Bayesian network-based threat intelligence automated inference monitoring method

Abstract

The application discloses a threat intelligence automatic reasoning monitoring method based on a Bayesian network and relates to the field of network security.The method solves the problems of the existing network security protection technology, such as untimely attack detection, high false alarm rate and lack of dynamic adaptive capacity.The method comprises the following steps: collecting network flow data, pre-processing the network flow data and extracting feature information; constructing and compiling a neural network model, training the neural network model, generating a classification model for identifying malicious flow and a corresponding label encoder; inputting real-time network flow into the trained classification model for automatic classification, obtaining the determination results of normal flow and abnormal flow, and writing the determination results into a whitelist file and a blacklist file respectively; dynamically triggering a firewall strategy in combination with the results of the whitelist file and the blacklist file, and automatically blocking malicious IP addresses; constructing a Bayesian network model file; and realizing automatic reasoning of an attack chain and security situation monitoring.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method for automated reasoning and monitoring of threat intelligence based on Bayesian networks. Background Technology

[0002] As cyberattack methods continue to evolve, attackers often employ multi-stage and multi-tactical approaches to achieve covert intrusion, thereby evading detection by traditional security defense systems. For example, APT attacks typically include reconnaissance, penetration, lateral movement, and data theft. A single indication at each stage may not be sufficient to trigger an alert, but when correlated, they form a complete attack chain.

[0003] Existing firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) mostly rely on static rules and signature matching for detection and interception. This approach is often insufficient in detecting unknown threats and zero-day attacks. Furthermore, these systems typically lack reasoning capabilities, only able to identify isolated anomalous behaviors and struggling to infer the complete attack process from multiple attack steps. As attack methods evolve, traditional methods lag behind in rule updates, leaving the defense system in a passive state. In addition, judgment mechanisms based on simple thresholds are prone to high false positives and false negatives, increasing the burden on operations personnel and potentially overlooking covert attacks. Although there are abundant structured threat intelligence standards (such as STIX), traditional detection methods struggle to effectively map this intelligence into the logical models of detection and defense. Therefore, there is an urgent need for an intelligent detection method that integrates machine learning and Bayesian network reasoning to achieve more efficient, accurate, and adaptive network security protection.

[0004] Traditional firewalls and intrusion detection and prevention systems primarily rely on static rules and signature databases, making it difficult to identify zero-day attacks and new, complex threats. They also lack reasoning and correlation analysis capabilities, failing to reveal the logical relationships within multi-stage attacks. Furthermore, these systems suffer from lag in rule updates, resulting in reactive defense responses, and reliance on threshold-based judgments easily leads to false positives and false negatives. While structured threat intelligence standards such as STIX exist, traditional methods struggle to effectively apply them to detection and defense models. Summary of the Invention

[0005] This invention addresses the problems of untimely attack detection, high false alarm rates, and lack of dynamic adaptive capabilities in existing network security protection technologies. To solve these technical problems, this invention achieves its goal through the following technical solution:

[0006] Option 1: This invention proposes an automated threat intelligence reasoning and monitoring method based on Bayesian networks, the method comprising the following steps:

[0007] Step 1: Collect network traffic data and preprocess the network traffic data;

[0008] Step 2: Extract feature information, including source IP, protocol type, traffic duration, and packet rate, based on the preprocessed network traffic data from Step 1;

[0009] Step 3: Build and compile a neural network model, train the feature information extracted in Step 2, and generate a classification model and corresponding label encoder for identifying malicious traffic.

[0010] Step 4: Input the real-time network traffic data into the trained classification model for automatic classification to obtain the judgment results of normal traffic and abnormal traffic, and write them into the whitelist file and blacklist file respectively, thereby completing the intelligent screening and classification of the raw traffic.

[0011] Step 5: Capture and monitor real-time network traffic data, and dynamically trigger firewall policies based on the results of whitelist and blacklist files to automatically block malicious IP addresses. Simultaneously, verify the effectiveness of the defense strategy by constructing simulated attack traffic. At the threat intelligence level, transform structured intelligence data into attack patterns and their logical relationships, and construct a Bayesian network model file. Based on the Bayesian network model, realize automated inference of attack chains and security posture monitoring, and realize real-time output and visualization of inference results through interface services, forming a closed loop of the entire process from data collection, classification, inference to defense.

