Network security threat research and judgment method, system and equipment and storage medium

Abstract

The invention discloses a network security threat research and judgment method, system and device and a storage medium, and the method comprises the following steps: S1, obtaining network traffic, terminal logs, application program interface calling records and threat intelligence data in real time, carrying out the standardized cleaning and format conversion of the data, and building a unified data lake; s2, matching, identifying and determining threats through a preset known threat feature library, constructing a normal behavior baseline by using an unsupervised learning algorithm, and marking suspicious events deviating from the baseline; s3, for the suspicious event marked in the step S2, mining a potential attack path and an attack intention by combining knowledge graph technology associated asset information, a historical attack chain and a homologous IP address; and S4, based on the attack success probability, the influence asset importance and the diffusion speed, calculating a threat level by adopting a fuzzy comprehensive evaluation model, and generating a research and judgment report containing disposal suggestions.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, system, device and storage medium for network security threat assessment. Background Technology

[0002] As cyberattacks become increasingly complex, covert, and diverse, traditional threat detection methods struggle to identify new and unknown threats in real time and accurately. Furthermore, they are unable to effectively correlate multi-source heterogeneous data to assess the threat landscape, resulting in delayed threat response and high false positive and false negative rates.

[0003] Currently, the main approaches used are static matching techniques based on feature databases (such as firewalls and intrusion detection systems) and simple rule engines. These techniques identify known threats by pre-setting attack characteristics or behavioral rules, with some solutions introducing a single machine learning model to assist in detection. The main drawbacks of these current approaches are: weak ability to identify unknown threats and variant attacks, reliance on manual updates to the feature database; isolated analysis of multi-source data, lacking cross-domain correlation capabilities; difficulty in quantifying the scope and risk level of threat impact; and the absence of a closed loop of "detection-analysis-assessment-response," resulting in low threat handling efficiency. Summary of the Invention

[0004] This application provides a method, system, device, and storage medium for assessing network security threats to address the aforementioned problems.

[0005] On the one hand, this application provides a method for assessing network security threats, which includes the following steps: Step S1: Real-time acquisition of network traffic, terminal logs, application programming interface call records, and threat intelligence data; standardization and format conversion of the data to establish a unified data lake; Step S2: Threat identification through matching with a pre-set known threat feature database; simultaneously, constructing a baseline of normal behavior using an unsupervised learning algorithm and marking suspicious events deviating from the baseline; Step S3: For the suspicious events marked in Step S2, combining knowledge graph technology to associate asset information, historical attack chains, and IP addresses from the same source to mine potential attack paths and attack intentions; Step S4: Based on the probability of attack success, the importance of the assets affected, and the spread speed, calculating the threat level using a fuzzy comprehensive evaluation model and generating an assessment report containing handling recommendations.

[0006] In one implementation of this application, step S1 specifically includes: obtaining IOC data from a public threat intelligence platform through distributed crawler technology; capturing transport layer and application layer traffic in real time using network probes; collecting process behavior logs and system configuration information by calling the terminal agent interface; performing data cleaning, in which a desensitization algorithm is used to remove sensitive fields during the data cleaning process; and converting unstructured logs into structured data through natural language processing technology to ensure data format consistency within the data lake.

[0007] In one implementation of this application, step S2 specifically includes: using an incremental update mechanism for the known threat feature database, synchronizing and automatically loading the latest attack features in the industry every hour; updating the normal behavior baseline in real time using a sliding window algorithm, and constructing baseline models for different network roles; and marking behaviors with deviations exceeding a preset threshold with multi-level warnings, wherein the deviation calculation combines Euclidean distance and cosine similarity for comprehensive judgment.

[0008] In one implementation of this application, step S3 specifically includes: constructing an association network containing asset nodes, vulnerability nodes, and attack nodes based on a knowledge graph, and using a graph neural network algorithm to mine hidden relationships between nodes; reconstructing the order of occurrence of suspicious events through time series analysis, and matching attack stages in conjunction with the ATT&CK framework to identify potential incomplete attack steps; using a clustering algorithm to analyze the attack patterns of IP addresses from the same source, and predicting subsequent attack targets by associating them with historical attack records.

