Attack chain modeling and serialization reasoning-based drilling behavior detection method and system

Abstract

The invention provides a drill behavior detection method and system based on attack chain modeling and serialized reasoning, and the method comprises the steps: an attack chain knowledge graph comprises a tactical node and a technical node, the tactical node is used for describing a tactical stage or a tactical state, and the technical node is used for describing a specific method or means for achieving a certain tactical; modeling the attack chain knowledge graph to obtain a state transition probability matrix among different tactical nodes and an observation probability matrix that a certain event is observed under a certain tactical node; dynamically reasoning and calculating the global confidence of the current system in a certain tactical stage under the continuous time sequence by adopting an HMM forward algorithm; the hierarchical risk value is determined according to the global confidence degree, the attack chain integrity and the asset risk level of the current system in a certain tactical stage under the continuous time sequence, and the corresponding response strategy is determined according to the hierarchical risk value, so that the reliability of network attack and defense drill behavior detection is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and network attack and defense exercise detection, and in particular to an exercise behavior detection method and system based on attack chain modeling and serialized reasoning. BACKGROUND

[0002] In network attack and defense exercises, the red team (the attacking side) usually gradually realizes the invasion of the target through a series of tactical steps such as scanning, penetration, horizontal movement, and persistence, and the blue team (the defending side) usually gradually realizes the invasion behavior detection and identification through a series of tactical steps such as behavior detection. Exercise behavior detection in network attack and defense exercises plays an important role in successfully identifying network attacks and identifying the stage of network attacks.

[0003] In recent years, the MITRE ATT&CK framework has proposed a standardized description of tactics and techniques, but existing attack and defense exercise behavior detection methods mostly rely on single-type node feature matching or rule-based alerts, making it difficult to model the attack chain globally, resulting in a lack of complete context for the blue team in tracing and defense. Or only through a single threshold to determine whether an attack exists, which cannot distinguish between "low-risk exploratory attacks" and "high-risk APT attacks", resulting in an unreasonable allocation of defense resources in response strategies.

[0004] In summary, the network attack and defense exercise behavior detection in the prior art is not highly reliable. To solve the problem of low reliability of network attack and defense exercise behavior detection in the prior art, the present application is proposed. SUMMARY

[0005] The present application is proposed to solve the problems existing in the prior art, and an exercise behavior detection method and system based on attack chain modeling and serialized reasoning are innovatively proposed, which effectively solve the problem of low reliability of network attack and defense exercise behavior detection caused by the prior art, and effectively improve the reliability of network attack and defense exercise behavior detection.

[0006] The first aspect of the present application provides an exercise behavior detection method based on attack chain modeling and serialized reasoning, comprising: obtaining network attack event history data and converting network attack history data events into event sequences; constructing an attack chain knowledge graph based on network attack event history data, the attack chain knowledge graph comprising tactical nodes and technical nodes, the tactical nodes being used to describe tactical stages or tactical states, and the technical nodes being used to describe specific methods or means for implementing a certain tactic; modeling the attack chain knowledge graph to obtain a state transition probability matrix between different tactical nodes and an observation probability matrix of observing a certain event under a certain tactical node; Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. Based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, a tiered risk value is determined, and the corresponding response strategy is determined based on the tiered risk value.

[0007] Optionally, the attribute information of tactical nodes includes tactical ID, tactical name, tactical phase sequence, typical technology list, and risk level; the attribute information of technical nodes includes attack technology ID, attack technology name, attack technology signature, required permissions for the attack technology, and associated vulnerabilities.

[0008] Optionally, the state transition probability matrix between different tactical nodes is as follows: ; ; in, Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. This is the corrected state transition probability matrix between tactical node i and tactical node j. For normalization parameters, This is the state transition probability matrix between tactical node i and tactical node j before correction. For topological correlation factor, As an asset importance factor; Wherein, the state transition probability matrix between tactical node i and tactical node j before correction The specific method for determining it is as follows: ; in, Let be the fundamental probability matrix for the state transition between tactical node i and tactical node j. The time decay factor, This represents the difference in timestamps between tactical node i and tactical node j.

[0009] Furthermore, the fundamental probability matrix of the state transition between tactical node i and tactical node j The specific method for determining it is as follows: ; in, Let i be the number of transitions from tactical node i to tactical node j. For the total number of transitions at tactical node i; or, ; wherein, is the weight from the tactical node i to the tactical node j, is the weight from the tactical node i to the tactical node , is the kth tactical node directly connected to the tactical node i after the tactical node i; wherein, the weight from the tactical node i to the tactical node j is determined in the following manner: ; wherein, is the number of times of transition from the tactical node i to the tactical node j in the historical data of network attack events, is the total number of transitions of the tactical node i in the historical data of network attack events, is the phase risk coefficient of the tactical node j in the historical data of network attack events.

[0010] Optionally, the observation probability matrix of an event observed under a certain tactical node is specifically: ; wherein, is the observation probability matrix of the event observed under a certain tactical node j, is the number of times of observation of the event under a certain tactical node j, is the total number of observations under a certain tactical node j; or, ; wherein, is the relative proportion of the occurrence of the technical node k under the tactical node j, is the relative proportion of the occurrence of the technical node under the tactical node j, is the kth technical node directly connected to the tactical node j after the tactical node j; wherein, the relative proportion of the occurrence of the technical node k under the tactical node j is determined in the following manner: ; ; wherein, is the occurrence frequency of the technical node k after the tactical node j, is the total number of technical nodes after the tactical node j; When a new attack technology is detected, the technical node k is added in the knowledge graph new ​​; the observation probability matrix of observing an event under a certain tactical node is automatically updated based on the correlation between the new attack technology and the existing tactics.

