0009] The path variation screening module calls the functional role offset evaluation results to screen the connection node pairs with communication offsets, count the consistency rate of interaction direction and the standard deviation of average time interval between node pairs, calculate the path anomaly index, identify suspicious node links, and generate a list of suspicious node links.

[0010] The behavior trajectory comparison module extracts dynamic behavior features from the audit logs based on the list of suspicious node links, compares the static behavior templates with the dynamic behavior items, marks and counts the mismatches, forms a mapping structure between nodes and the number of deviations, and generates a node behavior deviation index table.

[0011] The present invention improves upon this invention by including the following: the periodic behavior feature form includes a node identifier index, behavior category distribution, and behavior time density; the functional role offset evaluation result includes a vector angle value, frequency change value, and standardized offset score; the suspicious node link list includes communication frequency difference, directional consistency ratio, and time interval standard deviation; and the node behavior deviation index table includes static parameter matching results, dynamic behavior anomaly labels, and deviation item quantity statistics.

[0012] The present invention is improved in that the node behavior monitoring module includes:

[0013] The log extraction submodule obtains the node's unique identifier and audit logs within a specified monitoring period. It extracts the event type field, event timestamp field, and event target field from the logs. It filters the content of the event type field and retains four behavioral events: authentication events, file system operations, network session establishment, and remote command execution. It establishes an event mapping table based on the node's unique identifier and generates a set of node behavioral events.

[0014] The behavior statistics submodule calls the set of node behavior events, aggregates them according to the event type and timestamp field, and aggregates them by the unique identifier of the node. It counts the number of times each behavior event occurs within the monitoring period, extracts the hour and minute values ​​from the timestamp of the event occurrence, establishes a behavior event frequency and time distribution table by node number, and generates node behavior statistical distribution information.

[0015] The feature aggregation submodule establishes a two-dimensional data structure based on the statistical distribution information of information node behavior, using node number and event type number as index fields, and summarizing and organizing the statistical data of each node behavior with the frequency of behavior occurrence and time distribution density as data fields, constructing a node behavior feature data table, and generating a periodic behavior feature form.

[0016] The present invention is improved in that the functional offset recognition module includes:

[0017] Based on the periodic behavior feature form, the vector construction submodule extracts the event frequency data of each node under multiple types of behavior events, constructs a behavior frequency vector group within two periods by using the node number as the index field, and forms the vector structure within each period by arranging the frequencies in order of behavior type. It calculates the vector combination of node behavior frequency within the period and generates a periodic behavior vector pair group.

[0018] The offset determination submodule calls the periodic behavior vector pair group, calculates the corresponding cosine angle value in the behavior space based on the two periodic vector data of each node, extracts the frequency difference of each type of behavior, sums the absolute values, determines whether the angle value is greater than the set vector offset angle threshold, filters the node behavior offset records that meet the conditions, calculates the behavior vector change amplitude value of each node in the periodic behavior space, sorts them according to the magnitude of the amplitude value, and generates a behavior vector change amplitude sequence.

[0019] The change normalization submodule constructs a fluctuation sequence based on the sequence of behavioral vector change amplitudes, with the node number as the horizontal axis and the behavioral vector change amplitude value as the vertical axis. It then performs Z-score standardization, takes the average of the standardized values ​​of each node, calculates the overall deviation of the node's behavioral changes, establishes a performance metric for the node at the cyclical behavior level, and generates a functional role offset evaluation result.

[0020] The present invention is improved in that the path variation screening module includes:

[0021] The frequency extraction submodule calls the functional role offset evaluation results, extracts the communication records of the corresponding nodes in the network traffic log based on the node identifiers whose behavior change amplitude exceeds the judgment threshold, sets the attack occurrence time point as the benchmark, extracts the number of TCP connection establishments of each pair of communication nodes in the window interval before and after the target length, calculates the difference and outputs the difference value list according to the node pair number, and generates communication frequency difference information.

[0022] The offset calculation submodule compares the frequency difference of each node pair with a set communication frequency change threshold based on the communication frequency difference information, filters node pairs with frequency differences greater than the threshold, extracts the communication direction information and event timestamp of the node pair within two window intervals, counts the proportion of node pairs communicating in the same direction, calculates the standard deviation of the time interval between two consecutive connections, calculates the abnormal index value of each pair of communication nodes under the offset background, and generates node pair abnormal information.

[0023] The link determination submodule calls the abnormal information of the node pairs, sorts them in descending order according to the magnitude of the abnormal index of each communication node pair, filters the target number of high-risk node pairs according to the sorting, summarizes the communication field combination according to the node pair index field, extracts the source node and target node numbers, communication ports and protocol types as link features, combines them to form a link path determination table, establishes a set of many-to-many path information between nodes, and generates a list of suspicious node links.

[0024] The present invention is improved in that the behavior trajectory comparison module includes:

[0025] Based on the list of suspicious node links, the template extraction submodule extracts three static access template information items associated with each node: access control permission level, operation time period, and network protocol type. It also extracts three dynamic behavior records from the audit log: operation instruction type, target resource type, and event timestamp that match the node number. The module establishes a static and dynamic behavior dataset corresponding to the node and generates a node behavior information comparison table.

[0026] The behavior matching submodule calls the node behavior information lookup table, selects the static access template field and the dynamic behavior record field respectively to match the fields, and matches the static template data item by item for each dynamic behavior record in terms of permission level, operation time period and protocol type, determines whether there are inconsistent field values ​​and marks the matching status, records the marking status of inconsistent items and puts them into the node index table, and generates behavior field matching offset information.

[0027] The deviation counting submodule matches the offset information according to the behavior field, uses the node number as the index, counts the total number of mismatches for each node, summarizes them into the number of deviations, outputs the number of node deviations as a mapping table structure, establishes a set of the degree of behavioral deviation of the node between static expectation and dynamic trajectory, and generates a node behavior deviation index table.

