A cyber security situation awareness method and system

Abstract

The application relates to the technical field of network security monitoring, and discloses a network security situation awareness method and system, which comprises the following steps: collecting multi-source heterogeneous logs and performing standardized analysis to obtain log event data; performing real-time analysis on the log event data by using a dynamic baseline correlation engine to obtain log correlation alarm data, analyzing triplets from the log correlation alarm data, constructing a basic knowledge graph based on the triplets, and performing rule reasoning and embedding reasoning, integrating reasoning results to form a situation-enhanced security situation knowledge graph; extracting threat data from the security situation knowledge graph, combining a graph neural network GAT to optimize the threat data, obtaining a final network attack threat value, and performing network security situation awareness based on the network attack threat value; and the threat data comprises a comprehensive hazard degree and an attack influence range. The application can improve the efficiency and effect of network security management.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring, and in particular to a network security situation awareness method and system. Background Technology

[0002] As networks grow larger and their topologies become more complex, the difficulty of network security management increases dramatically. In the early days, network security protection mainly relied on single detection technologies, such as intrusion detection technology and malware detection technology. These technologies discover problems in the network from their own specific perspectives, but they ignore the correlation between different types of security elements, making it impossible to comprehensively and timely perceive threats in the network, let alone predict potential risks.

[0003] Currently, existing network security situational awareness systems primarily rely on known attack patterns for detection and analysis. Their ability to respond to zero-day attacks and unknown threats is severely inadequate. Because these attack patterns are yet to be detected, the lack of corresponding rules and characteristics for detection leaves network security at significant risk. For example, when new zero-day exploit attacks emerge, traditional situational awareness systems often struggle to detect and defend against them in a timely manner.

[0004] Furthermore, some network situational awareness technologies typically operate on a single sensing node, making information sharing and collaborative analysis between nodes difficult. This makes it impossible to present the overall attack process carried out by attackers on the entire network system and to provide a holistic and global perspective on network security intelligence. Consequently, when facing complex attacks that cross regions and systems, it is impossible to fully grasp the attack situation and formulate effective defense strategies.

[0005] Therefore, this application provides a network security situation awareness method to solve the above-mentioned technical problems. Summary of the Invention

[0006] The purpose of this invention is to provide a network security situation awareness method and system to solve the technical problem in the prior art of being unable to fully grasp the attack situation and formulate effective defense strategies when facing complex attacks across regions and systems.

[0007] To address the aforementioned technical problems, this invention provides a network security situation awareness method, comprising:

[0008] It responds to the collection of multi-source heterogeneous logs and performs standardized parsing to obtain log event data;

[0009] performing real-time analysis based on the log event data using a dynamic baseline correlation engine to obtain log correlation alert data, wherein the dynamic baseline correlation engine distinguishes abnormal events by obtaining a dynamic baseline of event types in a log sample sequence, and quantifies correlation of abnormal events, quantifies event correlation by fusing conditional probability and time decay correlation function, judges whether an event chain is formed, and matches the formed event chain with an attack chain template to generate the log correlation alert data, the attack chain template is based on the MITRE ATT&CK framework, and is obtained by combining actual attack event chain combinations in history;

[0010] parsing triplets from the log correlation alert data, constructing a basic knowledge graph based on the triplets and performing rule reasoning and embedding reasoning, and integrating reasoning results to form a security situation knowledge graph with enhanced situation;

[0011] extracting threat data from the security situation knowledge graph and optimizing the threat data by combining a graph neural network GAT to obtain a final network attack threat value, and performing network security situation awareness based on the network attack threat value, wherein the threat data includes comprehensive harm degree and attack impact range.

[0012] In some embodiments, in response to collecting multi-source heterogeneous logs and performing standardized parsing, log event data is obtained, further comprising:

[0013] defining a unified log field, the unified log field including log timestamp, event subject, event action and event object;

[0014] mapping logs of different sources and formats to the unified log field using regular expressions to convert them into structured log events;

[0015] performing timestamp normalization processing on all structured log events using NTP protocol, and transmitting through Kafka message queue, outputting standard events, and forming a unified standardized log event data set.

[0016] In some embodiments, the dynamic baseline correlation engine distinguishes abnormal events by obtaining a dynamic baseline of event types in a log sample sequence, further comprising:

[0017] selecting log event data corresponding to normal sample data in historical data, and defining event types of each log event data to form a log sample sequence;

[0018] based on the log sample sequence, a Gaussian kernel estimation method is used to calculate the probability density function of normal event frequency;

[0019] Based on the probability density function, a significance level is set, and an upper limit and a lower limit of a confidence interval corresponding to the significance level are calculated, so that the integral value of the probability density function from negative infinity to the lower limit is equal to half of the significance level, and the integral value from the upper limit to positive infinity is also equal to half of the significance level;

[0020] According to the upper limit and the lower limit, a dynamic baseline of the event type at a specified time is obtained, wherein the dynamic baseline is an interval defined by the upper limit and the lower limit.

[0021] In some embodiments, the correlation degree quantification for abnormal events further includes:

[0022] A correlation degree function is defined to measure the correlation degree between events, which integrates the conditional probability between event types and a factor simulating the influence of the interval between event occurrence times in an exponential decay manner;

[0023] The time window used to define the correlation relationship of events is preset to a fixed length.

[0024] In some embodiments, the event correlation quantification by the correlation degree function integrating the conditional probability and the time decay, the judgment of whether an event chain is formed, the matching of the formed event chain with an attack chain template to generate the log correlation alarm data further include:

[0025] From the historical attack log, the number of times of occurrence of a second event type within a preset time window after the occurrence of a first event type and the total number of times of occurrence of the first event type are counted;

[0026] The conditional probability of the second event type after the occurrence of the first event type is calculated;

[0027] Based on the conditional probability and the actual time interval between the first event and the second event to be analyzed, the correlation degree between the first event and the second event is calculated;

[0028] When the correlation degree reaches a preset correlation degree threshold, it is determined that the first event and the second event are correlated and form an event chain;

[0029] The edit distance similarity between the event chain and an attack chain template is calculated;

[0030] When the edit distance similarity reaches a preset similarity threshold, log correlation alarm data is generated, wherein the log correlation alarm data includes a set of correlated events, a correlation degree, and matched attack chain template identification information.

[0031] In some embodiments, triples are parsed from the log correlation alert data, a base knowledge graph is constructed based on the triples and rule-based reasoning and embedding reasoning are performed, and the reasoning results are integrated to form a threat-enhanced security posture knowledge graph, further comprising:

[0032] A knowledge graph is defined, and entity types of the knowledge graph include network assets, users, and attack behaviors.

[0033] Triples composed of head entities, relationships, and tail entities are extracted from the log correlation alert data.

