Attack chain modeling and serialization reasoning-based exercise behavior detection method and system

Abstract

The application provides a kind of based on attack chain modeling and serialization inference's exercise behavior detection method and system, this method includes: attack chain knowledge graph includes tactical node, technical node, the tactical node is used to describe tactical phase or tactical state, the technical node is used to describe the specific method or means for realizing a certain tactic;Attack chain knowledge graph is modeled, and the state transition probability matrix between different tactical nodes and the observation probability matrix observed to a certain event under a certain tactical node are obtained;The global confidence of current system under continuous time sequence in a certain tactical phase is dynamically inferred and calculated using HMM forward algorithm;The hierarchical risk value is determined according to the global confidence of current system under continuous time sequence in a certain tactical phase, attack chain integrity, asset risk level, and the corresponding response strategy is determined according to hierarchical risk value, effectively improve the reliability of network attack and defense exercise behavior detection.

Description

Technical Field

[0001] This invention relates to the field of information security and network attack and defense exercise detection, and in particular to a method and system for detecting exercise behavior based on attack chain modeling and serialized reasoning. Background Technology

[0002] In network attack and defense drills, the red team (attacker) typically achieves intrusion by gradually implementing a series of tactical steps, such as scanning, penetration, lateral movement, and persistence. The blue team (defender) typically achieves intrusion detection and identification by gradually implementing a series of tactical steps, such as behavior detection. Behavior detection plays a crucial role in successfully identifying network attacks and their current stage in network attack and defense drills.

[0003] In recent years, the MITRE ATT&CK framework has proposed standardized descriptions of tactics and techniques. However, existing attack and defense exercise behavior detection methods mostly rely on single-type node feature matching or rule-based alerts, making it difficult to model the attack chain globally. This results in the blue team lacking a complete context in tracing and defense. Alternatively, they may determine the existence of an attack based solely on a single threshold, failing to distinguish between "low-risk probing attacks" and "high-risk APT attacks," leading to unreasonable allocation of defense resources in response strategies.

[0004] In summary, the reliability of network attack and defense exercise behavior detection in existing technologies is not high. To address this issue, this solution is proposed. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention innovatively proposes a method and system for detecting network attack and defense exercise behavior based on attack chain modeling and serialized reasoning. This effectively solves the problem of low reliability in network attack and defense exercise behavior detection caused by existing technologies, and effectively improves the reliability of network attack and defense exercise behavior detection.

[0006] The first aspect of this invention provides a method for detecting drill behavior based on attack chain modeling and serialization reasoning, comprising: Obtain historical data on network attack events and convert these events into event sequences. An attack chain knowledge graph is constructed based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe the specific methods or means of implementing a certain tactic. The attack chain knowledge graph is modeled to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. Based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, a tiered risk value is determined, and the corresponding response strategy is determined based on the tiered risk value.

[0007] Optionally, the attribute information of tactical nodes includes tactical ID, tactical name, tactical phase sequence, typical technology list, and risk level; the attribute information of technical nodes includes attack technology ID, attack technology name, attack technology signature, required permissions for the attack technology, and associated vulnerabilities.

[0008] Optionally, the state transition probability matrix between different tactical nodes is as follows: ; ; in, Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. This is the corrected state transition probability matrix between tactical node i and tactical node j. For normalization parameters, This is the state transition probability matrix between tactical node i and tactical node j before correction. For topological correlation factor, As an asset importance factor; Wherein, the state transition probability matrix between tactical node i and tactical node j before correction The specific method for determining it is as follows: ; in, Let be the fundamental probability matrix for the state transition between tactical node i and tactical node j. The time decay factor, This represents the difference in timestamps between tactical node i and tactical node j.

[0009] Furthermore, the fundamental probability matrix of the state transition between tactical node i and tactical node j The specific method for determining it is as follows: ; in, Let i be the number of transitions from tactical node i to tactical node j. For the total number of transitions at tactical node i; or, ; in, Let i be the weight from tactical node i to tactical node j. For the tactical node i to tactical node The weight, The first tactical node directly connected to tactical node i. One tactical node; Wherein, the weights from tactical node i to tactical node j The specific method for determining it is as follows: ; in, This represents the number of times a network attack event is transferred from tactical node i to tactical node j in the historical data. This represents the total number of transitions for tactical node i in the historical data of network attack events. This represents the stage risk coefficient of tactical node j in the historical data of network attack events.

[0010] Optionally, the observation probability matrix for observing a certain event at a certain tactical node is specifically as follows: ; in, To observe an event at a certain tactical node j The observation probability matrix, To observe an event at a certain tactical node j Number of times, The total number of observations at a given tactical node j; or, ; in, The relative proportion of technical node k appearing at tactical node j. For technical nodes under tactical node j The relative proportion of appearance After tactical node j, and tactical node The directly connected first One technical node; Among them, the relative proportion of technical node k appearing under tactical node j The specific method for determining it is as follows: ; in, Let k be the frequency of occurrence of technical node k after tactical node j. The total number of techniques after tactical node j; When a new attack technique is detected, a technique node k is added to the knowledge graph. newThe observation probability matrix for a certain event observed at a certain tactical node is automatically updated based on the correlation between new attack techniques and existing tactics.

[0011] Optionally, based on the state transition probability matrix between different tactical nodes and the observation probability matrix of an event observed at a certain tactical node, the global confidence of the current system in a certain tactical stage under continuous time series is dynamically calculated using the HMM forward algorithm: Construct a tactical node set S = {s1…s2} M} and the set of observed event sequences O={o1…o t}; where M is the total number of tactical nodes, o t The event observed at the current time point t; Create a sliding window for a number of recent events and filter to obtain the event sequence that satisfies the criteria for creating the sliding window; Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved HMM. Based on the chain type formed by nodes in the knowledge graph, calculate the global confidence of the current system at a certain tactical stage in a continuous time sequence.