[0011] Optionally, the global confidence of the current system in a certain tactical stage under a continuous time sequence is dynamically inferred and calculated by using the HMM forward algorithm according to the state transition probability matrix between different tactical nodes and the observation probability matrix of observing an event under a certain tactical node. Specifically, the global confidence of the current system in a certain tactical stage under a continuous time sequence is calculated as follows: A set of tactical nodes S={s1…s M} and a set of observed event sequences O={o1…o t} are constructed; wherein M is the total number of tactical nodes, o t is an event observed at the current time point t; A sliding window is established for the recent events, and the event sequences satisfying the establishment of the sliding window are screened and obtained; The forward probability of each tactical node at each time point is calculated by using the improved HMM according to the state transition probability matrix between different tactical nodes and the observation probability matrix of observing an event under a certain tactical node. The global confidence of the current system in a certain tactical stage under a continuous time sequence is calculated according to the chain type composed of nodes in the knowledge graph.

[0012] Further, the forward probability of each tactical node at each time point is calculated by using the improved HMM according to the state transition probability matrix between different tactical nodes and the observation probability matrix of observing an event under a certain tactical node. Specifically, the forward probability of each tactical node at each time point is calculated as follows: ; Wherein, is the forward probability of the tactical node j at the current time point t, is the forward probability of the tactical node i at the previous time point t-1, is the normalized and corrected state transition probability matrix between the tactical node i and the tactical node j is the observation probability matrix of observing the event o under the tactical node j at the current time point t.

[0013] Optionally, the global confidence of the current system in a certain tactical stage under a continuous time sequence is calculated as follows: If the chain type composed of nodes in the knowledge graph is a linear chain, the forward probability of each tactical node at each time point is calculated by using the cumulative summation, and the global confidence of the current system in a certain tactical stage under a continuous time sequence is calculated. If the chain type formed by the nodes in the knowledge graph is a parallel chain, the forward probability of each tactical node at each time point is maximized, and the global confidence of the current system in a certain tactical stage under a continuous time sequence is calculated.

[0014] Optionally, the layered risk value is determined according to the global confidence of the current system in a certain tactical stage under a continuous time sequence, attack chain integrity, asset risk level, and specifically is: ; Wherein, R is a layered risk value; is a weight coefficient of global confidence, and P is the global confidence of the current system in a certain tactical stage under a continuous time sequence; is a weight coefficient of attack chain integrity, and I is a ratio of the number of observed tactics to the total number of tactics of the current system under a continuous time sequence; is a weight coefficient of asset risk level, and A is an average risk score of the attacked assets of the current system under a continuous time sequence; According to the layered risk value, the corresponding response strategy is determined, and specifically is: When the layered risk value is not less than a first preset risk value, an automatic defense mechanism is started and an alarm is immediately given; when the layered risk value is not less than a second preset risk value and less than the first preset risk value, the automatic defense mechanism is started and the alarm is immediately given, the alarm information is pushed and human-computer interaction verification is performed; when the layered risk value is less than the second preset risk value, the global confidence of the current system in a certain tactical stage under a continuous time sequence, the attack chain integrity, the asset risk level, and the layered risk value are recorded.

[0015] The second aspect of the present application provides a drill behavior detection system based on attack chain modeling and sequential reasoning, comprising: An acquisition module acquires network attack event historical data and converts network attack historical data events into event sequences; A construction module constructs an attack chain knowledge graph based on network attack event historical data, wherein the attack chain knowledge graph comprises tactical nodes and technical nodes, the tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe specific methods or means for implementing a certain tactic; A modeling module models the attack chain knowledge graph to obtain a state transition probability matrix between different tactical nodes and an observation probability matrix of observing a certain event under a certain tactical node; A reasoning calculation module dynamically reasons and calculates the global confidence of the current system in a certain tactical stage under a continuous time sequence according to the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node by using an HMM forward algorithm. The determining module determines a hierarchical risk value according to global confidence of the current system in a certain tactical stage under a continuous time sequence, attack chain integrity, asset risk level, and determines a corresponding response strategy according to the hierarchical risk value.

[0016] The technical scheme adopted by the present application includes the following technical effects: 1、The attack chain knowledge graph in the technical scheme of the present application includes tactical nodes and technical nodes, the tactical nodes are used for describing tactical stages or tactical states, and the technical nodes are used for describing specific methods or means for implementing a certain tactic; modeling is performed on the attack chain knowledge graph to obtain a state transition probability matrix between different tactical nodes and an observation probability matrix of observing a certain event under a certain tactical node; a HMM forward algorithm is used to dynamically infer and calculate global confidence of the current system in a certain tactical stage under a continuous time sequence; a hierarchical risk value is determined according to the global confidence of the current system in the certain tactical stage under the continuous time sequence, attack chain integrity and asset risk level, and a corresponding response strategy is determined according to the hierarchical risk value, so as to realize full-link identification and alarm of an attack behavior chain, help a blue team quickly locate an attack path, improve an overall protection level, make a defense response more accurate, effectively solve the problem of low reliability of network attack and defense exercise behavior detection caused by the prior art, and effectively improve the reliability of network attack and defense exercise behavior detection.

[0017] 2、The technical scheme of the present application corrects the state transition probability matrix between different tactical nodes by using the “topological correlation” (such as network distance between hosts) and “asset importance” (such as difference between a core server and a common terminal) of the attack chain, dynamically models and infers by using an improved HMM forward algorithm, realizes probabilistic detection of an attack stage and multi-dimensional reasoning of “time sequence + topology + asset”, reduces a false alarm rate, significantly improves subsequent reasoning accuracy, and further improves the reliability of network attack and defense exercise behavior detection.

[0018] 3、In the technical scheme of the present application, when a new attack technology is detected, a technical node is added in the knowledge graph; the observation probability matrix of observing a certain event under a certain tactical node is automatically updated based on the correlation degree between the new attack technology and an existing tactic, a closed loop of “intelligence→graph→update” is realized, the problem of lag in new attack detection is solved, and the adaptability of the scheme is significantly improved.

[0019] 4、In the technical scheme of the present application, global confidence of the current system in a certain tactical stage under a continuous time point sequence is calculated according to a chain type composed of nodes in the knowledge graph, and the adaptability of the scheme is further improved.

