Network attack path tracking method and system based on three-domain communication event structure

Abstract

The application discloses a network attack path tracking method and system based on a three-domain communication event structure, relates to the technical field of network security, and comprises the following steps: converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, and generating an industrial network topology graph; training a graph neural network model by using the industrial network topology graph, identifying abnormal jump paths and attack chain segments, and generating a suspicious path set; performing consistency calculation and weighted fusion on communication behaviors, protocol calling logic and physical state responses in the suspicious path set, and generating a credibility score vector; performing fusion calculation on the credibility score vector, selecting a path with the lowest credibility as a high-risk attack path, and combining a time sequence, the industrial network topology graph and an abnormal jump path to backtrack and reconstruct an attack path starting point, so that an attack propagation chain is obtained. The application improves the precision and efficiency of industrial network security situation awareness.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network attack path tracking method and system based on a three-domain communication event structure. BACKGROUND

[0002] With the digital transformation of industrial control systems and critical infrastructures, network attack means are increasingly complex and diverse, especially in the form of multi-hop attack chains and hidden abnormal jump paths. Existing network security technologies mostly rely on single-dimensional data analysis and rule matching methods, which have certain recognition capabilities for known attack behaviors, but have limitations in dealing with new attacks and complex attack chains. In recent years, the field of industrial network security has begun to introduce graph structure-based modeling and deep learning technologies, by constructing network topology graphs and training graph neural network models, to realize deep understanding of network communication relationships and mining of abnormal paths. It can extract complex nonlinear features between nodes in industrial networks, assist in discovering potential attack chain segments, and improve the accuracy and efficiency of network security situation awareness.

[0003] Existing technologies generally lack in multi-source data fusion and dynamic attack path reconstruction. On the one hand, most methods fail to fully integrate multi-dimensional information such as communication traffic, industrial protocol content, and device status, resulting in network topology graphs that do not fully express attack behaviors. On the other hand, the identification of abnormal jump paths and the reconstruction of attack chains lack consistent computing and weighted fusion mechanisms, making the credibility assessment of attack paths less accurate and affecting the timeliness and relevance of security responses. To address these shortcomings, there is an urgent need for a comprehensive method that can construct a three-domain communication event structure based on multi-source heterogeneous data, convert it into a multi-dimensional label heterogeneous graph, and use graph neural networks to identify abnormal paths and score credibility, thereby dynamically tracking attack paths and implementing real-time protection. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a network attack path tracking method based on a three-domain communication event structure to solve the problems of insufficient multi-source heterogeneous data fusion and low accuracy of dynamic attack path identification.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a network attack path tracking method based on a three-domain communication event structure, which comprises collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure; converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph; training a graph neural network model using the industrial network topology graph to identify abnormal jump paths and attack chain segments and generate a suspicious path set; performing consistency calculation and weighted fusion on the communication behavior, protocol call logic and physical state response in the suspicious path set to generate a credibility score vector; performing fusion calculation on the credibility score vector to select the path with the lowest credibility as a high-risk attack path, and combining time series, industrial network topology graph and abnormal jump path backtracking to reconstruct the attack path starting point to obtain an attack propagation chain; displaying the attack propagation chain in the industrial network topology graph through a visual method and outputting to an industrial security linkage to trigger real-time blocking, protection and early warning response.

[0008] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure comprises the following specific steps,

[0009] Collecting network communication traffic, industrial control protocol content and running state to form original multi-source data;

[0010] Performing format unification, time alignment and abnormal filtering on the original multi-source data to generate structured preprocessed data, and dividing the data into communication domain, protocol domain and state domain to form three-domain communication event structure elements;

[0011] Sorting and uniformly numbering the three-domain communication event structure elements according to event occurrence time to generate a three-domain communication event structure.

[0012] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the extracting communication parties as nodes from the three-domain communication event structure, mapping protocol types, communication frequencies, function code abnormality marks and state change information into multi-dimensional labels of edges, constructing and optimizing a heterogeneous graph structure, and generating an industrial network topology graph.