[0028] The present invention has an improvement, wherein the system further includes:

[0029] The threat tracing and determination module calls the node behavior deviation index table, extracts the first communication time and the number of deviations for each node, calculates the attack source ranking value, sorts each node in descending order according to the ranking value, filters the target number of nodes as tracing candidates based on the ranking value, and generates the attack source node location result.

[0030] The attack source node location results are specifically the behavior start time sorting and deviation value combination, and attack node priority score.

[0031] The present invention is improved in that the threat tracing and determination module includes:

[0032] The deviation filtering submodule, based on the node behavior deviation index table, selects a set of nodes whose number of deviation items exceeds the deviation item judgment threshold according to the number of deviation items of the nodes, extracts communication request records from the network communication log, establishes a node behavior activity sequence structure with the node number as the index, and generates a high deviation node set.

[0033] The behavior ranking submodule calls the set of high deviation nodes, sorts the communication behavior records of each node by time, extracts the time of the first communication and converts it into a timestamp value in seconds from 0:00, calls the number of deviation items corresponding to the node, calculates and obtains the attack source ranking value of each node, and sorts the nodes in descending order according to the ranking value to obtain the sorted list of nodes.

[0034] The node location submodule selects a target number of nodes based on the sorted node list, outputs the start time of the behavior, the number of deviations, and the communication link information of the node number, constructs a node location path mapping table structure, and generates the attack source node location result.

[0035] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0036] This invention extracts four types of behavioral events—authentication events, file system operations, network session establishment, and remote command execution—within a set monitoring period to construct a periodic behavioral feature form with nodes as keys. By combining the angle and frequency differences of behavioral vector changes over multiple time periods, nodes with drastic fluctuations in behavioral features are identified. Changes in communication frequency and interaction direction are analyzed. By combining the time interval differences of abnormal paths, node links with abnormal communication characteristics are screened. Based on the comparison results of static access templates and dynamic operation logs, the number of deviations is calculated and the suspicious communication starting point is traced. This achieves a comprehensive assessment and attack source location of changes in node functional roles, abrupt changes in communication paths, and abnormal operational behaviors. It effectively improves the accuracy of threat identification, enhances the systematicness of abnormal link screening, improves the credibility of attack path reconstruction and attacker identification, and strengthens the tracking capabilities and protection deployment response efficiency in multi-stage attack scenarios. Attached Figure Description

[0037] Figure 1 This is a system flowchart of the present invention;

[0038] Figure 2 This is a flowchart of the periodic behavior feature form of the present invention;

[0039] Figure 3 This is a flowchart of the functional role offset evaluation results of the present invention;

[0040] Figure 4 This is a flowchart of the suspicious node link list of the present invention;

[0041] Figure 5 This is a flowchart illustrating the deviation of node behavior from the index table in this invention.

[0042] Figure 6 This is a flowchart illustrating the results of locating the attack source node in this invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0044] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0045] Please see Figure 1 The present invention provides a technical solution: a network security threat assessment and tracing system based on big data, the system including a node behavior monitoring module, a function deviation identification module, a path variation screening module, a behavior trajectory comparison module, and a threat tracing determination module;

[0046] The node behavior monitoring module obtains the unique identifier of the node and audit logs within the specified monitoring period, extracts four types of behavior events from the logs: authentication events, file system operations, network session establishment, and remote command execution. It collects the frequency and time distribution of event types for each node by using the node identifier and behavior timestamp, performs frequency statistics on each behavior, constructs a behavior feature data table with the node as the key and the behavior type as the field, and generates a periodic behavior feature form.

[0047] The functional offset identification module extracts the event frequency vector of each node in each type of behavior within two adjacent periods based on the periodic behavior feature form. It constructs a vector space with behavior type as the dimension, calculates the angle between the vectors of the previous and next periods, and for nodes with the angle value greater than the vector offset angle threshold, it calculates the sum of the absolute values ​​of the frequency difference of each behavior type. After Z-score standardization based on the angle value, it is superimposed and averaged to obtain the change amplitude of the behavior vector of each node and generate the functional role offset evaluation result.

[0048] The path mutation screening module calls the functional role offset evaluation results, obtains the corresponding communication session records of nodes in the network traffic log based on the nodes whose behavior changes exceed the set judgment value, extracts the time window of the target length before and after the attack, extracts the difference in the number of TCP sessions of each pair of communication nodes in the time window, and compares it with the communication frequency change threshold, filters the connection node pairs with communication offset, counts the consistency rate of the interaction direction between node pairs and the standard deviation of the average time interval, calculates the path anomaly index, identifies suspicious node links, and generates a list of suspicious node links.

[0049] The behavior trajectory comparison module extracts the access control permission level, operation time period and network protocol type from the static access template of suspicious nodes based on the list of suspicious node links, and simultaneously extracts the dynamic behavior features from the audit log. The dynamic behavior features include operation instruction type, target resource type and event timestamp. The static behavior template is compared with the dynamic behavior items, and the mismatch items are marked and counted to form a mapping structure between nodes and the number of deviation items, and generate a node behavior deviation index table.

[0050] The threat tracing and determination module calls the node behavior deviation index table. Based on the number of deviation items exceeding the deviation item determination threshold, it sorts all communication requests initiated by the node in the network log, constructs a behavior time chain based on the start time, extracts the first communication time and the number of deviation items for each node, calculates the attack source ranking value, sorts each node in descending order according to the ranking value, selects the target number of nodes as tracing candidates based on the ranking value, and generates the attack source node location result.