[0034] All parsed triples are stored in a graph database, where the head entities and the tail entities are nodes, and the relationships are edges between the nodes, forming a base knowledge graph.

[0035] Hidden relationships are deduced through rule-based reasoning, and potential relationships are obtained through embedding reasoning.

[0036] The hidden relationships and the potential relationships are integrated into the base knowledge graph to obtain the security posture knowledge graph.

[0037] In some embodiments, hidden relationships are deduced through rule-based reasoning, and potential relationships are obtained through embedding reasoning, further comprising:

[0038] In rule-based reasoning, hidden relationships are deduced from the base knowledge graph according to pre-defined event chains.

[0039] In embedding reasoning, TransE model is used to map entities and relationships in the base knowledge graph to a low-dimensional vector space, and vector representations of entities and relationships are trained through vector operations.

[0040] For real-time triples, if the distance between the sum of the head entity vector and the relationship vector and the tail entity vector is less than a pre-set distance threshold, it is determined that there is a potential relationship between the head entity and the tail entity.

[0041] In some embodiments, threat data is extracted from the security posture knowledge graph, and graph neural network GAT is used to optimize the threat data to obtain a final network attack threat value, further comprising:

[0042] The comprehensive harm degree and the attack influence range are obtained from the security posture knowledge graph.

[0043] Vector representations of entities and relationships in the security posture knowledge graph are input into a graph attention network.

[0044] For the attack behavior in the security situation knowledge graph and the associated network asset, the attention weight of the attack behavior on the network asset is calculated, wherein the attention weight is calculated via an attention mechanism comprising vector splicing, linear transformation and activation function, and is normalized for all network asset nodes;

[0045] The information of the network asset nodes associated with the attack behavior is aggregated by the graph attention network to obtain an enhanced feature vector of the attack behavior;

[0046] In combination with the comprehensive harm degree, the attack influence range and the enhanced feature vector, a final network attack threat value is obtained through an activation function mapping.

[0047] In some embodiments, obtaining the comprehensive harm degree and the attack influence range further comprises:

[0048] For the attack behavior in the security situation knowledge graph, if it is a vulnerability exploitation type attack, a common vulnerability scoring system is used to score and obtain a harm degree through normalization processing;

[0049] If it is a non-vulnerability exploitation type attack, a harm degree is predefined according to a historical attack harm degree; the comprehensive harm degree is composed of the harm degree obtained by processing and the predefined harm degree;

[0050] The sum of the number of network assets directly affected by the attack behavior and the number of network assets indirectly affected in the knowledge graph is counted, and then compared with the total number of network assets to obtain the attack influence range.

[0051] Based on the same concept, the present application also provides a network security situation awareness system, comprising:

[0052] A log acquisition module configured to acquire log event data in response to collected multi-source heterogeneous logs and perform standardized analysis;

[0053] A data analysis module configured to perform real-time analysis based on the log event data using a dynamic baseline correlation engine to obtain log correlation alarm data, wherein the dynamic baseline correlation engine distinguishes abnormal events by obtaining a dynamic baseline of event types in a log sample sequence, and quantifies the correlation of abnormal events, quantifies event correlation by fusing a conditional probability and a time decay correlation function, judges whether an event chain is formed, matches the formed event chain with an attack chain template to generate the log correlation alarm data, and the attack chain template is based on the MITRE ATT&CK framework and is obtained by combining actual attack event chains that have occurred in history;

[0054] A rule reasoning module is configured to parse triples from the log correlation alarm data, construct a basic knowledge graph based on the triples, and perform rule reasoning and embedding reasoning, and integrate the reasoning results to form a security situation knowledge graph with enhanced situation awareness;

[0055] A situation awareness module is configured to extract threat data from the security situation knowledge graph and optimize the threat data by combining a graph neural network (GAT) to obtain a final network attack threat value, and perform network security situation awareness based on the network attack threat value, wherein the threat data includes a comprehensive harm degree and an attack impact range.

[0056] Compared with the prior art, the present application has the beneficial effects that:

[0057] The present application discloses a network security situation awareness method and system, which generates log correlation alarm data by performing correlation degree calculation, attack chain template matching and other operations on events, wherein the log correlation alarm data contains rich and accurate information such as a set of associated events, correlation degrees and template identifiers, ensuring that there is a reliable data source for subsequent analysis, avoiding analysis result deviation caused by poor data quality (such as incomplete data and inaccurate correlation), and using correlation degree thresholds and similarity thresholds to filter out meaningless isolated events or false positive events from a large number of log events, reduce the amount of data for subsequent processing, and improve the efficiency and pertinence of security analysis.

[0058] Through the basic knowledge graph, triples in the log correlation alarm data are integrated, network assets, users, attack behaviors and other entities and their explicit relationships are organized in a graph structure, hidden relationships are deduced through rule reasoning, potential relationships are obtained through embedding reasoning, and these relationships are integrated into the basic knowledge graph to form a security situation knowledge graph, further supplementing the indirect and potential correlation between entities. Embedding reasoning uses vector operations of the TransE model to mine threat relationships that have no explicit rules but potential correlations. The combination of the two enables the knowledge graph to have the ability to reason threats from different dimensions, improving the discovery probability of unknown threats and new attacks.

[0059] Based on the calculated network attack threat value, the threat distribution and change trend of different assets and different attack types can be visualized by using a heat map and a time series chart, enabling security personnel to intuitively and quickly grasp the network security situation and identify areas and attack types with high threats, providing clear and intuitive basis for formulating targeted protection strategies, and improving the efficiency and effectiveness of network security management. BRIEF DESCRIPTION OF DRAWINGS

[0060] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments made with reference to the accompanying drawings:

[0061] Figure 1 is a flowchart of a network security situation awareness method in some embodiments of the present application;

[0062] Figure 2 is a flowchart of a network security situation awareness system in some embodiments of the present application. DETAILED DESCRIPTION

[0063] For the purpose of the present application, the technical solutions and advantages will be more apparent, the present application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0064] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "an" and "the" used in the embodiments of the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. "Multiple" generally includes at least two.

[0065] It should be understood that the term "and / or" used herein is only to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " in this paper generally represents that the front and rear associated objects are a "or" relationship.

[0066] It should be understood that although the terms first, second, third, etc. can be used in the embodiments of the present application, these descriptions should not be limited to these terms. These terms are only used to distinguish the description. For example, without departing from the scope of the embodiments of the present application, the first can also be called the second, and similarly, the second can also be called the first.

[0067] Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if it is determined" or "if (a stated condition or event) is detected" can be interpreted as "when it is determined" or "in response to determining" or "when (a stated condition or event) is detected" or "in response to detecting (a stated condition or event)".

[0068] It is also important to note that the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0069] In particular, it should be noted that the symbols and / or numbers present in the description, if not marked in the description of the figures, are not figure references.