[0009] In one implementation of this application, step S4 specifically includes: establishing an evaluation index system that includes the credibility of the attack source, the value of the target asset, and the difficulty of exploiting the vulnerability; using the analytic hierarchy process to determine the weight of each index; dynamically adjusting the evaluation model parameters based on real-time attack and defense confrontation data; and classifying the threat level into four levels: low, medium, high, and emergency; wherein, emergency level threats automatically trigger emergency plans and are simultaneously pushed to the security operations center.

[0010] In one implementation of this application, the method further includes: comparing the assessment report with actual attack events, calculating the assessment accuracy and false negative rate, and using a reinforcement learning algorithm to optimize the behavioral baseline model in step S2 and the evaluation index weights in step S4, forming a self-iterative threat assessment mechanism to improve the ability to identify new threats.

[0011] In one implementation of this application, step S3 further includes: deploying lightweight federated clients on the edge nodes of each independent network domain based on a federated learning framework, and establishing a point-to-point encrypted data channel through asymmetric encryption and a secure handshake protocol; wherein, the independent network domains include, but are not limited to: office network, production network, and business network; without transmitting the original data, each client trains a local analysis model based on local suspicious event data, and encrypts and uploads the model gradient or intermediate feature vector to the federated server for aggregation and optimization; integrating the model update results of each domain, generating a global threat association model, and distributing it to each domain for local suspicious event re-identification and attack chain reconstruction.

[0012] Secondly, this application also provides a network security threat assessment system, which includes: a data fusion module for real-time acquisition of network traffic, terminal logs, application programming interface call records, and threat intelligence data; standardized cleaning and format conversion of the data to establish a unified data lake; a preliminary screening and detection module for identifying threats by matching them against a pre-set known threat feature library; and using an unsupervised learning algorithm to construct a baseline of normal behavior and mark suspicious events that deviate from the baseline; a correlation analysis module for linking marked suspicious events with asset information, historical attack chains, and homologous IP addresses using knowledge graph technology to mine potential attack paths and attack intentions; and a threat level assessment module for calculating the threat level based on the probability of attack success, the importance of the assets affected, and the spread speed using a fuzzy comprehensive evaluation model, and generating an assessment report containing handling recommendations.

[0013] Furthermore, this application also provides a network security threat assessment device, the device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the aforementioned network security threat assessment method.

[0014] Finally, this application also provides a non-volatile computer storage medium for network security threat assessment, which stores computer-executable instructions that are executed by a processor to implement the aforementioned network security threat assessment method.

[0015] The network security threat assessment method, system, device, and storage medium provided in this application have the following beneficial effects: (1) Achieving deep integration and efficient utilization of multi-source heterogeneous data. Through technologies such as distributed crawlers, network probes, and terminal agents, multi-source heterogeneous data such as network traffic, terminal logs, API calls, and threat intelligence are collected in real time. After standardized cleaning, de-identification, and natural language processing, the unstructured data is uniformly converted into a structured format and stored in the data lake. This process effectively solves the integration problem caused by the complexity of data sources and different formats, lays a high-quality data foundation for subsequent accurate threat analysis, and significantly improves data utilization efficiency and the comprehensiveness of threat detection.

[0016] (2) Improve the accuracy and adaptability of detection for known and unknown threats. A dual detection mechanism combining "known feature library matching" and "unsupervised behavioral baseline analysis" is adopted. On the one hand, the latest threat features are synchronized in real time through an incremental update mechanism to accurately identify known attacks; on the other hand, a normal behavior baseline is dynamically constructed using a sliding window algorithm, and the deviation is quantified by combining Euclidean distance and cosine similarity to effectively discover unknown threats and abnormal variants. This dynamic and static combined detection strategy significantly reduces the false alarm and false negative rates and enhances the system's adaptive detection capability for new threats.