[0012] Furthermore, based on the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved HMM as follows: ; in, This represents the forward probability of tactical node j at the current time point t. This represents the forward probability of tactical node i at the previous time point t-1. Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. To observe the event at the current time point t under tactical node j The observation probability matrix.

[0013] Optionally, the global confidence level of the current system at a certain tactical stage in a continuous time series is calculated as follows: If the chain formed by the nodes in the knowledge graph is a linear chain, the forward probability of each tactical node at each time point is summed to calculate the global confidence of the current system in a certain tactical stage under continuous time series. If the chain type formed by the nodes in the knowledge graph is a parallel chain, the forward probability of each tactical node at each time point is maximized to calculate the global confidence of the current system in a certain tactical stage under continuous time series.

[0014] Optionally, the tiered risk value is determined based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, as follows: ; Where R is the stratified risk value; , where P is the weighting coefficient of the global confidence score, and P is the global confidence score of the current system at a certain tactical stage in the continuous time series. I is the weighting coefficient for attack chain integrity, and I is the ratio of the number of currently observed tactics to the total number of tactics in the current system under continuous time series. , where A is the weighting coefficient for the asset risk level, and A is the average risk score of the attacked assets in the current system over a continuous time series. The specific response strategy determined based on the stratified risk values ​​is as follows: When the layered risk value is not less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately; when the layered risk value is not less than the second preset risk value and less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately, an alarm message is pushed and human-computer interaction verification is performed; when the layered risk value is less than the second preset risk value, the global confidence level, attack chain integrity, asset risk level and layered risk value of the current system at a certain tactical stage in a continuous time series are recorded.

[0015] A second aspect of this invention provides a training behavior detection system based on attack chain modeling and serialization reasoning, comprising: The acquisition module retrieves historical data of network attack events and converts these historical events into event sequences. The construction module builds an attack chain knowledge graph based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe the specific methods or means of implementing a certain tactic. The modeling module models the attack chain knowledge graph to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. The inference and calculation module uses the HMM forward algorithm to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series, based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed under a certain tactical node. The determination module determines the tiered risk value based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, and then determines the corresponding response strategy based on the tiered risk value.

[0016] The technical solution adopted in this invention has the following technical effects: 1. The attack chain knowledge graph in this invention includes tactical nodes and technical nodes. The tactical nodes describe tactical stages or tactical states, and the technical nodes describe specific methods or means of implementing a certain tactic. The attack chain knowledge graph is modeled to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. The HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. Based on the global confidence of the current system in a certain tactical stage under continuous time series, the integrity of the attack chain, and the asset risk level, a layered risk value is determined. Based on the layered risk value, a corresponding response strategy is determined, realizing full-link identification and alarm of the attack behavior chain. This helps the blue team quickly locate the attack path, improve the overall protection level, make the defense response more accurate, and effectively solve the problem of low reliability of network attack and defense exercise behavior detection caused by existing technologies, effectively improving the reliability of network attack and defense exercise behavior detection.

[0017] 2. The technical solution of this invention corrects the state transition probability matrix between different tactical nodes by using the "topological correlation" (such as the network distance between hosts) and "asset importance" (such as the difference between core servers and ordinary terminals) of the attack chain. It uses an improved HMM forward algorithm for dynamic modeling and reasoning to achieve probabilistic detection of the attack phase and multi-dimensional reasoning of "time sequence + topology + assets", thereby reducing the false alarm rate, significantly improving the accuracy of subsequent reasoning, and further improving the reliability of network attack and defense exercise behavior detection.

[0018] 3. In the technical solution of this invention, when a new attack technique is detected, a technique node is added to the knowledge graph; based on the correlation between the new attack technique and existing tactics, the observation probability matrix of an event observed under a certain tactical node is automatically updated, realizing a closed loop of "intelligence → knowledge graph → update", solving the problem of lagging detection of new attacks, and significantly improving the adaptability of the solution.

[0019] 4. In the technical solution of this invention, the global confidence of the current system at a certain tactical stage in a continuous time sequence is calculated based on the chain type formed by the nodes in the knowledge graph, thereby further improving the adaptability of the solution.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the method of Embodiment 1 in the present invention; Figure 2 This is a flowchart illustrating step S4 in the method of Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of the system structure in Embodiment 2 of the present invention. Detailed Implementation

[0023] To clearly illustrate the technical features of this solution, the invention will be described in detail below through specific embodiments and in conjunction with the accompanying drawings. The following disclosure provides many different embodiments or examples for implementing different structures of the invention. To simplify the disclosure of the invention, components and arrangements of specific examples are described below. Furthermore, reference numerals and / or letters may be repeated in different examples. This repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed. It should be noted that the components illustrated in the drawings are not necessarily drawn to scale. Descriptions of well-known components, processing techniques, and processes are omitted in this invention to avoid unnecessarily limiting the invention.

[0024] Example 1 like Figure 1 As shown, this invention provides a method for detecting drill behavior based on attack chain modeling and serialized reasoning, including: S1, acquire historical data of network attack events, and convert the historical data of network attack events into an event sequence; S2, construct an attack chain knowledge graph based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states. The technical nodes are used to describe specific methods or means of implementing a certain tactic. S3, model the attack chain knowledge graph to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. S4. Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of an event observed at a certain tactical node, the HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. S5 determines the tiered risk value based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, and determines the corresponding response strategy based on the tiered risk value.

[0025] In step S1, historical data of network attack events is acquired. These events are then converted into event sequences according to their chronological order. The historical data requires multi-source data collection and preprocessing. The collected results are cleaned (redundancy removal, time correction), standardized (JSON event format), and features are extracted: logs are templated using regular expressions (Drain algorithm), traffic is analyzed using quintuples and statistical features, and host behavior is extracted using system call sequences and file operation events. All events are ultimately converted into standardized sequences for subsequent modeling. The data collection sources and field extraction rules (required fields must be collected) are shown in Table 1 below. Table 1: Data Source and Field Extraction Rules Table

[0026] Among them, the Drain algorithm parameters (templates) are: Window size = 50 log entries; Cluster similarity threshold (sim_threshold) = 0.8; Maximum number of templates (max_templates) = 1000.