[0051] The periodic behavior feature form includes node identifier index, behavior category distribution, and behavior time density. The functional role offset evaluation results include vector angle value, frequency change value, and standardized offset score. The suspicious node link list includes communication frequency difference, direction consistency ratio, and time interval standard deviation. The node behavior deviation index table includes static parameter matching results, dynamic behavior anomaly labels, and deviation item quantity statistics. The attack source node location results specifically include behavior start time sorting and deviation value combination, and attack node priority score.

[0052] Please see Figure 2 The node behavior monitoring module includes:

[0053] The log extraction submodule obtains the node's unique identifier and audit logs within a specified monitoring period. It extracts the event type field, event timestamp field, and event target field from the logs. It filters the content of the event type field and retains four behavioral events: authentication events, file system operations, network session establishment, and remote command execution. It establishes an event mapping table based on the node's unique identifier and generates a set of node behavioral events.

[0054] The system retrieves audit logs and unique node identifiers for a specified monitoring period. This operation is performed using a log management module deployed in the network environment. The system selects the syslog system within the monitoring scope and exports all raw log data for the time interval from 00:00 to 23:59 on May 1, 2024. The log field structure includes five key fields: node IP, node number, event type, event timestamp, and target resource path. First, the node number field is extracted as the primary index, and duplicate values ​​are removed to determine the unique node set. Then, the event type field is extracted; this field is recorded in the log using abbreviations, and "AUTH", "FILE", and "SESS" are extracted. The four code values, "CMD", "CMD", and "CMD", correspond to authentication events, file system operations, network session establishment, and remote command execution behaviors, respectively. At the same time, the target resource field of the event is extracted and used to identify the system entity affected by the operation behavior. The event timestamp field is also extracted for subsequent behavior location and time series attribution. Then, the events are classified according to the node number. The extracted fields are used to construct a five-field log mapping structure. All non-behavioral events, such as system alarms, heartbeat detection, and resource warning log entries, are filtered out. The event record set corresponding to the node is constructed, and finally a node event mapping data structure containing the specified four types of behavioral events is formed, generating the node behavioral event set.

[0055] Table 1 Example of Node Behavior Log Recording

[0056]

[0057] As shown in Table 1, the event data content involves the behavior type and its execution target resources, reflecting the node behavior operation trajectory and constituting the source of node event behavior samples.

[0058] The behavior statistics submodule calls the node behavior event collection, aggregates them according to the event type and timestamp field, and aggregates them by the node's unique identifier. It counts the number of times each behavior event occurs within the monitoring period, extracts the hour and minute values ​​from the event timestamp, establishes a behavior event frequency and time distribution table by node number, and generates node behavior statistics distribution information.

[0059] The system retrieves the event type and timestamp fields from the node behavior event collection. It extracts the behavior category and corresponding time point value from each field. Aggregation is performed using each node number as an index. For each event type, the frequency of occurrence of each behavior category within the monitoring period is calculated. The period is divided into 96 15-minute segments. All event timestamps are converted to the total number of minutes (hour × 60 + minutes). This number is then divided by 15 and rounded to obtain the corresponding time period number. For example, "08:15" is assigned to segment 33 after 495 minutes, and "13:05" is assigned to segment 52 after 785 minutes. All behaviors are mapped to their corresponding time periods in this manner. For each segment, the frequency of the same event type of the same node in each time period is summarized, and a frequency table is constructed with "node number × event type × time period number" as the index item. The frequency value of each item is recorded and output as a frequency time distribution data structure according to the node number dimension. Taking Node-02 as an example, its file operation event is classified into the 39th, 40th, 40th and 42nd segments at 09:42, 10:05, 10:18 and 10:45 respectively, with corresponding frequencies of 1, 2 and 1, forming a frequency distribution record of behavior type under time period. Thus, a set of time distribution indicators for behavior events of each node is constructed, and finally, the statistical distribution information of node behavior is obtained.

[0060] The feature collection submodule establishes a two-dimensional data structure based on the statistical distribution information of information node behavior, using node number and event type number as index fields, and uses the frequency of behavior occurrence and time distribution density as data fields to summarize and organize the statistical data of each node behavior, construct a node behavior feature data table, and generate a periodic behavior feature form.

[0061] Based on the node behavior statistical distribution information, extract all node behavior frequency sequence data and corresponding time distribution segment widths to construct a two-dimensional structure table. Using "node number × behavior type number" as the index, calculate the total frequency value and the standard deviation of the frequency in the distribution segment width for each event type. The total frequency value represents the behavior occurrence intensity, and the standard deviation represents the behavior execution time density. After normalizing the data fields, write them into the behavior statistics table. Each row represents the frequency statistics of a node under a certain behavior type, including the fields "frequency value" and "time period standard deviation". Taking the Node-03 network session event as an example, its behavior frequency is 9 times, distributed in time period numbers 30~36, its standard deviation value is 1.6, the frequency normalization value is 0.47, and the time density value is 0.32. Fill in the corresponding positions according to each node and event type, and output as a statistical matrix. Finally, construct a data form with a unified structure to generate a periodic behavior feature form.

[0062] Please see Figure 3 The functional offset recognition module includes:

[0063] The vector construction submodule is based on the periodic behavior feature form. It extracts the event frequency data of each node under multiple types of behavior events, constructs a behavior frequency vector group within two periods by using the node number as the index field, and forms the vector structure within each period by arranging the frequencies in order of behavior type. It calculates the vector combination of node behavior frequency within the period and generates a periodic behavior vector pair group.