[0017] (3) Enhance the depth of threat correlation analysis and the intelligence level of attack intent identification. By constructing a knowledge graph that integrates nodes such as assets, vulnerabilities, and attacks, and using graph neural networks, time series analysis, and the ATT&CK framework for multi-level correlation analysis, it is possible to deeply explore hidden attack paths, behavior patterns of IPs from the same source, and potential incomplete attack steps. This method breaks through the limitations of isolated analysis in traditional detection technologies, realizes a leap from judging single-point anomalies to the global attack chain, accurately understands the attacker's intent, and improves the ability to recognize and respond to complex attacks.

[0018] (4) Establish a quantitative assessment and closed-loop optimization mechanism to achieve precise decision-making and continuous evolution in threat response. Using a fuzzy comprehensive evaluation model and analytic hierarchy process (AHP), the threat level is dynamically quantified from multiple dimensions, such as attack success probability and asset value, to achieve precise response decisions based on risk levels. Simultaneously, a reinforcement learning mechanism is introduced to optimize the baseline model and indicator weights by comparing the assessment results with actual events, forming a self-iterative closed loop of assessment-feedback-optimization. This system not only supports tiered emergency response but also possesses continuous learning and evolution capabilities, effectively improving the long-term response effectiveness to persistent and evolving threats. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart of a network security threat assessment method provided in this application embodiment; Figure 2 A diagram illustrating the composition of a network security threat assessment system provided in this application embodiment; Figure 3 This is a schematic diagram of a network security threat assessment device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] This application provides a method, system, device, and storage medium for network security threat assessment. The technical solutions proposed in this application will be described in detail below with reference to the accompanying drawings.

[0022] Figure 1 This is a flowchart illustrating a network security threat assessment method provided in an embodiment of this application. Figure 1 As shown, the method mainly includes the following steps: Step S1: Acquire network traffic, terminal logs, application programming interface call records, and threat intelligence data in real time, perform standardized cleaning and format conversion on the data, and establish a unified data lake.

[0023] In this application, firstly, distributed crawling technology is used to automatically collect IOC (Indicators of Compromise) data from multiple public and authorized threat intelligence platforms, ensuring the comprehensiveness and timeliness of threat intelligence. Secondly, high-performance probes are deployed at key network nodes to deeply capture full traffic data at the transport layer (such as TCP / UDP packets) and application layer (such as HTTP / DNS protocols), providing raw evidence for analyzing network layer attack behavior. Finally, lightweight agent proxies are deployed on terminal devices to collect fine-grained process behavior logs, system call sequences, and security configuration information in real time, constructing a complete behavioral profile of the endpoint. The synergy of these three technologies enables comprehensive data awareness from cloud to edge, and from external intelligence to internal traffic.

[0024] Furthermore, the collected raw data is characterized by its multi-source, heterogeneous, and unstructured nature, necessitating rigorous cleaning and standardization. The processing begins with a rule-based and machine learning-based de-identification algorithm to automatically identify and obfuscate sensitive fields such as personal identification information and key business data, ensuring privacy compliance. Subsequently, for unstructured text data such as system logs and application logs, natural language processing techniques are used for key entity identification, event extraction, and semantic parsing, converting it into a unified structured format such as JSON or columnar storage. This process not only eliminates ambiguity in data understanding but also lays a solid foundation for subsequent correlation analysis.

[0025] All cleaned, anonymized, and structured data is ultimately injected into a unified central data lake. The data lake uses a distributed file system as its storage foundation and employs a unified metadata management framework to catalog and manage various data assets. This design ensures high consistency, accessibility, and scalability of data from different sources and in different formats at the storage level. The uniformly formatted, high-quality data lake breaks down traditional data silos, providing a reliable and efficient data supply layer for advanced analytical functions such as threat signature matching, user behavior analysis, and machine learning modeling. It is the core infrastructure for the entire system to achieve intelligent analysis.