[0027] (The parameters were optimized based on experiments with 100,000 historical logs, and can achieve good template coverage and generalization on typical enterprise logs.) The redundancy removal rules are as follows: two records, eventA and eventB, are considered duplicates and deleted if and only if: event_id, host_ip, timestamp (accurate to the second) are completely identical and the msg content is the same; during the batch deduplication process, the first occurrence of the record is retained.

[0028] Among them, time correction (NTP): all acquisition nodes use NTP synchronization, and the maximum allowable deviation is ≤ 1 second; if a deviation > 1 second is detected, time correction is triggered and the correction log is recorded.

[0029] The event is output in a structured manner (using a unified JSON format): { "time": "2025-09-12T12:34:56Z", "source": "hostA", "event_type": "SSH_LOGIN", "features": { "src_ip":"xxxx", "user":"alice", ...}, "raw": "Raw log line" }

[0030] In step S2, the attribute information of the tactical node includes tactical ID (tactic_id), tactical name (name), tactical stage order (stage_order), typical technology list (typical_techniques[]), and risk level (risk_level); the attribute information of the technology node includes attack technology ID (tech_id), attack technology name (name), attack technology feature signature (feature_signature), required privileges (required_privilege), and associated vulnerabilities (associated_cve[]). Preferably, the knowledge graph may also include entity nodes (used to describe hosts or user terminals or servers, databases, application systems, etc.), and the attribute information of the entity nodes may include entity ID (host_id), entity role (role), asset value (asset_value), subnet (subnet), and historical alert count (historical_alert_count).

[0031] Specifically, the node types and attribute tables are shown in Table 2 below: Table 2: Node Type and Attribute Table

[0032] Among them, tactical nodes refer to the attacker's purpose or stage, which is equivalent to "what to do". For example, "initial access", "privilege escalation", "lateral movement" and "data leakage" are all tactics.

[0033] Technique: The specific method or means of implementing a tactic, equivalent to "how to do it". For example, the means of achieving "initial access" could be "spear phishing", "exploit", or "weak password login".

[0034] An attack chain knowledge graph is constructed based on the MITRE ATT&CK framework and stored in a graph database (Neo4j). Nodes are divided into tactical nodes and technical nodes, with edges representing phase transition paths. Each technical node is configured with a [signature + behavioral pattern], such as: Lateral movement / SMB is characterized by "445 port connection + NTLM authentication event"; persistence / registry is characterized by "RegSetValue + startup key". This knowledge model is used for subsequent event and phase matching.

[0035] MITRE ATT&CK currently contains 14 tactics and corresponding key feature templates. Starting with version 8 in 2018, the ATT&CK matrix has expanded to 14 tactical phases, up from 12 previously. This includes two new tactics, "Reconnaissance" and "Resource Establishment," and 12 additional tactics: "Initial Access," "Execution," "Persistence," "Privilege Escalation," "Defense Bypass," "Credential Access," "Discovery," "Lateral Movement," "Collection," "Command and Control," "Data Disclosure," and "Impact." The first two tactics, "Reconnaissance" and "Resource Establishment," correspond to the PRE-ATT&CK phase, while the latter 12 tactics correspond to the ATT&CK phase.

[0036] In step S3, the attack chain knowledge graph is modeled (HMM model), and the state transition probability matrix between different tactical nodes is as follows: ; ; in, Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. This is the corrected state transition probability matrix between tactical node i and tactical node j. For normalization parameters, This is the state transition probability matrix between tactical node i and tactical node j before correction. For topological correlation factor, As an asset importance factor; Topological association factor and asset importance factor can be greater than or less than 1, and their consecutive multiplication will significantly affect the probability value. Each row of probability matrix A must satisfy the probability distribution law, meaning the sum of all elements in the same row must be 1. This correction operation directly violates this fundamental property, making the state transition probability matrix no longer a valid probability matrix, causing subsequent HMM forward algorithm calculations to fail. To avoid this problem, normalization is introduced into the formula, with normalization parameters... Let the sum be a very small positive number (e.g., 1e-9) such that each row of the probability matrix A must satisfy the probability distribution law, that is, the sum of all elements in the same row must be 1.

[0037] Wherein, the state transition probability matrix between tactical node i and tactical node j before correction The specific method for determining it is as follows: ; in, Let be the fundamental probability matrix for the state transition between tactical node i and tactical node j. The time decay factor, This represents the difference in timestamps between tactical node i and tactical node j.

[0038] The time decay factor δ adopts exponential decay, and its value can be set as follows: δ=0.05 (based on actual testing of 500 APT chains, when Δt=10 minutes, the transition probability Aij′ decays to approximately 60%); Δt = current tactical phase or state end timestamp - previous tactical phase or state end timestamp. (Preferably, if Δt>30 minutes, it is considered an attack timeout, and Aij′=0).

[0039] Topological factor T topo Based on the shortest hop count h between hosts: if h=1, the topology factor=1.0; for each additional hop, the topology factor decreases by 0.2 (minimum 0.2).

[0040] Asset Importance Factor I asset Core assets = 1.5, Medium = 1.0, Edge = 0.8.

[0041] For example: If the fundamental probability matrix of the state transition between tactical node i and tactical node j is... =0.6, h=2( T) topo =0.8), I asset =1.5, then: ; Wherein, the fundamental probability matrix of state transition between tactical node i and tactical node j One way to determine it is: ; in, Let i be the number of transitions from tactical node i to tactical node j. The total number of transitions for tactical node i; State transition probability matrix: the probability of moving from one tactical node i (tactical phase) to another tactical node j (tactical phase) in an attack pattern.

[0042] If A[Initial Access][Execution] = 0.6, it means that there is a 60% probability of entering the "Execution" stage after "Initial Access".