[0064] This process retrieves the event frequency data for each node in the periodic behavior feature form under various behavior events. Specifically, using the node number as an index, it extracts the event frequency values ​​for four behavior categories—"Authentication," "File Operation," "Network Session," and "Remote Command"—within two monitoring periods. The corresponding field formats are such as "Period 1_Authentication," "Period 2_Network Session," etc. In practical applications, the behavior type field is automatically aligned according to log event coding rules to ensure the same behavior remains consistent across different time periods. For example, Node-01 has an authentication frequency of 12 times and a file operation frequency of 20 times in Period 1, and 10 and 18 times respectively in Period 2. The behavior frequency vectors for Period 1 and Period 2 are then constructed as follows. , Then, using the node number as an index, a vector pair combination for each node is constructed, and the vectorized alignment of each behavior type field is constructed to form a one-to-one vector pair list in the data structure. All vector data should be the numerical result after frequency normalization. The normalization process uses the maximum value of each behavior in all nodes as the denominator for ratio processing. This maximum value is determined by the maximum number of times all nodes appear in a certain behavior type within the period to ensure the consistency of the normalization scale. For example, if the maximum frequency of file operation events in period one is 20, then the normalized value is processed as frequency / 20. The maximum value setting comes from the statistics of the entire sample set within the period and does not rely on external data or experience judgment. Therefore, it is a dynamically adjusted benchmark value, which is convenient for subsequent perspective judgment operations. Finally, a set of behavior frequency vectors of all nodes is generated to obtain the periodic behavior vector pair group.

[0065] Table 2 Example of Node Behavior Frequency Vector

[0066]

[0067] Table 2 shows the frequency data of each behavioral event for the three nodes in two periods, which is used to construct the behavioral frequency vector.

[0068] The offset determination submodule calls the periodic behavior vector pair group. Based on the two periodic vector data of each node, it calculates the corresponding cosine angle value in the behavior space, extracts the frequency difference of each type of behavior, sums the absolute values, and determines whether the angle value is greater than the set vector offset angle threshold. It then filters the node behavior offset records that meet the conditions using the following formula:

[0069] ;

[0070] The algorithm calculates the magnitude of the behavior vector change for each node in the periodic behavior space, sorts the values ​​according to their magnitude, and generates a sequence of behavior vector change magnitudes.

[0071] in, Indicates the first The magnitude of the change in the behavior vector of each node. Indicates the first The normalized total frequency of all behavioral events of each node during the first monitoring period. Indicates the first The normalized total frequency of all behavioral events of each node during the second monitoring period. Indicates the first The node at the th Normalized frequency for each behavior type Indicates the first The normalized mean frequency of each node across all behavior types. This represents the total number of behavior types. Indicates the first The angle between two periodic behavior vectors of each node. Indicates the first The number of non-zero behavior types participated in by each node;

[0072] By calling the periodic behavior vector pair for each node vector in the group, a periodic vector is constructed respectively. With periodic two vectors Calculate the cosine angle value of the angle in the four-dimensional behavior space. Using formula ,right The included angle is obtained by calculating the inverse cosine, and then... and The corresponding terms are subtracted one by one and the absolute values ​​are taken. Then the difference sequence is summed. Taking node-01 as an example, its difference vector is: The sum is 7. Calculate the mean of all behavior items at period one frequency. The standard deviation is obtained by taking the square root of the variance of each item. Then, the sum of differences, the standard deviation, and the included angle are used to embed a formula, as follows:

[0073] ;

[0074] The calculation logic of this formula is as follows: Part 1 The first part reflects the overall intensity change of periodic behavior, and the second part is the dispersion of the frequency vector, which measures the volatility of the behavior distribution. The denominator term... Used to suppress the erroneous amplification of changes in values ​​when vectors are similar, while logarithmic terms The variation intensity expansion factor is extracted for multi-behavior involvement scenarios and combined to measure the overall shift of a single node in its functional role behavior. The angle is measured in radians. The angular deviation is determined by a set vector deviation angle threshold, which is set to 45 degrees by default. The rationale for setting this threshold is that when the included angle exceeds 45 degrees, the behavioral structure no longer exhibits significant unidirectionality. This threshold is derived from the standard vector direction consistency limit (cosine value below 0.707) calculation benchmark, and therefore serves as a universal mathematical benchmark value. The calculation for Node-01 is as follows:

[0075] The sum of behavioral differences is 7, the behavioral mean is 10.5, and the sum of squared differences is 210.5. radian, Substituting into the formula, we get:

[0076] ;

[0077] The result value of 16.98 represents the intensity of the overall behavioral change of node-01 during structural reconstruction under the four types of functional behaviors. The larger the value, the more drastic the degree of functional evolution. It can be directly used as a quantitative indicator of behavioral role offset. Finally, it is output according to the node number to generate a sequence of behavioral vector change amplitude.

[0078] The Change Normalization submodule constructs a fluctuation sequence based on the sequence of behavioral vector change amplitudes, with node number as the horizontal axis and behavioral vector change amplitude value as the vertical axis. It then performs Z-score standardization, takes the standardized value of each node and averages it to statistically analyze the overall deviation of node behavior changes, establishes a performance metric for nodes at the cyclical behavior level, and generates functional role offset evaluation results.

[0079] Based on the sequence of behavioral vector changes in magnitude, a change sequence graph is constructed using node numbers as the horizontal axis and magnitude values ​​as the vertical axis. First, the overall sequence mean and standard deviation are calculated, and then the Z-score standardization formula is applied. All amplitude values ​​are standardized, among which The original amplitude value. , These represent the mean and standard deviation of the entire sequence, respectively. Assume the calculated results for the three nodes are Node-01: 16.98, Node-02: 10.12, and Node-03: 9.54. The standardized values ​​were calculated as follows: Node-01 was 1.17, Node-02 was -0.51, and Node-03 was -0.65. The Z-score normalization rule is based on the assumption of normal distribution and uses the dispersion and central difference of the behavior offset value in the distribution of the whole set as reference indicators. It is a common benchmark processing form in standard behavior analysis. The node average value is calculated again for the Z-score standard value as the node's comprehensive deviation level. The output is a deviation degree score table. This score is used as the dynamic behavior indicator of the node's functional role evolution within the cycle. After sorting out the scores of all nodes, a measurement sequence of functional behavior evolution is generated to obtain the functional role offset evaluation results.