[0013] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the generating a suspicious path set comprises the following specific steps,

[0014] Converting the industrial network topology graph into a node feature matrix and an edge weight matrix, iteratively training a graph neural network model until the loss converges, and obtaining a trained graph neural network model;

[0015] The trained graph neural network model is used to infer the industrial network topology graph, complex nonlinear features are extracted, and an abnormal jump path and a potential attack chain are identified in the industrial network topology graph by using a path search method and an anomaly detection method, and a suspicious path set is generated.

[0016] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the steps of generating the credibility score vector are as follows,

[0017] The communication behavior, protocol calling logic and physical state response involved in the suspicious path set are parsed from the three-domain communication event structure, the corresponding function code sequence and parameter structure features are extracted, and the behavior consistency score, the logic consistency score and the state response consistency score are calculated by matching with the historical normal mode.

[0018] The behavior consistency score, the logic consistency score and the state response consistency score are weighted and fused and normalized to generate a multi-path credibility score vector.

[0019] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the steps of generating the credibility score vector are as follows,

[0020] The multi-path credibility score vector set is sorted in ascending order, the path with the lowest multi-path credibility score is extracted, and a high-risk attack path candidate set is formed;

[0021] Based on the communication node sequence and the timestamp information of the high-risk attack path candidate set, the order of events in the path is rearranged to generate a time-consistent attack behavior chain.

[0022] In the attack behavior chain, the industrial network topology graph and the abnormal jump path are combined, the first abnormal communication event is traced back, and the path source node is located.

[0023] According to the path source node, the jump nodes in the high-risk attack path candidate set are traced back, and the path source node, the abnormal jump path and the candidate path endpoint are connected in order to obtain the attack propagation chain.

[0024] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the steps of triggering real-time blocking, protection and early warning response are as follows,

[0025] The attack propagation chain is structured and coded to convert into graphical representation of network node coordinates, connection edge attributes and identification information, forming a visual graphical input data.

[0026] Based on the industrial network topology graph, the visual graph input data is mapped to the network node coordinates and connection relationship in the industrial network topology graph, and the attack propagation chain spatial structure is obtained;

[0027] The path starting node, abnormal jump path and victim node identification information are extracted from the attack propagation chain spatial structure, and a security linkage trigger instruction set is generated;

[0028] The security linkage trigger instruction set is transmitted to the linkage execution end, and real-time blocking, protection and early warning response are triggered.

[0029] In a second aspect, the present application provides a network attack path tracking system based on a three-domain communication event structure, comprising a data processing module for collecting and preprocessing original multi-source data and encoding into a three-domain communication event structure; a graph construction module for converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, generating an industrial network topology graph; a training and identification module for training a graph neural network model using the industrial network topology graph, identifying abnormal jump paths and attack chain segments, and generating a suspicious path set; a score calculation module for consistency calculation and weighted fusion of communication behavior, protocol call logic and physical state response in the suspicious path set, generating a credibility score vector; a path screening module for fusion calculation of the credibility score vector, selecting the path with the lowest credibility as the high-risk attack path, and combining time series, industrial network topology graph and abnormal jump path backtracking to reconstruct the attack path starting point, obtaining an attack propagation chain; a visualization module for displaying the attack propagation chain in the industrial network topology graph through a visual method and outputting to an industrial security linkage to trigger real-time blocking, protection and early warning response.

[0030] In a third aspect, the present application provides a computer device comprising a memory and a processor, the memory storing a computer program, wherein the computer program is executed by the processor to implement any step of the network attack path tracking method based on the three-domain communication event structure according to the first aspect of the present application.

[0031] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by the processor to implement any step of the network attack path tracking method based on the three-domain communication event structure according to the first aspect of the present application.

[0032] The application has the beneficial effects that: by collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure, the fusion and unified expression of multi-source heterogeneous data are realized, the data island is broken, and the integrity and consistency of the data are improved; the three-domain communication event structure is converted into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, an industrial network topology graph is generated, the semantic association and topological continuity of nodes and edges in the network are strengthened, the expression ability of the model to complex interaction relationships is improved, thereby effectively enhancing the accuracy and robustness of subsequent attack path identification, and significantly improving the precision and efficiency of industrial network security situation awareness. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0034] Fig. 1 The flowchart of the network attack path tracking method based on the three-domain communication event structure.