[0026] Step S2: Identify threats by matching them against a pre-set known threat feature database, and simultaneously use an unsupervised learning algorithm to construct a baseline of normal behavior and mark suspicious events that deviate from the baseline.

[0027] In this application, to address the rapid evolution of cybersecurity threats, the system employs an efficient incremental update mechanism for its known threat signature database. This mechanism establishes automated synchronization channels with multiple authoritative threat intelligence platforms (such as VirusTotal and AlienVault) via API interfaces, proactively retrieving the latest attack signatures hourly, including malicious IPs, domains, file hash values ​​(IoC), and the latest attack tactics, techniques, and procedures (TTPs). After format validation and redundancy filtering, the acquired signature data is automatically loaded into the online detection engine without manual intervention. This high-frequency incremental synchronization strategy ensures that the signature database covers the latest known threats globally in near real-time, significantly reducing the time lag between threat exposure and local protection, and substantially improving the system's immediate detection capability for known attacks.

[0028] To address unknown threats and anomalous behaviors that are difficult to describe with fixed features, the system employs unsupervised learning to construct a dynamic baseline of normal behavior. This baseline is not static but continuously learns from recent (e.g., the past 24 hours) historical behavior data using a sliding window algorithm, updating the baseline model in real time to accurately reflect the latest normal state of network and terminal behavior. More importantly, the system abandons a "one-size-fits-all" modeling approach, instead constructing unique baseline models for different network roles such as servers, user terminals, and network devices. For example, for servers, the focus is on monitoring their service port access sequences, while for terminals, the focus is on their process tree creation behavior. This differentiated modeling strategy significantly reduces false alarms caused by differences in role behavior, improving the accuracy of baseline analysis.

[0029] For real-time generated behavioral data, the system determines the anomaly level by comprehensively calculating its deviation from the corresponding behavioral baseline. This deviation does not rely on a single indicator but innovatively combines Euclidean distance and cosine similarity for a comprehensive judgment: Euclidean distance quantifies the overall deviation of behavior in numerical scale, while cosine similarity judges changes in the direction of behavioral patterns. The combination of these two methods comprehensively captures two anomaly patterns: "doing more" and "doing different things." Finally, based on the calculated comprehensive deviation score, the system activates a multi-level early warning system, such as "low-risk alert," "medium-risk warning," and "high-risk alert," thereby providing security analysts with tiered response priorities and enabling precise and efficient handling of security incidents.

[0030] Step S3: For the suspicious events marked in step S2, combine knowledge graph technology to associate asset information, historical attack chains and same-origin IP addresses to explore potential attack paths and attack intentions.

[0031] This application constructs a knowledge graph integrating assets, vulnerabilities, and attack entities to form a deeply correlated network threat analysis model. Utilizing graph neural network (GNN) algorithms to embed and represent complex relationships between nodes through deep learning, it effectively uncovers hidden attack associations and lateral movement paths that are difficult to detect using traditional methods. Building upon this, time-series analysis techniques are introduced to timestamp and reconstruct the behavioral sequences of alert events. Furthermore, the MITRE ATT&CK framework is used to calibrate attack tactics and techniques, thereby accurately identifying the current stage in the attack chain and inferring potential subsequent steps that attackers have not yet implemented, achieving proactive prediction of attack intent.

[0032] For attack source analysis, the system employs clustering algorithms (such as DBSCAN or K-Means) to segment and mine patterns in historical behavioral data of IP addresses from the same source, identifying different attack patterns such as scanning, brute-force attacks, and penetration attacks. Furthermore, it correlates and matches real-time attack events with historical attack records in a knowledge graph, predicting the attacker's next potential target asset or attack method through pattern similarity calculation and risk propagation reasoning. This method effectively overcomes the limitations of single-point alerts, realizing a shift from "post-event response" to "pre-event warning," significantly improving proactive defense capabilities.