[0080] Please see Figure 4 The path variation filtering module includes:

[0081] The frequency extraction submodule calls the function role offset evaluation results, and extracts the communication records of the corresponding nodes in the network traffic log based on the node identifiers whose behavior change amplitude exceeds the judgment threshold. The attack occurrence time point is set as the benchmark, and the number of TCP connection establishments of each pair of communication nodes in the two time windows is extracted within the window interval before and after the attack occurrence time point. The difference is calculated and the difference value list is output according to the node pair number to generate communication frequency difference information.

[0082] The function selects the set of nodes whose behavior change magnitude exceeds a set threshold in the role offset evaluation results. This threshold is the median of the behavior vector change magnitude among all nodes plus the upper limit of the standard deviation. Specifically, it is set as the mean plus one standard deviation as a dynamic threshold to avoid static imbalance caused by changes in node size. In the example, if the mean change magnitude of all nodes is 14.2 and the standard deviation is 3.8, then the threshold is set to 14.2 + 3.8 = 18.0. Any node with a change magnitude exceeding 18.0 will proceed to the next step, where the node number is selected and its communication records in the network traffic log are extracted. The field includes five pieces of information: source address, destination address, protocol, port, and timestamp. Based on the attack event trigger time, TCP connection events within a 300-second interval are extracted forward and backward to form two comparison windows. The number of TCP connections for each pair of communication nodes in the front and back windows is obtained. The frequency difference is calculated by using "node pair" as the index. The difference is defined as the number in the back window minus the number in the front window. Positive values ​​indicate an increase in activity, and negative values ​​indicate a decrease. All difference records form a difference data structure and are output by node pair number to obtain communication frequency difference information.

[0083] The offset calculation submodule compares the frequency difference of each node pair with a set communication frequency change threshold based on the communication frequency difference information. It filters node pairs with frequency differences greater than the threshold, extracts the communication direction information and event timestamps of the node pairs within two window intervals, calculates the proportion of node pairs communicating in the same direction, and calculates the standard deviation of the time interval between two consecutive connections using the formula:

[0084] ;

[0085] The abnormal index value of each pair of communication nodes under the offset background is obtained by calculation, and node pair abnormal information is generated.

[0086] in, Indicates the first Anomaly index for communication nodes. Indicates the first The difference in the number of TCP sessions within the time window before and after the communication node. Indicates the first The standard deviation of the communication time interval between communication nodes within the time window. Indicates the first The normalized value of the percentage of times communication nodes have the same interaction direction. Indicates the first The normalized value of the average time interval of communication events at communication nodes;

[0087] Based on the node pairs and difference items in the communication frequency difference information, the absolute value of the difference for all node pairs is extracted and compared with a set communication frequency change threshold. This threshold is set as the median value of the communication frequency distribution of node pairs within a period plus 5 as an adjustment reference. Given that the median communication frequency in the sample is 18, the threshold is set to 23. Communication pairs with a frequency difference greater than 23 are selected for the next step. The communication direction information of these node pairs within two window intervals is extracted, and the ratio of the number of times the direction matches to the total number of communications is used to calculate the direction consistency rate. Synchronously read the timestamps of adjacent events in each communication node pair, calculate the interval between two consecutive communications, and obtain the standard deviation. and mean The mean and standard deviation are normalized and then used to construct the formula, as follows:

[0088] ;

[0089] The formula logic is explained as follows: The numerator is a joint expression of frequency variation and communication interval fluctuation, used to comprehensively evaluate connection rate and regularity changes; the denominator is the directional consistency increment, the closer to 1, the higher the directional stability, used to suppress the influence of random disturbances; the square root of the multiplicative term expresses the reinforcing factor of the cumulative effect of time on abnormal behavior, forming a full-factor index. The larger the value, the stronger the behavioral evolution deviation, making it suitable for identifying abnormal node pairs in a path. For example, the communication records of Node01-Node02 in Table 2 are 25 times in the first window and 42 times in the second window, with a difference of 17, a direction consistency rate of 0.75, a standard deviation of 3.2 seconds, and a mean of 6.0 seconds. The calculation is as follows:

[0090] ;

[0091] The anomaly index of the node pair was finally determined to be 30.52. The higher the value, the stronger the behavioral deviation. After obtaining the anomaly index of all node pairs, a node pair anomaly information structure was formed to obtain the node pair anomaly information.

[0092] Table 3 Examples of Communication Node Behaviors

[0093]

[0094] Table 3 shows sample data of communication behavior fields for some node pairs within the front and back windows, including frequency, direction consistency rate, and time interval data.

[0095] The link determination submodule calls the node pair abnormal information, sorts them in descending order according to the size of the abnormal index of each communication node pair, filters the target number of high-risk node pairs according to the sorting, summarizes the communication field combination according to the node pair index field, extracts the source node and target node number, communication port and protocol type as link features, combines them to form a link path determination table, establishes a multi-to-multi path information set between nodes, and generates a list of suspicious node links.

[0096] The system retrieves the anomaly index of all node pairs in the abnormal node information, sorts them in descending order of anomaly index value, and sets a filtering ratio of 10% for node pairs with the highest anomaly index to enter the source path analysis stage. This filtering ratio is fixed at 10% and is the system default parameter. It has been successfully used to identify source link nodes in actual test scenarios. If the total number of sample node pairs is 90, the first 9 are extracted for path mapping construction. After filtering, the source address, destination address, protocol type (such as TCP, UDP), and communication port number of each node pair are extracted and combined into link field items. These are then summarized by node pair number to form a multi-pair multi-path structure set, recording the communication trajectory boundaries and communication protocol status between nodes. Finally, a path matrix record with the output field format "source node-target node-protocol-port" is generated to obtain a list of suspicious node links.