[0035] Fig. 2 The schematic diagram of the network attack path tracking system.

[0036] Fig. 3 The flowchart of the three-domain communication event structure generation.

[0037] Fig. 4 The flowchart of the credibility score vector generation. DETAILED DESCRIPTION

[0038] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0039] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the connotation of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0040] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an independent or alternative embodiment that excludes other embodiments.

[0041] REFERENCE Figs. 1-4For an embodiment of the present application, the embodiment provides a network attack path tracking method based on a three-domain communication event structure, comprising the following steps:

[0042] S1, collect raw multi-source data for preprocessing and encode into a three-domain communication event structure.

[0043] S1.1, collect network communication traffic, industrial control protocol content and running state to form raw multi-source data.

[0044] Specifically, by setting up a mirror port or deploying a traffic collection probe, network communication traffic generated in the industrial network environment is collected and stored in pcap format; a communication middleware or protocol decoder is connected to the key nodes of the industrial control system to extract Modbus, OPC UA and Profinet industrial control protocol content in real time, including function code, register address and call parameters; the running state information of devices such as controllers, sensors and actuators is obtained by calling the device management interface or reading the log record to obtain the real-time state parameters of the device, such as temperature, pressure and motor start-stop state. During the collection process, timestamp information is added respectively, and the data is labeled and sorted in a unified data format, finally forming a data set containing network communication traffic, industrial control protocol content and running state as raw multi-source data.

[0045] S1.2, format unification, time alignment and abnormality filtering are performed on the raw multi-source data to generate structured preprocessed data, and the data is divided into communication domain, protocol domain and state domain to form three-domain communication event structure elements.

[0046] Specifically, the network communication traffic, industrial control protocol content and running state data in the raw multi-source data are respectively converted in format, the network communication traffic in pcap format is extracted into data records containing source IP, destination IP, port number, protocol type and timestamp, the industrial control protocol content is parsed into a structure composed of function code, register address, call parameters and timestamp, and the running state data is unified into a data format containing state variable name, variable value and collection time;

[0047] Taking timestamp as the reference, all data are aligned in a unified time accuracy (e.g. millisecond level) using a sliding window mechanism, ensuring that network communication traffic, industrial control protocol content and running state data can be analyzed synchronously within the same time interval;

[0048] The missing values, duplicate records and obvious error values in the raw multi-source data are removed or corrected, examples including: deleting network communication traffic with no source IP or destination IP, removing industrial control protocol content with empty function code, and correcting running state data with illegal state value coding;

[0049] The processed network communication traffic is divided into communication domain data, the parsed industrial control protocol content is divided into protocol domain data, and the processed running state data is divided into state domain data, and the three types of data are combined according to the aligned time sequence to form a three-domain communication event structure element.

[0050] S1.3, the three-domain communication event structure elements are sorted according to the event occurrence time and numbered uniformly to generate a three-domain communication event structure.

[0051] Specifically, the timestamp field in the three-domain communication event structure element is extracted, and all three-domain communication event structure elements are sorted in ascending order according to time, ensuring that the communication domain data, protocol domain data and state domain data are arranged in the same time axis according to the actual occurrence order;

[0052] From the earliest timestamp, a unique event number is assigned to each three-domain communication event structure element in an incremental manner, with example number formats such as "E0001", "E0002" and "E0003". The numbering process must strictly maintain the event order and time sequence, and cannot skip or repeat numbers;

[0053] The sorted three-domain communication event structure elements retain the original field information (including source address, destination address, protocol type, function code, parameter and state value, etc.), and add an event number field, finally forming a three-domain communication event structure arranged in time sequence and having a unique number identifier.

[0054] S2, the three-domain communication event structure is converted into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph.