[0012] Furthermore, a preferred embodiment is provided in which the preprocessed network traffic data is divided into a training set and a test set in step 1, wherein the ratio of the training set to the test set is 8:2.

[0013] Furthermore, in a preferred embodiment, step 2 further includes a step of calculating the data packet rate per second, the calculation method being as follows:

[0014]

[0015] The unit of FlowDuration is µs.

[0016] Furthermore, a preferred embodiment is provided, wherein the method for automatically classifying real-time network traffic data into a trained classification model in step 4 to obtain the determination result of normal traffic and abnormal traffic is as follows:

[0017] A threshold esik_degeri=30 is set. This threshold is used to distinguish between normal traffic and attack traffic. When the average rate of a certain flow exceeds 30 packets per second, it is judged as a DDoS attack.

[0018] Furthermore, a preferred embodiment is provided, in which step 3 further includes a step of cleaning the feature information, namely, reading the yeni_veri.csv file in the prediction stage, extracting the feature columns and IP address columns, numerating the features through the saved encoder, and completing the cleaning operation.

[0019] Furthermore, a preferred embodiment is provided, wherein the method for automatically classifying real-time network traffic into a trained classification model in step 4 to obtain the determination results of normal traffic and abnormal traffic is as follows:

[0020] The feature information is input into the trained neural network model to obtain the prediction result. If the prediction probability is greater than 0.5, it is marked as an attack; otherwise, it is marked as normal. The prediction result and the corresponding IP address are written to a file, with attack sources written to blacklist.txt and normal sources written to whitelist.txt.

[0021] Furthermore, a preferred implementation method is provided, in which step 5, real-time network traffic is captured and monitored, and firewall policies are dynamically triggered based on the results of the whitelist and blacklist files to automatically block malicious IP addresses; simultaneously, the method for verifying the effectiveness of the defense strategy by constructing simulated attack traffic is as follows:

[0022] First, it checks if the IP address is in the whitelist; if so, it is allowed to pass directly. If it is in the blacklist, it immediately calls iptables to block it and logs the information. In addition, it has a built-in feature rule detection function that blocks the IP address as soon as a match is found. For other traffic, it calculates the packet rate of each IP address in a one-second window and inputs [protocol number, rate] into the neural network model. If the neural network model predicts an attack and the IP address has not yet been blocked, it will immediately call iptables to blacklist the IP address and write the information to the log and blacklist file, thus achieving AI-based dynamic defense.

[0023] Furthermore, a preferred implementation method is provided, in step 5 at the threat intelligence level, the structured intelligence data is transformed into attack patterns and their logical relationships, and a Bayesian network model file is constructed; and the method for automatically reasoning about the attack chain and monitoring the security situation based on the Bayesian network model is as follows:

[0024] Initialize an empty Bayesian network and process the extracted TTP information one by one; each technology with technique_id is added as a CPT node, and the node name, state, and prior probability distribution [0.99, 0.01] are set, indicating that the technology is not triggered in most cases; and a mapping from STIXID to network node ID is established.

[0025] The source and target of the relationship can both find the corresponding technical nodes in the ID mapping. Then, a directed arc from the source to the target is added to the empty Bayesian network, which transforms the attack path in the STIX file into a causal relationship in the network structure, thus completing the automated reasoning and security situation monitoring of the attack chain based on the Bayesian network model.

[0026] Option 3: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in Option 1.

[0027] Option 4: A computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the method described in Option 1.

[0028] The advantages of this invention are:

[0029] The Bayesian network-based automated threat intelligence inference and monitoring method described in this invention exhibits significant advantages in data processing, modeling, and monitoring. This method, driven by intelligence, extracts attack patterns and their relationships by parsing threat intelligence formats such as STIX, constructing a Bayesian network model to achieve logical modeling of the attack chain. Building upon this, the method combines machine learning with inference. First, it uses a deep learning model to classify real-time traffic, generating blacklists and whitelists. Then, it uses a Bayesian network for further inference, significantly improving the accuracy and intelligence of detection. Simultaneously, this invention possesses dynamic real-time monitoring capabilities, automatically triggering firewall policies for suspicious IPs by combining packet capture and traffic analysis, forming an immediate defense loop. Furthermore, the model is adaptive and scalable, dynamically evolving based on continuously updated threat intelligence and traffic data to maintain continuous detection capabilities. Through probabilistic inference and multi-feature fusion, this method effectively reduces false positives and false negatives caused by single thresholds, improving the reliability and credibility of security event alerts.