[0033] Furthermore, based on the federated learning framework, lightweight federated clients are deployed at the edge nodes of each independent network domain, establishing point-to-point encrypted data channels through asymmetric encryption and a secure handshake protocol. These independent network domains include, but are not limited to, office networks, production networks, and business networks. Without transmitting raw data, each client trains a local analysis model based on local suspicious event data, encrypting and uploading the model gradients or intermediate feature vectors to the federated server for aggregation and optimization. The updated model results from each domain are integrated to generate a global threat correlation model, which is then distributed to each domain for local suspicious event re-identification and attack chain reconstruction.

[0034] Step S4: Based on the probability of attack success, the importance of the affected assets, and the speed of spread, a fuzzy comprehensive evaluation model is used to calculate the threat level and generate an assessment report containing disposal recommendations.

[0035] This application first constructs a multi-dimensional and quantifiable threat assessment indicator system, which comprehensively considers three core elements: attack source, target attributes, and the vulnerability itself. Specifically, the "attack source credibility" indicator assesses the probability of malicious intent by analyzing factors such as IP reputation history, attack frequency, and geographical location; the "target asset value" is graded and assigned values ​​based on the asset's importance in the business system, the sensitivity of stored data, and service continuity requirements; and the "vulnerability exploitation difficulty" is judged by comprehensively considering CVSS scores, vulnerability exploitation conditions (such as whether user interaction is required), and the effectiveness of existing protection measures. To scientifically determine the relative importance of the above three core indicators, the system adopts the Analytic Hierarchy Process (AHP), constructs a judgment matrix through expert scoring, and calculates the objective weight of each indicator after consistency verification, thereby avoiding subjective assumptions and ensuring the theoretical rigor and scientific nature of the assessment model.

[0036] To ensure the assessment model continuously adapts to the rapidly changing network attack and defense environment, the system introduces a dynamic parameter adjustment mechanism. This mechanism continuously incorporates real-time attack and defense data (such as vulnerability exploitation success rates, the latest threat intelligence, and attack blocking records) and uses machine learning algorithms to fine-tune and optimize the assessment model's judgment thresholds and weight parameters, thereby improving its accuracy and robustness in responding to new attack methods. Based on the model's comprehensive scoring results, the system precisely classifies the threat level into four levels: "low, medium, high, and urgent." This classification not only reflects the potential impact of the threat but also provides a clear decision-making basis for subsequent graded responses.

[0037] For threats classified as "urgent," the system will initiate a fully automated emergency response process. This process requires no manual intervention and automatically triggers pre-set emergency plans, executing immediate containment operations such as isolating affected hosts, blocking malicious IP addresses, and closing high-risk ports. Simultaneously, alert information, complete analysis reports, and handling updates are pushed in real-time via API to the Security Operations Center's (SOC) command dashboard and ticketing system, immediately alerting security analysts and providing them with comprehensive decision support. This mechanism achieves a closed-loop response within seconds, from "threat perception" to "automatic handling" and then to "human collaboration," significantly shortening the Mean Time To Response (MTTR) and effectively curbing the spread and damage of advanced threats.

[0038] In this application, after generating an assessment report containing handling recommendations, a rigorous feedback verification and quantitative evaluation mechanism is established to ensure the continuous evolution of threat assessment capabilities. This mechanism accurately compares the automatically generated assessment report with the finally confirmed actual attack events, and objectively measures the detection effectiveness of the current system model by calculating key performance indicators (KPIs), such as accuracy and false negative rate. These quantitative results, along with the corresponding raw data (such as alarm logs, network traffic packets, and terminal behavior sequences), are systematically collected and stored to form a high-quality feedback dataset, providing real and reliable training samples and optimization basis for subsequent model optimization.

