Threat intelligence automatic reasoning and monitoring method based on Bayesian network

Abstract

The invention discloses a threat intelligence automatic reasoning and monitoring method based on a Bayesian network, and relates to the field of network security. The problems that an existing network security protection technology is not timely in attack detection, high in false alarm rate, lack of dynamic self-adaptive capacity and the like are solved. The method comprises the steps of collecting network flow data, performing preprocessing and extracting feature information; a neural network model is constructed and compiled, training is carried out, and a classification model used for identifying malicious traffic and a corresponding label encoder are generated; inputting real-time network traffic into the trained classification model for automatic classification to obtain judgment results of normal traffic and abnormal traffic, and respectively writing the judgment results into a white list file and a black list file; performing packet capture monitoring on real-time network traffic, dynamically triggering a firewall policy in combination with a white list file and a black list clear result, and automatically blocking a malicious IP address; constructing a Bayesian network model file; and automatic reasoning and security situation monitoring of the attack chain are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a threat intelligence automatic reasoning monitoring method based on Bayesian network. BACKGROUND

[0002] With the continuous evolution of network attack means, attackers often use multi-stage and multi-tactical methods to achieve hidden intrusion, thereby evading detection by traditional security defense systems. For example, APT attacks usually include reconnaissance, penetration, lateral movement, data theft and other links. The single sign of each link may not be enough to trigger an alarm, but the overall correlation constitutes a complete attack chain.

[0003] Existing firewalls, intrusion detection (IDS) and intrusion prevention (IPS) mostly rely on static rules and feature matching for detection and interception. This approach often lacks detection capability when facing unknown threats and zero-day attacks. At the same time, this type of system usually lacks reasoning ability and can only identify single abnormal behavior in isolation, making it difficult to infer the complete attack process by combining multiple attack steps. With the continuous evolution of attack methods, traditional methods have a lag in rule updates, causing the defense system to be in a passive state. In addition, the simple threshold-based judgment mechanism is prone to high false positives and false negatives, increasing the burden on operational personnel and potentially missing hidden attacks. Although there are rich structured threat intelligence standards (such as STIX), traditional detection methods cannot effectively map these intelligence to detection and defense logic models, so there is an urgent need for an intelligent detection method that combines machine learning and Bayesian network reasoning to achieve more efficient, accurate and adaptive network security protection.

[0004] Traditional firewalls, intrusion detection and prevention rely mainly on static rules and feature libraries, making it difficult to identify zero-day attacks and new complex threats, and lacking reasoning and correlation analysis capabilities, which cannot reveal the logical relationship of multi-stage attacks. At the same time, these have a lag in rule updates, and the defense response is passive, and relying on threshold judgment can easily lead to false positives and false negatives. Although there are STIX and other structured threat intelligence standards, traditional methods cannot effectively apply them to detection and defense models. SUMMARY

[0005] The present application is to solve the problems of existing network security protection technology, such as delayed attack detection, high false positive rate, lack of dynamic adaptive ability, etc. To solve the above technical problems, the present application is realized by the following technical scheme: Scheme one, the present application proposes a threat intelligence automatic reasoning monitoring method based on Bayesian network, the method comprises the following steps: Step 1, collect network traffic data and preprocess the network traffic data; Step 2, based on the pre-processed network traffic data in step 1, extract feature information including source IP, protocol type, traffic duration and packet rate; Step 3, build and compile a neural network model, train the feature information extracted in step 2, generate a classification model for identifying malicious traffic and a corresponding label encoder; Step 4, input real-time network traffic data into the trained classification model for automatic classification, get the determination result of normal traffic and abnormal traffic, and write it into the whitelist file and blacklist file respectively, so as to complete the intelligent filtering and classification of the original traffic; Step 5, packet capture monitoring is performed on real-time network traffic data, and the results of whitelist file and blacklist file are combined to dynamically trigger firewall strategy, and automatically block malicious IP addresses; at the same time, the effectiveness of the defense strategy is verified by constructing simulated attack traffic, and in the threat intelligence level, structured intelligence data is converted into attack mode and its logical relationship, and a Bayesian network model file is constructed; and based on the Bayesian network model, automatic reasoning and security situation monitoring of attack chain are realized, and through interface service, real-time output and visual display of reasoning results are realized, forming a full-process closed loop from data collection, classification, reasoning to defense.