[0020] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the method of Embodiment 1 in the present invention; Figure 2 This is a flowchart illustrating step S4 in the method of Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of the system structure in Embodiment 2 of the present invention. Detailed Implementation

[0023] To clearly illustrate the technical features of this solution, the invention will be described in detail below through specific embodiments and in conjunction with the accompanying drawings. The following disclosure provides many different embodiments or examples for implementing different structures of the invention. To simplify the disclosure of the invention, components and arrangements of specific examples are described below. Furthermore, reference numerals and / or letters may be repeated in different examples. This repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed. It should be noted that the components illustrated in the drawings are not necessarily drawn to scale. Descriptions of well-known components, processing techniques, and processes are omitted in this invention to avoid unnecessarily limiting the invention.

[0024] Example 1 like Figure 1 As shown, this invention provides a method for detecting drill behavior based on attack chain modeling and serialized reasoning, including: S1, acquire historical data of network attack events, and convert the historical data of network attack events into an event sequence; S2, construct an attack chain knowledge graph based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states. The technical nodes are used to describe specific methods or means of implementing a certain tactic. S3, model the attack chain knowledge graph to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. S4. Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of an event observed at a certain tactical node, the HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. S5, determining a hierarchical risk value according to the global confidence of the current system in a certain tactical phase under a continuous time sequence, the integrity of the attack chain, the asset risk level, and determining a corresponding response strategy according to the hierarchical risk value.

[0025] In step S1, network attack event history data is acquired, and network attack history data events are converted into event sequences according to the order of event occurrence. Multi-source data collection and preprocessing are required for the network attack event history data. The collected results are cleaned (de-redundancy, time correction), unified in format (JSON event format), and features are extracted: regular templates are used for logs (Drain algorithm), five-tuple and statistical features are used for traffic, and system call sequences and file operation events are extracted for host behavior. All events are finally converted into standardized sequences for subsequent modeling. The collection sources and field extraction rules table (necessary fields must be collected) is shown in Table 1 as follows: Table 1: Collection source and field extraction rule table

[0026] Drain algorithm parameters (templating): Window size (window size) = 50 logs; Clustering similarity threshold (sim_threshold) = 0.8; Maximum number of templates (max_templates) = 1000.

[0027] (The parameters are based on 100,000 historical log experiments and can achieve good template coverage and generalization on typical enterprise logs.) De-redundancy rules: two records eventA and eventB are considered as duplicates and deleted when and only when: event_id, host_ip, timestamp (accurate to seconds) are completely consistent and the msg content is the same; during batch deduplication, the first occurrence record is retained.

[0028] Time correction (NTP): all collection nodes are synchronized using NTP, allowing a maximum deviation of ≤ 1 second; if a deviation > 1s is detected, time correction is triggered and correction logs are recorded.

[0029] Event structured output (unified JSON mode): { "time": "2025-09-12T12:34:56Z", "source": "hostA", "event_type": "SSH_LOGIN", "features": { "src_ip":"xxxx", "user":"alice", ...}, "raw": "Raw log line" }

[0030] In step S2, the attribute information of the tactical node includes tactical ID (tactic_id), tactical name (name), tactical stage order (stage_order), typical technology list (typical_techniques[]), and risk level (risk_level); the attribute information of the technology node includes attack technology ID (tech_id), attack technology name (name), attack technology feature signature (feature_signature), required privileges (required_privilege), and associated vulnerabilities (associated_cve[]). Preferably, the knowledge graph may also include entity nodes (used to describe hosts or user terminals or servers, databases, application systems, etc.), and the attribute information of the entity nodes may include entity ID (host_id), entity role (role), asset value (asset_value), subnet (subnet), and historical alert count (historical_alert_count).

[0031] Specifically, the node types and attribute tables are shown in Table 2 below: Table 2: Node Type and Attribute Table

[0032] Among them, tactical nodes refer to the attacker's purpose or stage, which is equivalent to "what to do". For example, "initial access", "privilege escalation", "lateral movement" and "data leakage" are all tactics.

[0033] Technique: The specific method or means of implementing a tactic, equivalent to "how to do it". For example, the means of achieving "initial access" could be "spear phishing", "exploit", or "weak password login".

[0034] An attack chain knowledge graph is constructed based on the MITRE ATT&CK framework and stored in a graph database (Neo4j). Nodes are divided into tactical nodes and technical nodes, with edges representing phase transition paths. Each technical node is configured with a [signature + behavioral pattern], such as: The lateral movement / SMB feature is "445 port connection + NTLM authentication event"; the persistence / registry feature is "RegSetValue + startup key". This knowledge model is used for subsequent event and stage matching.

[0035] MITRE ATT&CK currently has 14 tactics and corresponding key feature template lists. The ATT&CK matrix has increased from 12 tactics to 14 tactics since the v8 version in 2018. The two additional tactics are "Reconnaissance" and "Resource Development". The 12 additional tactics are "Initial Access", "Execution", "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access", "Discovery", "Lateral Movement", "Collection", "Command and Control", "Exfiltration", and "Impact". The first two tactics correspond to the PRE-ATT&CK stage, and the last 12 tactics correspond to the ATT&CK stage.

[0036] In step S3, the attack chain knowledge graph is modeled (HMM model), and the state transition probability matrix between different tactic nodes is as follows: ; ; wherein, is the normalized and corrected state transition probability matrix between tactic node i and tactic node j, is the corrected state transition probability matrix between tactic node i and tactic node j, is a normalization parameter, is the state transition probability matrix between tactic node i and tactic node j before correction, is a topological correlation factor, is an asset importance factor; The topological correlation factor and the asset importance factor can be greater than 1 or less than 1, and continuous multiplication will have a great influence on the probability value. Each row of the probability matrix A must satisfy the probability distribution law, that is, the sum of all elements in the same row must be 1. This correction operation directly destroys this basic property, so that the state transition probability matrix is no longer a legal probability matrix, resulting in the failure of the subsequent HMM forward algorithm calculation. To avoid this problem, a normalization parameter is introduced in the formula, which is a very small positive number (such as 1e-9) to make each row of the probability matrix A satisfy the probability distribution law, that is, the sum of all elements in the same row must be 1.

