A method, device, and medium for automating the handling of network security incidents.

Abstract

This disclosure provides a method, device, and medium for automating the processing of network security incidents. It relates to the field of network security technology. The method includes: capturing data streams flowing through the edge of a transmission link and extracting multi-dimensional fingerprint vectors from the data streams; decoupling an attack intent subspace from the multi-dimensional fingerprint vectors based on a twin network, and generating a threat vector field characterizing attack intent and propagation paths in the communication network using a hidden Markov chain based on the attack intent subspace; searching for at least one transmission path with the lowest security risk in the communication network according to the gradient distribution of the threat vector field, and forming a minimum exposure path cluster from the at least one transmission path; forming a shadow channel in the communication network based on the minimum exposure path cluster, and redirecting the data stream to the shadow channel for transmission. The technical solution of this disclosure can improve the accuracy of network security incident identification, reduce the response lag and false positive rate of network security incidents.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity technology, and in particular to a method, device, and medium for automating the handling of cybersecurity incidents. Background Technology

[0002] With the rapid development of network communication technology, network attack techniques are also evolving in parallel, exhibiting characteristics of organization, complexity, and persistence, leading to an increasingly complex threat environment for network communication security.

[0003] Current technical solutions for responding to and handling cybersecurity incidents rely on static rule signature databases or predefined protocol specifications for cybersecurity detection. For example, when network traffic passes through, the cybersecurity system performs pattern matching between the network traffic and static rules such as malware signature databases, attack rule signature databases, or IP reputation databases to identify threats already present in the static rules.

[0004] The solutions mentioned above can only identify "known threats" that have been discovered and analyzed. They are insufficient to deal with network attacks that exploit unknown vulnerabilities or malicious code employing polymorphic techniques, resulting in a lag in the handling of network security incidents. Furthermore, attackers can easily bypass detection based on fixed features in static rule bases through traffic encryption, protocol spoofing, and payload obfuscation. For example, encapsulating malicious payloads within legitimate HTTPS traffic or making minor modifications to attack commands can render static rules ineffective.

[0005] Therefore, the aforementioned solutions for network security detection that rely on static rule feature libraries or predefined protocol specifications have limitations in handling network security incidents and carry the risk of misjudgment. Summary of the Invention

[0006] This disclosure provides a method, device, and medium for automating the processing of network security incidents; it can improve the accuracy of network security incident identification, reduce the response lag of network security incidents, and reduce the false positive rate of network security incidents.

[0007] The technical solution disclosed herein is implemented as follows:

[0008] In a first aspect, this disclosure provides an apparatus for automatically handling network security incidents, comprising: a probe portion deployed at the edge of a transmission link in a communication network, a processing portion, and a transmission portion; wherein the probe portion and the transmission portion are communicatively connected to the processing portion; and wherein...

[0009] The probe portion is configured to capture the data stream flowing through the edge of the transmission link and extract a multidimensional fingerprint vector from the data stream;

[0010] The processing section is configured to decouple the attack intent subspace from the multidimensional fingerprint vector based on the Siamese network, and generate a threat vector field based on the attack intent subspace using a hidden Markov chain to characterize the attack intent and propagation path in the communication network; and search for at least one transmission path with the lowest security risk in the communication network according to the gradient distribution of the threat vector field, and form the at least one transmission path into a minimum exposure path cluster.

[0011] The transmission section is configured to form a shadow channel in the communication network based on the minimum exposed path cluster, and to redirect the data stream to the shadow channel for transmission.

[0012] Secondly, this disclosure provides a method for automating the handling of network security incidents, including:

[0013] Capture the data stream flowing through the edge of the transmission link and extract a multidimensional fingerprint vector from the data stream;

[0014] The attack intent subspace is decoupled from the multidimensional fingerprint vector based on the twin network, and a threat vector field is generated based on the attack intent subspace through hidden Markov chains to characterize the attack intent and propagation path in the communication network.

[0015] Based on the gradient distribution of the threat vector field, at least one transmission path with the lowest security risk is searched in the communication network, and the at least one transmission path is formed into a minimum exposure path cluster.

[0016] A shadow channel is formed in the communication network based on the minimum exposed path cluster, and the data stream is redirected to the shadow channel for transmission.

[0017] Thirdly, this disclosure provides a computer-readable storage medium storing at least one instruction that is executed by a processor to implement the method for automating network security incidents as described in the second aspect.

[0018] This disclosure provides a method, device, and medium for automating network security incident handling. By constructing a multidimensional fingerprint vector containing sequence entropy, cross-layer interaction deviation, and latency jitter, and combining it with an adversarial intent decoupling model that integrates twin networks and hidden Markov chains, it can accurately identify the attacker's true intent and the attack stage from the multidimensional fingerprint vector. This reduces the false positive and false negative rates of communication networks against covert attacks such as protocol spoofing and traffic encryption. Furthermore, this disclosure also predicts the propagation direction and potential impact of attacks by generating a threat vector field. Based on this prediction, it dynamically plans a minimum exposure path cluster using an entropy weight decision matrix and activates shadow channels to bypass traffic based on the minimum exposure path cluster. This allows threats to be avoided by reshaping the network topology before the network attack causes substantial damage, thereby improving the security of the communication network. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the composition of a network system provided in this disclosure.

[0020] Figure 2 This is a schematic diagram of the composition of a device for automatically handling network security incidents provided in this disclosure.

[0021] Figure 3 This is a schematic diagram of the composition of a processing component provided in this disclosure.

[0022] Figure 4 This is a schematic diagram of the composition of an adversarial intent decoupling engine provided in this disclosure.

[0023] Figure 5 This is a flowchart illustrating a method for automating the handling of network security incidents provided in this disclosure.

[0024] Figure 6 This is a schematic diagram of the process for generating a threat vector field provided in this disclosure. Detailed Implementation

[0025] The technical solutions in this disclosure will now be clearly and completely described with reference to the accompanying drawings.