[0006] Further, a preferred embodiment is provided, in which the pre-processed network traffic data in step 1 is divided into training set and test set, and the ratio of the training set and test set is 8:2.

[0007] Further, a preferred embodiment is provided, in which step 2 further includes the step of calculating the packet rate per second, and the calculation method is:

[0008] Wherein, the unit of FlowDuration is µs.

[0009] Further, a preferred embodiment is provided, in which in step 4, the method for inputting real-time network traffic data into the trained classification model for automatic classification to get the determination result of normal traffic and abnormal traffic is: Set threshold esik_degeri=30, which is used to distinguish normal traffic and attack traffic, when the average rate of a flow exceeds 30 packets per second, it is judged as DDoS attack.

[0010] Further, a preferred embodiment is provided, in which step 3 further includes the step of cleaning the feature information, that is, reading the yeni_veri.csv file in the prediction stage, extracting the feature column and IP address column, numerizing the feature value through the saved encoder, and completing the cleaning operation.

[0011] Further, a preferred embodiment is provided, in step 4, the method for automatically classifying the real-time network traffic input into the trained classification model to obtain the determination results of normal traffic and abnormal traffic is: The feature information is input into the trained neural network model to obtain a prediction result. If the prediction probability is greater than 0.5, it is marked as an attack; otherwise, it is marked as normal. The prediction result and the corresponding IP address are written into a file, wherein the attack source is written into blacklist.txt, and the normal source is written into whitelist.txt.

[0012] Further, a preferred embodiment is provided, in step 5, the method for dynamically triggering the firewall strategy by combining the whitelist file and the blacklist file obvious results to automatically block malicious IP addresses; at the same time, the method for verifying the effectiveness of the defense strategy by constructing simulated attack traffic is: First, check if the IP address is in the whitelist. If yes, directly pass; if in the blacklist, immediately call iptables to block it and record the log; in addition, there is also a feature rule detection, which will block as soon as it matches; for other traffic, the packet rate of each IP address is counted per second window, and [protocol number, rate] is input into the neural network model; if the neural network model prediction result is attack and the IP address has not been blocked, it will immediately call iptables to blacklist it, and write into the log and blacklist file, realizing AI-based dynamic defense.

[0013] Further, a preferred embodiment is provided, in step 5, in the threat intelligence level, the method for converting structured intelligence data into attack patterns and their logical relationships to build a Bayesian network model file; and based on the Bayesian network model, the method for realizing automatic reasoning of attack chain and security posture monitoring is: Initialize an empty Bayesian network, and process the extracted TTP information one by one; each technique with technique_id will be added as a CPT node, and the node name, state, and prior probability distribution [0.99, 0.01] will be set, indicating that in most cases the technique is not triggered; and a mapping from STIXID to network node ID is established, The source and target of the relationship can be found in the ID mapping corresponding to the technology node, and a directed arc from the source to the target is added in the empty Bayesian network, that is, the attack path in the STIX file is converted into the causal relationship in the network structure, realizing automatic reasoning of attack chain and security posture monitoring based on Bayesian network model.

[0014] Scheme three, a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by the processor to realize the steps of the method of scheme one.

[0015] Scheme four, a computer device, comprising a memory and a processor, the memory has a computer program stored therein, when the processor runs the computer program stored in the memory, the processor executes the method of scheme one.

[0016] The present application has the advantages of: The threat intelligence automatic reasoning monitoring method based on Bayesian network has significant advantages in data processing, modeling and monitoring. The method takes intelligence-driven as the core, analyzes STIX and other threat intelligence formats, extracts attack patterns and their correlation, builds a Bayesian network model, and realizes the logical modeling of attack chain. On this basis, the method combines machine learning and reasoning, first uses a deep learning model to classify real-time traffic, generates a blacklist, and then uses a Bayesian network to further reason, thereby significantly improving the accuracy and intelligence level of detection. At the same time, the present application has dynamic real-time monitoring capability, can automatically trigger firewall strategy combined with packet capture and traffic analysis for suspicious IP, forming an instant defense closed loop. In addition, the model also has self-adaptation and scalability, can dynamically evolve according to the constantly updated threat intelligence and traffic data, and continuously maintain the detection capability. Through probability reasoning and multi-feature fusion, the method effectively reduces the false positives and false negatives caused by a single threshold, and improves the reliability and credibility of security event alarms.