[0097] Please see Figure 5 The behavior trajectory comparison module includes:

[0098] The template extraction submodule extracts three static access template information items associated with each node based on the list of suspicious node links: access control permission level, operation time period, and network protocol type. It also extracts three dynamic behavior records from the audit log: operation instruction type, target resource type, and event timestamp that match the node number. The module establishes a static and dynamic behavior dataset corresponding to the node and generates a node behavior information comparison table.

[0099] Based on the node numbers filtered from the list of suspicious node links, the system calls the access control policy configuration file and network configuration table for each node to extract its corresponding access control permission level, operation time period range, and bound protocol type fields. These three static information items are usually set during the initial deployment phase of the system. For example, the permission level is represented by a value of 0-3, where 0 is the minimum permission and 3 is the highest permission. The operation time period is recorded in a 24-hour format (e.g., 08-18 represents normal working hours). The protocol type is a standard protocol such as TCP, UDP, or HTTP. The system synchronously reads the audit log file and performs node number matching and filtering on all entries in the log. Only log lines with the same number are retained. The log structure is parsed to extract the operation command type, target resource type, and event timestamp fields. Operation commands include "chmod", "scp", "ssh", etc., and resource types include "directory", "kernel driver", "system configuration file", etc. The timestamp field is further parsed into a time format consisting of year, month, day, hour, minute, and second. The static access fields and dynamic behavior fields are bound side by side using the node as an index. The structured output is a node behavior information lookup table.

[0100] The behavior matching submodule calls the node behavior information lookup table, selects the static access template fields and dynamic behavior record fields respectively to match the fields, and matches the static template data item by item for each dynamic behavior record in terms of permission level, operation time period and protocol type, determines whether there are inconsistent field values ​​and marks the matching status, records the marking status of inconsistent items and puts them into the node index table, and generates behavior field matching offset information.

[0101] The system calls the node behavior information lookup table. For each dynamic behavior record by node number, it calls the permission level, operation time period, and protocol type of the node in the static access template. It then compares the operation instruction type, event timestamp, and communication protocol fields of the dynamic behavior. The consistency judgment standard between fields is set to have completely identical values ​​(e.g., equal permission level, timestamp hour value within the template time period, and protocol complete match). If any of the three fields do not match, the record is marked as inconsistent and the inconsistent field type information is attached to the dynamic behavior record. For example, if the permission in the record is 2 but the corresponding permission requirement for the instruction operation is 3, or the time is 21:00 but the template only allows time until 18:00, these are all considered inconsistent behaviors and are included in the record list. All marked record entries are summarized by node number, and the behavior field matching offset information is output.

[0102] The deviation counting submodule matches the offset information based on the behavior field, uses the node number as the index, counts the total number of mismatches for each node, summarizes them into the number of deviations, outputs the number of node deviations as a mapping table structure, establishes a set of the degree of behavior deviation of the node between static expectation and dynamic trajectory, and generates a node behavior deviation index table.

[0103] The system calls the behavior field to match each marked record in the offset information. It then counts the number of inconsistent marks in the permission, time, and protocol fields according to the node number and maps the statistical results to the corresponding node index item. This forms the deviation result between the template preset conditions and the actual dynamic behavior of this node. For example, if node A corresponds to 6 inconsistent behaviors, of which 3 are permission conflicts, 2 are timeout operations, and 1 is protocol inconsistency, then the number of deviation items for this node is 6. The results are merged into the node number mapping structure and the node behavior deviation index table is output.

[0104] Table 4 Deviation Item Data Table

[0105]

[0106] Table 4 lists the abnormal records of permission, time period and protocol fields matching for some nodes and the statistical results of the number of deviations, which can be used as data input for the subsequent behavior trajectory matching and comparison module.

[0107] Please see Figure 6 The threat attribution determination module includes:

[0108] The deviation filtering submodule is based on the node behavior deviation index table. According to the number of deviation items of a node, it selects a set of nodes whose number of deviation items exceeds the deviation item judgment threshold, extracts communication request records from the network communication log, establishes a node behavior activity sequence structure with the node number as the index, and generates a high deviation node set.

[0109] Based on the node behavior deviation index table, the system reads each node number and its corresponding deviation count. The deviation count threshold is set to 5. This threshold is derived from historical behavior monitoring results, where most legitimate nodes have 4 or fewer deviations within a period, and nodes with more than 5 deviations show significant differences in behavior. Therefore, 5 is used as the threshold for deviation filtering to exclude non-abnormal nodes. When filtering the number of deviations, the system checks whether the number of deviations for each node is greater than the threshold. If it is true, the node is included in the filtering results, and its network communication logs within the period are extracted. The system analyzes the communication request behavior initiated by the node in the logs, including fields such as target node address, communication port, protocol type, and event timestamp. All behavior event sequences are collected by node number and integrated to generate a high deviation node set.

[0110] The behavior sorting submodule calls the high deviation node set, sorts the communication behavior records of each node by time, extracts the time of the first communication initiation and converts it into a timestamp in seconds starting from midnight, and calls the number of deviation items corresponding to the node, using the formula:

[0111] ;

[0112] The attack source ranking value of each node is obtained through calculation. The nodes are then sorted in descending order according to the ranking value to obtain a list of sorted nodes.