[0043] Alternatively, another way to determine this is: ; in, Let i be the weight from tactical node i to tactical node j. For the tactical node i to tactical node The weight, The first tactical node directly connected to tactical node i. One tactical node; For example, suppose a certain tactical stage (tactical node) i has three possible subsequent stages: 1, 2, 3, with corresponding weights Wi, ... tt (i 1)=2、W tt (i 2)=5、W tt (i 3) = 3, that is, W tt (i 1)=2、W tt (i 2)=5、W tt (i If 3) = 3, then the sum is 10.

[0044] Then, A[i][1]=2 / 10=0.2, A[i][2]=5 / 10=0.5, A[i][3]=3 / 10=0.3.

[0045] Wherein, the weights from tactical node i to tactical node j The specific method for determining it is as follows: ; in, This represents the number of times a network attack event is transferred from tactical node i to tactical node j in the historical data. This represents the total number of transitions for tactical node i in the historical data of network attack events. The stage risk coefficient of tactical node j in the historical data of network attack events (e.g., high = 1.2, medium = 1.0, low = 0.8).

[0046] Threshold for abnormal state transition probability matrix: When A[i][j] < 0.05 (based on historical statistics: mean + 2σ), it is marked as an abnormal transition and recorded for auditing.

[0047] Training convergence condition: Using the log-likelihood iterative method, if the log-likelihood increment for 5 consecutive iterations is less than 0.001, then the model (HMM model) is considered to have converged.

[0048] One specific method for determining the observation probability matrix of a certain event observed at a certain tactical node is as follows: ; in, To observe an event at a certain tactical node j The observation probability matrix, To observe an event at a certain tactical node j Number of times, The total number of observations at a given tactical node j; Observation probability distribution matrix: In an attack pattern, after a tactical node j (tactical phase or state) completes, the following events may be observed. The possibility.

[0049] If B[lateral movement][445 port connection] = 0.8, it means that the probability of observing the event "445 port connection" is 80% during the "lateral movement" phase.

[0050] Alternatively, another way to determine this is as follows: ; in, The relative proportion of technical node k appearing at tactical node j. For technical nodes under tactical node j The relative proportion of appearance After tactical node j, and tactical node The directly connected first One technical node; Among them, the relative proportion of technical node k appearing under tactical node j The specific method for determining it is as follows: ; in, Let k be the frequency of occurrence of technical node k after tactical node j. The total number of techniques after tactical node j; For example, suppose that at a certain tactical stage (tactical node) j, there are three possible technical nodes: 1, 2, and 3, with corresponding weights W respectively. ttech (j 1)=2、W ttech (j 2)=5、W ttech (j 3) = 3, that is, W ttech (j 1)=2、W ttech (j 2)=5、W ttech (j If 3) = 3, then the sum is 10.

[0051] Therefore, B[j][1] = 2 / 10 = 0.2, B[j][2] = 5 / 10 = 0.5, and B[j][3] = 3 / 10 = 0.3.

[0052] The initial value is the historical proportion of transfers from tactical node i to tactical node j. When actual transfers from tactical node i to tactical node j are observed, the proportion is accumulated and recalculated periodically. The initial value represents the relative proportion of technical node k appearing under tactical node j. This can be adjusted based on high-credibility reports from internal or external sources (e.g., a vulnerability being widely exploited) or new technologies. These two values ​​are used to initialize and influence HMM parameters. Initialize the values ​​of the state transition probability matrix A; use Initialize the value of the observation probability distribution matrix B.

[0053] When a new attack technique is detected, a technique node k is added to the knowledge graph. new The observation probability matrix for a certain event observed at a certain tactical node is automatically updated based on the correlation between new attack techniques and existing tactics.

[0054] Specifically, the knowledge graph can access real-time data from threat intelligence platforms (such as MITRE, VirusTotal, and CIRCL). When a new attack technique is detected (such as "Tactics: Initial Access, Technique: Exploiting CVE-2024-XXXX"), an update process is automatically triggered. Add entity: Add a technology node (ID:TXXXX, feature: exploit string + port 443) to the knowledge graph. Relationship calculation: Based on the correlation between new technologies and existing tactics (e.g., CVE-2024-XXXX is often used for initial access, correlation = 0.9), add a relationship edge "initial access → TXXXX", weight = 0.9 × threat intelligence credibility (e.g. 0.8) = 0.72; Model adaptation: Automatically updating the observation probability distribution B[j][ The observation probability of new technologies is included in the calculation (e.g., B[initial visit][TXXXX]=0.72).

[0055] By linking and updating threat intelligence with knowledge graphs and HMM models, a closed loop of "intelligence → knowledge graph → model" is achieved, solving the problem of lagging detection of new attacks and significantly improving the adaptability of the solution.

[0056] The pseudocode for automatic update is as follows: On NewThreatIntel (intel): parse intel ->{tech_id, signature, assoc_tactic, confidence} if (tech_id) does not exist in KG: add node Technique(tech_id, signature) compute assoc_score = similarity(signature, existing_tech_signatures) (Note: Calculates the similarity between the feature signature of the newly discovered attack behavior and the existing technology signatures in the knowledge graph, quantifies the strength of the association between the two, and then dynamically updates the weight of the entity-technology edge) weight = assoc_score * intel.confidence (Note: Relevance score and intelligence confidence) add_or_update_edge(Tactic(assoc_tactic) ->Technique(tech_id), weight) update B[tactic][tech_id]:= normalize_observation_prob(...) enqueue for incremental HMM update After a new technology node is added, the correlation between the new technology node and existing tactical nodes is automatically calculated and the edge weights are updated. Subsequently, the new observation probabilities are incorporated into the observation probability matrix distribution in the HMM (using a smoothing / weighting strategy to avoid abrupt changes). Knowledge graph updates trigger incremental updates of the HMM (EWMA-style parameter fusion), ensuring that the HMM model can quickly incorporate new technological features.