[0026] Figure 1 This is a schematic diagram illustrating the composition of an exemplary network system 100 provided in this disclosure. Figure 1In this system, network system 100 can predict, detect, and handle network security incidents. Specifically, communication network 125 provides broadband access 110 to multiple data terminals 114 via access device 112, wireless access 120 to multiple mobile devices 124 and vehicles 126 via base station or access point 122, voice access 130 to multiple telephone devices 134 via switching device 132, and media access 140 to multiple audio / video display devices 144 via media terminal 142. Furthermore, communication network 125 is also connected to one or more audio, video, graphic, text, or other media content sources 175. Although broadband access 110, wireless access 120, voice access 130, and media access 140 are shown as separate forms, one or more of these access forms can be combined to provide multiple access services to a single client device (e.g., mobile device 124 can receive media content via media terminal 142, data terminal 114 can provide voice access via switching device 132, etc.).

[0027] Communication network 125 includes multiple network elements (NEs) 150, 152, 154, 156, etc., for implementing broadband access 110, wireless access 120, voice access 130, media access 140, and content distribution from content source 175. Communication network 125 may include circuit-switched or packet-switched networks, Internet Protocol (IP) networks, Voice over Internet Protocol (VoIP) networks, cable television networks, passive or active optical networks, 4G, 5G, or other wireless access networks, World Interoperability for Microwave Access (WiMAX) networks, ultra-wideband networks, personal area networks, or other wireless access networks, broadcast satellite networks, or other communication networks.

[0028] In various embodiments, the communication network 125 may include wired, optical, and / or wireless connections, and network elements 150, 152, 154, 156, etc., may include service switching points, signal transfer points, service control points, network gateways, media distribution hubs, servers, firewalls, routers, edge devices, switches, and other network nodes for routing and controlling communication traffic over wired, fiber optic, and wireless connections, as part of the Internet and other public networks, as well as one or more private networks. These network elements are also used to manage user access, billing and network management, and other network functions.

[0029] In addition, Figure 1The system also includes a device 200 for processing network security incidents that operates within or is operatively superimposed on the communication network 125. This device 200 may be implemented as one or more devices (e.g., server devices) configured to detect and process network security incidents within the communication network 125.

[0030] although Figure 1 As not shown, the device 200 for handling network security incidents can be connected to... Figure 1 It communicates with other devices within the network, and this communication connection may include wired and / or wireless networks. For example, the network may include cellular networks (such as Long Term Evolution (LTE) networks, Code Division Multiple Access (CDMA) networks, 3G networks, 4G networks, 5G networks, and other next-generation networks), Public Land Mobile Networks (PLMNs), Local Area Networks (LANs), Wide Area Networks (WANs), Metropolitan Area Networks (MANs), telephone networks (such as Public Switched Telephone Networks (PSTNs)), private networks, self-organizing networks, intranets, the Internet, fiber optic networks, cloud computing networks, and combinations of these networks. Furthermore, Figure 1 Other devices connected to device 200 may generate, store, process and / or provide data related to device 200 in handling network security incidents (e.g., network-related data, control data, etc.).

[0031] Figure 2 This is a schematic diagram illustrating the composition of a device 200 for automatically handling network security incidents as provided in this disclosure. Figure 2The device 200 includes a probe section 210, a processing section 220, and a transmission section 230. The probe section 210 is communicatively connected to the processing section 220 and is deployed at the edge of the transmission link in the communication network 125. For example, the probe section 210 can be deployed on the communication port of network elements 150, 152, 154, and 156 as edge devices, or as a mirror port of a switch, router, or network gateway. The transmission section 230 is also communicatively connected to the processing section 220 and is deployed at a network node capable of controlling the signal forwarding path in the communication network 125, such as network elements 150, 152, 154, and 156 as network gateways, or the transmission section 230 can be integrated into a network controller (such as a Software Defined Network (SDN) controller) in the communication network 125.

[0032] The probe portion 210 is configured to capture data streams flowing through the edge of the transmission link and extract multidimensional fingerprint vectors from the data streams. In some examples, the probe portion 210 continuously monitors the data streams flowing through the edge of the transmission link and uses dynamic window segmentation to segment the continuous data streams. Specifically, the probe portion 210 can monitor the network traffic characteristics at the edge of the transmission link and adaptively adjust the time window length according to these characteristics to capture the data stream within each time window. For example, a baseline time window length of 100ms or 50 consecutive data packets can be set. When the probe portion 210 detects a sudden increase in traffic (e.g., the traffic rate exceeds three standard deviations of the historical average traffic rate), the time window length is extended to 150ms to ensure that a complete application layer protocol interaction cycle of data streams can be captured within a single time window. This ensures the stability and completeness of the multidimensional feature vector extraction.

[0033] In this disclosure, probe portion 210 extracts multidimensional features for each time window of the data stream according to three exemplary modalities, and forms a multidimensional fingerprint vector. In this disclosure, the multidimensional features include sequence entropy values, deviations in cross-layer protocol interactions, and latency jitter components.

[0034] In some examples, probe section 210 calculates the sequence entropy value of the data stream using payload statistical modality, which is the dispersion of the payload length distribution of all packets in the data stream. For attack traffic, such as encrypted C2 (Command and Control) communication, polymorphic malware payloads, or certain types of denial-of-service attacks, the distribution of packet payloads often exhibits entropy characteristics different from normal business traffic. Specifically, within a single time window, all packets in the data stream are statistically analyzed according to the frequency of their payload length occurrences, and the sequence entropy value is calculated. For example, if there are a total of [number missing] payload lengths... Class, where the first The frequency of the payload length in the data stream is Then the sequence entropy value of that single time window It is calculated by the following formula:

[0035]

[0036] It is understandable that a high entropy value usually means that the payload length distribution of data packets in the data stream is more random, and the data stream is more likely to be associated with encryption, obfuscation or certain scanning behaviors.