[0037] wherein, the state transition probability matrix between tactic node i and tactic node j before correction is determined as follows: ; wherein, is a state transition base probability matrix between tactical node i and tactical node j, is a time decay factor, is a difference of time stamps between tactical node i and tactical node j.

[0038] The time decay factor δ adopts exponential decay, and the value setting can be: δ = 0.05 (based on 500 APT chain measurements, when Δt = 10 minutes, the transition probability Aij' decays to about 60%); Δt = current tactical stage or state end time stamp - last tactical stage or state end time stamp. (Preferably, if Δt > 30 minutes, it is considered that the attack is timed out, and Aij' = 0 is set).

[0039] Topological factor T topo : based on the shortest hop number h between hosts, the value is: if h = 1, the topological factor = 1.0; for every 1 hop, the topological factor decreases by 0.2 (minimum 0.2).

[0040] Asset importance factor I asset : core asset = 1.5, medium = 1.0, edge = 0.8.

[0041] For example: if the state transition base probability matrix between tactical node i and tactical node j = 0.6, h = 2 (T topo = 0.8), I asset = 1.5, then: ; wherein, the state transition base probability matrix between tactical node i and tactical node j is determined in one of the following ways: ; wherein, is the number of transitions from tactical node i to tactical node j, is the total number of transitions of tactical node i; State transition base probability matrix: the possibility of going from one tactical node i (tactical stage) to another tactical node j (tactical stage) in the attack routine.

[0042] If A[initial access][execution] = 0.6, it means that there is a 60% probability of entering the "execution" stage after "initial access".

[0043] Or, another determination method can be: ; in, Let i be the weight from tactical node i to tactical node j. For the tactical node i to tactical node The weight, The first tactical node directly connected to tactical node i. One tactical node; For example, suppose a certain tactical stage (tactical node) i has three possible subsequent stages: 1, 2, 3, with corresponding weights Wi, ... tt (i 1)=2、W tt (i 2)=5、W tt (i 3) = 3, that is, W tt (i 1)=2、W tt (i 2)=5、W tt (i If 3) = 3, then the sum is 10.

[0044] Then, A[i][1]=2 / 10=0.2, A[i][2]=5 / 10=0.5, A[i][3]=3 / 10=0.3.

[0045] Wherein, the weights from tactical node i to tactical node j The specific method for determining it is as follows: ; in, This represents the number of times a network attack event is transferred from tactical node i to tactical node j in the historical data. This represents the total number of transitions for tactical node i in the historical data of network attack events. The stage risk coefficient of tactical node j in the historical data of network attack events (e.g., high = 1.2, medium = 1.0, low = 0.8).

[0046] Threshold for abnormal state transition probability matrix: When A[i][j] < 0.05 (based on historical statistics: mean + 2σ), it is marked as an abnormal transition and recorded for auditing.

[0047] Training convergence condition: Using the log-likelihood iterative method, if the log-likelihood increment for 5 consecutive iterations is less than 0.001, then the model (HMM model) is considered to have converged.

[0048] One specific method for determining the observation probability matrix of a certain event observed at a certain tactical node is as follows: ; wherein, is the observation probability matrix of observing event at a certain tactical node j, is the number of times of observing event at a certain tactical node j, is the total number of observations at a certain tactical node j; Observation probability distribution matrix: in an attack routine, after a tactical node j (tactical phase or state) is completed, the possibility of observing event .

[0049] If B[horizontal movement][445 port connection]=0.8, it means that the probability of observing event "445 port connection" at the "horizontal movement" phase is 80%.

[0050] Or, another determination method is specifically: ; wherein, is the relative proportion of technical node k appearing at tactical node j, is the relative proportion of technical node k appearing at tactical node j, is the kth technical node directly connected to tactical node j after tactical node j; is the relative proportion of technical node k appearing at tactical node j . The determination method of the relative proportion of technical node k appearing at tactical node j is specifically: ; wherein, is the frequency of technical node k appearing after tactical node j, is the total number of technical nodes after tactical node j; For example, assuming that a certain tactical phase (tactical node) j has three possible technical nodes: 1, 2, and 3, and the corresponding weights W are W ttech (j 1)=2, W ttech (j 2)=5, and W ttech (j 3)=3, i.e., W ttech (j 1)=2, W ttech (j 2)=5, and W ttech (j 3)=3, then the total sum is 10.

[0051] ​Then, B[j][1]=2 / 10=0.2, B[j][2]=5 / 10=0.5, B[j][3]=3 / 10=0.3.

[0052] : initial value is the historical transition proportion from tactic node i to tactic node j, and it will be accumulated and recalculated regularly when the transition from tactic node i to tactic node j is actually observed; : initial value is the relative proportion of the appearance of technology node k under tactic node j, which can be adjusted according to high-confidence internal and external reports (such as a vulnerability being widely exploited). These two values are used to initialize and affect the HMM parameters. Use to initialize the values of the state transition probability matrix A; use to initialize the values of the observation probability distribution matrix B.

[0053] When a new attack technology is detected, add technology node k to the knowledge graph new ; based on the correlation between the new attack technology and existing tactics, automatically update the observation probability matrix of observing an event under a certain tactic node.

[0054] Specifically, real-time data from threat intelligence platforms (such as MITRE, VirusTotal, and CIRCL) can be accessed in the knowledge graph. When a new attack technology (such as "tactic: initial access, technology: exploit CVE-2024-XXXX") is detected, an automatic update process is triggered: Entity addition: add technology node (ID: TXXXX, features: exploit string + port 443) to the knowledge graph; Relationship calculation: based on the correlation between the new technology and existing tactics (such as CVE-2024-XXXX commonly used for initial access, correlation = 0.9), add a relationship edge "initial access -> TXXXX" with weight = 0.9 x threat intelligence credibility (such as 0.8) = 0.72; Model adaptation: automatically update the observation probability distribution B[j][ ] of the HMM, including the observation probability of the new technology (such as B[initial access][TXXXX]=0.72).

[0055] By linking threat intelligence with the knowledge graph and HMM model for automatic updating, a closed loop of "intelligence -> graph -> model" is realized, solving the problem of new attack detection lag and significantly improving the adaptability of the solution.