[0070] With reference to Figure 1 A network security situation awareness method comprises:

[0071] S101, acquiring log event data by responding to collected multi-source heterogeneous logs and performing standardized analysis;

[0072] S102, obtaining log correlation alarm data by using a dynamic baseline correlation engine to perform real-time analysis based on the log event data, wherein the dynamic baseline correlation engine distinguishes abnormal events by acquiring a dynamic baseline of event types in a log sample sequence, quantifies correlation of abnormal events, quantifies event correlation by fusing a conditional probability and a time decay correlation function, judges whether an event chain is formed, matches the formed event chain with an attack chain template to generate the log correlation alarm data, the attack chain template is based on the MITRE ATT&CK framework and is obtained by combining actual attack event chain combinations in history;

[0073] S103, parsing triplets from the log correlation alarm data, constructing a basic knowledge graph based on the triplets and performing rule reasoning and embedding reasoning, integrating reasoning results to form a situation-enhanced security situation knowledge graph;

[0074] S104, extracting threat data according to the security situation knowledge graph and combining a graph neural network GAT to optimize the threat data to obtain a final network attack threat value, performing network security situation awareness based on the network attack threat value, wherein the threat data includes comprehensive harm degree and attack impact range.

[0075] Specifically, in the embodiments of the present application, in response to the collected multi-source heterogeneous logs and standardized analysis, log event data is obtained, including defining a unified log field structure, which includes log timestamp, event subject, event action and event object; using regular expressions to map logs from different sources and with different formats to the unified field structure, converting them into structured log events; using network time protocol for timestamp normalization processing of all structured log events to ensure time sequence consistency; the parsed and normalized data is transmitted through a message queue, output as a standard event, forming a unified standardized log event data set. Based on the log event data, a dynamic baseline correlation engine is used for real-time analysis to obtain log correlation alarm data. The dynamic baseline correlation engine distinguishes abnormal events by obtaining the dynamic baseline of event types in the log sample sequence, the process includes: selecting event logs corresponding to historical normal data to define event types and constitute a sample sequence, calculating the probability density function of normal event occurrence frequency based on the sequence using kernel density estimation method, setting the significance level according to the function and calculating the upper and lower limits of the corresponding confidence interval to determine the dynamic baseline; after identifying abnormal events deviating from the dynamic baseline, the correlation of abnormal events is quantified, the correlation closeness between events is calculated through the correlation degree function of fusing conditional probability between event types and time decay factor, and whether the events form an event chain is judged according to whether the correlation degree reaches a preset threshold; the formed event chain is matched with a preset attack chain template, the attack chain template is obtained based on the MITRE ATT&CK framework and combined with historical attack event chains, the similarity between the event chain and the template is calculated using the edit distance algorithm, and if the similarity reaches a set threshold, log correlation alarm data containing the associated event set, correlation degree and template identifier is generated. Triples are parsed from the log correlation alarm data, a basic knowledge graph is constructed based on the triples and rule reasoning and embedding reasoning are performed, and the reasoning results are integrated to form a situation-enhanced security situation knowledge graph, including: defining a knowledge graph with network assets, users and attack behaviors as entity types, extracting triples composed of head entities, relationships and tail entities from alarm data; storing all triples in a graph database to build a basic knowledge graph with entities as nodes and relationships as edges; hidden relationships are derived through pre-defined event chain rules for rule reasoning, and at the same time, TransE embedding model is used to map entities and relationships to low-dimensional vector space, vector representation is obtained through vector operation training and potential relationships are inferred accordingly; hidden relationships and potential relationships are integrated into the basic knowledge graph to form an enhanced security situation knowledge graph.According to the security situation knowledge graph, threat data is extracted, and a graph neural network GAT is combined to optimize the threat data to obtain a final network attack threat value. Network security situation awareness is performed based on the network attack threat value. The threat data includes a comprehensive harm degree and an attack influence range. The process includes: for an attack behavior identified in the knowledge graph, if the attack behavior belongs to a vulnerability exploitation type attack, a harm degree is obtained by scoring and normalizing according to a common vulnerability scoring system; if the attack behavior belongs to a non-vulnerability exploitation type attack, a harm degree is preset according to historical data; and a comprehensive harm degree is formed by comprehensively combining the two harm degrees; the number of assets directly and indirectly affected by the attack behavior is counted, and an attack influence range is obtained by comparing the number of assets with a total number of assets; a vector representation of entities and relationships in the knowledge graph is input into a graph attention network, attention weights between the attack behavior and associated assets are calculated, and an enhanced feature vector of the attack behavior is obtained after aggregation of associated node information; the network attack threat value is obtained by combining the comprehensive harm degree, the attack influence range and the enhanced feature vector, and is mapped through an activation function, and is used to generate a visualized situation awareness result.

[0076] For example, collect multi-source logs from servers, firewalls and application systems, and after parsing, obtain a standardized event: the timestamp is October 15, 2023 14:05:30, the event subject is user "admin", the event action is "execute", and the event object is "command rm -rf / tmp". In dynamic baseline analysis, assuming that the frequency of "command execution" type events in the historical normal sample is dynamically baseline [5 times / minute, 20 times / minute], and 50 times of the event are detected within 1 minute, it is determined to be abnormal. In correlation analysis, it is found that the event and another abnormal event "user admin logs in from IP 192.168.1.100" occur within 10 seconds, the conditional probability is 0.8, the time decay factor is 0.95, the correlation degree result is 0.76, which exceeds the threshold value 0.5, and an event chain is formed. The attack chain template matched with the event chain is "initial access -> execution", the edit distance similarity is 0.75, which exceeds the threshold value 0.7, and an alarm data is generated. From which the triplets (admin, execute, rm -rf / tmp), (admin, login, 192.168.1.100) are parsed. After constructing the basic knowledge graph, it is found through rule reasoning that (rm-rf / tmp, belongs to, malicious command) is a hidden relationship, and the vector distance calculated by the TransE model is 0.8, which is less than the threshold value 1.0, and it is inferred that (192.168.1.100, source, foreign IP) is a potential relationship. The security situation knowledge graph is obtained after integration. Extract threat data: the "malicious command execution" behavior belongs to a non-exploitation attack, and the preset harm degree is 0.7; directly affects 1 asset, indirectly affects 3 assets, and the total number of assets is 100, and the attack influence range is 0.04. The attention weight of the attack behavior on the associated assets in the GAT network is 0.6, and the enhanced feature vector is [0.1, 0.3,..., 0.05] (100 dimensions), and the final threat value is calculated as 0.7x0.04xsigmoid(0.6xenhanced feature vector)=0.025. The value is used to generate a heat map to show that the threat level of the corresponding asset area has increased.