[0030] This invention addresses the shortcomings of existing network security protection technologies, such as untimely attack detection, high false positive rates, and lack of dynamic adaptive capabilities. It proposes a comprehensive detection and protection method combining machine learning models, blacklist / whitelist management, Bayesian inference, and monitoring visualization. This invention extracts and labels features from raw traffic data, utilizes deep learning models for efficient training and automatic classification of large-scale traffic, and automatically generates blacklists and whitelists from the prediction results, enabling rapid screening of offline data. In the real-time protection phase, this invention combines traffic rate features with artificial intelligence model discrimination to dynamically identify and block suspicious IP addresses. Simultaneously, it performs feature matching detection on specific known attack patterns (such as worm characteristics), achieving a dual protection mechanism of "rules + model." Furthermore, this invention introduces a Bayesian network-based inference model to represent the dependencies between attack techniques and updates the belief values ​​of each node in real time using the Prometheus metric, supporting visualized monitoring and alerts.

[0031] This invention is also applicable to the processing and modeling of network traffic data and threat intelligence data, enabling automatic identification, real-time monitoring and defense against potential attacks. Attached Figure Description

[0032] Figure 1 This is a flowchart of the threat intelligence automated reasoning and monitoring method based on Bayesian networks as described in Implementation Method 1.

[0033] Figure 2 This is a flowchart for packet capture monitoring of real-time network traffic data as described in Implementation Method 1. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them.

[0035] Implementation Method 1, see Figure 1 and Figure 2 This embodiment describes an automated threat intelligence reasoning and monitoring method based on Bayesian networks. The method includes the following steps:

[0036] First, network traffic data is collected and preprocessed to extract feature information including source IP, protocol type, traffic duration, and packet rate. Then, machine learning or deep learning models are used to train the extracted data to generate a classification model and corresponding label encoder for identifying malicious traffic. Based on this, new network traffic is input into the trained model for automatic classification to obtain the judgment results of normal and abnormal traffic, which are written to whitelist and blacklist files respectively, thereby completing the intelligent screening and classification of raw traffic.

[0037] Furthermore, real-time network traffic is monitored through packet capture, and firewall policies are dynamically triggered based on whitelist and blacklist results to automatically block malicious IP addresses. Simultaneously, the effectiveness of the defense strategy is verified by constructing simulated attack traffic. At the threat intelligence level, structured intelligence data (such as in STIX format) is transformed into attack patterns and their logical relationships, constructing a Bayesian network model file. Based on this model, automated reasoning of attack chains and security posture monitoring are implemented. Finally, the reasoning results are output and visualized in real-time through interface services, thus forming a closed-loop process from data collection, classification, reasoning to defense.

[0038] Step 1: Importing and Reading Data

[0039] The program first uses the pandas library to read the raw network traffic file islenmemis_veri.csv and stores it as a DataFrame. This not only facilitates data management and retrieval but also provides a unified data structure for subsequent data filtering and calculations. In practice, if only small-scale testing is needed, the iloc method can be used to extract partial rows, thereby reducing processing time.

[0040] Step 2: Field Filtering and Copying

[0041] After importing the data, the program filters four fields closely related to DDoS detection from the original table: source IP (Src_IP), protocol type (Protocol), flow duration (FlowDuration), and total positive packets (TotalFwdPacket). These fields reflect the core characteristics of network traffic. Then, a new data copy, df_filtered, is generated using the .copy() method to avoid direct modification of the original data and to avoid potential warnings from chained assignments.

[0042] Step 3: Parameter setting (threshold)

[0043] After data preparation is complete, the program sets a threshold esik_degeri=30. This threshold is used to distinguish between normal traffic and suspected attack traffic. When the average rate of a flow exceeds 30 packets per second, it may be identified as a DDoS attack. This value can be set based on experience or further optimized through statistical analysis or experimental verification.