[0056] The automatic update pseudocode is as follows: On NewThreatIntel(intel): parse intel ->{tech_id, signature, assoc_tactic, confidence} if not exists(tech_id) in KG: add node Technique(tech_id, signature) compute assoc_score = similarity(signature, existing_tech_signatures) weight = assoc_score * intel.confidence add_or_update_edge(Tactic(assoc_tactic) ->Technique(tech_id), weight) update B[tactic][tech_id]:= normalize_observation_prob(...) enqueue for incremental HMM update After the new technique node is added, the association between the new technique node and the existing tactic node is automatically calculated and the edge weight is updated; then the new observation probability is incorporated into the observation probability matrix distribution in the HMM (a smoothing / weighting strategy is adopted to avoid abrupt changes). The knowledge graph update triggers the incremental update of the HMM (EWMA style parameter fusion), so that the HMM model can quickly incorporate new technology features.

[0057] As shown in Figure 2 , step S4 specifically includes: S41, constructing a set of tactic nodes S={s1…s M} and a set of observed event sequences O={o1…o t}; wherein M is the total number of tactic nodes, o t is the total number of observed events at the current time point t (this step can also be performed in step S3); State set S: corresponding to 14 major categories of the ATT&CK framework, M is the total number of elements in the state set (tactical stage combination). Observation set O: the types of events that can be observed in the actual operation of the system, such as "login failure", "create new process", "file write", "network connection exception" and the like.

[0058] S42, a sliding window is established for the recent events, and the event sequence meeting the establishment of the sliding window is screened and obtained; Sliding window definition: a "sliding window" is established for the recent events, and the events in the window are analyzed. Specifically, the serial port width parameter W = 50 can be set: it represents the last 50 continuous events (non-time unit); if the interval between adjacent events is > 10 minutes (attack interruption threshold), the window is reset; the sliding step = 10 events, which ensures that the analysis can be continuously updated when a new event is added.

[0059] S43, according to the state transition probability matrix between different tactical nodes and the observation probability matrix of observing an event under a certain tactical node, an improved HMM is used to calculate the forward probability of each tactical node at each time point; Specifically, the forward probability of each tactical node at each time point is calculated as follows: ; Wherein, is the forward probability of the tactical node j at the current time point t, is the forward probability of the tactical node i at the last time point t-1, is the normalized and corrected state transition probability matrix between the tactical node i and the tactical node j is the observation probability matrix of observing the event at the current time point t under the tactical node j.

[0060] Forward probability is used to evaluate the possibility that the current event sequence conforms to the attack chain.

[0061] Definition: assuming o1, o2…o t is the event sequence (observation sequence O) observed up to the current time point t. is the probability of observing the current event sequence O up to the current time point t while the system is in state j (state j is a certain attack stage). Using the improved HMM, the "forward probability" of each attack stage at each time point is calculated When, first, initialization is performed, that is: = B[j][o1]; πj is the initial state probability, representing the probability of the attack chain starting from the tactical node j (state j), which can be calculated from the training data (the number of times j is the starting tactic of the attack chain / the total number of attack chains for training).

[0062] B is an observation probability distribution matrix, B[j][ol] is the probability of observing the first event ol in the current event sequence under the tactical node j (state j).

[0063] The recursive formula is: (t>1) ; That is, the state transition probability matrix between the previous tactical node i and the tactical node j, representing the probability of transitioning from state i to state j. is the observation probability matrix of observing event at the current time point t under the tactical node j. M represents the total number of state sets S, that is, the number of all possible attack stages in the HMM. All paths from each possible previous tactical node i to the current tactical node j are accumulated to their probabilities.

[0064] is the probability of the system being in the tactical node j and observing the first t-1 events at the previous time step t-1, that is, the forward probability that has been calculated in the last step, and the new is obtained by continuously iterating the event sequence. 、 The calculation of and the initialization and recursion described above are not repeated here.

[0065] S44, according to the chain type composed of nodes in the knowledge graph, calculates the global confidence of the current system in a certain tactical stage under a continuous time point sequence.

[0066] Specifically, if the chain type composed of nodes in the knowledge graph is a linear chain, the forward probability of each time point and each tactical node is summed up using an additive sum to calculate the global confidence of the current system in a certain tactical stage under a continuous time sequence. Linear chain (stage series, such as initial access→execution→lateral movement): an additive sum is used, that is: ; wherein, is a subset of tactical nodes included in the linear chain within the state set S; If the chain type composed of nodes in the knowledge graph is a parallel chain, the maximum value of the forward probability of each time point and each tactical node is used to calculate the global confidence of the current system in a certain tactical stage under a continuous time sequence.

[0067] Parallel chain (phase mutual exclusion or parallel, such as execution and persistence occur at the same time): take the maximum value, that is: ; For example: if a (initial) = 0.3, a (execution) = 0.6, a (horizontal) = 0.1, then the confidence P = 1.0 in linear chain, and the confidence P = 0.6 in parallel chain.

[0068] Continuous decision parameter k 判 , that is, the number of times the condition P > θ appears continuously, if P > θ appears continuously k 判 times, trigger (default: θ = 0.7, k 判 = 3). The scale parameter θ is selected by ROC curve / cross validation (the θ corresponding to the maximum F1 value on historical data).

[0069] In step S5, the hierarchical risk value is determined according to the global confidence of the current system in a certain tactical phase under continuous time sequence, attack chain integrity, asset risk level, and specific to: ; Where R is the hierarchical risk value; is the weight coefficient of global confidence, P is the global confidence of the current system in a certain tactical phase under continuous time sequence; is the weight coefficient of attack chain integrity, I is the ratio of the number of observed tactics to the total number of tactics under continuous time sequence of the current system; is the weight coefficient of asset risk level, A is the average risk score of the attacked assets under continuous time sequence of the current system; The hierarchical risk value R can be obtained by integrating three dimensions, and the calculation relationship and weight coefficient of the hierarchical risk value R under different dimensions are shown in the following table three: Table three: calculation method of hierarchical risk value R under different dimensions and corresponding weight coefficient table

[0070] That is, the hierarchical risk value R = 0.4P + 0.3I + 0.3A; Through the dimension of attack chain integrity I, it can be judged to distinguish between "low-risk exploratory attack" and "high-risk APT attack", and the high-risk APT attack (attack chain integrity is higher) is preferentially defended in the response strategy; Through the dimension of asset risk level A, the APT attack on core assets (high-risk assets) can be preferentially defended in the response strategy (asset risk level is higher), and the rationality of the allocation of defense resources in the response strategy is improved.