[0057] Among them, such as Figure 2 As shown, step S4 specifically includes: S41, Construct the tactical node set S={s1…s… M} and the set of observed event sequences O={o1…o t}; where M is the total number of tactical nodes, o t The total number of events observed at the current time point t (this step can also be performed in step S3); State set S: Corresponds to the 14 major categories of the ATT&CK framework, and M is the total number of elements in the state set (tactical phase combination). Observation set O: The types of events that the system can observe during actual operation, such as "login failed", "creating a new process", "file writing", "network connection error", etc.

[0058] S42, Create a sliding window for several recent events and filter to obtain the event sequence that satisfies the conditions for creating the sliding window; Sliding window definition: A "sliding window" is created for analyzing a number of recent events. Specifically, the serial port width parameter W = 50 can be set to represent the 50 most recent consecutive events (not a time unit); if the interval between adjacent events is >10 minutes (attack interruption threshold), the window is reset; the sliding step size = 10 events, ensuring continuous updates and analysis when new events are added.

[0059] S43. Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of an event observed at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved HMM. Specifically, the forward probability calculation method for each tactical node at each time point is as follows: ; in, This represents the forward probability of tactical node j at the current time point t. This represents the forward probability of tactical node i at the previous time point t-1. Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. To observe the event at the current time point t under tactical node j The observation probability matrix.

[0060] Forward probability Used to assess the likelihood that the current event sequence matches an attack chain.

[0061] Definition: Assume o1, o2…o t It is the sequence of events observed up to the current time point t (observation sequence O). It is the probability that the current event sequence O is observed at the current time point t, and the system is in state j (state j is a certain attack stage). Using an improved Hidden Markov Model (HMM), the "forward probability" for each attack phase at each time point is calculated. First, initialization is performed, that is: = B[j][o1]; πj The initial state probability represents the probability that the attack chain starts from tactical node j (state j), which can be calculated from several (e.g., 1000) training data points (j is the number of times the attack chain starts as a tactic / the total number of attack chains used for training).

[0062] B is the observation probability distribution matrix, and B[j][o1] is the probability of observing the first event o1 in the current event sequence at tactical node j (state j).

[0063] Recurrence relation: (t>1) ; This is the state transition probability matrix between tactical node i and tactical node j, representing the probability of transitioning from state i to state j. To observe the event at the current time point t under tactical node j The observation probability matrix. M represents the total number of states in the state set S, which is the total number of all possible attack phases in the HMM. The probabilities of all possible paths from the previous tactical node i to the current tactical node j are summed.

[0064] It is the probability that the system was at tactical node j and observed the previous t-1 events at the previous time step t-1, which is the forward probability calculated in the previous step and is recursively derived as the event sequence continues. . , The calculations are the same as the initialization and recursion described above, and the technical solution of this invention will not be repeated here.

[0065] S44. Based on the chain type formed by the nodes in the knowledge graph, calculate the global confidence of the current system at a certain tactical stage in a continuous time sequence.

[0066] Specifically, if the chain type formed by the nodes in the knowledge graph is a linear chain, the forward probability of each tactical node at each time point is summed using an accumulative method to calculate the global confidence of the current system in a certain tactical stage under continuous time series. Linear chains (stage chaining, such as initial access → execution → lateral movement): use a summation method, i.e.: ; in, The set of tactical nodes is a subset of the linear chains within the state set S. If the chain type formed by the nodes in the knowledge graph is a parallel chain, the forward probability of each tactical node at each time point is maximized to calculate the global confidence of the current system in a certain tactical stage under continuous time series.

[0067] Parallel chains (phases mutually exclusive or parallel, such as execution and persistence occurring simultaneously): Maximize the value, i.e.: ; For example, if α(initial) = 0.3, α(execution) = 0.6, and α(lateral) = 0.1, then the confidence level P = 1.0 for linear chains and 0.6 for parallel chains.

[0068] Continuous decision parameter k 判 This represents the number of consecutive occurrences of the condition P>θ. If P>θ occurs consecutively k times... 判 This will trigger (default: θ=0.7, k 判 =3). The scaling parameter θ was selected using ROC curves / cross-validation (θ corresponding to the maximum F1 score on historical data).

[0069] Specifically, in step S5, the tiered risk value is determined based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series. ; Where R is the stratified risk value; , where P is the weighting coefficient of the global confidence score, and P is the global confidence score of the current system at a certain tactical stage in the continuous time series. I is the weighting coefficient for attack chain integrity, and I is the ratio of the number of currently observed tactics to the total number of tactics in the current system under continuous time series. , where A is the weighting coefficient for the asset risk level, and A is the average risk score of the attacked assets in the current system over a continuous time series. The stratified risk value R can be obtained by combining three dimensions. The calculation relationship and weighting coefficient of the stratified risk value R under different dimensions are shown in Table 3 below: Table 3: Calculation methods and weighting coefficients for stratified risk values ​​R under different dimensions

[0070] That is, the stratified risk value R = 0.4P + 0.3I + 0.3A; By using the attack chain integrity dimension (I), we can distinguish between "low-risk probing attacks" and "high-risk APT attacks" and prioritize defense against high-risk APT attacks (higher attack chain integrity) in the response strategy. By using the asset risk level dimension (A), we can prioritize defense against APT attacks on core assets (high-risk assets) in the response strategy (higher asset risk level), thereby improving the rationality of defense resource allocation in the response strategy.

[0071] Among them, the weighting coefficient of global confidence. Weighting coefficients for attack chain integrity , which are the weighting coefficients for asset risk levels. In the process of determining the risk level, the determination can be optimized on the historical validation dataset using a grid search method to maximize the F1 score of high-risk alarms.

[0072] Specifically, the determination of the weighting coefficients: This invention adopts an optimization experimental design based on historical data, and the specific steps are as follows: Data Preparation: Collect 1000 tagged historical attack chain data entries, including 500 real network attack drill data entries and 500 normal business behavior data entries. Each data entry includes the attack chain phase sequence, the observed event sequence, and information about the attacked assets.