[0044] Step 4: Rate Calculation (Packets / s)

[0045] At this stage, the program adds a new column, "Packets / s," to represent the data packet transmission rate per unit time. The calculation formula is as follows:

[0046]

[0047] The unit of FlowDuration is microseconds (µs), which needs to be converted to seconds before calculation. This metric can intuitively reflect the intensity of each flow. In practical applications, special cases also need to be considered. For example, when FlowDuration=0, it may lead to a division-by-zero error. In this case, the result should be set as a missing value or special handling should be performed.

[0048] Step 5: Threshold-based labeling

[0049] After calculating the rate, the program further generates a Boolean field "DDOSAttack" to mark whether the traffic is likely an attack flow. The judgment logic is: if "Packets / s" is greater than the threshold of 30, it is marked as True, indicating that the traffic is suspected of being a DDoS attack; otherwise, it is marked as False, and it is considered to be normal traffic. Although this binary labeling method is simplified, it can quickly and effectively screen out high-risk traffic from large-scale data.

[0050] Step 6: Export Results

[0051] Finally, the program exports a new data table containing all key fields, calculated rates, and attack tags as a file named yeni_veri.csv. Specifying `index=False` during export avoids saving irrelevant row indexes. This file not only retains the original key information but also adds rate metrics and attack tags, making it directly usable for subsequent statistical analysis, visualization, or as input data for machine learning models, thus contributing to both research and practical defense.

[0052] Step 7: Importing and Reading Data

[0053] The program imports libraries such as pandas, numpy, scikit-learn, keras, and joblib, and reads the yeni_veri.csv file. Currently, the implementation directly loads the raw data, but improvements could include adding data version control or log output to ensure the traceability of data input under different experimental environments.

[0054] Step 8: Field Filtering and Data Cleaning

[0055] Select Protocol and Packets / s as features from the data, and DDOSAttack as the label. Use LabelEncoder to convert non-numerical features into integer codes. The current implementation selects data based on column index; for improvement, it is recommended to select directly by column name (e.g., X=data[['Protocol','Packets / s']], y=data['DDOSAttack']) to avoid errors caused by changes in column order. Additionally, feature scaling (e.g., StandardScaler or RobustScaler) can be added to improve the model's adaptability to data with different scales.

[0056] Step 9: Dataset Partitioning

[0057] The training and test sets are split into an 8:2 ratio using `train_test_split`. The current implementation guarantees independent evaluation, but improvements could include a validation set and early stopping or cross-validation to further enhance the model's generalization ability.

[0058] Step 10: Build and compile the neural network model

[0059] The model consists of three fully connected hidden layers and one sigmoid output layer. The optimizer is Adam, and the loss function is binary cross-entropy. Improvements can be made by adjusting the network structure (e.g., reducing the number of layers to prevent overfitting, or adding a Dropout layer to improve robustness), and by setting learning rate scheduling during compilation to help achieve faster convergence.

[0060] Step 11: Model Training and Evaluation

[0061] The model was trained for 50 epochs with a batch size of 32, and accuracy and classification reports were evaluated on the test set. The current method reflects the basic performance of the model, but if the sample class distribution is imbalanced, it is recommended to introduce a class_weight parameter or use oversampling / undersampling techniques to improve the recall rate for the minority class (attack traffic).

[0062] Step 12: Model and encoder saving and example inference

[0063] After training, the model is saved as an .h5 file, and the encoder is saved as a .joblib file to ensure consistency during prediction. Example input [17, 35.264324] is fed into the model, and the output is the prediction result. For improvement, a model version number and inference script encapsulation can be added during the saving process for integration into actual detection.

[0064] Step 13: Load dependencies and models

[0065] The program first imports the necessary libraries, including pandas, numpy, keras, joblib, and os. Next, it loads the pre-trained deep learning model model_test.h5 and the previously saved label encoder label_encoders.joblib, ensuring that the processing of new data remains consistent with that used during training.

[0066] Step 14: Read new data

[0067] The script loads a new traffic data file using pd.read_csv("yeni_veri.csv"). It extracts columns 2 and 5 as input features X_new (protocol number and packets per second), while saving the source IP address in column 1 separately as an identifier for subsequent output.