[0071] Where the weight coefficient of global confidence , weight coefficient of attack chain integrity , weight coefficient of asset risk level In the determination process of the weight coefficient, the grid search method can be used to optimize the determination on the historical verification data set to maximize the F1 score of high-risk alarms.

[0072] Specifically, the determination of the weight coefficient value: the application adopts an optimized experimental design based on historical data, and the specific steps are as follows: Data preparation: 1000 pieces of historical attack chain data with labels are collected, including 500 pieces of real network attack simulation data and 500 pieces of normal business behavior data. Each piece of data includes attack chain stage sequence, observed event sequence, and attacked asset information.

[0073] Initial setting: the weight coefficients are initialized by equal division, that is, = = = 0.33, to ensure that the starting point of the experiment is unbiased.

[0074] Search and verification method: the grid search + three-fold cross-validation method is used to optimize the weight combination. The search range is [0.1, 0.6] with a step of 0.1, which ensures that all weight combinations satisfy the sum of the weight coefficients being 1. The detection effect (F1 score, AUC value) is used as the evaluation index.

[0075] Verification result: among all candidate weight combinations, when = 0.4, = 0.3, = 0.3, the detection performance is best: the F1 score is 0.92 (the highest value); the AUC value is 0.95; the false positive rate is less than 5%; the false negative rate is less than or equal to 3%; at the same time, in the three-fold cross-validation, the result variance is less than 0.02, and the performance is stable.

[0076] The result meets the logical expectation: the global confidence P is directly derived from the HMM forward algorithm reasoning, and can most accurately reflect the timing consistency of the attack chain, so the weight is slightly high (0.4); the attack chain integrity I and the asset risk level A have a considerable impact on the attack severity, and each is allocated 0.3.

[0077] According to the layered risk value, the corresponding response strategy is determined as follows: When the hierarchical risk value is not less than the first preset risk value, the automatic defense mechanism is started and an immediate alarm is given; when the hierarchical risk value is not less than the second preset risk value and less than the first preset risk value, the automatic defense mechanism is started and an immediate alarm is given, the alarm information is pushed and human-computer interaction verification is performed; when the hierarchical risk value is less than the second preset risk value, the global confidence, attack chain integrity, asset risk level and hierarchical risk value of the current system in a continuous time sequence under a certain tactical phase are recorded.

[0078] Response strategy: 1. High risk R≥0.8 (first preset risk value): automatic defense (block IP, isolate host), immediate alarm and evidence snapshot.

[0079] 2. Medium risk 0.5≤R<0.8: push alarm, human-computer interaction verification.

[0080] 3. Low risk R<0.5 (second preset risk value): record and include in the training buffer area for HMM model update, i.e. hidden Markov model.

[0081] The key parameters of HMM model update include: State transition probability matrix A: representing the state transition probability between attack phases (for example, the probability of "execution→lateral movement").

[0082] Observation probability matrix B: representing the probability of observing event types in a certain attack phase (for example, the probability of "remote login failure" event in "lateral movement" phase).

[0083] Initial state probability π: prior probability of the starting phase of the attack chain.

[0084] "Low risk event" does not trigger an alarm, but contains new information that may be valuable to the model, such as normal behavior or slight abnormal behavior.

[0085] Specific update method: Encode the low-risk event sequence into an event vector according to the HMM observation event sequence set O, and mark the attack chain phase associated with the identifiable event as the potential state set S. Add the above data to the training buffer area and retain the latest 1000 data.

[0086] For state transition probability matrix A: count the number of newly observed inter-phase transitions in the buffer area, calculate the new A value of the buffer area (A , new ), and do weighted fusion with the original A value (A , old ) to update the transition probability.

[0087] For example, new A value = old A value * 0.9 + buffer A value * 0.1. (For each element in the matrix) Likewise for observation probability matrix B: count the number of times the technology in the newly observed tactical phase appears in the buffer, calculate the new B value of the buffer ( , new ), and make a weighted fusion with the original B value ( , old ) to update the observation probability.

[0088] New B value = old B value * 0.9 + buffer B value * 0.1. (For each element in the matrix).

[0089] In this way, the model can learn new behavior patterns. It can also be decided according to the actual situation whether to update when the buffer is full or to update regularly.

[0090] Preferably, the knowledge graph can also be graphically displayed (nodes: tactics / technologies / entities; edges: transition probabilities and confidence), supporting time playback and highlighting key nodes to output complete attack chain paths and visual reports, assisting blue teams in rehearsal review and tracing. Moreover, the knowledge base and detection engine can be flexibly extended according to the rehearsal scenario, adapting to different attack modes. The alert can be output in JSON format for easy integration with SIEM / SOAR systems. The visualization part uses graph-based mapping, with node colors representing phases, supporting dynamic updates with event flow to enable defenders to intuitively understand attack paths.

[0091] During HMM model training and evaluation, training data: initially based on 1000 labeled chains (500 normal, 500 attack); external intelligence / synthetic samples can be expanded to 3000+.

[0092] The source of δ can be 0.05: based on 500 APT chain measurements, the A value decays to 0.6 after a 10-minute delay (experimental target); if more conservative, take 0.01.

[0093] Continuous decision parameter source: based on historical data, the ROC / F1 curve is optimized to reduce false positives to about 5% and false negatives to about 3%.

[0094] HMM convergence criteria: log likelihood increment <0.001 for 5 consecutive times.

[0095] Abnormal transition decision threshold: A[i][j]<0.05 (mean + 2σ decision).