[0055] It should be noted that through multi-source domain information fusion, the multi-dimensional information of the communication domain, protocol domain and state domain is innovatively integrated to build multi-dimensional label edges containing dynamic characteristics such as function code anomaly markers and state changes, significantly improving the richness and accuracy of the industrial network topology expression; the introduction of a heterogeneous graph structure realizes the high-dimensional attribute expression of the edges, which is different from the traditional network construction which only uses simple edge weights or single labels, and enhances the performance of the industrial network behavior; through node intelligent merging and label aggregation, redundant information of repeated nodes and multiple edges is effectively avoided, ensuring the compactness and information integrity of the topology graph; at the same time, dynamic state information is included in the topology construction, breaking through the limitation of the existing technology which only depicts static communication relationships, and improving the dynamic perception ability of the topology graph to the running state of the industrial network, which embodies significant innovation and practical value.

[0056] The beneficial effect is that by fusing the communication domain, protocol domain and state domain information in the three-domain communication event structure to construct a heterogeneous graph structure of multi-dimensional tag edges, it is significantly distinguished from the method of constructing an industrial network topology based on only a single communication relationship or a simple edge weight in the prior art. For example, the prior art usually only uses the IP address or MAC address of the communication parties as nodes, and the edge only represents a simple connection relationship or communication frequency, and cannot reflect protocol abnormalities and device state changes. The application innovatively integrates the function code abnormality mark and state change information into the multi-dimensional tag of the edge, greatly improving the sensitivity and performance of the industrial network topology to abnormal behavior and device operating state.

[0057] S2.1, extracting the communication parties from the three-domain communication event structure as nodes, mapping the protocol type, communication frequency, function code abnormality mark and state change information into the multi-dimensional tag of the edge, constructing and optimizing the heterogeneous graph structure, and generating the industrial network topology graph.

[0058] Specifically, for each communication event in the three-domain communication event structure, the source address and destination address information in the communication domain are extracted as the starting node and the ending node, respectively. The starting node is named the source address node, and the ending node is named the destination address node. The node pair source address node-destination address node is formed;

[0059] Iterate through all events to count the interactions between node pairs. For the communication behavior between each node pair source address node-destination address node, extract the protocol type in the protocol domain, count the number of occurrences of the protocol type within the observation period as the communication frequency, and generate the function code abnormality mark information according to whether the function code field is abnormally marked;

[0060] Further extract the state value change amplitude or state change type in the state domain to generate the state change information. The state change information is summarized as the multi-dimensional tag of the edge between the node pair source address node-destination address node, and the example format is {protocol type: Modbus, communication frequency: 120, function code abnormality mark: yes, state change information: offset up};

[0061] Collect all the edges of the node pair source address node-destination address node to form a heterogeneous graph structure composed of destination address nodes and edges with multi-dimensional tags. Merge the repeated destination address nodes in the graph structure, aggregate the edge information, and complete the generation of the industrial network topology graph.

[0062] S3, training the graph neural network model using the industrial network topology graph to identify abnormal jump paths and attack chain segments, and generating a suspicious path set.

[0063] It should be explained that the industrial network topology graph is innovatively used as an input structure, combined with a graph neural network model for deep training, to realize accurate modeling of complex industrial communication relationships and dynamic behaviors, breaking through the limitations of traditional methods based on static rules or single feature detection; through iterative optimization of node embedding and edge weight parameters, the identification accuracy of abnormal jump paths and attack chain segments is improved; the joint detection mechanism of abnormal jump paths and attack chain segments is introduced, which can capture hidden potential attack behaviors and generate a more comprehensive and accurate suspicious path set; the depth and breadth of industrial network security situation awareness are significantly enhanced, which is different from the existing technology of single feature matching or threshold determination, improving the intelligence and robustness of anomaly detection.

[0064] The beneficial effects are that through the graph neural network model training based on the industrial network topology graph, unlike the methods of static rule matching or single feature threshold judgment in the prior art, complex nonlinear correlation features in the industrial network can be dynamically captured to realize accurate identification of abnormal jump paths and attack chain segments; the prior art relies on fixed feature extraction and lacks comprehensive utilization of multi-dimensional node and edge weight information, while the fusion of node embedding and edge weight optimization significantly improves the accuracy and generalization ability of anomaly detection; in addition, the abnormal path recognition in the prior art is limited to single path analysis, and through the combination of path search and anomaly detection, multiple path potential attack chain segments can be identified, enhancing the spatio-temporal correlation analysis capability of attack behaviors.