[0113] in, For the first The attack source ranking value of each node. For the first The normalized value of the first communication time ranking of each node among all high-deviation nodes. For the first The number of deviations for each node. For the first The total number of communication sessions for each node during this period;

[0114] The high-deviation node set is accessed, and the network communication records of each node are sorted in ascending order by the timestamp field. The timestamp of each node's first communication is extracted and converted into a second value counting from 00:00:00 on the current day, which is recorded as the behavior start time. For example, if the node's first communication occurs at 03:15:00, the timestamp is 11700 seconds. The start times of all nodes are then ranked and normalized to a certain value. The interval is used to obtain the corresponding normalized time rank value, denoted as . Simultaneously, count the number of node deviations, denoted as... For example, if the node's match deviation count is 8 items; then extract the total number of communication sessions generated by the node throughout the entire period, denoted as... If the number is 56, use the following formula to calculate the node attack source ranking value:

[0115] ;

[0116] The calculation is as follows, using the example parameters:

[0117] Let the normalized start time rank of node f be: ;

[0118] The number of deviations is: ;

[0119] The total number of communications is: ;

[0120] Step 1: Square and Root:

[0121] ;

[0122] Step 2: Denominator Calculation:

[0123] ;

[0124] Step 3: Overall Calculation:

[0125] ;

[0126] Therefore, the attack source ranking value of this node is 1.595, which can be used to compare with the ranking values ​​of other nodes to determine the ranking position.

[0127] Explanation of the formula calculation logic:

[0128] Molecular part It integrates the early occurrence of the node's first communication time. ) and the degree of behavioral abnormality ( The sum of the squares reflects the combined anomaly intensity of these two factors; the denominator... A communication activity suppression mechanism is introduced, giving relatively low weight to nodes that communicate frequently but deviate less or have later communication times; Results : Measures the likelihood that a node is the starting point in an attack path. The higher the ranking value, the more likely the node is to be the starting point of an attack.

[0129] Parameter source and setting instructions:

[0130] The result is obtained by sorting the first communication time of each node in ascending order among all nodes with high deviation and then normalizing it by percentile. The total number of inconsistent items matched to the behavior fields obtained from the deviation counting submodule mentioned above; The total number of sessions is calculated from the communication logs; all participating parameters have been normalized or dimensionless data has been used to avoid dimension conflicts.

[0131] Table 5 Example of attack source sorting value calculation:

[0132]

[0133] As shown in Table 5, Node01 has the highest ranking value due to its higher number of deviations and earlier initial communication behavior, making it the priority target for attack source nodes. The results in the table will be used to filter target nodes in the subsequent node location submodule.

[0134] The node localization submodule selects the target number of nodes based on the sorted node list, outputs the start time of the behavior, the number of deviations and the communication link information of the node number, constructs the node localization path mapping table structure, and generates the attack source node localization result;

[0135] Based on the sorted node list output by the behavior sorting submodule, the top 5 node numbers are selected as the target set. The initial communication time, number of deviations, and communication link field information of the corresponding nodes are extracted. The link field includes three items: the target node to which the node establishes a connection within the period, the port number used, and the protocol type. All fields are summarized by node number as the primary key to construct a path information structure. This structure uses nodes as indexes to list the many-to-many communication link combinations between the node and other nodes. The constructed structure is formatted and output to generate the attack source node location result.

[0136] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A big data based cyber security threat assessment and tracing system, characterized in that, The system comprises: The node behavior monitoring module obtains the node unique identifier and the audit log within a specified monitoring period, aggregates the event type occurrence times and time distribution of each node through the node identifier and behavior timestamp, constructs a behavior feature data table with the node as the key and the behavior type as the field, and generates a period behavior feature table; The function role deviation identification module calculates the sum of the absolute values of the frequency difference of each behavior type based on the period behavior feature table, obtains the behavior vector change amplitude of each node, and generates a function role deviation evaluation result; The path variation screening module calls the function role deviation evaluation result, screens the connection node pairs with communication deviation, calculates the abnormal index of the path by calculating the interaction direction consistency rate and the average time interval standard deviation between the node pairs, identifies suspicious node links, and generates a suspicious node link list; The behavior trajectory comparison module extracts dynamic behavior features from the audit log based on the suspicious node link list, compares the static behavior template with the dynamic behavior items, marks and counts the unmatched items, forms a mapping structure of the node and the deviation item number, and generates a node behavior deviation index table; The threat source tracing judgment module extracts the first communication time and the deviation item number of each node by calling the node behavior deviation index table, calculates the attack source ranking value, ranks each node in descending order of the ranking value, selects a target number of nodes as the source candidate according to the ranking value, and generates an attack source node positioning result. The period behavior feature table includes a node identifier index, a behavior category distribution, and a behavior time density. The function role deviation evaluation result includes a vector angle value, a frequency change value, and a standardized deviation score. The suspicious node link list includes a communication frequency difference value, a direction consistency ratio, and a time interval standard deviation. The node behavior deviation index table includes a static parameter matching result, a dynamic behavior anomaly label, and deviation item number statistical information. The attack source node positioning result specifically includes a behavior start time ranking and a deviation value combination, and an attack node priority score.

2. The big data based cyber security threat assessment and forensics system as claimed in claim 1, wherein, The node behavior monitoring module comprises: The log extraction submodule obtains the node unique identifier and the audit log within a specified monitoring period, extracts the event type field, event timestamp field, and event target field from the log, filters the event type field content, retains four behavior events of authentication event, file system operation, network session establishment, and remote command execution, establishes an event mapping table according to the node unique identifier, and generates a node behavior event set quantity; The behavior statistics submodule calls the node behavior event set quantity, aggregates the events according to the event type and timestamp field, and according to the node unique identifier, counts the occurrence times of each behavior event within the monitoring period, extracts the hour value and minute value in the event occurrence timestamp, establishes a behavior event frequency and time distribution table according to the node number, and generates node behavior statistical distribution information; The feature collection submodule collects node behavior statistical distribution information, establishes a two-dimensional data structure with node number and event type number as index fields, summarizes and arranges each node behavior statistical data with behavior occurrence frequency and time distribution density as data fields, constructs a node behavior feature data table, and generates a periodic behavior feature table.