[0096] Although LSTM (Long Short Term Memory Network) or Transformer model can also learn and classify attack event sequences, and improve feature expression ability by using deep learning method, such model has high training cost, needs large amount of labeled data, and has insufficient generalization ability in small sample or new attack scene. In comparison, the improved HMM used in the application has small calculation cost, strong interpretability, and can reduce false positives through time decay factor, and is more suitable for real-time detection in attack and defense exercise scene.

[0097] Although the confidence interval determination method based on Bayesian inference can also dynamically adjust the alarm threshold, the method has large operation cost in high concurrency environment, and is easily affected by abnormal fluctuations. In comparison, the application uses the combination determination of sliding window + fixed threshold, which is simple in calculation and easy to implement, and can ensure real-time performance and effectively reduce false positive rate.

[0098] In the technical scheme of the application, the attack chain knowledge graph includes a tactical node and a technical node, the tactical node is used to describe a tactical phase or a tactical state, and the technical node is used to describe a specific method or means for implementing a certain tactic; the attack chain knowledge graph is modeled to obtain a state transition probability matrix between different tactical nodes and an observation probability matrix of observing a certain event under a certain tactical node; the global confidence of the current system in a certain tactical phase under continuous time sequence is dynamically inferred and calculated by using the HMM forward algorithm; the hierarchical risk value is determined according to the global confidence of the current system in a certain tactical phase under continuous time sequence, the integrity of the attack chain, and the asset risk level, the corresponding response strategy is determined according to the hierarchical risk value, the full-link identification and alarm of the attack behavior chain are realized, the attack path is quickly located for the blue team, and the overall protection level is improved, so that the defense response is more accurate, the problem of low reliability of network attack and defense exercise behavior detection caused by the prior art is effectively solved, and the reliability of network attack and defense exercise behavior detection is effectively improved.

[0099] The technical scheme of the application corrects the state transition probability matrix between different tactical nodes by using the “topological correlation” (such as network distance between hosts) and “asset importance” (such as difference between core server and ordinary terminal) of the attack chain, dynamically models and infers by using the improved HMM forward algorithm, realizes probabilistic detection of the attack phase and multi-dimensional reasoning of “time sequence + topology + asset”, reduces the false positive rate, significantly improves the subsequent reasoning accuracy, and further improves the reliability of network attack and defense exercise behavior detection.

[0100] In the technical scheme of the present application, when a new attack technology is detected, a technology node is added in the knowledge graph; based on the correlation degree between the new attack technology and the existing tactics, the observation probability matrix of observing a certain event under a certain tactic node is automatically updated, realizing the closed loop of "intelligence-graph-updating", solving the problem of new attack detection lag, and significantly improving the adaptability of the scheme.

[0101] In the technical scheme of the present application, according to the chain type of the nodes in the knowledge graph, the global confidence of the current system in a certain tactical phase under a continuous time point sequence is calculated, further improving the adaptability of the scheme.

[0102] Embodiment two As Figure 3 shown, the technical scheme of the present application also provides a drill behavior detection system based on attack chain modeling and serialized reasoning, which comprises: The acquisition module 101 acquires network attack event historical data and converts network attack historical data events into event sequences. The construction module 102 constructs an attack chain knowledge graph based on network attack event historical data, wherein the attack chain knowledge graph comprises tactic nodes and technology nodes, the tactic nodes are used to describe tactical phases or tactical states, and the technology nodes are used to describe specific methods or means for implementing a certain tactic. The modeling module 103 models the attack chain knowledge graph to obtain a state transition probability matrix between different tactic nodes and an observation probability matrix of observing a certain event under a certain tactic node. The reasoning calculation module 104 dynamically reasons and calculates the global confidence of the current system in a certain tactical phase under a continuous time sequence according to the state transition probability matrix between different tactic nodes and the observation probability matrix of observing a certain event under a certain tactic node by using the HMM forward algorithm. The determination module 105 determines a layered risk value according to the global confidence of the current system in a certain tactical phase under a continuous time sequence, the integrity of the attack chain, and the asset risk level, and determines a corresponding response strategy according to the layered risk value.

[0103] The implementation processes of the acquisition module 101, the construction module 102, the modeling module 103, the reasoning calculation module 104, and the determination module 105 in this embodiment two correspond to the method steps in embodiment one, and this embodiment two will not be repeated here.

[0104] The attack chain knowledge graph in the technical scheme of the present application includes a tactical node and a technical node, the tactical node is used to describe a tactical stage or a tactical state, and the technical node is used to describe a specific method or means for implementing a certain tactic; the attack chain knowledge graph is modeled to obtain a state transition probability matrix between different tactical nodes and an observation probability matrix of observing a certain event under a certain tactical node; a HMM forward algorithm is used to dynamically infer and calculate a global confidence of the current system in a certain tactical stage under a continuous time sequence; a hierarchical risk value is determined according to the global confidence of the current system in the certain tactical stage under the continuous time sequence, attack chain integrity, asset risk level, a corresponding response strategy is determined according to the hierarchical risk value, and full-link identification and alarm of an attack behavior chain are realized, so as to help a blue team quickly locate an attack path, improve an overall protection level, make defense response more accurate, effectively solve the problem of low reliability of network attack and defense exercise behavior detection caused by the prior art, and effectively improve the reliability of network attack and defense exercise behavior detection.

[0105] The technical scheme of the present application corrects the state transition probability matrix between different tactical nodes by using the “topological correlation” (such as the network distance between hosts) and the “asset importance” (such as the difference between a core server and a common terminal) of the attack chain, dynamically models and infers by using an improved HMM forward algorithm, realizes probabilistic detection of an attack stage and multi-dimensional reasoning of “time sequence + topology + asset”, reduces the false alarm rate, significantly improves the subsequent reasoning accuracy, and further improves the reliability of network attack and defense exercise behavior detection.

[0106] In the technical scheme of the present application, when a new attack technology is detected, a technical node is added in the knowledge graph; the observation probability matrix of observing a certain event under a certain tactical node is automatically updated based on the correlation degree between the new attack technology and the existing tactics, a closed loop of “intelligence→graph→update” is realized, the problem of new attack detection lag is solved, and the adaptability of the scheme is significantly improved.