[0065] S3.1, convert the industrial network topology graph into a node feature matrix and an edge weight matrix, iteratively train the graph neural network model until the loss converges, and obtain the trained graph neural network model.

[0066] Specifically, all address nodes and corresponding attribute information are extracted from the industrial network topology graph, and a node feature vector is constructed based on the historical communication behavior, device identifier, function type and protocol participation degree of each address node in the three-domain communication event structure; all node feature vectors are arranged in order in the industrial network topology graph to form a node feature matrix;

[0067] All edge source address node-destination address nodes and corresponding multi-dimensional label information are extracted from the industrial network topology graph, including communication frequency, protocol type, function code abnormality mark and state change amount; the weight value of each edge source address node-destination address node is calculated, and the edge weight matrix is finally formed. Based on communication frequency normalization, the expression is:

[0068] ;

[0069] wherein, represents the weight value of the edge from the starting node to the terminal node an edge weight value of an edge between a start node and an end node, denotes a start node denotes an end node denotes a communication frequency between a start node and an end node, denotes a sum of communication frequencies between all node pairs, denotes an index number of a start node, denotes an index number of an end node, denotes index numbers of all start nodes, denotes index numbers of all end nodes, denotes a communication frequency corresponding to an edge between a start node numbered and an end node numbered ;

[0070] The node feature matrix and the edge weight matrix are input into the graph neural network model, and the back propagation algorithm is used for iterative training. In each round of training, the loss function value is calculated according to the error between the prediction output of the graph neural network model and the real label, and the expression is:

[0071] ;

[0072] wherein, denotes the loss function value of the entire training batch, denotes the total number of training samples, denotes the real label of the i-th sample, denotes the prediction probability value of the i-th sample, denotes the index number of the training sample; The parameter optimization of the graph neural network model is continued until the loss function converges, and the optimization and update of the node embedding vector and the edge weight parameter are completed.

[0073] S3.2, using the trained graph neural network model to reason the industrial network topology graph, extracting complex nonlinear features, using path search method and anomaly detection method to identify abnormal jump path and potential attack chain in the industrial network topology graph, generating suspicious path set.

[0074] Specifically, the trained graph neural network model is used to reason the industrial network topology graph, and the node feature matrix and the edge weight matrix of the industrial network topology graph are input as input. After multi-layer graph convolution operation, complex nonlinear embedding features are extracted;

[0075]

[0076] ​​Based on node embedding features, a path search method is used to traverse the industrial network topology and mine connection paths. At the same time, anomaly detection methods are used to extract multi-dimensional features of communication nodes and edges in the paths, including communication frequency, protocol type, and function code anomaly markers. These features are then compared with a behavior model established from historical normal patterns to calculate feature deviation or anomaly scores. The degree of anomaly of nodes and edges is judged based on the anomaly scores, and abnormal behaviors in abnormal jump paths are identified. Abnormal jump paths and potential attack chains are identified. The identified abnormal jump paths and attack chains are summarized to generate a set of suspicious paths.

[0077] S4. Perform consistency calculation and weighted fusion on the communication behavior, protocol call logic and physical state response of the suspicious path set to generate a credibility score vector.

[0078] S4.1. Analyze the communication behavior, protocol call logic and physical state response involved in the suspicious path set from the three-domain communication event structure, extract the corresponding function code sequence and parameter structure features respectively, and match them with the historical normal pattern to calculate the behavior consistency score, logic consistency score and state response consistency score.

[0079] Specifically, from the three-domain communication event structure, the communication behaviors, protocol call logic and physical state responses involved in the suspicious path set are extracted, and the function code sequence and parameter structure features are analyzed respectively.