[0017] The present application proposes a comprehensive detection and protection method combining machine learning model, blacklist management, Bayesian reasoning and monitoring visualization to solve the problems of attack detection not timely, high false alarm rate, lack of dynamic adaptive ability and other problems existing in the prior art network security protection technology. The present application extracts and labels the original traffic data, uses a deep learning model to realize efficient training and automatic classification of large-scale traffic, and automatically generates a blacklist based on the prediction result, thereby realizing rapid screening of offline data. In the real-time protection link, the present application combines traffic rate features and artificial intelligence model to identify and block suspicious IP addresses, and at the same time, detects specific known attack patterns (such as worm features) for feature matching, realizes a "rule + model" dual protection mechanism. In addition, the present application also introduces a reasoning model based on Bayesian network to represent the dependency relationship between attack techniques, and updates the belief value of each node in real time through Prometheus index, supports visual monitoring and alarm.

[0018] The present application is also applicable to processing and modeling of network traffic data and threat intelligence data, realizing automatic identification, real-time monitoring and defense of potential attack behaviors and other fields. Attached Figure Description

[0019] Figure 1 This is a flowchart of the threat intelligence automated reasoning and monitoring method based on Bayesian networks as described in Implementation Method 1.

[0020] Figure 2 This is a flowchart for packet capture monitoring of real-time network traffic data as described in Implementation Method 1. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them.

[0022] Implementation Method 1, see [link] Figure 1 and Figure 2 This embodiment describes an automated threat intelligence reasoning and monitoring method based on Bayesian networks. The method includes the following steps: First, network traffic data is collected and preprocessed to extract feature information including source IP, protocol type, traffic duration, and packet rate. Then, machine learning or deep learning models are used to train the extracted data to generate a classification model and corresponding label encoder for identifying malicious traffic. Based on this, new network traffic is input into the trained model for automatic classification to obtain the judgment results of normal and abnormal traffic, which are written to whitelist and blacklist files respectively, thereby completing the intelligent screening and classification of raw traffic.

[0023] Furthermore, real-time network traffic is monitored through packet capture, and firewall policies are dynamically triggered based on whitelist and blacklist results to automatically block malicious IP addresses. Simultaneously, the effectiveness of the defense strategy is verified by constructing simulated attack traffic. At the threat intelligence level, structured intelligence data (such as in STIX format) is transformed into attack patterns and their logical relationships, constructing a Bayesian network model file. Based on this model, automated reasoning of attack chains and security posture monitoring are implemented. Finally, the reasoning results are output and visualized in real-time through interface services, thus forming a closed-loop process from data collection, classification, reasoning to defense.

[0024] Step 1: Importing and Reading Data The program first reads the original network traffic file islenmemis_veri.csv using the pandas library and stores it as a DataFrame format. This not only facilitates data management and calling, but also provides a unified data structure for subsequent data filtering and calculation. In actual operation, if only small-scale testing is required, part of the rows can also be intercepted through the iloc method, thereby reducing processing time.

[0025] Step 2: Field filtering and copying After completing data import, the program filters four fields closely related to DDoS detection from the original table, namely source IP (Src_IP), protocol type (Protocol), flow duration (FlowDuration), and total forward packet number (TotalFwdPacket). These fields can reflect the core characteristics of network traffic. Subsequently, a new data copy df_filtered is generated through the.copy() method to avoid direct modification of the original data and to circumvent potential warnings of chained assignment.

[0026] Step 3: Parameter setting (threshold) After data preparation is complete, the program sets a threshold esik_degeri=30. This threshold is used to distinguish between normal traffic and suspected attack traffic. When the average rate of a flow exceeds 30 packets per second, it may be judged as a DDoS attack. This value can be set based on experience, or further optimized through statistical analysis or experimental verification.