[0037] In some examples, probe section 210 analyzes the deviation of cross-layer protocol interactions through protocol interaction modal analysis. Specifically, probe section 210 establishes a protocol stack context association rule to characterize the logical dependencies between application layer fields and transport layer fields. For example, when the HTTP request method is POST, the transport layer TCP flag is set along with PSH+ACK. It can be understood that abnormal HTTP requests will disrupt this logical dependency; that is, when the above logical dependency is disrupted, it indicates a deviation in cross-layer protocol interactions.

[0038] This disclosure assesses the deviation of cross-layer protocol interactions based on co-occurrence probability or coupling weight. In assessing the deviation of cross-layer protocol interactions based on co-occurrence probability, the probe part 210 parses the interaction pattern by modeling a protocol field state machine. Specifically, this state machine includes core states such as connection establishment, data transmission, and connection termination. The transition between each state is triggered by the co-occurrence probability of transport layer flags (such as SYN, ACK, FIN, etc.) and application layer payload content (such as HTTP methods, TLS handshake information). For example, when the transport layer TCP flag is SYN-ACK and the application layer payload content contains the SSL / TLS handshake protocol, the state of the protocol field state machine transitions from connection establishment to data transmission. If a non-standard protocol identifier is detected in the application layer payload content, such as the unconventional HTTP method INJECT, the state machine is triggered to jump to an abnormal state. The co-occurrence probability is calculated by statistically analyzing the frequency of the joint occurrence of the transport layer flags and application layer payload content in historical traffic. For example, in historical traffic, the probability of transport layer flag A and application layer payload content B occurring simultaneously is calculated. for ,in, This represents the number of times the transport layer flag A and the application layer payload content B appear simultaneously in historical traffic. This represents the total number of data packets in historical traffic. It's understandable that low-probability events often carry high risk; therefore, the lower the probability of an event occurring, the higher its risk level and the greater its deviation. For example, this disclosure sets a frequency threshold to represent regular interactions, such as 0.1. When the co-occurrence probability of the transport layer flag—the TCP URG flag—and the application layer HTTP response code 500 is 0.02, this co-occurrence probability is significantly less than the frequency threshold for regular interactions (0.1). Therefore, the deviation of the cross-layer protocol interaction for a data packet with the transport layer flag being the TCP URG flag and the application payload being the HTTP response code 500 is high, constituting an abnormal deviation. In this disclosure, the probe portion 210 calculates the deviation of the cross-layer protocol interaction based on the negative log-likelihood of the co-occurrence probability.

[0039] In assessing the deviation of cross-layer protocol interactions based on coupling weights, the frequency of the joint occurrence of the transport layer flag and application layer payload content fields (i.e., co-occurrence probability) is first calculated from historical traffic. Then, the correlation strength between these two fields is calculated using the covariance matrix, and this covariance matrix is ​​normalized to obtain the coupling weight. For example, probe 210 calculates the normalized Pearson correlation coefficient based on the covariance matrix and uses this correlation coefficient as the coupling weight. Next, probe 210 calculates the real-time correlation coefficient of the joint occurrence of the same fields in the data packets of the real-time data stream, and uses the difference between this real-time correlation coefficient and the coupling weight as the deviation of the cross-layer protocol interaction. For example, in historical traffic, when the HTTP Content-Type is application / json, its covariance coefficient with the TCP window size is 0.68, and the normalized coupling weight label is 0.68. However, in the real-time data stream's packet window, the real-time correlation coefficient for the event "HTTP Content-Type is application / json" is -0.21. Therefore, the cross-layer protocol interaction deviation of this packet is |-0.21-0.68|=0.89. It can be understood that the cross-layer protocol interaction deviation is high, indicating a high probability of an anomaly.

[0040] In some examples, probe section 210 measures and identifies delay jitter components in anomalous data packets using dynamic delay mode. Specifically, probe section 210 employs a sliding baseline calibration technique, setting the sliding window size to a number of consecutive data packets (e.g., 10). Then, the average arrival time interval of adjacent data packets within the sliding window is used as the baseline delay, and the historical baseline delay is weighted relative to the arrival time interval of the current data packet for baseline updates, as shown in the following baseline update formula:

[0041]

[0042] In the above formula, Indicates the current data packet arrival time interval. Indicates the baseline delay of the previous time. This represents a smoothing factor, such as 0.8. Then, probe section 210 defines the number of times the absolute value of the arrival time interval of the current data packet deviates from the baseline and exceeds a multiple of the baseline standard deviation as a jitter component. The baseline standard deviation is the standard deviation of the time intervals of all adjacent data packets within the sliding window. In this disclosure, if the absolute value of the arrival time interval of the current data packet deviates from the baseline delay by more than three times the baseline standard deviation, this difference is marked as an abnormal jitter component. For example, if the baseline delay is 20ms and the baseline standard deviation is 5ms, when the arrival time interval of a data packet exceeds 35ms or is less than 5ms, the data packet is determined to have abnormal jitter.

[0043] In some examples, after extracting three features—sequence entropy, deviation of cross-layer protocol interaction, and latency jitter component—the probe part 210 aligns these three features spatiotemporally according to timestamp order and protocol interaction stage to form a multidimensional fingerprint vector. For example, in the TCP handshake stage corresponding to timestamp t1, if the calculated sequence entropy is 1.5 bits, the deviation is 0.6 (normalized value), and the abnormal jitter is 3.2 ms, then a multidimensional fingerprint vector V1=[1.5,0.6,3.2]. Subsequently, corresponding multidimensional fingerprint vectors {V1, V2, V3, ..., Vn} are generated in chronological order. These multidimensional fingerprint vectors can be used for subsequent analysis, and combined with the aforementioned feature acquisition methods, the multidimensional fingerprint vectors can quantify attack characteristics (such as abnormal situations) and distinguish network attack intentions (such as the occurrence of abnormal situations).

[0044] It is understandable that the probe part 210 is mainly implemented in software form, but hardware acceleration can be used in key calculation processes (such as entropy calculation and high-precision time delay measurement) to form a software and hardware co-deployment architecture.