[0068] Step 15: Feature Encoding and Data Cleaning

[0069] For each column in X_new, if its data type is string and a corresponding encoder exists in label_encoders, then that encoder is used to convert the string value to a number. Subsequently, the data is cleaned: non-numeric items are forcibly converted to NaN and replaced with 0; missing values ​​are filled with 0; positive and negative infinity are also replaced with 0 to ensure the stability and reliability of the input data.

[0070] Step 16: Make a prediction

[0071] The cleaned feature data is input into a neural network model for inference. The prediction results are in probabilistic form. The program uses 0.5 as a threshold, classifying results greater than this value as 1 (suspected DDoS attack), and otherwise as 0 (normal traffic).

[0072] Step 17: Classify and write the results to the file

[0073] The script iterates through each IP address and its corresponding prediction result: if the prediction is 1, the IP address is written to blacklist.txt (blacklist); if the prediction is 0, it is written to whitelist.txt (whitelist). This clearly distinguishes between suspicious attack sources and normal sources.

[0074] Step 18: Set file permissions

[0075] The program modifies the permissions of the blacklist file using os.chmod("blacklist.txt",0o666) to make it readable and writable by all users, so that it can be directly invoked in security policies.

[0076] As described, after feature extraction and classification labeling, machine learning and Bayesian networks are further combined for automated inference and dynamic monitoring. Specifically, firstly, the training module is used to model the structured data in yeni_veri.csv, generating a deep learning classification model and a corresponding label encoder; then, the prediction module calls the training results to automatically classify newly collected network traffic data, and outputs the classification results to whitelist.txt (normal IPs) and blacklist.txt (malicious IPs). During the real-time monitoring phase, network traffic is continuously monitored using packet capture tools, and firewall policies are dynamically triggered using blacklists and whitelists to block suspicious IP addresses in real time. Simultaneously, Bayesian networks are used to map structured threat intelligence into attack patterns and their logical relationships, enabling automated inference of attack chains and security posture monitoring. Therefore, this invention forms a closed-loop process from feature extraction and model training to real-time detection and dynamic defense, effectively improving the ability to identify and defend against complex attacks.

[0077] Step 1: Data Preparation

[0078] The program reads network session data from the raw traffic file and extracts key fields such as source IP, protocol type, flow duration, and total number of forward packets. Based on these fields, it calculates the packet rate per second (Packets / s) by dividing the total number of packets by the flow duration (converted to seconds). A threshold (e.g., 30 packets / second) is then set, and traffic exceeding this threshold is marked as "suspected DDoS attack," with a new Boolean label added. The final output file, yeni_veri.csv, contains both the original traffic characteristics and supplements the rate indicators and attack markers, providing a unified data foundation for subsequent training and inference.

[0079] Step 2: Feature Engineering and Data Cleaning

[0080] In this step, the protocol number and packet rate (Packets / s) are selected from yeni_veri.csv as input features for the model, and the attack flag (DDOSAttack) is used as the label. For any potentially string-type fields, LabelEncoder is used to convert them to numerical values, and the encoder is saved to ensure consistency between the training and prediction phases. The data is then cleaned: non-numerical values ​​are forcibly converted to NaN and then padded with 0; positive and negative infinity values ​​are also replaced with 0 to avoid numerical instability. This processed feature matrix meets the requirements for neural network input and reduces the interference of outlier data on the training results.

[0081] Step 3: Model Training and Evaluation

[0082] The cleaned data is divided into training and test sets (typically in an 8:2 ratio). A multilayer perceptron model built on Keras consists of three ReLU hidden layers, each with 100 neurons, and a final sigmoid output for binary classification. The optimizer is Adam, and the loss function is binary cross-entropy. The model is iteratively trained on the training set and evaluated on the test set, outputting accuracy and classification reports (Precision, Recall, F1 score). The evaluation results reveal the model's ability to distinguish between attack and legitimate traffic. After training, the model is saved as `model_test.h5`, and the encoder is saved as `label_encoders.joblib` for subsequent batch prediction and online inference.