[0027] Step 4: Rate calculation (Packets / s) In this stage, the program adds a column "Packets / s" to represent the data packet transmission rate per unit time. The calculation formula is:

[0028] Where FlowDuration is in microseconds (µs) and needs to be converted to seconds before calculation. This indicator can directly reflect the intensity of each flow. In practical applications, special cases such as FlowDuration=0, which may cause division by zero error, should be considered and the result should be set to missing value or special processing.

[0029] Step 5: Labeling based on threshold After calculating the rate, the program further generates a Boolean field "DDOSAttack" to mark whether the traffic is likely an attack stream. The judgment logic is: if "Packets / s" is greater than the threshold of 30, it is marked as True, indicating that the traffic is suspected of DDoS attack; otherwise, it is marked as False, considering it as normal traffic. This binary labeling method, although simplified, can quickly and effectively screen out high-risk traffic in large-scale data.

[0030] Step 6: Result Export Finally, the program exports a new data table containing all key fields, calculated rates, and attack labels as a yeni_veri.csv file. When exporting, specify index=False to avoid saving irrelevant row indices. This file not only retains the original key information, but also adds rate indicators and attack labels, which can be directly used for subsequent statistical analysis, visualization, or as input data for machine learning models, thus playing a role in research and actual defense.

[0031] Step 7: Import and Read Data The program imports libraries such as pandas, numpy, scikit-learn, keras, and joblib, and reads the yeni_veri.csv file. The current implementation directly loads the original data, but in the future, data version control or log output can be added to ensure traceability of data input in different experimental environments.

[0032] Step 8: Field Selection and Data Cleaning Select Protocol and Packets / s as features and DDOSAttack as label from the data. Use LabelEncoder to convert non-numeric features into integer encoding. The existing implementation selects data based on column index, but in the future, it is recommended to select data directly by column name (e.g., X=data[['Protocol','Packets / s']], y=data['DDOSAttack']) to avoid errors caused by column order changes. At the same time, feature scaling (such as StandardScaler or RobustScaler) can be added to improve the adaptability of the model to different dimensional data.

[0033] Step 9: Dataset Division Use train_test_split to divide the training set and test set in the ratio of 8:2. The current implementation can ensure independent evaluation, but in the future, a validation set can be added, combined with EarlyStopping or cross-validation, to further improve the generalization ability of the model.

[0034] Step 10: Build and Compile Neural Network Model The model consists of three fully connected hidden layers and a sigmoid output layer, with Adam as the optimizer and binary cross-entropy as the loss function. When improving, consider adjusting the network structure (such as reducing the number of layers to prevent overfitting, or adding Dropout layers to improve robustness), and setting the learning rate schedule when compiling to help faster convergence.

[0035] Step 11: Model Training and Evaluation The model is trained for 50 epochs with a batch size of 32, and the accuracy and classification report are evaluated on the test set. The current method can reflect the basic performance of the model, but if the sample class distribution is unbalanced, it is recommended to introduce the class_weight parameter or use oversampling / undersampling techniques to improve the recall rate for the minority class (attack traffic).

[0036] Step 12: Model and Encoder Saving and Example Inference After training, the model is saved as a.h5 file and the encoder is saved as a.joblib file to ensure consistency during prediction. The example input [17, 35.264324] is fed into the model, and the output prediction result is obtained. To improve, you can add a model version number and inference script packaging during the saving process to facilitate integration into actual detection.

[0037] Step 13: Load Dependencies and Model The program first imports the required libraries, including pandas, numpy, keras, joblib, and os. Then it loads the already trained deep learning model model_test.h5 and the previously saved label encoder label_encoders.joblib, ensuring that the processing method for new data remains consistent with training.

[0038] Step 14: Read New Data The script loads the new traffic data file through pd.read_csv("yeni_veri.csv"). The 2nd and 5th columns are extracted as input features X_new (protocol number Protocol and packets per second Packets / s), while the 1st column of source IP addresses is saved separately as an identifier for subsequent result output.