[0045] After the probe section 210 extracts the multidimensional fingerprint vector, it transmits the multidimensional fingerprint vector to the processing section 220. The processing section 220 is configured to decouple the attack intent subspace from the multidimensional fingerprint vector and generate a threat vector field based on the attack intent subspace to characterize the attack intent and propagation path in the communication network. After generating the threat vector field, the processing section 220 is further configured to search for at least one transmission path with the lowest security risk in the communication network according to the gradient distribution of the threat vector field, and form the at least one transmission path into a minimum exposure path cluster.

[0046] See Figure 3The processing unit 220 includes an adversarial intent decoupling engine 222 and a decision module 224. The adversarial intent decoupling engine 222 decouples the attack intent subspace from the multidimensional fingerprint vector based on a Siamese network, and generates a threat vector field representing the attack intent and propagation path in the communication network using a hidden Markov chain based on the attack intent subspace. The decision module 224 searches for at least one transmission path with the lowest security risk in the communication network based on the gradient distribution of the threat vector field, and forms this at least one transmission path into a minimum exposure path cluster.

[0047] See in some examples Figure 4 The adversarial intent decoupling engine 222 includes a Siamese network 2221 and a Hidden Markov Model (HMM) 2224. In the adversarial intent decoupling engine 222, the Siamese network 2221 includes two sub-network branches 2221-A and 2221-B. These two sub-network branches share weights and have identical structures; for example, both sub-network branches are deep neural networks with the same structure. These two sub-network branches take historical normal traffic and multi-dimensional fingerprint vectors as inputs, respectively, and generate differential feature vectors containing only anomalous information through contrastive learning, thereby decoupling the attack intent subspace from the multi-dimensional fingerprint vector.

[0048] Specifically, taking subnetwork branch 2221-A as inputting historical normal traffic and subnetwork branch 2221-B as inputting multidimensional fingerprint vectors as an example, the input to subnetwork branch 2221-A is a dataset sampled from a huge and continuously updated historical normal traffic. This dataset covers normal behavior vectors for all typical application scenarios in the network (such as HTTP web page access, DNS resolution, SSL / TLS encrypted communication, database access, etc.). The input to subnetwork branch 2221-B is a multidimensional fingerprint vector. To effectively utilize the feature extraction capabilities of deep neural networks, this disclosure reshapes a one-dimensional vector sequence into a two-dimensional feature tensor. For example, the fingerprint vectors (each vector has C dimensions) of L consecutive data packets within a time window are stacked to form a tensor of shape [L, C]. For instance, the first 128 bytes of the maximum payload within a time window are combined with TCP flags to form a two-channel tensor, where one channel is the payload and the other channel is the flags.

[0049] Furthermore, both sub-network branches internally include multiple stacked convolutional layers, pooling layers, and fully connected layers. The weights of sub-network branch 2221-A are obtained through pre-training on a historical normal traffic dataset. Its training objective is to minimize the reconstruction error of the input features (similar to an autoencoder), thereby learning a compact representation of the coupling weights of protocol fields and their temporal relevance in normal traffic. In sub-network branch 2221-A, the encoder extracts the coupling features between transport layer flags and application layer payload content by stacking three convolutional layers, outputting a one-dimensional compressed 128-dimensional feature vector, and the optimizer uses Adam (i.e., adaptive moment estimation) with a learning rate set to 0.001.

[0050] The convolutional layers in sub-network branch 2221-B employ deformable convolutional kernels. This means the shape and size of the kernels are not fixed but dynamically adjusted based on input features (such as the length of cross-layer protocol fields in real-time data streams). For example, for high-load traffic like HTTP long connections, the kernel can adaptively expand to 5×5 to capture the offset between the payload content and the TCP window size; while for short-connection traffic like DNS queries, it can shrink to 3×3 to focus on key fields. This allows sub-network branch 2221-B to better adapt to the diversity of real-time data streams.

[0051] In addition, the outputs of the two sub-network branches are each encoded as a low-dimensional (e.g., 128-dimensional) floating-point feature vector, such as... and Subsequently, the difference between these two floating-point feature vectors is obtained, for example, by calculating the Euclidean distance or subtracting element-wise to obtain the difference feature vector. The difference feature vector The magnitude and direction of the data stream directly reflect the degree and direction of deviation of the real-time data stream from the normal flow. In this way, the twin network 2221 can decouple the attack intent subspace represented by the difference feature vector from the real-time data stream.

[0052] After the Siamese network 2221 transmits the differential feature vector sequence, formed by time-series differential feature vectors, to the HMM 2224, the HMM 2224 discretizes the differential feature vector sequence and maps it to a finite set of observation symbols for subsequent processing. Specifically, the differential feature vector sequence output over T consecutive time windows is generated by... Composition. Since the differential feature vectors are continuous vectors, each differential feature vector needs to be discretized first through vector quantization or clustering (such as K-Means), mapping it to a finite set of observation symbols, such as the observation symbol set. , KThe value range is 64 to 256. For example, a 128-dimensional difference feature vector space can be divided into 256 cluster centers, each center representing an observation symbol. The set of observation symbols arranged in temporal order forms an observation symbol sequence.

[0053] In this disclosure, the set of hidden states in HMM 2224 is given explicit cybersecurity semantics, corresponding to various stages (e.g., six) used to characterize the dynamic evolution of cyberattack behavior. For example, the set of hidden states... Furthermore, these six stages are reconnaissance scanning (such as attackers probing the target network, such as port scanning and service identification), initial penetration (such as using vulnerabilities to establish an initial access channel), privilege escalation (such as obtaining higher privileges through privilege escalation vulnerabilities or credential theft), lateral movement (such as expanding the scope of control in the network), data leakage (such as transmitting sensitive data to the C2 server), and persistent residence (such as implanting backdoors or scheduled tasks to maintain long-term access).

[0054] For the above 6 hidden states, the state transition probability matrix of HMM 2224 is... elements Indicates from stage i Transition to stage j The probability, i.e. ,in, Indicates the current moment. This represents the previous time step. Understandably, the state transition probability matrix... The initial values ​​are determined based on the temporal patterns of attack samples at each stage in historical traffic. For example, the state transition probability from the reconnaissance and scanning stage to the initial penetration is initialized to 0.6, and the state transition probability from the initial penetration to data leakage is initialized to 0.3.