[0083] Step 4: Batch Prediction and List Generation

[0084] During the prediction phase, the `yeni_veri.csv` file is read, and the feature columns and IP address columns are extracted. The features are quantified using a pre-saved encoder, and a cleaning process is performed. The features are then input into the trained model to obtain the prediction results. If the predicted probability is greater than 0.5, it is marked as an attack; otherwise, it is marked as normal. The prediction results and corresponding IP addresses are written to files, with attack sources written to `blacklist.txt` and normal sources written to `whitelist.txt`. This step categorizes IP addresses from large amounts of historical or batch data into blacklists and whitelists for subsequent real-time monitoring.

[0085] Step 5: Online Traffic Monitoring and Blocking

[0086] During the real-time protection phase, the script runs with root privileges and uses Scapy to capture IP-layer packets. It first checks if the source IP is in the whitelist; if so, it allows the traffic. If it's in the blacklist, it immediately calls iptables to block the IP and logs the changes. Additionally, it includes built-in feature-based rule detection, such as identifying Nimda worm attack characteristics (GET / scripts / root.exe), which blocks the traffic immediately upon a match. For other traffic, it calculates the packet rate for each source IP in a one-second window and inputs [protocol number, rate] into a neural network model. If the model predicts an attack and the IP hasn't been blocked yet, it immediately calls iptables to blacklist the IP, writing the changes to the logs and blacklist file, achieving AI-based dynamic defense.

[0087] Step 6: Log recording and closed-loop optimization

[0088] During operation, all intercepted events are written to log files in the `logs / ` folder, with filenames including timestamps for easy tracing and analysis. These logs not only provide audit evidence of attack sources and blocking reasons but also serve for subsequent model optimization. For example, newly intercepted attack IPs can be periodically added to the training data for model retraining, thereby improving detection performance. Simultaneously, thresholds, model structure, and blacklists / whitelists can be dynamically adjusted based on evaluation results, forming a complete detection-interception-optimization closed loop.

[0089] Step 7: Import dependency libraries

[0090] The script first imports the standard libraries sys and time, and then imports Ether, IP, TCP, and sendp from scapy.all. The Scapy library is used to build and send raw network packets.

[0091] Step 8: Set parameters

[0092] Define the target IP address (hedef_ip), network interface (arayuz), maximum number of packets sent (paket_sayisi), and duration (sure). These parameters determine the destination, exit point, and scale of the attack traffic.

[0093] Step 9: Construct the data packet

[0094] In the function `paket_gonder`, a basic Ethernet frame + IP layer + TCP layer data packet is constructed using `Ether() / IP(dst=hedef_ip) / TCP()`, with the destination address being the specified `hedef_ip`. Since no port or TCP options are specified here, a default TCP packet is constructed.

[0095] Step 10: Control the sending duration and number of times

[0096] The script calculates an end time bitis_zamani = time.time() + sure, and sets the counter gondelelen_paket_sayisi = 0. The sending loop is subject to two constraints simultaneously:

[0097] The current time has not exceeded the preset duration.

[0098] The number of data packets sent has not exceeded paket_sayisi.

[0099] Step 11: Send data packets in a loop

[0100] The loop calls `sendp(paket,iface=arayuz)` to continuously send constructed data packets through the specified network interface. Each time a packet is sent, a counter is incremented until the termination condition is met.

[0101] Step 12: Load dependencies and program entry point

[0102] The script first activates the pysmile license using pysmile_license and imports the necessary standard libraries json and sys, as well as pysmile.Network required for Bayesian network modeling. In the main entry point, the program checks the command-line arguments; if the STIXJSON file path is not specified, it prompts for correct usage and exits; otherwise, it passes the path to the main function for processing.

[0103] Step 13: Parse STIX data and extract TTP and relationships.

[0104] In the `extract_ttps` function, the program iterates through all objects in the STIX file. For objects of type `attack-pattern`, it extracts their ID, name, `technique_id` from external references, and tactical phase, storing this information in the dictionary `ttps`. For objects of type `relationship`, it records the source and target reference IDs in a relationship list, representing the dependencies between different attack techniques. Finally, it returns a set of TTPs and a list of relationships.