[0039] Step 15: Feature Encoding and Data Cleaning For each column in X_new, if its data type is string and there is a corresponding encoder in label_encoders, use the encoder to convert the string value to a numerical value. Then, clean the data: non-numerical items are converted to NaN and replaced with 0; missing values are filled with 0; positive and negative infinity are also replaced with 0 to ensure that the input data is stable and reliable.

[0040] Step 16: Make a prediction The cleaned feature data is input into the neural network model for inference. The prediction result is in the form of probability, and the program takes 0.5 as the threshold, and the result greater than this value is judged as 1 (suspected DDoS attack), otherwise 0 (normal traffic).

[0041] Step 17: Write the result file The script traverses each IP address and its corresponding prediction result: if the prediction is 1, write the IP address to blacklist.txt (blacklist); if the prediction is 0, write it to whitelist.txt (whitelist). In this way, it can clearly distinguish between suspicious attack sources and normal sources.

[0042] Step 18: Set file permissions The program modifies the permissions of the blacklist file by os.chmod("blacklist.txt", 0o666) to make it readable and writable to all users, so that it can be directly called in the or security policy.

[0043] According to the above, after completing feature extraction and classification labeling, further combined with machine learning and Bayesian network for automatic inference and dynamic monitoring. Specifically, first, use the training module to model the structured data in yeni_veri.csv, generate a deep learning classification model and the corresponding label encoder; then through the prediction module to call the training results, automatically classify the newly collected network traffic data, and output the classification results to whitelist.txt (normal IP) and blacklist.txt (malicious IP). In the real-time monitoring stage, through the packet capture tool to continuously monitor the network traffic, and combined with the blacklist and whitelist to dynamically trigger the firewall strategy, and implement real-time blocking of suspicious IP addresses. At the same time, with the help of Bayesian network, the structured threat intelligence is mapped to attack patterns and their logical relationships, realizing the automatic inference of attack chain and security situation monitoring. Thus, the present application can form a closed-loop process from feature extraction, model training to real-time detection and dynamic defense, effectively improving the recognition and defense ability of complex attacks.

[0044] Step 1: Data preparation The program reads network session data from the original traffic file and extracts key fields such as source IP, protocol type, flow duration, and total number of packets in the forward direction. Based on these fields, the packet rate per second (Packets / s) is calculated, with the formula being the total number of packets divided by the flow duration (converted to seconds). Then set a threshold (such as 30 packets / second), mark the traffic exceeding the threshold as "suspected DDoS attack", and add a boolean label column. The final output file yeni_veri.csv contains both the original traffic features and the rate indicators and attack labels, providing a unified data foundation for subsequent training and inference.

[0045] Step 2: Feature engineering and data cleaning In this step, Protocol and Packets / s are selected from yeni_veri.csv as input features of the model, and DDOSAttack is selected as the label. For string type fields that may exist, use LabelEncoder to convert them to numerical values, and save the encoder to ensure consistency between training and prediction stages. Then clean the data: non-numeric values are forced to NaN, and then filled with 0; positive and negative infinity values are also replaced with 0 to avoid numerical instability. The feature matrix processed in this way can meet the input requirements of the neural network and reduce the interference of abnormal data on the training results.

[0046] Step 3: Model training and evaluation The cleaned data is divided into training set and test set (usually in the ratio of 8:2). The multi-layer perceptron model built based on Keras consists of three layers of 100 neurons each, with ReLU hidden layers, and the last layer is Sigmoid output for binary classification. The optimizer uses Adam, and the loss function is binary cross-entropy. The model is trained iteratively on the training set and evaluated on the test set, outputting the accuracy and classification report (Precision, Recall, F1 value). The evaluation results can reveal the model's ability to identify attack traffic and normal traffic. After training, the model is saved as model_test.h5, and the encoder is saved as label_encoders.joblib for subsequent batch prediction and online inference.