[0077] In some applications, in response to the collected multi-source heterogeneous logs and standardized parsing, log event data is obtained, including defining a unified log field, the unified log field including a log timestamp, an event subject, an event action and an event object; using regular expressions to map logs of different sources and formats to the unified log field, and converting into structured log events; performing timestamp normalization processing on all structured log events using an NTP protocol, and transmitting through a Kafka message queue, outputting standard events, and forming a unified standardized log event data set.

[0078] For example, collect multi-source heterogeneous logs from web servers, firewalls and database systems, and the original log formats are "2023-10-15T14:05:30Z user=admin action=execute command='rm -rf / tmp'", "15 / Oct / 2023:14:05:30+0800 192.168.1.1 DENY TCP 123.45.67.89:443" and "20231015140530|DB_QUERY|admin|SELECT * FROM users", respectively. After defining the uniform log fields including timestamp, subject, action and object, the mapping is parsed by regular expression, and the standardized events are obtained as follows: the timestamp is October 15, 2023, 14:05:30, the subject is admin, the action is execute, and the object is the command rm -rf / tmp; the timestamp is October 15, 2023, 14:05:30, the subject is 192.168.1.1, the action is deny, and the object is TCP connection 123.45.67.89:443; the timestamp is October 15, 2023, 14:05:30, the subject is admin, the action is query, and the object is the database table users. The time synchronization normalization is performed on all events by using the NTP protocol to unify the timestamps to the UTC time zone. Finally, the structured events are transmitted through the Kafka message queue to form a log event data set containing three standardized records.

[0079] In some applications, the dynamic baseline correlation engine distinguishes abnormal events by obtaining a dynamic baseline of an event type in a log sample sequence, including selecting log event data corresponding to normal sample data in historical data, and defining an event type of each log event data to form a log sample sequence; based on the log sample sequence, a Gaussian kernel estimation method is used to calculate a probability density function of a normal event frequency; based on the probability density function, a significance level is set, and an upper limit and a lower limit of a confidence interval corresponding to the significance level are calculated, so that the integral value of the probability density function from negative infinity to the lower limit is equal to half of the significance level, and the integral value from the upper limit to positive infinity is also equal to half of the significance level; according to the upper limit and the lower limit, a dynamic baseline of the event type at a specified time is obtained, wherein the dynamic baseline is an interval defined by the upper limit and the lower limit.

[0080] For example, the log event data generated during the normal operation of the past seven days is selected, the event type is defined as "user login", and a log sample sequence containing 10080 samples (one sample point per minute) is formed; the probability density function of the "user login" event frequency is calculated based on the sequence using the Gaussian kernel estimation method; the upper limit of the 95% confidence interval is calculated to be 20 times / minute and the lower limit is 5 times / minute, where the integral value of the probability density function from negative infinity to 5 times / minute is 0.025, and the integral value from 20 times / minute to positive infinity is also 0.025; thus, the dynamic baseline of the "user login" event at the current time is obtained as the interval range [5 times / minute, 20 times / minute]; when the real-time monitoring of the "user login" event frequency is 30 times / minute, the value exceeds the dynamic baseline range, and the abnormal event is identified.

[0081] In some applications, the correlation of abnormal events is quantified, including defining a correlation degree function to measure the correlation degree between events, the correlation degree function fuses the conditional probability between event types and a factor that simulates the influence of the interval between event occurrence times in an exponential decay manner; the time window for defining the correlation relationship between events is preset to a fixed length.

[0082] For example, two abnormal events are detected: event A is "user admin abnormal login" and occurs at 14:05:30; event B is "sensitive file access" and occurs at 14:05:38. The preset time window is 30 seconds, and the time interval between the two events is 8 seconds within the window. The conditional probability of event B occurring within 30 seconds after event A is 0.6 according to the historical attack log statistics. The time decay coefficient is set to 0.1, and the time decay factor is e raised to the power of -0.1 times 8, which is approximately equal to 0.45. The correlation degree function value is calculated as 0.6 x 0.45 = 0.27. The correlation degree threshold is set to 0.2, and since 0.27 is greater than 0.2, it is determined that the two abnormal events have significant correlation, and the correlation degree value is recorded for subsequent event chain construction.

[0083] In some applications, the correlation of events is quantified by fusing the conditional probability with the time-decay correlation function, to determine whether an event chain is formed, and to match the formed event chain with an attack chain template to generate the log correlation alert data. The number of times that a second event type occurs within a preset time window after a first event type occurs, and the total number of times that the first event type occurs, are counted from historical attack logs. The conditional probability of the second event type after the first event type is calculated. Based on the conditional probability and the actual time interval between the first event and the second event to be analyzed, the correlation between the first event and the second event is calculated. When the correlation reaches a preset correlation threshold, it is determined that the first event and the second event are correlated and form an event chain. The edit distance similarity between the event chain and the attack chain template is calculated. When the edit distance similarity reaches a preset similarity threshold, log correlation alert data is generated, wherein the log correlation alert data includes a set of correlated events, a correlation degree, and matched attack chain template identification information.

[0084] For example, it is found from historical attack logs that, within a 30-second time window after an "abnormal login" event, a "sensitive file access" event occurred 85 times, while the "abnormal login" event occurred a total of 100 times, and the conditional probability is calculated to be 0.85. The current monitoring shows that the abnormal login event occurred at 14:05:30 and the sensitive file access event occurred at 14:05:40, with a time interval of 10 seconds. The time decay coefficient is set to 0.1, and the time decay factor is the natural constant negative decay coefficient raised to the power of the time interval, which is approximately 0.37. The correlation value is 0.85 x 0.37 ≈ 0.31. The correlation threshold is set to 0.3, and since 0.31 is greater than 0.3, it is determined that the two events are correlated and form an event chain containing two events. The event chain is matched with the "initial access → execution" attack chain template in the MITRE ATT&CK framework, and the edit distance similarity is calculated: the event chain length is 4, the template length is 5, the number of operations is 2, and the similarity is 1-2÷5=0.6. The similarity threshold is set to 0.55, and since 0.6 is greater than 0.55, the matching is successful. Log correlation alert data is generated, including detailed information of the two events, a correlation value of 0.31, and matched ATT&CK tactic identifiers TA0001 and TA0002.

[0085] In some of the applications, triples are parsed from the log correlation alert data, a base knowledge graph is constructed based on the triples and rule-based reasoning and embedding-based reasoning are performed, and the reasoning results are integrated to form a security situation knowledge graph with enhanced situation, including defining a knowledge graph, the entity types of the knowledge graph including network assets, users, and attack behaviors; triples composed of head entities, relationships, and tail entities are extracted from the log correlation alert data; all parsed triples are stored in a graph database, where the head entities and the tail entities are nodes and the relationships are edges between the nodes, forming a base knowledge graph; hidden relationships are derived through rule-based reasoning, and potential relationships are obtained through embedding-based reasoning; the hidden relationships and the potential relationships are integrated into the base knowledge graph to obtain the security situation knowledge graph.