[0105] Step 14: Create Bayesian Network and Add Nodes

[0106] In the `build_bayesian_network` function, the program initializes an empty Bayesian network and processes the extracted TTP information one by one. Each technique with a `technique_id` is added as a CPT node, and the node name, two possible states (False / True), and a prior probability distribution [0.99, 0.01] are set, indicating that the technique is not triggered in most cases. At the same time, a mapping from `STIXID` to network node ID is established for later use.

[0107] Step 15: Establish dependencies between attack techniques

[0108] Next, the program iterates through the list of relationships extracted from STIX. If both the source and target of a relationship can be found in the ID mapping, a directed arc from the source to the target is added to the Bayesian network. This step transforms the "attack path" in the STIX file into a causal relationship in the network structure.

[0109] Step 16: Generate the Conditional Probability Table (CPT)

[0110] For each technology with a parent node, the program constructs a conditional probability table based on the number of parent nodes. When all parent nodes are False, the probability distribution of the current node remains [0.99, 0.01]; while when there are parent nodes that are True, the probability distribution is set to [0.2, 0.8], meaning that the probability of this technology occurring increases significantly when an upstream technology is triggered. In this way, the system transforms the dependencies in STIX into a probabilistic model that can be used for inference.

[0111] Step 17: Save the network file and execute the main process.

[0112] The program saves the constructed Bayesian network as a .xdsl file (default name attack_flow.xdsl), facilitating visualization and inference analysis in tools such as GenIe / SMILE. The main process reads the STIX file, calls extraction and modeling functions, and outputs the final network file, achieving automatic conversion from STIX attack pattern data to a Bayesian network model.

[0113] Step 18: Load dependencies and initialize the network

[0114] First, activate the pysmile license using pysmile_license, then import Flask, the Prometheus monitoring library, and the pysmile Network class. Next, load the pre-generated Bayesian network file attack_flow.xdsl and construct the network object, providing the foundation for subsequent inference and API calls.

[0115] Step 19: Initialize monitoring metrics

[0116] The system iterates through all nodes in the Bayesian network and creates a PrometheusGauge metric for each node. These metrics record the belief values ​​of each node when they are True, enabling the monitoring system to collect and visualize each attack technique node.

[0117] Step 20: Define the indicator update mechanism

[0118] The `update_prometheus_metrics` function is defined to re-acquire the belief distribution of each node after each network inference update and write the probability of `True` to the corresponding `PrometheusGauge`. This mechanism ensures that the data exposed by Prometheus remains consistent with the current state of the model.

[0119] Step 21: Implement the evidence injection interface

[0120] Flask provides the ` / evidence` route, allowing external entities to submit a JSON list as observed attack technique IDs via POST requests. After clearing old evidence, the program marks these technique nodes as True and calls `update_beliefs` to update the Bayesian network. Once the update is complete, the Prometheus metrics are refreshed synchronously, and a success message is returned, confirming the injected observation evidence.

[0121] Step 22: Implement the query and monitoring interface

[0122] The system provides two additional interfaces:

[0123] / nodes: Returns the belief values ​​(probabilities of False and True) of all nodes after inference via a GET request, making it easy for external systems or users to view directly.

[0124] / metrics: Outputs all metric data in Prometheus format, facilitating data collection by the monitoring platform and enabling real-time monitoring and visualization of the security situation.

[0125] Step 23: Start the service and monitoring thread

[0126] At the main program entry point, the script starts the Prometheus HTTP service (listening on port 8000) via a thread, while simultaneously running the Flask Web service (listening on port 5000). This allows the system to both provide a REST API for business interaction and be automatically monitored by the monitoring system through the Prometheus interface, achieving a dual-functionality integration.

[0127] Through the above technical solutions, this invention not only improves the accuracy and real-time performance of detecting distributed denial-of-service attacks and complex threats, but also reduces the incidence of false positives and false negatives. At the same time, it has good scalability and observability, and can be seamlessly integrated with existing security operation and maintenance platforms, thereby significantly improving the protection capabilities and practical value of network systems.