[0047] Step 4: Batch prediction and list generation In the prediction phase, the yeni_veri.csv file is read to extract the feature columns and IP address column. The feature values are normalized by the saved encoder, and the cleaning operation is completed. Then the features are input into the trained model to get the prediction results. If the prediction probability is greater than 0.5, it is marked as an attack; otherwise, it is marked as normal. The prediction results are written to the file together with the corresponding IP address, where the attack source is written to blacklist.txt and the normal source is written to whitelist.txt. The role of this step is to classify the IP addresses in a large amount of historical or batch data into black and white lists, which is convenient for subsequent real-time monitoring.

[0048] Step 5: Online traffic monitoring and blocking In the real-time protection phase, the script runs with root permission and captures IP layer packets based on Scapy. First, check if the source IP is in the whitelist, if so, directly pass; if in the blacklist, immediately call iptables to block it and record the log. In addition, there are also built-in feature rule detection, such as Nimda worm attack feature (GET / scripts / root.exe), which will be blocked immediately upon matching. For other traffic, the packet rate of each source IP is counted per second window, and [protocol number, rate] is input into the neural network model. If the model prediction result is an attack and the IP has not been blocked, it will immediately call iptables to blacklist it, while writing to the log and blacklist file, realizing AI-based dynamic defense.

[0049] Step 6: Log recording and closed-loop optimization During the running process, all intercepted events will be written to the log file under the logs / folder, with the file name containing the timestamp, which is convenient for subsequent tracing and analysis. These logs not only provide audit evidence for attack sources and blocking reasons, but also can be used for subsequent model optimization. For example, new intercepted attack IPs can be added to the training data periodically for model retraining, thereby improving detection effect. At the same time, threshold, model structure and black and white list can be dynamically adjusted according to the evaluation results, forming a complete detection-interception-optimization closed loop.

[0050] Step 7: Import dependent libraries The script first imports the sys and time two standard libraries, and introduces Ether, IP, TCP and sendp from scapy.all. Among them, the Scapy library is used to build and send raw network packets.

[0051] Step 8: Set parameters Define the target IP address (hedef_ip), network interface (arayuz), the maximum number of packets to send (paket_sayisi), and the duration (sure). These parameters determine the destination, outlet, and scale of the attack traffic.

[0052] Step 9: Construct the packet In the function paket_gonder, a basic Ethernet frame + IP layer + TCP layer packet is constructed using Ether() / IP(dst=hedef_ip) / TCP(). The target address is set to hedef_ip. No port or TCP option is specified here, so the default TCP packet is constructed.

[0053] Step 10: Control the sending duration and times The script calculates an end time bitis_zamani = time.time() + sure and sets the counter gonderilen_paket_sayisi = 0. The sending loop is subject to two constraints: The current time does not exceed the preset duration sure; The number of packets sent does not exceed paket_sayisi.

[0054] Step 11: Loop to send packets In the loop, call sendp(paket, iface=arayuz) to continuously send the constructed packet through the specified network card interface. The counter is incremented each time until the end condition is met.

[0055] Step 12: Load dependencies and program entry The script first activates the pysmile license through pysmile_license and imports the required standard libraries json and sys, as well as the Bayesian network modeling required pysmile.Network. In the main entry part, the program checks the command line parameters. If the STIXJSON file path is not specified, it prompts the correct usage and exits, otherwise it passes the path into the main function for processing.

[0056] Step 13: Parse STIX data and extract TTP and relationships In the extract_ttps function, the program iterates through all objects in the STIX file. For objects of type attack-pattern, it extracts their ID, name, technique_id in external references, and tactic stage (tactic), and stores this information in the dictionary ttps. For objects of type relationship, it records the reference IDs of its source and target in the relationship list, indicating the dependency between different attack techniques. Finally, it returns the TTP set and the relationship list.

[0057] Step 14: Create Bayesian Network and Add Nodes In the build_bayesian_network function, the program initializes an empty Bayesian network and processes the extracted TTP information one by one. Each technique with a technique_id is added as a CPT node, with the node name, two possible states (False / True), and the prior probability distribution [0.99, 0.01] set, indicating that the technique is not triggered in most cases. At the same time, a mapping from STIX ID to network node ID is established for subsequent use.