[0086] For example, triples (user admin, execute, command rm -rf / tmp), (IP address 192.168.1.100, initiate, unauthorized access), and (web server, run, application service) are parsed from the log correlation alert data; these triples are stored in a Neo4j graph database to form a base knowledge graph containing 5 nodes and 3 edges; a hidden relationship (command rm -rf / tmp, belongs to, dangerous operation) is discovered through rule-based reasoning; at the same time, TransE embedding model is used to map entities and relationships to a 100-dimensional vector space, and after calculating the vector representation, it is found that the vector distance of the potential relationship (IP address 192.168.1.100, source, malicious IP segment) is 0.8, which is less than the preset threshold 1.0; the two new relationships are added as edges to the base knowledge graph, adding 2 nodes and 2 edges, to obtain a security situation knowledge graph containing 7 nodes and 5 edges, enhancing the representation ability of the network security situation.

[0087] In some of the applications, hidden relationships are derived through rule-based reasoning, and potential relationships are obtained through embedding-based reasoning, including in rule-based reasoning, forming rules according to predefined event chains, and deriving hidden relationships from the base knowledge graph; in embedding-based reasoning, TransE model is used to map entities and relationships in the base knowledge graph to a low-dimensional vector space, and vector representations of entities and relationships are trained through vector operations; for real-time triples, if the distance between the sum of the head entity vector and the relationship vector and the tail entity vector is less than the preset distance threshold, it is determined that there is a potential relationship between the head entity and the tail entity.

[0088] For example, in the rule reasoning process, based on the predefined rule "if a user executes a specific command and the command is marked as a dangerous operation, the user may have malicious intent", from the base knowledge graph containing (user admin, execute, command rm -rf / tmp), the hidden relationship (user admin, have, malicious intent) is inferred. In the embedding reasoning process, the TransE model is used to map entities and relationships in the graph to a 50-dimensional vector space. After training, the vector of the entity "IP address 192.168.1.100" is [0.2, -0.3,..., 0.1], the vector of the relationship "source" is [0.4, 0.2,..., -0.3], and the vector of the entity "malicious IP segment" is [0.6, -0.1,..., 0.4]. The head entity vector plus the relationship vector is [0.6, -0.1,..., 0.1], and the Euclidean distance with the tail entity vector is 0.7, which is less than the preset threshold 1.0, so it is determined that there is a potential relationship (IP address 192.168.1.100, source, malicious IP segment). The two new relationships obtained by reasoning are integrated into the base knowledge graph to enhance the knowledge representation of the security posture.

[0089] In some applications, threat data is extracted from the security posture knowledge graph and combined with a graph neural network GAT to optimize the threat data to obtain a final network attack threat value, including obtaining the comprehensive harm degree and the attack impact range from the security posture knowledge graph; the vector representation of entities and relationships in the security posture knowledge graph is input into a graph attention network; for attack behaviors and associated network assets in the security posture knowledge graph, the attention weight of the attack behavior on the network asset is calculated, wherein the attention weight is calculated through an attention mechanism including vector splicing, linear transformation and activation function, and all network asset nodes are normalized; the information of the network asset nodes associated with the attack behavior is aggregated through the graph attention network to obtain an enhanced feature vector of the attack behavior; the comprehensive harm degree, the attack impact range and the enhanced feature vector are combined, and the final network attack threat value is obtained through an activation function mapping.

[0090] For example, the comprehensive harm degree of the attack behavior "data theft" is 0.8 and the attack influence range is 0.3 obtained from the security posture knowledge graph; the 100-dimensional vector representation of all entities and relationships in the knowledge graph is input into the graph attention network; the attention weight is calculated for the attack behavior "data theft" and the three network assets (database server, file server and application server) associated with it: the attack behavior vector [0.1, 0.2,..., 0.3] is spliced with the database server vector [0.4, 0.1,..., 0.2], and after processing by the linear transformation matrix W (dimension 50x200) and the parameter vector a (dimension 50x1), the intermediate value 0.6 is obtained using the LeakyReLU activation function, and then the attention weight of the database server is obtained by normalizing all associated assets through softmax, which is 0.4; the same method is used to calculate the attention weights of the file server and the application server, which are 0.35 and 0.25 respectively; after aggregating the node information of the three assets, the enhanced feature vector of the attack behavior is obtained as [0.2, 0.3,..., 0.1]; combined with the comprehensive harm degree 0.8, the attack influence range 0.3 and the enhanced feature vector, the network attack threat value 0.72 is obtained by mapping through the sigmoid activation function, which is used to quantify the overall threat degree of this attack.

[0091] In some applications, the comprehensive harm degree and the attack influence range are obtained, including for the attack behavior in the security posture knowledge graph, if it is a vulnerability exploitation type attack, the harm degree is obtained by scoring using the Common Vulnerability Scoring System and normalized processing; if it is a non-vulnerability exploitation type attack, the harm degree is predefined according to the historical attack harm degree; the comprehensive harm degree is composed of the harm degree obtained by processing and the predefined harm degree; the sum of the number of network assets directly affected by the attack behavior and the number of network assets indirectly affected is calculated, and then compared with the total number of network assets to obtain the attack influence range.

[0092] For example, two attack behaviors are identified in the security posture knowledge graph: the first is a vulnerability exploitation type attack "CVE-2021-34527 exploit", which has a CVSS score of 8.8 (full score 10), and a normalized damage degree of 0.88; the second is a non-vulnerability exploitation type attack "brute force attack", and the damage degree is predefined as 0.7 according to the average loss degree caused by this type of attack in historical data; the comprehensive damage degree is composed of the two damage degree values. The number of network assets directly affected by the vulnerability exploitation attack is 2 (web server and database server), and the number of network assets indirectly affected is 5 (connected application servers and terminal devices), and the total number of network assets is 100, and the attack influence range is calculated as (2+5) / 100=0.07. The attack influence range value and the comprehensive damage degree value will be used as input parameters for subsequent calculation of network attack threat values.

[0093] The following describes another embodiment of a network security posture perception method of the application:

[0094] A unified log field is defined, including log timestamp t, event subject (user, process, device, etc.), event action (login, access, modification, etc.), and event object (file, database table, network port, etc.). Different sources and formats of logs are mapped to log fields using regular expressions (text logs) to convert them into structured log events. NTP protocol is used for all structured log events, and the timestamp of each structured log event is normalized. The parsed data is transmitted through a Kafka message queue, and the output standard event is represented as , i is the event number, and the final log event data containing different events and unified standardization is .