[0055] In this disclosure, after receiving the observed symbol sequence, HMM 2224 uses a forward-backward algorithm to calculate the most likely hidden state sequence at the current time. Specifically, it employs bidirectional state propagation to simultaneously calculate the forward propagation probability and the backward residual risk probability, i.e., the probability of recursively calculating from the initial state to the current attack stage and the probability of backtracking from the terminated state to the current stage, and comprehensively derives the confidence level of the attack intent. For example, if the current differential feature vector indicates penetration behavior, the forward probability is updated to 0.7, the backward residual risk probability is 0.4, and the comprehensive confidence level of the attack intent is 0.7 × 0.4 = 0.28. In this disclosure, the probability distribution of the attack intent is represented as a weighted aggregation of the posterior probabilities of the hidden states, i.e. ,in express t Hidden state at all times s The posterior probability, The attack type weights corresponding to hidden state s are defined as follows: for example, the weight for reconnaissance scanning is 0.4, and the weight for initial penetration is 0.6. On nodes or links of the communication network, based on the aforementioned posterior probabilities, a heatmap is generated to display the probability of the current node's location at each stage, thus forming an attack intent probability distribution cloud map. Furthermore, after calculating the posterior probability of each hidden state at each time point, HMM 2224 traverses all paths in the state transition probability matrix and selects the path with the largest entropy value based on the entropy value of the state transition probabilities. This path with the largest entropy value is the threat propagation path. The entropy value of the path is calculated using the following formula:

[0056]

[0057] in, path Indicates a path. i This represents the state index, used to traverse each state transition in all paths.

[0058] For example, if there are two paths in the state transition matrix: the first path is from reconnaissance scan to initial penetration with an entropy of 1.2, and the second path is from reconnaissance scan to persistent residence with an entropy of 0.8, HMM 2224 selects the first path as the path with the maximum entropy, which indicates that the attack intent of this path is more certain.

[0059] The threat vector field is generated by overlaying the probability distribution cloud map of attack intent with the threat propagation path. For example, when the probability of reconnaissance scanning intent is 0.7 and the probability of initial penetration is 0.3, the threat vector field marks the scanning path as a high-risk area in the topology link.

[0060] In this disclosure, the Siamese network 2221 and the HMM 2224 are trained using a unified contrastive loss function. Specifically, this loss function is reconstructed as the negative log-likelihood function of the state observation probabilities of the HMM 2224, i.e. ,in, Indicates the length of the time window. express t The observation symbols received at time HMM 2224 Indicates the first tThe hidden state corresponding to each time step. The parameters in the Siamese network are optimized by maximizing the negative log-likelihood function. Furthermore, the state transition gradients of the Hidden Markov Chain (HMM) are backpropagated to the protocol feature extraction layer of the Siamese network via the chain rule. That is, if a convolutional kernel weight in Siamese Network 2221 causes the generated differential feature vector to lead to an incorrect stage judgment in HMM 2224, the backpropagated gradient will adjust the weight of that convolutional kernel, making it more sensitive to key traffic features that can distinguish between the two stages. For example, if a convolutional kernel weight causes a reconnaissance scan to be misjudged as normal, the gradient update will strengthen the kernel's sensitivity to abnormal flags, such as unconventional TCP flag combinations.

[0061] In some examples, decision module 224 is configured to, upon receiving a threat vector field, construct an entropy-weighted decision matrix for dynamic transmission paths based on the gradient distribution of the threat vector field, and search for the transmission path with the lowest risk weight within the entropy-weighted decision matrix to form a cluster of minimally exposed paths. The construction of the entropy-weighted decision matrix is ​​based on the probability distribution of attack intent and threat propagation paths in the threat vector field. Specifically, the entropy value of the attack state transition probability matrix generated by the Hidden Markov Chain is mapped to a dynamic scaling factor for the topology link weights. For example, when the state transition entropy value of a communication link is 1.5, its weight is scaled to 1.5 times the original value, indicating a higher attack propagation risk for that link. The magnitude of the differential feature vectors generated by the Siamese network is converted into relative risk coefficients between topology links through normalization. For example, when the magnitude of the differential feature vector is 2.0, the risk coefficient is labeled as 0.8, used to quantify the threat propagation intensity between links. Based on the weights and relative risk coefficients of these links, a comprehensive risk weight for these links is formed, thus creating the entropy-weighted decision matrix.

[0062] After forming the entropy-weighted decision matrix, decision module 224 uses heuristic rules and a dynamic threshold adjustment strategy to perform path search, aiming to find the transmission path with the lowest risk weight to form a cluster of minimally exposed paths. Specifically, decision module 224 filters candidate paths based on the current entropy-weighted decision matrix, prioritizing paths with an entropy weight threshold lower than the dynamic upper limit. In this disclosure, the dynamic upper limit is calculated in real-time using the covariance of attack intent probability, and its calculation formula is as follows: ,in, The historical average entropy weight threshold, The standard deviation of the covariance. As an adjustment factor, it can be set to 2 in this disclosure. When a sudden increase in covariance leads to an expansion of the standard deviation, the dynamic upper limit is reduced, for example, from 0.6 to 0.4, to exclude high-risk paths.

[0063] In some examples, during the process of generating the minimum exposed path cluster through iteration, the optimal path obtained in each iteration is back-injected into the observation sequence of the Hidden Markov Chain. For example, in a certain iteration, path A is selected with an entropy weight of 0.3. Path A is the minimum exposed path, and its node attributes, such as protocol interaction frequency, can be encoded into observation symbols and trigger the prior distribution update of the state transition probability of the Hidden Markov Chain, thereby driving the adaptive recalibration of the protocol feature extraction layer of the Siamese network.