[0107] In the technical scheme of the present application, the global confidence of the current system in a certain tactical stage under a continuous time sequence is calculated according to the chain type composed of nodes in the knowledge graph, and the adaptability of the scheme is further improved.

[0108] Although the specific embodiments of the present application are described above with reference to the accompanying drawings, the present application is not limited to the above description, and various modifications or changes made by those skilled in the art without creative labor on the basis of the technical scheme of the present application are still within the protection scope of the present application.

Claims

1. A method for detecting drill behavior based on attack chain modeling and sequential reasoning, characterized by: include: Acquire historical data on network attack events and convert these events into event sequences; An attack chain knowledge graph is constructed based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe the specific methods or means of implementing a certain tactic. The attack chain knowledge graph is modeled to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. Based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, a tiered risk value is determined, and the corresponding response strategy is determined based on the tiered risk value.

2. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The attribute information of a tactical node includes tactical ID, tactical name, tactical phase sequence, list of typical techniques, and risk level; The attribute information of the technical node includes the attack technique ID, attack technique name, attack technique signature, permissions required for the attack technique, and associated vulnerabilities.

3. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The state transition probability matrix between different tactical nodes is as follows: ； ； in, Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. This is the corrected state transition probability matrix between tactical node i and tactical node j. For normalization parameters, This is the state transition probability matrix between tactical node i and tactical node j before correction. For topological correlation factor, As an asset importance factor; Wherein, the state transition probability matrix between tactical node i and tactical node j before correction The specific method for determining it is as follows: ； in, Let be the fundamental probability matrix for the state transition between tactical node i and tactical node j. The time decay factor, This represents the difference in timestamps between tactical node i and tactical node j.

4. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 3, characterized in that, The fundamental probability matrix of state transitions between tactical node i and tactical node j The specific method for determining it is as follows: ； in, Let i be the number of transitions from tactical node i to tactical node j. For the total number of transitions at tactical node i; or, ； in, Let i be the weight from tactical node i to tactical node j. For the tactical node i to tactical node The weight, The first tactical node directly connected to tactical node i. One tactical node; Wherein, the weights from tactical node i to tactical node j The specific method for determining it is as follows: ； in, This represents the number of times a network attack event is transferred from tactical node i to tactical node j in the historical data. This represents the total number of transitions for tactical node i in the historical data of network attack events. This represents the stage risk coefficient of tactical node j in the historical data of network attack events.

5. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The specific observation probability matrix for observing a certain event at a certain tactical node is as follows: ； in, To observe an event at a certain tactical node j The observation probability matrix, To observe an event at a certain tactical node j Number of times, The total number of observations at a given tactical node j; or, ； in, The relative proportion of technical node k appearing at tactical node j. For technical nodes under tactical node j The relative proportion of appearance After tactical node j, and tactical node The directly connected first One technical node; Among them, the relative proportion of technical node k appearing under tactical node j The specific method for determining it is as follows: ； in, Let k be the frequency of occurrence of technical node k after tactical node j. The total number of techniques after tactical node j; When a new attack technique is detected, a technique node is added to the knowledge graph; the observation probability matrix of an event observed under a certain tactic node is automatically updated based on the correlation between the new attack technique and existing tactics.

6. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 3, characterized in that, Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the global confidence of the current system in a certain tactical stage under continuous time series is calculated using the HMM forward algorithm for dynamic inference. Construct a tactical node set S = {s1…s2} M } and the set of observed event sequences O={o1…o t }; where M is the total number of tactical nodes, o t The event observed at the current time point t; Create a sliding window for a number of recent events and filter to obtain the event sequence that satisfies the criteria for creating the sliding window; Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved HMM. Based on the chain type formed by nodes in the knowledge graph, calculate the global confidence of the current system at a certain tactical stage in a continuous time sequence.

7. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 6, characterized in that, Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved Hidden Markov Model (HMM): ； in, This represents the forward probability of tactical node j at the current time point t. This represents the forward probability of tactical node i at the previous time point t-1. Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. To observe the event at the current time point t under tactical node j The observation probability matrix.

8. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 6, characterized in that, The global confidence level of the current system at a certain tactical stage in a continuous time series is calculated as follows: If the chain formed by the nodes in the knowledge graph is a linear chain, the forward probability of each tactical node at each time point is summed to calculate the global confidence of the current system in a certain tactical stage under continuous time series. If the chain type formed by the nodes in the knowledge graph is a parallel chain, the forward probability of each tactical node at each time point is maximized to calculate the global confidence of the current system in a certain tactical stage under continuous time series.

9. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The tiered risk values ​​are determined based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, as follows: ； Where R is the stratified risk value; , where P is the weighting coefficient of the global confidence score, and P is the global confidence score of the current system at a certain tactical stage in the continuous time series. I is the weighting coefficient for attack chain integrity, and I is the ratio of the number of currently observed tactics to the total number of tactics in the current system under continuous time series. , where A is the weighting coefficient for the asset risk level, and A is the average risk score of the attacked assets in the current system over a continuous time series. The specific response strategy determined based on the stratified risk values ​​is as follows: When the layered risk value is not less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately; when the layered risk value is not less than the second preset risk value and less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately, an alarm message is pushed and human-computer interaction verification is performed; when the layered risk value is less than the second preset risk value, the global confidence level, attack chain integrity, asset risk level and layered risk value of the current system at a certain tactical stage in a continuous time series are recorded.

10. A training behavior detection system based on attack chain modeling and sequential reasoning, characterized in that: include: The acquisition module retrieves historical data of network attack events and converts these historical events into event sequences. The construction module builds an attack chain knowledge graph based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe the specific methods or means of implementing a certain tactic. The modeling module models the attack chain knowledge graph to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. The inference and calculation module uses the HMM forward algorithm to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series, based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed under a certain tactical node. The determination module determines the tiered risk value based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, and then determines the corresponding response strategy based on the tiered risk value.

Images