[0095] The dynamic baseline of the event type in the log sample sequence is obtained to distinguish abnormal events, and the implementation process is as follows:

[0096] Normal sample data that has been running continuously for a week and has no security events is selected from historical data, and the corresponding log event data is obtained. The event type of each log event data is defined as , and the log sample sequence is formed as , where m is the number of samples.

[0097] Based on the collected log sample sequence , the probability density function of the normal event frequency is estimated using a Gaussian kernel , and the formula is as follows:

[0098] ;

[0099] wherein represents the event frequency value, is the jth log sample sequence in the log sample sequence, h is a bandwidth parameter;

[0100] Specifically, the bandwidth parameter h is determined by cross-validation method, the samples are divided into training set and validation set, and then different h values are traversed to calculate the log likelihood of the validation set:

[0101] The h that can maximize the log likelihood is selected, and the final bandwidth parameter can make the estimated probability density function most consistent with the data distribution of the validation set;

[0102] Based on the probability density function , set the significance level , and calculate the upper and lower limits of the 95% confidence interval , and satisfy , , thus the dynamic baseline of the event type in the log sample sequence at time t is obtained: ;

[0103] Specifically, the dynamic baseline is updated every hour with the latest normal data to ensure synchronization with the system state, and the normal event data that meets the dynamic baseline in subsequent real-time analysis will be continuously supplemented to the normal sample set;

[0104] Collect the current log event data L with a time window of 1 minute, based on the dynamic baseline corresponding to different events in the log event data L, the frequency of each event type is counted , if does not belong to the dynamic baseline , the event corresponding to the log event data is marked as an abnormal event, and the event correlation analysis is performed on the abnormal event;

[0105] The process of correlation quantification for abnormal events is:

[0106] For abnormal events, define a correlation degree function to measure the correlation degree between events, which is expressed as:

[0107] ;

[0108] Among them, represents the correlation closeness, represents the conditional probability, represents the time decay coefficient, represents the time interval between events and , , This represents a preset time interval of 30 seconds, where e is a natural constant.

[0109] Extract "event type" from historical attack logs After it occurs, within a time interval Event type within 30 seconds The number of occurrences and the total number of occurrences for each event type are used to calculate the conditional probability. This conditional probability will serve as the basis for the next step of calculating the correlation. The conditional probability is expressed as:

[0110] Indicates the event type in the historical attack log. After it occurs, within a time interval Internal event types Number of times it happens Indicates event type Total number of occurrences;

[0111] Next, the obtained conditional probabilities are used. and the events currently to be analyzed. and time interval Calculate the event again and correlation The correlation degree will be used to determine whether two events can form an event chain;

[0112] when (threshold) When the event occurs... and Event chains are formed by association, and these event chains are matched with attack chain templates (based on the MITRE ATT&CK framework, combined with a summary of event chains corresponding to historical attacks). Similarity is calculated using edit distance.

[0113] ,when At that time, log-related alarm data A is generated, which includes the set of related events, the degree of correlation, and template identification information;

[0114] Specifically, the content of the log-related alarm data A is: a set of related events, that is, the events that form the event chain. and Relevance And template identifiers (identification information of the matching attack chain templates). The attack chain templates are based on the MITRE ATT&CK framework and are summarized and refined from historical attack event chains.

[0115] In summary of the attack chain template, by analyzing the historical attack event chain, the typical step sequence of attack behavior from beginning to end under different attack scenarios is sorted out, such as a certain type of attack first obtains initial permission through "phishing" (belongs to the initial access technology in MITRE ATT&CK), then performs "lateral movement" to expand the scope of influence, and then implements "data theft" and other operations. Combining these steps with logical sequence and in line with the rules of attack evolution forms an attack chain template.

[0116] Parse triples from log correlation alert data, build a basic knowledge graph using triples, and perform rule-based reasoning and embedding reasoning, and integrate the reasoning results to form a security situation knowledge graph with enhanced situation;

[0117] The process of building a basic knowledge graph is as follows:

[0118] Define a knowledge graph, with entities divided into network assets D, users U, and attack behaviors C, and extract triples from log correlation alert data A , (head entity , relationship , tail entity );

[0119] Specifically, obtain log correlation alert data A, which includes a set of correlated events, correlation degree, and template identification information. Select specific alert content from the set of correlated events in A, such as "User admin executed unauthorized command 'rm-rf / tmp' on host web-01 at 2025-09-08 11:00";

[0120] Parse each alert to extract triples in the form of "head entity, relationship, tail entity" , where the head entity and tail entity belong to the three types of entities "network assets D, users U, and attack behaviors C", and the relationship describes the connection between entities, such as operation, initiation, and targeting;

[0121] For example, the above alert can be parsed to obtain triples (admin, operation, web-01), (admin, initiation, unauthorized command execution), and (unauthorized command execution, targeting, web-01);

[0122] Then, input all triples parsed from log correlation alert data A into a graph database (such as Neo4j) for storage. The graph database treats each triple's head entity and tail entity as nodes (included in the entity set V) and the relationship as edges between nodes (included in the relationship set E). Through the storage operation of the graph database, a basic knowledge graph G=(V,E) is formed, where V is the entity set and E is the relationship set;

[0123] The process of rule reasoning and embedding reasoning is:

[0124] Rule reasoning uses the pre-defined event chain to form rules according to the constructed base knowledge graph G, when the event chain is formed, the triples The relationship is the hidden relationship;

[0125] Embedding reasoning uses the TransE model to map entities and relationships in the base knowledge graph G to a 100-dimensional vector space, and trains through vector operations (the training process is to minimize the loss function of the TransE model), so as to obtain the vector representation of entities and relationships, according to the vector representation of entities and relationships, for real-time triples If , it is considered that there is a potential relationship between the head entity and the tail entity ;

[0126] Integrate the hidden relationship obtained by rule reasoning and the potential relationship obtained by embedding reasoning into the base knowledge graph G to obtain the final security situation knowledge graph containing the reasoning entity relationship ;

[0127] Specifically, for the base knowledge graph G stored in the graph database, the hidden relationship triples obtained by rule reasoning and the potential relationship triples obtained by embedding reasoning are added to the graph database as new nodes (entities) and edges (relationships), check whether the head entity and the tail entity in the new triple exist in the node set of the graph database, if they exist, establish the relationship between them, if they do not exist, first create entity nodes, and then establish relationship edges;

[0128] The final log correlation alarm data is an important information source for analyzing security situation, the pre-defined event chain rule based on rule reasoning is summarized in combination with the process and characteristics of network attacks, in actual security threat analysis, it is a feasible method to infer hidden attack relationship through event chain, TransE model is a classic model of knowledge graph embedding reasoning, which is widely used in knowledge graph representation learning and relationship reasoning tasks and its effectiveness has been verified, using it for embedding reasoning of security situation knowledge graph has technical rationality and feasibility.