[0073] Initial settings: Initialize the weighting coefficients by distributing them evenly, i.e. = = = 0.33, to ensure that the experimental starting point is unbiased.

[0074] Search and Validation Methods: A grid search combined with three-fold cross-validation is used to optimize the weight combinations. The search range is [0.1, 0.6], with a step size of 0.1, ensuring that the sum of all weight combinations equals 1. Detection performance (F1 score, AUC value) is used as the evaluation metric.

[0075] Validation results: Among all candidate weight combinations, when =0.4、 =0.3、 When the coefficient of performance is 0.3, the detection performance is optimal: the F1 score is 0.92 (the highest value); the AUC value is 0.95; the false alarm rate is <5%; the false negative rate is ≤3%; and in the three-fold cross-validation, the variance of the result is less than 0.02, showing stable performance.

[0076] The results are in line with logical expectations: the global confidence P comes directly from the forward algorithm reasoning of HMM, which can most accurately reflect the temporal consistency of the attack chain, and therefore has a slightly higher weight (0.4); the attack chain integrity I and the asset risk level A have a similar impact on the severity of the attack, and are both assigned 0.3.

[0077] The specific response strategy determined based on the stratified risk values ​​is as follows: When the layered risk value is not less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately; when the layered risk value is not less than the second preset risk value and less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately, an alarm message is pushed and human-computer interaction verification is performed; when the layered risk value is less than the second preset risk value, the global confidence level, attack chain integrity, asset risk level and layered risk value of the current system at a certain tactical stage in a continuous time series are recorded.

[0078] Response strategy: 1. High risk R≥0.8 (first preset risk value): Automatic defense (block IP, isolate host), immediate alarm and capture evidence snapshot.

[0079] 2. Medium risk 0.5≤R<0.8: Push alarms and human-computer interaction verification.

[0080] 3. Low risk R<0.5 (second preset risk value): Recorded and included in the training buffer for HMM model update, i.e. Hidden Markov Model.

[0081] Key parameters for updating the HMM model include: State transition probability matrix A: Represents the state transition probability between attack phases (e.g., the probability of "execution → lateral movement").

[0082] Observation probability matrix B: represents the probability of observing an event type at a certain attack phase (e.g., the probability of a "remote login failure" event occurring during the "lateral movement" phase).

[0083] Initial state probability π: The prior probability at the beginning of the attack chain.

[0084] Although “low-risk events” do not trigger alarms, they contain new information that may be valuable to the model, such as normal behavior or slightly abnormal behavior.

[0085] Specific update method: Low-risk event sequences are encoded into event vectors according to the HMM observation event sequence set O, and identifiable attack chain stages associated with events are marked as potential state sets S. This data is then added to the training buffer, retaining the most recent 1000 data points.

[0086] For the state transition probability matrix A: count the number of newly observed inter-stage transitions in the statistical buffer, and calculate the new A value of the buffer. , new ), and compared with the original value of A ( , old Perform weighted fusion and update the transition probability.

[0087] For example, the new value of A = the old value of A * 0.9 + the value of A in the buffer * 0.1. (For each element in the matrix) Similarly, for the observation probability matrix B: calculate the new B value of the buffer by counting the number of times the technique appears in the newly observed tactical phase in the statistical buffer. , new ), and compared with the original B value ( , old Perform weighted fusion and update the observation probabilities.

[0088] The new B value = old B value * 0.9 + buffer B value * 0.1 (for each element in the matrix).

[0089] This allows the model to learn new behavioral patterns. It can also be updated either when the buffer is full or periodically, depending on the actual situation.

[0090] Preferably, the knowledge graph can be displayed graphically (nodes: tactics / techniques / entities; edges: transition probabilities and confidence levels), supporting time-based replay and highlighting of key nodes to output complete attack chain paths and visual reports, assisting the blue team in conducting exercise debriefing and attribution. Furthermore, the knowledge base and detection engine can be flexibly expanded according to exercise scenarios to adapt to different attack patterns. Alerts can be output in JSON format for easy integration with SIEM / SOAR systems. The visualization uses graph-based drawing, with node colors representing stages, and supports dynamic updates with the event flow, allowing the defender to intuitively understand the attack path.

[0091] During the training and evaluation of the HMM model, the training data is initially based on 1000 labeled chains (500 normal and 500 attack); external intelligence / synthetic samples can be expanded to 3000+.

[0092] The reason for taking δ to be 0.05 is: in actual tests on 500 APT chains, the A value after a 10-minute delay was reduced to 0.6 (experimental target); if a more conservative approach is needed, 0.01 can be used.

[0093] The continuous judgment parameters are derived from historical data through optimization using the ROC / F1 curve, which can reduce false alarms to about 5% and false negatives to about 3%.

[0094] HMM convergence criterion: Log-likelihood increments for 5 consecutive iterations < 0.001.

[0095] Abnormal transfer judgment threshold: A[i][j]<0.05 (mean + 2σ judgment).

[0096] While LSTM (Long Short-Term Memory) or Transformer models can learn and classify attack event sequences and enhance feature representation through deep learning, these models are costly to train, require large amounts of labeled data, and lack generalization ability in small sample sizes or novel attack scenarios. In contrast, this invention employs an improved HMM, which, compared to LSTM or Transformer models, has lower computational overhead, stronger interpretability, and can reduce false positives through a time decay factor, making it more suitable for real-time detection in attack and defense simulation scenarios.

[0097] While the confidence interval determination method based on Bayesian inference can dynamically adjust the alarm threshold, it suffers from high computational overhead in high-concurrency environments and is susceptible to abnormal fluctuations. In contrast, this invention uses a combination of sliding window and fixed threshold determination, which is computationally simple, easy to implement, ensures real-time performance, and effectively reduces the false alarm rate.