[0064] exist Figure 3 In this process, after the decision module 224 forms a minimum exposed path cluster, the transmission unit 230 is configured to form a shadow channel in the communication network based on the minimum exposed path cluster and redirect the data stream to the shadow channel for transmission. Specifically, the transmission unit 230 can switch the data stream that poses an attack threat from its original path to one or more paths in the minimum exposed path cluster by controlling network devices (e.g., modifying flow tables via the OpenFlow protocol of SDN). These switched paths form a logical shadow channel.

[0065] In some examples, when the data stream that generates the attack threat is transmitted in the shadow channel, the transmission part 230 is also configured to perform protocol-insensitive encapsulation processing on the data stream that generates the attack threat to form a heterogeneous protocol frame sequence, and transmit the heterogeneous protocol frame in the shadow channel so that the protocol characteristics of the heterogeneous protocol frame are changed compared to the original data stream, thereby dismantling the attacker's detection and attack methods based on protocol analysis.

[0066] Specifically, the transmission unit 230 divides the data stream that poses an attack threat into multiple variable-length fragments based on the fragmentation entropy value. More specifically, the transmission unit 230 calculates the entropy value of each frame length in the data stream to represent the distribution dispersion, and dynamically determines the fragment length based on the entropy value. For example, the higher the entropy value, the more random the information, and the longer the fragment; conversely, the lower the entropy value, the shorter the fragment, thus artificially increasing randomness by increasing the number and boundaries of fragments. Fragmentation entropy value Dynamic decay function It is related to the hidden state transition probability, specifically calculated by the formula. It means that, among them, The initial hidden state transition rate. As the attenuation coefficient increases, the state transition probability of the attack intent subspace decreases exponentially as the slice entropy gradient increases, forming a reverse coupling. For example, when the slice entropy increases sharply from 1.2 to 2.0, the state transition probability decreases from 0.6 to 0.3, suppressing the spread of high-entropy attack payload intent.

[0067] After fragmentation, the transmission section 230 reassembles and encapsulates the fragments into a heterogeneous protocol frame. The structure of this heterogeneous protocol frame includes: a pseudo-protocol header, which is a forged, compliantly formatted protocol identifier inserted at the beginning of the fragment. For example, a forged HTTP header (e.g., GET / index.html HTTP / 1.1\r\nHost:www.example.com\r\n), a forged SSH version negotiation string (e.g., SSH-2.0-OpenSSH_8.2p1), or other common protocol handshake information can be randomly inserted. This causes Deep Packet Inspection (DPI) systems that identify protocols based on payloads to make false judgments. Following the pseudo-protocol header are fragment data and random padding data. This random padding data refers to randomly generated bytes that conform to a specific byte distribution model after the fragment data, ensuring that the final total length of the protocol frame meets the Ethernet Maximum Transmission Unit (MTU) limit (typically 1500 bytes).

[0068] During the construction of heterogeneous protocol frames, the transport section 230 also mutates some non-critical fields in the TCP / UDP header to further increase the unpredictability of the traffic. For example, it can randomize the TCP window size field, the urgent pointer field (if the URG flag is not set), or change the initial value of the TTL in the IP header.

[0069] In detail, the heterogeneity rate of the protocol frame is based on the proportion of mutations in protocol fields within a fragment, specifically the percentage of mutated fields out of the total number of fields. For example, if a fragment contains 10 TCP flag fields, and 4 of these fields are randomized or rearranged, the heterogeneity rate is 40%. When the threat vector field detects an attack intent probability distribution offset exceeding a threshold, such as increasing from 0.3 to 0.6, the transmission section 230 can recalculate the target heterogeneity rate based on the posterior probability of the current attack subspace. For example, when the posterior probability is 0.6, the target heterogeneity rate increases from 30% to 50%, and the fragment reassembly rules are dynamically adjusted accordingly. If the target heterogeneity rate increases, the fragment length is shortened from the default 1024 bytes to 512 bytes, and the number of randomly padded fields is increased. If the attack intent probability decreases, the structure reverts to long fragments and standard fields. During transmission, the shadow channel continuously receives the link risk weights from the entropy weight decision matrix. For example, when a link weight rises to 0.9, it prioritizes the transmission of protocol frames with higher fragment entropy values ​​and heterogeneity rates exceeding 60%. At the same time, it feeds back the actual transmitted protocol field variation characteristics to the twin network to calibrate its anomaly detection convolution kernel weights.

[0070] In some examples, in addition to reassembling heterogeneous protocol frames, the transport portion 230 is also configured to inject deobfuscation noise packets into the original attack path of the data stream that generates the attack threat. Specifically, the generation of deobfuscation noise packets is based on the link risk weight of the minimum exposed path cluster and the protocol frame heterogeneity rate. For example, the generation rule for the deobfuscation noise packet content is as follows: if the risk weight of the current link's entropy weight decision matrix exceeds 0.7, then 30% of the transport layer flags in the noise packet are randomly replaced, such as changing the TCP ACK bit to the invalid combination URG+PSH, and padding payloads are inserted to make the length distribution dispersion match the fragmentation entropy value target, thereby triggering anomalies in the attacker's analysis tools. When the protocol frame heterogeneity rate is 50%, 50% of the fields in the application layer payload of the noise packet are replaced with invalid characters, such as the non-standard HTTP method "XPLOIT".

[0071] In addition, the injection frequency of the noise packet Through link risk weight Linear mapping, the formula is Where k is the base frequency, such as 10 packets / second. If a link weight is 0.8, the injection frequency is increased to 8 packets / second, thus allocating more interference resources to the most dangerous paths. The quantitative relationship of attack path interference is measured by the noise packet coverage rate and the rate of decrease in the probability of attack intent; for example, when noise packets cover 40% of the traffic on a certain path, the probability of attack intent drops from 0.7 to 0.4, and the observability of the path decreases by 50%.

[0072] In addition, to prevent other normal devices in the network (such as monitoring systems) from misidentifying these noise packets as attack traffic, the transmission section 230 employs a dual avoidance mechanism. First, dynamic whitelist verification: the five-tuple information (source IP, destination IP, source port, destination port, protocol) of the generated noise packets is announced to other security devices in the network in real time and added to the dynamic whitelist. Second, in-band hash verification: in some protocols that support extended fields (such as the TLS handshake), a key-based hash message authentication code (HMAC) known only to this system can be embedded in the extended field. The parsing module or probe at the destination can accurately identify and silently discard the noise packets by verifying this hash.