[0039] Based on the aforementioned feedback data stream, this technical solution employs reinforcement learning algorithms (such as Deep Q-Learning or policy gradient methods) to construct a closed-loop optimization engine. This engine, with the reward objective of improving accuracy and reducing false negatives, automatically adjusts and optimizes the judgment threshold of the unsupervised learning behavior baseline model in step S2, and the weight allocation of various indicators (such as asset value and vulnerability exploitation difficulty) within the fuzzy comprehensive evaluation model in step S4. Through this continuous self-play and policy iteration, the entire judgment mechanism can dynamically adapt to new attack methods and changing network environments, ultimately forming an intelligent system with self-learning and self-evolution capabilities, significantly improving the ability to identify and warn of unknown threats and advanced persistent threats (APTs).

[0040] The above describes a method for assessing network security threats provided by embodiments of this application. Based on the same inventive concept, embodiments of this application also provide a network security threat assessment system. Figure 2 A diagram illustrating the composition of a network security threat assessment system provided in this application embodiment is shown below. Figure 2As shown, the system mainly includes: a data fusion module 201, used to acquire network traffic, terminal logs, application programming interface call records, and threat intelligence data in real time, perform standardized cleaning and format conversion on the data, and establish a unified data lake; a preliminary screening and detection module 202, used to identify threats by matching them against a preset known threat feature library, and simultaneously use unsupervised learning algorithms to construct a baseline of normal behavior and mark suspicious events that deviate from the baseline; a correlation analysis module 203, used to associate the marked suspicious events with asset information, historical attack chains, and same-origin IP addresses using knowledge graph technology, and to mine potential attack paths and attack intentions; and a threat level assessment module 204, used to calculate the threat level based on the probability of attack success, the importance of the assets affected, and the spread speed using a fuzzy comprehensive evaluation model, and generate an assessment report containing disposal recommendations.

[0041] The above describes a network security threat assessment system provided by an embodiment of this application. Based on the same inventive concept, this application also provides a network security threat assessment device. Figure 3 This is a schematic diagram of a network security threat assessment device provided in an embodiment of this application, such as... Figure 3 As shown, the device mainly includes: at least one processor 301; and a memory 302 communicatively connected to the at least one processor; wherein the memory 302 stores instructions that can be executed by the at least one processor 301, and the instructions are executed by the at least one processor 301 to enable the at least one processor 301 to complete the aforementioned network security threat assessment method.

[0042] Below is an example of a specific application scenario of this application. A national commercial bank (hereinafter referred to as "Bank A") has fully deployed the cybersecurity threat assessment system described in this application. On a certain afternoon, the system successfully issued an early warning and dealt with a targeted ransomware attack that was stealthy and persistent, targeting its core business system. The specific process is as follows: Phase 1: Multi-source data collection and initial anomaly screening.

[0043] The attackers first exploited an undisclosed Office vulnerability (0-day) to create a phishing email, which was then sent to the email address of a department at Bank A, disguised as a policy notification from the central bank. An employee clicked on a malicious link (URL) in the email.

[0044] (1) Data Collection: The terminal agent immediately collected the behavior logs of the Word process on the employee's host launching an unconventional PowerShell script. Almost simultaneously, the network probe captured a DNS query and an encrypted HTTPS connection initiated by the host to an unknown external domain name, with minimal and brief traffic. The distributed crawler system had just synchronized a low-confidence IOC information from the threat intelligence platform two hours earlier, mentioning that the domain name might be related to a ransomware group that had been active recently.

[0045] (2) Initial screening: The known threat signature database failed to match the exploit behavior of this 0-day vulnerability, but its network connection behavior partially matched the low-confidence IOC, triggering a primary alert. More importantly, the unsupervised learning-constructed baseline model of "employee office terminal" behavior (based on the sliding window data of the last 7 days) detected that this PowerShell script execution behavior showed significant deviations in both command sequence parameters (large Euclidean distance deviation) and execution purpose (extremely low cosine similarity to office behavior patterns), with the overall deviation score exceeding the "high-risk" threshold. The system marked it as a high-risk suspicious event.

[0046] Phase Two: Cross-Domain Correlation Analysis and Attack Chain Reconstruction.

[0047] The system did not treat this as an isolated incident, but immediately initiated a deep correlation analysis.