[0129] According to the security situation knowledge graph, extract threat data and combine the graph neural network GAT to optimize the threat data to obtain the final network attack threat value, and perform network security situation awareness based on the attack threat value;

[0130] The threat data includes comprehensive harm degree and attack influence range;

[0131] For the attack behavior C in the security posture knowledge graph , if it is a vulnerability exploitation type attack, the CVSS score is normalized to obtain the harm degree , if it is a non-vulnerability exploitation type attack, the harm degree is predefined according to the historical attack harm degree , and the final comprehensive harm degree is represented as ;

[0132] Among them, the harm degree By collecting the relevant data of non-vulnerability exploitation type attack events in historical data, including the loss caused by the attack and the importance information of the affected assets, statistical analysis is performed on these data, and according to different attack types and scene factors, the harm degree value corresponding to the attack behavior is predefined , and when the non-vulnerability exploitation type attack behavior C appears in the security posture knowledge graph , the predefined harm degree is directly matched;

[0133] At the same time, the number of assets directly affected by the attack behavior C and the number of assets indirectly affected by the attack behavior C are counted, and the total number of network assets is combined to calculate the attack impact range ;

[0134] Specifically, the threat data is extracted, which is the basis for subsequent calculation of attack threat value, and the comprehensive harm degree and the attack impact range are important inputs for calculating the attack threat value. In the field of network security, CVSS score is an effective means to measure the harm degree of vulnerability, which is used to determine the harm degree of vulnerability exploitation type attack, and the harm degree of non-vulnerability exploitation type attack is predefined according to the historical attack harm degree, which is consistent with the actual security analysis based on historical experience to evaluate the threat, and the number of assets affected by the attack is counted to calculate the attack impact range, which is also an effective way to evaluate the attack threat from the perspective of the scale of assets affected;

[0135] The vector representation of the entities and relationships obtained in the security posture knowledge graph is taken as the input of the graph attention network, and the attention weight between the entities in the security posture knowledge graph is learned through the graph attention network to more accurately capture the influence relationship of the attack behavior on the assets:

[0136] For the attack behavior C and its associated network assets D in the security posture knowledge graph , the attention weight of the attack behavior C on the network assets D is calculated , and the formula is: ​

[0137] ;

[0138] wherein, is the parameter vector of the attention mechanism, is the weight matrix, and are the feature vectors of the attack behavior C and the network asset D, respectively, denotes vector concatenation, is the activation function, is the normalization operation on all neighbor asset nodes of the network asset D;

[0139] Collect historical network security event data, including the asset affected when the attack behavior occurs, and use these data as labels to train the GAT network. The trained graph attention network is used to optimize the acquisition of threat data.

[0140] For the attack behavior C in the security posture knowledge graph , the information of its associated asset nodes is aggregated through the GAT network to obtain the enhanced feature vector of the attack behavior C.

[0141] The attack threat value is obtained by combining the comprehensive harm degree of the attack behavior (previously obtained for the vulnerability exploitation class , and the non-vulnerability exploitation class ) and the attack impact range :

[0142] ;

[0143] wherein, is the activation function, used to map the result to the range, making the threat value more interpretable;

[0144] Specifically, the attack threat value integrates the comprehensive harm degree , the attack impact range , and the enhanced feature vector , and the result is the core data for network security posture awareness. Finally, based on the calculated attack threat value , the threat values of all attack behaviors in the network are summarized and analyzed, and the threat distribution and change trend of different assets and different attack types are displayed through visualization tools (such as heat maps and time series charts), thereby realizing real-time awareness of the network security posture. When the color of the area in the heat map is darker, it means that the threat value is higher, and the network security situation in that area is more serious, which needs to be focused on and protected.

[0145] For the method steps disclosed in the above embodiments, the method steps are described as a combination of a series of actions for the purpose of simple description, but those skilled in the art should know that the embodiments of the present application are not limited by the order of the described actions, because according to the embodiments of the present application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of the present application.

[0146] As shown in Figure 2 The present application also provides a network security situation awareness system, comprising:

[0147] A log acquisition module 201 configured to acquire log event data in response to collected multi-source heterogeneous logs and perform standardized analysis;

[0148] A data analysis module 202 configured to perform real-time analysis based on the log event data using a dynamic baseline correlation engine to obtain log correlation alarm data, wherein the dynamic baseline correlation engine distinguishes abnormal events by obtaining the dynamic baseline of event types in the log sample sequence, and quantifies the correlation of abnormal events, quantifies event correlation by fusing conditional probability and time decay correlation function, judges whether an event chain is formed, matches the formed event chain with an attack chain template to generate the log correlation alarm data, and the attack chain template is based on the MITRE ATT&CK framework and is obtained by combining actual attack event chain combinations in history;

[0149] A rule reasoning module 203 configured to parse triples from the log correlation alarm data, build a basic knowledge graph based on the triples and perform rule reasoning and embedding reasoning, and integrate the reasoning results to form a situation-enhanced security situation knowledge graph;

[0150] A situation awareness module 204 configured to extract threat data from the security situation knowledge graph and optimize the threat data by combining a graph neural network GAT to obtain a final network attack threat value, and perform network security situation awareness based on the network attack threat value, wherein the threat data includes comprehensive harm degree and attack impact range.

[0151] It is worth noting that, although only some basic functional modules are disclosed in the embodiments of the present application, it does not mean that the composition of the system is limited to the above basic functional modules, on the contrary, the meaning expressed by the embodiments is: on the basis of the above basic functional modules, those skilled in the art can add one or more functional modules to form infinite embodiments or technical solutions in combination with the prior art, that is, the system is open rather than closed, and the protection scope of the present application claim cannot be limited to the disclosed basic functional modules because the embodiments only disclose individual basic functional modules. At the same time, in order to facilitate description, the above device is described as various units and modules. Of course, the functions of the units and modules can be implemented in the same software and / or hardware when implementing the present application.