[0058] Step 15: Establish Dependency Relationships Between Attack Techniques Next, the program iterates through the relationship list extracted from STIX. If the source and target of a relationship can both be found in the ID mapping, a directed arc from the source to the target is added to the Bayesian network. This step converts the "attack path" in the STIX file into causal relationships in the network structure.

[0059] Step 16: Generate Conditional Probability Table (CPT) For each technique with parent nodes, the program constructs a conditional probability table based on the number of parent nodes. When all parent nodes are False, the probability distribution of the current node remains [0.99, 0.01]; when there is a parent node that is True, the probability distribution is set to [0.2, 0.8], meaning that the likelihood of the current technique occurring significantly increases when the upstream technique is triggered. In this way, the system converts the dependency relationships in STIX into a probability model that can be used for reasoning.

[0060] Step 17: Save Network File and Execute Main Flow The program saves the constructed Bayesian network as a.xdsl file (named attack_flow.xdsl by default) for visualization and inference analysis in tools like GeNIe / SMILE. The main flow reads the STIX file, calls the extraction and modeling functions, and outputs the final network file, achieving automatic conversion from STIX attack pattern data to Bayesian network model.

[0061] Step 18: Load dependencies and initialize the network First, activate the pysmile license through pysmile_license, then import Flask, Prometheus monitoring library, and Network class of pysmile. Then load the previously generated Bayesian network file attack_flow.xdsl and build the network object, providing a foundation for subsequent inference and interface calls.

[0062] Step 19: Initialize monitoring metrics The system iterates through all nodes in the Bayesian network and creates a PrometheusGauge metric for each node. These metrics record the belief value of each node when the value is True, allowing each attack technique node to be collected and visualized by the monitoring system.

[0063] Step 20: Define the metric update mechanism Define the update_prometheus_metrics function to reacquire the belief distribution of each node after each network inference update and write the True probability to the corresponding PrometheusGauge. This mechanism ensures that the data exposed by Prometheus is consistent with the current state of the model.

[0064] Step 21: Implement the evidence injection interface Flask provides the / evidence route, allowing external JSON lists to be submitted as observed attack technique IDs through POST requests. The program clears old evidence, marks these technique nodes as True, and calls update_beliefs to update the Bayesian network. After updating, it synchronously refreshes Prometheus metrics and returns a success message to confirm the injected observation evidence.

[0065] Step 22: Implement the query and monitoring interface The system provides two additional interfaces: / nodes: Through GET requests, it returns the belief values (False and True probabilities) of all nodes after inference, allowing external systems or users to directly view them.

[0066] / metrics: output all metrics data in Prometheus format, convenient for monitoring platform to collect, realize real-time monitoring and visualization of security posture.

[0067] Step 23: start service and monitoring thread At the main program entry, the script starts the HTTP service of Prometheus (listening to port 8000) through a thread, and runs the FlaskWeb service (listening to port 5000) at the same time. In this way, the system can not only provide RESTAPI externally for business interaction, but also be automatically collected by the monitoring system through the Prometheus interface, realizing the integration of dual functions.

[0068] Through the above technical solutions, the application not only improves the detection accuracy and real-time performance of distributed denial of service attacks and complex threats, but also reduces the occurrence rate of false positives and false negatives; at the same time, it has good scalability and observability, can be seamlessly connected with existing security operation and maintenance platforms, and thus significantly improves the protection capability and practical value of the network system.

[0069] Those skilled in the art can understand that the above description is only preferred embodiments of the present application, and the features described in each embodiment and / or technical solution of the present disclosure can be combined or combined, even if such combination or combination is not explicitly described in the present disclosure. It is not intended to limit the present application, although the present application has been described in detail with reference to the foregoing embodiments, and those skilled in the art can modify the technical solutions described in the foregoing embodiments or make equivalent replacement of part of the technical features, and any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0070] Although the preferred embodiments of the present application have been described, those skilled in the art can make further changes and modifications to these embodiments once they know the basic creative concept. Therefore, the appended technical solutions are intended to include the preferred embodiments and all changes and modifications falling within the scope of the present application. Obviously, those skilled in the art can make various modifications and changes to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and changes of the present application fall within the scope of the technical solutions and equivalents thereof, the present application also intends to include these modifications and changes.