3. The big data based cyber security threat assessment and forensics system as claimed in claim 2, wherein, The function offset identification module includes: The vector construction submodule extracts event frequency data of each node under multiple types of behavior events based on the periodic behavior feature table, constructs a behavior frequency vector group in two periods with node number as an index field, arranges the frequency in the order of behavior type to form a vector structure in each period, calculates the vector combination of node behavior frequency in the period, generates a pair of periodic behavior vectors, and calculates the cosine angle value corresponding to each node in the behavior space. The offset determination submodule calls the pair of periodic behavior vectors, calculates the cosine angle value corresponding to each node in the behavior space based on the two-period vector data of each node, extracts the frequency difference value of each type of behavior, takes the absolute value and sums it up, determines whether the angle value is greater than a set vector offset angle threshold, screens node behavior offset records that meet the conditions, calculates the behavior vector change amplitude value of each node in the period behavior space, sorts the amplitude values according to their size, generates a behavior vector change amplitude sequence, and generates a function role offset evaluation result based on the behavior vector change amplitude sequence. The path variation screening module includes:

4. The big data based cyber security threat assessment and forensics system as claimed in claim 3, wherein, The frequency extraction submodule calls the function role offset evaluation result, extracts the communication records of the corresponding node in the network traffic log according to the node identifier whose behavior amplitude value exceeds the determination threshold, sets the attack occurrence time point as the reference, extracts the window interval of the target length before and after, extracts the establishment times of TCP connections of each pair of communication nodes in the two time windows, calculates the difference and outputs the difference value list according to the node pair number, and generates communication frequency difference information. The offset calculation submodule compares the frequency difference value of each node pair with the set communication frequency change threshold according to the communication frequency difference information, screens node pairs with frequency difference values greater than the threshold, extracts the communication direction information and event timestamp of the node pair in the two window intervals, calculates the proportion of the same direction communication node pair, and calculates the standard deviation of the connection time interval for two consecutive times. The link determination submodule calls the node pair abnormal information, sorts each communication node pair abnormal index in descending order, screens a target number of high-risk node pairs according to the sorting, summarizes the communication field combination according to the node pair index field, extracts the source node and target node number, communication port and protocol type as link features, combines to form a link path determination table, establishes a many-to-many path information set between nodes, and generates a suspicious node link list. The path variation screening module includes: The frequency extraction submodule calls the function role offset evaluation result, extracts the communication records of the corresponding node in the network traffic log according to the node identifier whose behavior amplitude value exceeds the determination threshold, sets the attack occurrence time point as the reference, extracts the window interval of the target length before and after, extracts the establishment times of TCP connections of each pair of communication nodes in the two time windows, calculates the difference and outputs the difference value list according to the node pair number, and generates communication frequency difference information; The offset calculation submodule compares the frequency difference value of each node pair with the set communication frequency change threshold according to the communication frequency difference information, screens node pairs with frequency difference values greater than the threshold, extracts the communication direction information and event timestamp of the node pair in the two window intervals, calculates the proportion of the same direction communication node pair, and calculates the standard deviation of the connection time interval for two consecutive times. The link determination submodule calls the node pair abnormal information, sorts each communication node pair abnormal index in descending order, screens a target number of high-risk node pairs according to the sorting, summarizes the communication field combination according to the node pair index field, extracts the source node and target node number, communication port and protocol type as link features, combines to form a link path determination table, establishes a many-to-many path information set between nodes, and generates a suspicious node link list.

5. The big data based cyber security threat assessment and forensics system as claimed in claim 4, wherein, The behavior trajectory comparison module comprises: The template extraction submodule extracts, based on the suspicious node link list, three static access template information of access control permission level, operation time period and network protocol type associated with each node, extracts three dynamic behavior records of operation instruction type, target resource type and event timestamp matching the node number from the audit log, establishes a static and dynamic behavior data set corresponding to the node, and generates a node behavior information comparison table; The behavior matching submodule calls the node behavior information comparison table, selects static access template fields and dynamic behavior record fields for field correspondence respectively, matches static template data on three items of permission level, operation period and protocol type for each dynamic behavior record, judges whether there is a field value inconsistency and makes a matching state mark, records the mark state of the inconsistent items and enters the node index table, generates behavior field matching offset information; The deviation counting submodule counts the total number of unmatched items for each node according to the behavior field matching offset information, takes the node number as the index item, and outputs the node deviation item number as a mapping table structure to establish a behavior deviation degree set between the static expectation and the dynamic trajectory of the node, and generates a node behavior deviation index table.

6. The big data based cyber security threat assessment and forensics system as claimed in claim 5, wherein, The threat tracing determination module comprises: The deviation screening submodule selects a node set with a deviation item number exceeding a deviation item determination threshold based on the node behavior deviation index table according to the deviation item number of the node, extracts communication request records in the network communication log, takes the node number as the index, establishes a node behavior activity sequence structure, and generates a high deviation node set; The behavior sorting submodule calls the high deviation node set, sorts the communication behavior records of each node by time, extracts the first communication initiation time and converts it into a timestamp second value from zero point, calls the deviation item number corresponding to the node, calculates the attack source sorting value of each node, and arranges the nodes in descending order according to the sorting value to obtain a sorted node list; The node positioning submodule selects a target number of nodes according to the sorted node list, outputs the behavior starting time, deviation item number and corresponding communication link information according to the node number, constructs a node positioning path mapping table structure, and generates an attack source node positioning result.

Images