[0073] During the transmission of heterogeneous protocol frame sequences and / or reverse obfuscation noise packets in the shadow channel, the construction of heterogeneous protocol frames and the injection of reverse obfuscation noise packets are fed back to the aforementioned processing section for adaptive optimization of the model. Specifically, the degree of heterogeneity of protocol frames is quantified by the protocol field mutation rate. For example, when the randomization of TCP flag bits or the rearrangement ratio of HTTP header fields exceeds 30%, the dynamic offset of the observation symbol increases to 1.5, thereby correcting the observation probability of the Hidden Markov Chain. The link risk weights of the entropy weight decision matrix are mapped to the correction factor of the Hidden Markov Chain, through the co-occurrence probability of protocol fields. The nonlinear superposition of the piecewise entropy values, i.e. The spatiotemporal constraints of the reconstructed state transition matrix are then used. When the trajectory of the maximum entropy path deviates from the expected path, the protocol's encapsulation parameters, such as dynamically adjusting the fragment length (e.g., shortening the fragment length from 1024 bytes to 512 bytes, increasing the fragment entropy H from 1.2 to 2.0), decrease the state transition probability in the attack intent subspace of the threat vector field, thereby suppressing the spread of the attack path and guiding traffic to low-risk links. The topological attributes of the minimum exposed path cluster, such as node degree and link delay, are back-injected into the posterior probability space of the hidden state. The covariance matrix of the attack intent probability distribution cloud map and the threat propagation trajectory is used to generate adversarial perturbations, where the covariance matrix is ​​defined as the probability distribution of the attack intent. With maximum entropy path features The covariance matrix between For example, when the covariance exceeds the threshold of 0.5, noise gradient perturbation is injected into the threat vector field to interfere with the attacker's path detection capability, ultimately achieving dynamic defense.

[0074] Understandably, as new data streams arrive, the probe section 210 continuously monitors the traffic in the shadow channel and the situation on the original path, and generates new fingerprint vectors which are sent to the adversarial intent decoupling engine 222, and the threat vector field is updated in real time.

[0075] When the gradient of the threat vector field converges to a safety threshold, such as an attack probability ≤ 0.2, it is determined that the threat has subsided or the attacker has given up. The transmission section 230 switches the shadow channel back to the main link and removes the two active defense measures: protocol-insensitive encapsulation and reverse obfuscation noise packet injection. Furthermore, parameters effective in this defense, such as the state transition probabilities of the HMM, the weights of the Siamese network, the mapping function parameters of the entropy-weighted decision matrix, and the noise injection rules, will be saved as the baseline configuration for future defenses or used for incremental training of the model. This step addresses the issues of continuous optimization and adaptive evolution of the defense strategy.

[0076] For the aforementioned device 200 for handling network security incidents, by constructing a multi-dimensional fingerprint vector including sequence entropy, cross-layer interaction deviation, and latency jitter, and combining it with an adversarial intent decoupling model that integrates Siamese networks and Hidden Markov Chains, traffic behavior can be analyzed from a deep and multi-faceted perspective. Siamese networks effectively distinguish between normal and abnormal patterns, while Hidden Markov Chains model and infer the temporal evolution (attack chain) of attack behavior. This combination can accurately identify the attacker's true intent and the attack stage they are in, significantly reducing the false positive and false negative rates for covert attacks such as protocol spoofing and traffic encryption. Furthermore, this disclosure predicts the propagation direction and potential impact of attacks by generating a threat vector field. Based on this prediction, it dynamically plans the minimum exposure path cluster using an entropy-weighted decision matrix and activates shadow channels for traffic detours, enabling the reshaping of network topology to mitigate threats before network attacks cause substantial damage, thus improving security.

[0077] Based on the same inventive concept as the aforementioned technical solution, see [link to inventive concept]. Figure 5 This disclosure illustrates a method for automating the handling of cybersecurity incidents, the method comprising:

[0078] S502: Captures the data stream flowing through the edge of the transmission link and extracts a multidimensional fingerprint vector from the data stream.

[0079] S504: Based on twin networks, the attack intent subspace is decoupled from the multidimensional fingerprint vector, and a threat vector field is generated by hidden Markov chains based on the attack intent subspace to characterize the attack intent and propagation path in the communication network.

[0080] S506: Based on the gradient distribution of the threat vector field, search for at least one transmission path with the lowest security risk in the communication network, and form at least one transmission path into a minimum exposure path cluster.

[0081] S508: Form a shadow channel in the communication network based on the minimum exposed path cluster, and redirect the data stream to the shadow channel for transmission.

[0082] In some examples, the multidimensional fingerprint vector is formed by aligning the sequence entropy value, the deviation of cross-layer protocol interaction, and the delay jitter component in a spatiotemporal manner according to the time sequence and the protocol interaction stage.

[0083] In some examples, such as Figure 6 As shown, an attack intent subspace is decoupled from the multidimensional fingerprint vector based on a Siamese network, and a threat vector field is generated based on the attack intent subspace using a Hidden Markov Chain to characterize attack intent and propagation paths in the communication network, including:

[0084] S5042: Obtain differential feature vectors based on multidimensional fingerprint vectors using a Siamese network;

[0085] S5044: Generate a threat vector field through a hidden Markov chain based on the differential feature vector; wherein, the threat vector field includes an attack intent probability distribution and a threat propagation path, the attack intent probability distribution is represented as a weighted aggregation of the posterior probabilities of the hidden states, and the threat propagation path includes the transmission path with the largest entropy value among the state transition probabilities of the hidden Markov chain.

[0086] In some examples, the loss function used to train the Siamese network is the negative log-likelihood function of the state observation probabilities of the hidden Markov chain.