[0128] Those skilled in the art will understand that the above description is merely a preferred embodiment of the present invention, and the features described in the various embodiments and / or technical solutions of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. This is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0129] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended technical solutions are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the present invention. Clearly, those skilled in the art can make various modifications and variations to the present invention without departing from its spirit and scope. Thus, if these modifications and variations of the present invention fall within the scope of the present invention and its equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A method for automated reasoning and monitoring of threat intelligence based on Bayesian networks, characterized in that, The method includes the following steps: Step 1: Collect network traffic data and preprocess the network traffic data; Step 2: Extract feature information, including source IP, protocol type, traffic duration, and packet rate, based on the preprocessed network traffic data from Step 1; Step 3: Build and compile a neural network model, train the feature information extracted in Step 2, and generate a classification model and corresponding label encoder for identifying malicious traffic. Step 4: Input the real-time network traffic data into the trained classification model for automatic classification to obtain the judgment results of normal traffic and abnormal traffic, and write them into the whitelist file and blacklist file respectively, thereby completing the intelligent screening and classification of the raw traffic. Step 5: Capture and monitor real-time network traffic data, and dynamically trigger firewall policies based on the results of whitelist and blacklist files to automatically block malicious IP addresses. Simultaneously, verify the effectiveness of the defense strategy by constructing simulated attack traffic. At the threat intelligence level, transform structured intelligence data into attack patterns and their logical relationships, and construct a Bayesian network model file. Based on the Bayesian network model, implement automated inference of attack chains and security posture monitoring, and achieve real-time output and visualization of inference results through interface services, forming a closed-loop process from data collection, classification, inference to defense. In step 5, at the threat intelligence level, structured intelligence data is transformed into attack patterns and their logical relationships, and a Bayesian network model file is constructed. The method for automating attack chain reasoning and security posture monitoring based on the Bayesian network model is as follows: Initialize an empty Bayesian network and process the extracted TTP information one by one; each technology with technique_id is added as a CPT node, and the node name, state, and prior probability distribution [0.99, 0.01] are set, indicating that the technology is not triggered in most cases; and a mapping from STIXID to network node ID is established. The source and target of the relationship can both find the corresponding technical nodes in the ID mapping. Add a directed arc from the source to the target in the empty Bayesian network, that is, transform the attack path in the STIX file into the causal relationship in the network structure, and complete the automated reasoning and security situation monitoring of the attack chain based on the Bayesian network model.

2. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, In step 1, the preprocessed network traffic data is divided into a training set and a test set, with a ratio of 8:

2.

3. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 2 also includes calculating the data packets per second rate, which is calculated as follows: The unit of Flow Duration is µs.

4. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 4 involves inputting real-time network traffic data into a trained classification model for automated classification to obtain the determination results of normal and abnormal traffic. A threshold esik_degeri=30 is set. This threshold is used to distinguish between normal traffic and attack traffic. When the average rate of a certain flow exceeds 30 packets per second, it is judged as a DDoS attack.

5. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 3 also includes a step of cleaning the feature information, namely, reading the yeni_veri.csv file in the prediction stage, extracting the feature columns and IP address columns, quantifying the features using the saved encoder, and completing the cleaning operation.

6. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 4 involves inputting real-time network traffic into the trained classification model for automated classification to obtain the determination results of normal and abnormal traffic. The feature information is input into the trained neural network model to obtain the prediction result. If the prediction probability is greater than 0.5, it is marked as an attack; otherwise, it is marked as normal. The prediction result and the corresponding IP address are written to a file, with attack sources written to blacklist.txt and normal sources written to whitelist.txt.

7. The method for automated threat intelligence reasoning and monitoring based on Bayesian networks according to claim 1, characterized in that, Step 5 involves capturing and monitoring real-time network traffic, and dynamically triggering firewall policies based on the results of the whitelist and blacklist files to automatically block malicious IP addresses. Simultaneously, the effectiveness of the defense strategy is verified by constructing simulated attack traffic. First, it checks if the IP address is in the whitelist; if so, it is allowed directly. If it is in the blacklist, iptables is immediately invoked to block it and logs the information. In addition, it has built-in feature rule detection, which blocks the IP address immediately upon matching. For other traffic, the packet rate of each IP address is counted in a one-second window, and [protocol number, rate] is input into the neural network model. If the neural network model predicts an attack and the IP address has not yet been blocked, iptables will be invoked to blacklist it, and the information will be written to the log and blacklist file, thus achieving AI-based dynamic defense.

8. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-7.

9. A computer device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method of any one of claims 1-7.

Images