[0048] (3) Association Mining: The knowledge graph association analysis module began working. The graph showed that the IP address mapped to the suspected host (asset node) had brief SMB communication with a server (asset node) in the industry's development and testing environment within the past 24 hours. This server has a known SMB sharing vulnerability (vulnerable node). The graph neural network algorithm inferred that there was a hidden potential "lateral movement" path between the two. The time sequence analysis reconstructed the sequence of events: first the external connection, then the internal lateral communication. Combined with the ATT&CK framework, the system determined that the attack had moved from the "initial access" stage to the "lateral movement" stage, and predicted that the attacker's next intention was to try to exploit the SMB vulnerability to penetrate the development and testing server.

[0049] Cross-domain analysis: Almost simultaneously, federated learning clients in Bank A's independent "office network" and "business network" domains detected similar suspicious behavior locally. Without exchanging any raw data, each domain only uploaded encrypted model updates to the federated server for aggregation and optimization. After the generated global model was distributed, the office network system immediately strengthened its detection of PowerShell-like abnormal behavior, while the business network system strengthened its monitoring of abnormal SMB connections initiated from office network IPs. The "TTPs" signature of this attack was shared by all network domains, achieving comprehensive collaborative defense across all domains.

[0050] Phase 3: Dynamic risk assessment and automated closed-loop response.

[0051] (4) Threat Assessment: The threat assessment module is activated. The assessment index system is calculated as follows: "Attack Source Credibility" is rated as medium risk due to its association with IOC; "Target Asset Value" is rated as medium value due to the presence of a small amount of anonymized test data on the development and testing server; "Exploitation Difficulty" is rated as low difficulty due to the maturity of the SMB vulnerability exploitation tool. The Analytic Hierarchy Process (AHP) assigns a higher weight to "Exploitation Difficulty". After comprehensive fuzzy evaluation, the system determines this threat to be at the emergency level—because the attacker has entered the internal network and is using a mature vulnerability to move towards the server containing data, resulting in a high probability of success and a fast spread speed.

[0052] (5) Automatic Response: The emergency response plan is triggered immediately upon the "emergency" determination. The system automatically performs the following actions through API calls: isolate the suspected office host network; block all SMB communication from the office network to the development and testing server; disable the suspicious account on the development and testing server; push the complete analysis report (including attack chain reconstruction diagram, threat level assessment basis, and list of handling actions) to the SOC platform and issue the highest level alarm.

[0053] (6) Feedback Optimization: It was later confirmed that this was an unsuccessful ransomware delivery incident. The SOC analyst confirmed the accuracy of the assessment in the report. The system included the data from this incident in the feedback dataset. One week later, the reinforcement learning algorithm began to optimize the model, slightly increasing the deviation weight of the "Office process startup script" behavior in the behavioral baseline model, making it more sensitive to the detection of similar attacks in the future.

[0054] In addition, embodiments of this application also provide a non-volatile computer storage medium for network security threat assessment, which stores computer-executable instructions, which are executed by a processor to implement the aforementioned network security threat assessment method.

[0055] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0056] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0058] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0059] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0060] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0061] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A method for assessing network security threats, characterized in that, The method includes the following steps: Step S1: Acquire network traffic, terminal logs, application programming interface call records and threat intelligence data in real time, perform standardized cleaning and format conversion on the data, and establish a unified data lake; Step S2: Identify and determine threats by matching them against a pre-set known threat feature database, and at the same time use an unsupervised learning algorithm to construct a baseline of normal behavior and mark suspicious events that deviate from the baseline; Step S3: For the suspicious events marked in step S2, combine knowledge graph technology to associate asset information, historical attack chains and same-origin IP addresses to explore potential attack paths and attack intentions; Step S4: Based on the probability of attack success, the importance of the affected assets, and the speed of spread, a fuzzy comprehensive evaluation model is used to calculate the threat level and generate an assessment report containing disposal recommendations.