[0152] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A network security situation awareness method, characterized in that, include: It responds to the collection of multi-source heterogeneous logs and performs standardized parsing to obtain log event data; Based on the log event data, a dynamic baseline correlation engine is used for real-time analysis to obtain log correlation alarm data. The dynamic baseline correlation engine distinguishes abnormal events by obtaining dynamic baselines of event types in the log sample sequence, and performs correlation quantification on abnormal events. It quantifies event correlation by fusing conditional probability and time decay correlation functions to determine whether an event chain is formed. The formed event chain is matched with an attack chain template to generate the log correlation alarm data. The attack chain template is based on the MITRE ATT&CK framework and is obtained by combining historically actual attack event chains. The triples are parsed from the log-related alarm data, a basic knowledge graph is constructed based on the triples, and rule-based reasoning and embedding reasoning are performed. The reasoning results are integrated to form a situation-enhanced security situation knowledge graph. Threat data is extracted from the security situation knowledge graph and optimized using graph neural network GAT to obtain the final network attack threat value. Network security situation awareness is then performed based on the network attack threat value. The threat data includes the overall severity and the scope of attack impact. Specifically, log event data corresponding to normal sample data in historical data is selected, and the event type of each log event data is defined to form a log sample sequence; Based on the log sample sequence, the probability density function of the normal event frequency is calculated using the Gaussian kernel estimation method; Based on the probability density function, a significance level is set, and the upper and lower limits of the confidence interval corresponding to the significance level are calculated, such that the integral value of the probability density function from negative infinity to the lower limit is equal to half of the significance level, and the integral value from the upper limit to positive infinity is also equal to half of the significance level. Based on the upper and lower limits, a dynamic baseline for the event type at a specified time is obtained, wherein the dynamic baseline is an interval defined by the upper and lower limits; Among them, a correlation function is defined to measure the correlation between events. The correlation function integrates the conditional probability between event types and the factor that simulates the influence of the time interval between events in an exponential decay manner. Set the time window used to define the relationship between events to a fixed duration.

2. The network security situation awareness method according to claim 1, characterized in that, In response to the collection of multi-source heterogeneous logs and the standardization and parsing to obtain log event data, further including: Define unified log fields, which include log timestamp, event body, event action, and event object; Regular expressions are used to map logs from different sources and formats to the unified log field, transforming them into structured log events; All structured log events are timestamped using the NTP protocol and transmitted via a Kafka message queue to output standard events, forming a unified and standardized log event data set.

3. The network security situation awareness method according to claim 1, characterized in that, Event correlation is quantified by fusing conditional probability and time decay correlation functions to determine whether an event chain has formed. The formed event chain is then matched with an attack chain template to generate the log correlation alarm data, which further includes: From the historical attack logs, count the number of times the second event type occurred after the first event type occurred and within a preset time window, as well as the total number of times the first event type occurred; Calculate the conditional probability of the second event type after the first event type occurs; Based on the conditional probability and the actual time interval between the first and second events to be analyzed, the correlation degree between the first and second events is calculated. When the correlation reaches a preset correlation threshold, the first event and the second event are determined to be related and form an event chain; Calculate the edit distance similarity between the event chain and the attack chain template; When the edit distance similarity reaches a preset similarity threshold, log association alarm data is generated, wherein the log association alarm data includes a set of associated events, the degree of association, and the matching attack chain template identification information.

4. The network security situation awareness method according to claim 1, characterized in that, The system parses triples from the log-related alarm data, constructs a basic knowledge graph based on the triples, performs rule-based reasoning and embedding reasoning, and integrates the reasoning results to form a situation-enhanced security situation knowledge graph, further including: Define a knowledge graph, wherein the entity types of the knowledge graph include network assets, users, and attack behaviors; Extract triples consisting of a head entity, a relation, and a tail entity from the log-related alarm data; All the parsed triples are stored in a graph database, where the head entity and tail entity are nodes, and the relations are edges between nodes, forming a basic knowledge graph. Hidden relationships are deduced through rule-based reasoning, and potential relationships are obtained through embedding reasoning. The hidden and potential relationships are integrated into the basic knowledge graph to obtain the security situation knowledge graph.

5. A network security situation awareness method according to claim 4, characterized in that, Hidden relationships are derived through rule-based reasoning, and latent relationships are obtained through embedding reasoning, further including: In rule-based reasoning, rules are formed based on predefined event chains, and hidden relationships are inferred from the basic knowledge graph. In embedded reasoning, the TransE model is used to map the entities and relations in the basic knowledge graph to a low-dimensional vector space, and vector representations of entities and relations are obtained through vector operations. For real-time triples, if the distance between the sum of the head entity vector and the relation vector and the tail entity vector is less than a preset distance threshold, then it is determined that there is a potential relationship between the head entity and the tail entity.

6. A network security situation awareness method according to claim 5, characterized in that, Threat data is extracted from the security posture knowledge graph and optimized using a graph neural network (GAT) to obtain the final network attack threat value. This further includes: The overall hazard level and the attack impact range are obtained from the security situation knowledge graph; The vector representations of entities and relationships in the security situation knowledge graph are input into the graph attention network; For the attack behaviors and associated network assets in the security situation knowledge graph, the attention weight of the attack behavior on the network assets is calculated. The attention weight is calculated through an attention mechanism that includes vector concatenation, linear transformation and activation function, and normalized for all network asset nodes. The graph attention network aggregates information about network asset nodes associated with the attack behavior to obtain an enhanced feature vector of the attack behavior. Combining the overall hazard level, the attack impact range, and the enhanced feature vector, the final network attack threat value is obtained through activation function mapping.

7. A network security situation awareness method according to claim 6, characterized in that, To obtain the overall severity and attack impact range, further including: For attack behaviors in the security situation knowledge graph, if they are vulnerability exploitation attacks, the severity is obtained by scoring them using a general vulnerability scoring system and then normalizing the scores. If the attack is not a vulnerability exploitation attack, the severity level is predefined based on the severity level of historical attacks; the overall severity level is composed of the processed severity level and the predefined severity level. The attack's impact range is obtained by summing the number of network assets directly affected and indirectly affected by the attack in the knowledge graph and then comparing this sum with the total number of network assets.

8. A network security situation awareness system, used to implement the network security situation awareness method of claim 1, characterized in that, include: The log acquisition module is configured to respond to collected multi-source heterogeneous logs and perform standardized parsing to obtain log event data. The data analysis module is configured to perform real-time analysis based on the log event data using a dynamic baseline correlation engine to obtain log-related alarm data. The dynamic baseline correlation engine distinguishes abnormal events by acquiring dynamic baselines of event types in the log sample sequence and performs correlation quantification on abnormal events. It quantifies event correlation by fusing a correlation function that integrates conditional probability and time decay, determines whether an event chain has been formed, and matches the formed event chain with an attack chain template to generate the log-related alarm data. The attack chain template is based on the MITRE ATT&CK framework and is obtained by combining historically actual attack event chains. The rule reasoning module is configured to parse triples from the log-related alarm data, construct a basic knowledge graph based on the triples, perform rule reasoning and embedding reasoning, and integrate the reasoning results to form a situation-enhanced security situation knowledge graph. The situational awareness module is configured to extract threat data based on the security situation knowledge graph and optimize the threat data using a graph neural network (GAT) to obtain a final network attack threat value. Based on the network attack threat value, network security situational awareness is performed. The threat data includes a comprehensive hazard level and an attack impact range.

Images