Claims

1. A method for automated reasoning and monitoring of threat intelligence based on Bayesian networks, characterized in that, The method includes the following steps: Step 1: Collect network traffic data and preprocess the network traffic data; Step 2: Extract feature information, including source IP, protocol type, traffic duration, and packet rate, based on the preprocessed network traffic data from Step 1; Step 3: Build and compile a neural network model, train the feature information extracted in Step 2, and generate a classification model and corresponding label encoder for identifying malicious traffic. Step 4: Input the real-time network traffic data into the trained classification model for automatic classification to obtain the judgment results of normal traffic and abnormal traffic, and write them into the whitelist file and blacklist file respectively, thereby completing the intelligent screening and classification of the raw traffic. Step 5: Capture and monitor real-time network traffic data, and dynamically trigger firewall policies based on the results of whitelist and blacklist files to automatically block malicious IP addresses. Simultaneously, verify the effectiveness of the defense strategy by constructing simulated attack traffic. At the threat intelligence level, transform structured intelligence data into attack patterns and their logical relationships, and construct a Bayesian network model file. Based on the Bayesian network model, realize automated inference of attack chains and security posture monitoring, and realize real-time output and visualization of inference results through interface services, forming a closed loop of the entire process from data collection, classification, inference to defense.

2. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, In step 1, the preprocessed network traffic data is divided into a training set and a test set, with a ratio of 8:

2.

3. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 2 also includes calculating the data packets per second rate, which is calculated as follows: The unit of Flow Duration is µs.

4. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 4 involves inputting real-time network traffic data into a trained classification model for automated classification to obtain the determination results of normal and abnormal traffic. A threshold esik_degeri=30 is set. This threshold is used to distinguish between normal traffic and attack traffic. When the average rate of a certain flow exceeds 30 packets per second, it is judged as a DDoS attack.

5. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 3 also includes a step of cleaning the feature information, namely, reading the yeni_veri.csv file in the prediction stage, extracting the feature columns and IP address columns, quantifying the features using the saved encoder, and completing the cleaning operation.

6. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 4 involves inputting real-time network traffic into the trained classification model for automated classification to obtain the determination results of normal and abnormal traffic. The feature information is input into the trained neural network model to obtain the prediction result. If the prediction probability is greater than 0.5, it is marked as an attack; otherwise, it is marked as normal. The prediction result and the corresponding IP address are written to a file, with attack sources written to blacklist.txt and normal sources written to whitelist.txt.

7. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 5 involves capturing and monitoring real-time network traffic, and dynamically triggering firewall policies based on the results of the whitelist and blacklist files to automatically block malicious IP addresses. Simultaneously, the effectiveness of the defense strategy is verified by constructing simulated attack traffic. First, it checks if the IP address is in the whitelist; if so, it is allowed directly. If it is in the blacklist, iptables is immediately invoked to block it and logs the information. In addition, it has a built-in feature rule detection function that blocks the IP address immediately upon matching a match. For other traffic, the packet rate of each IP address is calculated in one-second windows, and [protocol number, rate] is input into the neural network model. If the neural network model predicts an attack and the IP address has not yet been blocked, iptables will be invoked to blacklist it, and the information will be written to the log and blacklist file, thus achieving AI-based dynamic defense.

8. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, In step 5, at the threat intelligence level, structured intelligence data is transformed into attack patterns and their logical relationships, and a Bayesian network model file is constructed. The method for automating attack chain reasoning and security posture monitoring based on the Bayesian network model is as follows: Initialize an empty Bayesian network and process the extracted TTP information one by one; each technology with technique_id is added as a CPT node, and the node name, state, and prior probability distribution [0.99, 0.01] are set, indicating that the technology is not triggered in most cases; and a mapping from STIXID to network node ID is established. The source and target of the relationship can both find the corresponding technical nodes in the ID mapping. Add a directed arc from the source to the target in the empty Bayesian network, that is, transform the attack path in the STIX file into the causal relationship in the network structure, and complete the automated reasoning and security situation monitoring of the attack chain based on the Bayesian network model.

9. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-7.

10. A computer device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method of any one of claims 1-7.

Images