2. The method for assessing network security threats according to claim 1, characterized in that, Step S1 specifically includes: The system uses distributed crawler technology to obtain IOC data from public threat intelligence platforms, employs network probes to capture transport layer and application layer traffic in real time, and calls the terminal agent interface to collect process behavior logs and system configuration information. Data cleaning is performed, during which sensitive fields are removed using desensitization algorithms, and unstructured logs are converted into structured data using natural language processing technology to ensure data format consistency within the data lake.

3. The method for assessing network security threats according to claim 1, characterized in that, Step S2 specifically includes: An incremental update mechanism is used for the known threat signature database, which synchronizes the latest attack signatures in the industry every hour and loads them automatically. The baseline for normal behavior is updated in real time using a sliding window algorithm, and baseline models are constructed separately for different network roles. Multi-level warnings are issued for behaviors that deviate from a preset threshold. The deviation is calculated by combining Euclidean distance and cosine similarity.

4. The method for assessing network security threats according to claim 1, characterized in that, Step S3 specifically includes: A knowledge graph-based network containing asset nodes, vulnerability nodes, and attack nodes is constructed, and graph neural network algorithms are used to uncover hidden relationships between nodes. By reconstructing the sequence of suspicious events through time-series analysis and combining the ATT&CK framework to match attack phases, potential incomplete attack steps can be identified. Clustering algorithms are used to analyze the attack patterns of IP addresses from the same source, and historical attack records are correlated to predict subsequent attack targets.

5. The method for assessing network security threats according to claim 1, characterized in that, Step S4 specifically includes: Establish an evaluation index system that includes attack source credibility, target asset value, and vulnerability exploitation difficulty, and use the analytic hierarchy process (AHP) to determine the weight of each index. Based on real-time attack and defense data, the evaluation model parameters are dynamically adjusted, and the threat level is divided into four levels: low, medium, high, and emergency. Among them, emergency level threats automatically trigger emergency plans and are simultaneously pushed to the security operations center.

6. The method for assessing network security threats according to claim 1, characterized in that, The method further includes: comparing the assessment report with actual attack events, calculating the assessment accuracy and false negative rate, and using reinforcement learning algorithms to optimize the behavioral baseline model in step S2 and the evaluation index weights in step S4, forming a self-iterative threat assessment mechanism to improve the ability to identify new threats.

7. The method for assessing network security threats according to claim 1, characterized in that, Step S3 further includes: Based on the federated learning framework, lightweight federated clients are deployed at the edge nodes of each independent network domain to establish point-to-point encrypted data channels through asymmetric encryption and secure handshake protocols; the independent network domains include, but are not limited to: office network, production network, and business network. Without transmitting the original data, each client trains a local analysis model based on local suspicious event data, and then encrypts and uploads the model gradient or intermediate feature vector to the federated server for aggregation and optimization. Integrate the update results of models from various domains to generate a global threat association model, which is then distributed to various domains for local suspicious event re-identification and attack chain reconstruction.

8. A network security threat assessment system, characterized in that, The system includes: The data fusion module is used to acquire network traffic, terminal logs, application interface call records and threat intelligence data in real time, and to perform standardized cleaning and format conversion on the data to establish a unified data lake. The initial screening and detection module is used to identify threats by matching them against a pre-set known threat feature library. At the same time, it uses an unsupervised learning algorithm to build a baseline of normal behavior and mark suspicious events that deviate from the baseline. The correlation analysis module is used to identify potential attack paths and intents by associating marked suspicious events with asset information, historical attack chains, and similar IP addresses using knowledge graph technology. The threat level assessment module is used to calculate the threat level based on the probability of attack success, the importance of the assets affected, and the speed of spread, using a fuzzy comprehensive evaluation model, and to generate an assessment report that includes disposal recommendations.

9. A network security threat assessment device, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform a network security threat assessment method as described in any one of claims 1-7.

10. A non-volatile computer storage medium for network security threat assessment, storing computer-executable instructions, characterized in that, The computer-executable instructions are executed by a processor to implement a network security threat assessment method according to any one of claims 1-7.

Images