[0087] In some examples, the threat vector field includes an attack intent probability distribution and a threat propagation path; wherein the attack intent probability distribution is represented as a weighted aggregation of the posterior probabilities of the hidden states, and the threat propagation path includes the transmission path with the largest entropy value among the state transition probabilities of the hidden Markov chain.

[0088] In some examples, the method further includes:

[0089] The data stream that generates attack threats is encapsulated in a protocol-insensitive manner to form a heterogeneous protocol frame sequence, and this heterogeneous protocol frame sequence is transmitted in the shadow channel.

[0090] In some examples, the method further includes:

[0091] Inject reverse obfuscation noise packets into the original attack path of the data stream that generates the attack threat.

[0092] This disclosure also provides a computer-readable storage medium storing at least one instruction that is executed by a processor to implement the method for automating network security incident processing as described in the various embodiments above.

[0093] This disclosure also provides a computer program product including computer instructions stored in a computer-readable storage medium; a processor of a computing device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computing device to perform the method for automating the handling of network security incidents as described in the various embodiments above.

[0094] Those skilled in the art will recognize that the functions described in this disclosure in one or more of the examples above can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0095] It should be noted that the technical solutions described in this disclosure can be combined arbitrarily as long as they do not conflict.

[0096] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A device for automatically handling network security incidents, characterized in that, The device includes: a probe section deployed at the edge of a transmission link in a communication network, a processing section, and a transmission section; the probe section and the transmission section are communicatively connected to the processing section; wherein, The probe portion is configured to capture the data stream flowing through the edge of the transmission link and extract a multidimensional fingerprint vector from the data stream; the multidimensional fingerprint vector is formed by aligning the sequence entropy value, the deviation of cross-layer protocol interaction, and the delay jitter component in time order and protocol interaction stage. The processing section is configured to obtain differential feature vectors from the multidimensional fingerprint vectors based on a Siamese network, and generate a threat vector field characterizing attack intent and propagation paths in the communication network using a Hidden Markov Chain based on the differential feature vectors; and to search for at least one transmission path with the lowest security risk in the communication network according to the gradient distribution of the threat vector field, and to form a minimum exposure path cluster of the at least one transmission path; wherein, the Siamese network includes two sub-network branches, and the two sub-network branches respectively take historical normal traffic and multidimensional fingerprint vectors as inputs, and generate differential feature vectors including only abnormal information through contrastive learning; the input sequence of the Hidden Markov Chain is a sequence of differential feature vectors formed by the differential feature vectors in a time sequence and then discretized and mapped to a finite set of observation symbols; the threat vector field includes an attack intent probability distribution and a threat propagation path; the attack intent probability distribution is represented as a weighted aggregation of the posterior probabilities of the hidden states, and the threat propagation path includes the transmission path with the largest entropy value among the state transition probabilities of the Hidden Markov Chain; The transmission section is configured to form a shadow channel in the communication network based on the minimum exposed path cluster, and to redirect the data stream to the shadow channel for transmission.

2. The device according to claim 1, characterized in that, The processing part includes: an adversarial intent decoupling engine and a decision module; wherein, the adversarial intent decoupling engine is configured to decouple the attack intent subspace from the multidimensional fingerprint vector based on the Siamese network, and generate a threat vector field based on the attack intent subspace using a hidden Markov chain to characterize the attack intent and propagation path in the communication network. The decision module is configured to search for at least one transmission path with the lowest security risk in the communication network based on the gradient distribution of the threat vector field, and to form the minimum exposure path cluster from the at least one transmission path.

3. The device according to claim 1, characterized in that, The loss function used to train the Siamese network is the negative log-likelihood function of the state observation probability of the hidden Markov chain.

4. The device according to claim 2, characterized in that, The decision module is configured to construct an entropy-weighted decision matrix for dynamic transmission paths based on the gradient distribution of the threat vector field, and search for the transmission path with the lowest risk weight in the entropy-weighted decision matrix to form a cluster of minimally exposed paths.

5. The device according to claim 1, characterized in that, The transmission section is also configured to perform protocol-insensitive encapsulation processing on the data stream that generates the attack threat to form a heterogeneous protocol frame sequence, and to transmit the heterogeneous protocol frame sequence in the shadow channel.

6. The device according to claim 1, characterized in that, The transmission portion is also configured to inject reverse obfuscation noise packets into the original attack path of the data stream that generates the attack threat.

7. A method for automating the handling of network security incidents, characterized in that, The method includes: The data stream flowing through the edge of the transmission link is captured, and a multi-dimensional fingerprint vector is extracted from the data stream. The multi-dimensional fingerprint vector is formed by aligning the sequence entropy value, the deviation of cross-layer protocol interaction, and the delay jitter component in time order and protocol interaction stage. Based on the Siamese network, differential feature vectors are obtained from the multidimensional fingerprint vectors, and a threat vector field is generated using a hidden Markov chain to characterize attack intent and propagation paths in the communication network. The Siamese network comprises two sub-network branches, each taking historical normal traffic and the multidimensional fingerprint vector as inputs, respectively, and generating differential feature vectors containing only anomalous information through contrastive learning. The threat vector field includes an attack intent probability distribution and a threat propagation path. The attack intent probability distribution is represented as a weighted aggregation of the posterior probabilities of the hidden states, and the threat propagation path includes the transmission path with the highest entropy among the state transition probabilities of the hidden Markov chain. Based on the gradient distribution of the threat vector field, at least one transmission path with the lowest security risk is searched in the communication network, and the at least one transmission path is formed into a minimum exposure path cluster. A shadow channel is formed in the communication network based on the minimum exposed path cluster, and the data stream is redirected to the shadow channel for transmission.

8. The method according to claim 7, characterized in that, The method further includes: The data stream that generates an attack threat is encapsulated in a protocol-insensitive manner to form a heterogeneous protocol frame sequence, and the heterogeneous protocol frame sequence is transmitted in the shadow channel.

9. The method according to claim 7, characterized in that, The method further includes: Inject reverse obfuscation noise packets into the original attack path of the data stream that generates the attack threat.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which is executed by a processor to implement the method for automating network security incidents as described in any one of claims 7 to 9.

Images