[0098] The attack chain knowledge graph in this invention includes tactical nodes and technical nodes. Tactical nodes describe tactical stages or states, while technical nodes describe specific methods or means of implementing a particular tactic. The attack chain knowledge graph is modeled to obtain state transition probability matrices between different tactical nodes and observation probability matrices for observing a particular event at a given tactical node. The Hidden Markov Model (HMM) forward algorithm is used to dynamically calculate the global confidence level of the current system at a specific tactical stage in a continuous time series. Based on the global confidence level of the current system at a specific tactical stage in a continuous time series, the attack chain integrity, and the asset risk level, hierarchical risk values ​​are determined. Corresponding response strategies are determined based on these hierarchical risk values, enabling full-link identification and alerting of the attack behavior chain. This helps the blue team quickly locate attack paths, improves overall protection levels, and makes defense responses more accurate. It effectively solves the problem of low reliability in network attack and defense exercise behavior detection caused by existing technologies, and effectively improves the reliability of network attack and defense exercise behavior detection.

[0099] The technical solution of this invention corrects the state transition probability matrix between different tactical nodes by using the "topological correlation" (such as the network distance between hosts) and "asset importance" (such as the difference between core servers and ordinary terminals) of the attack chain. It uses an improved HMM forward algorithm for dynamic modeling and reasoning to achieve probabilistic detection of the attack phase and multi-dimensional reasoning of "time sequence + topology + assets", thereby reducing the false alarm rate, significantly improving the accuracy of subsequent reasoning, and further improving the reliability of network attack and defense exercise behavior detection.

[0100] In the technical solution of this invention, when a new attack technique is detected, a technique node is added to the knowledge graph; based on the correlation between the new attack technique and existing tactics, the observation probability matrix of an event observed under a certain tactic node is automatically updated, realizing a closed loop of "intelligence → knowledge graph → update", solving the problem of lagging detection of new attacks, and significantly improving the adaptability of the solution.

[0101] In this invention, the global confidence level of the current system at a certain tactical stage in a continuous time sequence is calculated based on the chain type formed by the nodes in the knowledge graph, thereby further improving the adaptability of the solution.

[0102] Example 2 like Figure 3 As shown, the technical solution of the present invention also provides a training behavior detection system based on attack chain modeling and serialized reasoning, including: Module 101 acquires historical data of network attack events and converts the historical data of network attack events into an event sequence. Module 102 constructs an attack chain knowledge graph based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe specific methods or means of implementing a certain tactic. Modeling module 103 models the attack chain knowledge graph to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. The inference and calculation module 104 uses the HMM forward algorithm to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series, based on the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event under a certain tactical node. Module 105 determines the hierarchical risk value based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, and determines the corresponding response strategy based on the hierarchical risk value.

[0103] The implementation process of the acquisition module 101, construction module 102, modeling module 103, reasoning and calculation module 104, and determination module 105 in this embodiment 2 corresponds to the method steps in embodiment 1, and will not be repeated here.

[0104] The attack chain knowledge graph in this invention includes tactical nodes and technical nodes. Tactical nodes describe tactical stages or states, while technical nodes describe specific methods or means of implementing a particular tactic. The attack chain knowledge graph is modeled to obtain state transition probability matrices between different tactical nodes and observation probability matrices for observing a particular event at a given tactical node. The Hidden Markov Model (HMM) forward algorithm is used to dynamically calculate the global confidence level of the current system at a specific tactical stage in a continuous time series. Based on the global confidence level of the current system at a specific tactical stage in a continuous time series, the attack chain integrity, and the asset risk level, hierarchical risk values ​​are determined. Corresponding response strategies are determined based on these hierarchical risk values, enabling full-link identification and alerting of the attack behavior chain. This helps the blue team quickly locate attack paths, improves overall protection levels, and makes defense responses more accurate. It effectively solves the problem of low reliability in network attack and defense exercise behavior detection caused by existing technologies, and effectively improves the reliability of network attack and defense exercise behavior detection.

[0105] The technical solution of this invention corrects the state transition probability matrix between different tactical nodes by using the "topological correlation" (such as the network distance between hosts) and "asset importance" (such as the difference between core servers and ordinary terminals) of the attack chain. It uses an improved HMM forward algorithm for dynamic modeling and reasoning to achieve probabilistic detection of the attack phase and multi-dimensional reasoning of "time sequence + topology + assets", thereby reducing the false alarm rate, significantly improving the accuracy of subsequent reasoning, and further improving the reliability of network attack and defense exercise behavior detection.

[0106] In the technical solution of this invention, when a new attack technique is detected, a technique node is added to the knowledge graph; based on the correlation between the new attack technique and existing tactics, the observation probability matrix of an event observed under a certain tactic node is automatically updated, realizing a closed loop of "intelligence → knowledge graph → update", solving the problem of lagging detection of new attacks, and significantly improving the adaptability of the solution.

[0107] In this invention, the global confidence level of the current system at a certain tactical stage in a continuous time sequence is calculated based on the chain type formed by the nodes in the knowledge graph, thereby further improving the adaptability of the solution.

[0108] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for detecting drill behavior based on attack chain modeling and sequential reasoning, characterized by: include: Obtain historical data on network attack events and convert these events into event sequences. An attack chain knowledge graph is constructed based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe the specific methods or means of implementing a certain tactic. The attack chain knowledge graph is modeled to obtain the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event at a certain tactical node; specifically, the state transition probability matrix between different tactical nodes is as follows: ； ； in, Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. This is the corrected state transition probability matrix between tactical node i and tactical node j. For normalization parameters, This is the state transition probability matrix between tactical node i and tactical node j before correction. For topological correlation factor, As an asset importance factor; Wherein, the state transition probability matrix between tactical node i and tactical node j before correction The specific method for determining it is as follows: ； in, Let be the fundamental probability matrix for the state transition between tactical node i and tactical node j. The time decay factor, The difference between the timestamps of tactical node i and tactical node j; Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the HMM forward algorithm is used to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series. Based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, a tiered risk value is determined, and the corresponding response strategy is determined based on the tiered risk value.

2. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The attribute information of a tactical node includes tactical ID, tactical name, tactical phase sequence, typical technology list, and risk level; The attribute information of the technical node includes the attack technique ID, attack technique name, attack technique signature, permissions required for the attack technique, and associated vulnerabilities.

3. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The fundamental probability matrix of state transitions between tactical node i and tactical node j The specific method for determining it is as follows: ； in, Let i be the number of transitions from tactical node i to tactical node j. For the total number of transitions at tactical node i; or, ； in, Let i be the weight from tactical node i to tactical node j. For the tactical node i to tactical node The weight, The first tactical node directly connected to tactical node i. One tactical node; Wherein, the weights from tactical node i to tactical node j The specific method for determining it is as follows: ； in, This represents the number of times a network attack event is transferred from tactical node i to tactical node j in the historical data. This represents the total number of transitions for tactical node i in the historical data of network attack events. This represents the stage risk coefficient of tactical node j in the historical data of network attack events.

4. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The specific observation probability matrix for observing a certain event at a certain tactical node is as follows: ； in, To observe an event at a certain tactical node j The observation probability matrix, To observe an event at a certain tactical node j Number of times, The total number of observations at a given tactical node j; or, ； in, The relative proportion of technical node k appearing at tactical node j. For technical nodes under tactical node j The relative proportion of appearance After tactical node j, and tactical node The directly connected first One technical node; Among them, the relative proportion of technical node k appearing under tactical node j The specific method for determining it is as follows: ； in, Let k be the frequency of occurrence of technical node k after tactical node j. The total number of techniques after tactical node j; When a new attack technique is detected, a technique node is added to the knowledge graph; the observation probability matrix of an event observed under a certain tactic node is automatically updated based on the correlation between the new attack technique and existing tactics.

5. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the global confidence of the current system in a certain tactical stage under continuous time series is calculated using the HMM forward algorithm for dynamic inference. Construct a tactical node set S = {s1…s2} M } and the set of observed event sequences O={o1…o t }; where M is the total number of tactical nodes, o t The event observed at the current time point t; Create a sliding window for a number of recent events and filter to obtain the event sequence that satisfies the criteria for creating the sliding window; Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of observing a certain event at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved HMM. Based on the chain type formed by nodes in the knowledge graph, calculate the global confidence of the current system at a certain tactical stage in a continuous time sequence.

6. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 5, characterized in that, Based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed at a certain tactical node, the forward probability of each tactical node at each time point is calculated using an improved Hidden Markov Model (HMM): ； in, This represents the forward probability of tactical node j at the current time point t. This represents the forward probability of tactical node i at the previous time point t-1. Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. To observe the event at the current time point t under tactical node j The observation probability matrix.

7. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 5, characterized in that, The global confidence level of the current system at a certain tactical stage in a continuous time series is calculated as follows: If the chain formed by the nodes in the knowledge graph is a linear chain, the forward probability of each tactical node at each time point is summed to calculate the global confidence of the current system in a certain tactical stage under continuous time series. If the chain type formed by the nodes in the knowledge graph is a parallel chain, the forward probability of each tactical node at each time point is maximized to calculate the global confidence of the current system in a certain tactical stage under continuous time series.

8. The method for detecting drill behavior based on attack chain modeling and serialized reasoning according to claim 1, characterized in that, The tiered risk values ​​are determined based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, as follows: ； Where R is the stratified risk value; , where P is the weighting coefficient of the global confidence score, and P is the global confidence score of the current system at a certain tactical stage in the continuous time series. I is the weighting coefficient for attack chain integrity, and I is the ratio of the number of currently observed tactics to the total number of tactics in the current system under continuous time series. , where A is the weighting coefficient for the asset risk level, and A is the average risk score of the attacked assets in the current system over a continuous time series. The specific response strategy determined based on the stratified risk values ​​is as follows: When the layered risk value is not less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately; when the layered risk value is not less than the second preset risk value and less than the first preset risk value, the automatic defense mechanism is activated and an alarm is triggered immediately, an alarm message is pushed and human-computer interaction verification is performed; when the layered risk value is less than the second preset risk value, the global confidence level, attack chain integrity, asset risk level and layered risk value of the current system at a certain tactical stage in a continuous time series are recorded.

9. A training behavior detection system based on attack chain modeling and sequential reasoning, characterized in that: include: The acquisition module retrieves historical data of network attack events and converts these historical events into event sequences. The construction module builds an attack chain knowledge graph based on historical data of network attack events. The attack chain knowledge graph includes tactical nodes and technical nodes. The tactical nodes are used to describe tactical stages or tactical states, and the technical nodes are used to describe the specific methods or means of implementing a certain tactic. The modeling module models the attack chain knowledge graph, obtaining the state transition probability matrix between different tactical nodes and the observation probability matrix for observing a certain event at a given tactical node. Specifically, the state transition probability matrix between different tactical nodes is as follows: ； ； in, Let be the normalized and corrected state transition probability matrix between tactical node i and tactical node j. This is the corrected state transition probability matrix between tactical node i and tactical node j. For normalization parameters, This is the state transition probability matrix between tactical node i and tactical node j before correction. For topological correlation factor, As an asset importance factor; Wherein, the state transition probability matrix between tactical node i and tactical node j before correction The specific method for determining it is as follows: ； in, Let be the fundamental probability matrix for the state transition between tactical node i and tactical node j. The time decay factor, The difference between the timestamps of tactical node i and tactical node j; The inference and calculation module uses the HMM forward algorithm to dynamically infer and calculate the global confidence of the current system in a certain tactical stage under continuous time series, based on the state transition probability matrix between different tactical nodes and the observation probability matrix of a certain event observed under a certain tactical node. The determination module determines the tiered risk value based on the global confidence level, attack chain integrity, and asset risk level of the current system at a certain tactical stage in a continuous time series, and then determines the corresponding response strategy based on the tiered risk value.

Images