[0080] By comparing the corresponding function code sequence and parameter structure in the historical normal mode item by item, the behavior consistency score is calculated, and the expression is:

[0081] ;

[0082] in, Indicates the behavioral consistency score. Indicates the length of the function code sequence. Indicates the index position of the current function code sequence. Indicates the first suspicious path Function codes, Indicating the normal historical path and Reference function code corresponding to the location, This represents a conditional function;

[0083] Based on the protocol call logic, the call order and logical relationship of the function code sequence are verified, and a logical consistency score is calculated. The expression is as follows:

[0084] ;

[0085] in, Indicates the logical consistency score. Indicates the first suspicious path a function code, a reference function code corresponding to the position in the historical normal path, a logical comparison function;

[0086] At the same time, the state change value in the physical state response is extracted, compared with the historical normal state change range, and the state response consistency score is calculated, and the expression is:

[0087]

[0088] wherein, the state response consistency score, the total number of state parameters, the index of the state parameter currently processed, the value of the state parameter in the suspicious path, the reference state parameter value corresponding to the position in the historical normal path, a small positive number;

[0089] The behavior consistency score, the logical consistency score, and the state response consistency score are calculated and output respectively.

[0090] S4.2, the behavior consistency score, the logical consistency score, and the state response consistency score are weighted and fused and normalized to generate a multi-path credibility score vector.

[0091] Specifically, for each suspicious path, the corresponding behavior consistency score, logical consistency score, and state response consistency score are extracted, and fixed weighting coefficients are assigned, for example, 0.4, 0.3, and 0.3 respectively, and the three types of scores are weighted and summed according to the weighting coefficients to obtain the original credibility score of each suspicious path.

[0092] The maximum value of the original credibility score of all suspicious paths is calculated, and the maximum value is used as a normalization factor to normalize the original credibility score of all suspicious paths to obtain a multi-path credibility score vector corresponding to all suspicious paths.

[0093] S5, the credibility score vector is fused and calculated, the path with the lowest credibility is selected as the high-risk attack path, and the time sequence, industrial network topology, and abnormal jump path are combined to backtrack and reconstruct the attack path starting point to obtain the attack propagation chain.

[0094] S5.1, the multi-path credibility score vector set is sorted in ascending order, and the path with the lowest multi-path credibility score is extracted to form a high-risk attack path candidate set. ​

[0095] Specifically, for each suspicious path in the multi-path credibility score vector set, the multi-path credibility score values are sorted from small to large to form a sorted path sequence. The sorted results are traversed to extract paths with multi-path credibility scores in the smallest interval as candidates;

[0096] The specific extraction method includes scoring the features and distinguishing normal from abnormal by setting a percentile threshold, such as selecting paths with multi-path credibility scores ranked in the top 10%, or selecting paths with multi-path credibility scores lower than a fixed value, such as paths with multi-path credibility scores lower than 0.3. Finally, the path set that meets the conditions forms the high-risk attack path candidate set.

[0097] It should also be noted that the specific steps for setting the percentile threshold are as follows: extract the numerical values of all credibility scores in the multi-path credibility score vector set, and sort them in ascending order according to the numerical values; calculate the percentile threshold position index value according to the set percentile value, for example, 10%, in the example, the total number of paths multiplied by 10%; obtain the multi-path credibility score at the index position as the percentile threshold; traverse all paths, filter out paths with multi-path credibility scores less than or equal to the percentile threshold, and aggregate to form the high-risk attack path candidate set.

[0098] S5.2, based on the communication node sequence and timestamp information of the high-risk attack path candidate set, rearrange the sequence of events in the path, and generate a time-consistent attack behavior chain.

[0099] Specifically, based on the communication node sequence and timestamp information of the high-risk attack path candidate set, extract all communication node pairs contained in each high-risk attack path candidate, and filter out all three-domain communication event structure elements corresponding to the communication node pairs from the three-domain communication event structure;

[0100] Sort all three-domain communication event structure elements in ascending order according to the event occurrence time field, uniformly renumber, and determine the sequence of events in the path according to the sorting results;

[0101] Construct an attack behavior chain with the sorted three-domain communication event structure elements, and map the communication node sequence and the protocol type, function code, parameter value and state change information recorded in the three-domain communication event structure to generate a time-consistent attack behavior chain.

[0102] S5.3, in the attack behavior chain, combine the industrial network topology graph with the abnormal jump path, backtrack the first abnormal communication event, and locate the path source node.

[0103] Specifically, in the attack behavior chain, all three-domain communication event structure elements are extracted, and for each three-domain communication event structure element associated with the communication node pair, the corresponding edge in the industrial network topology graph is matched to identify the edge belonging to the abnormal jump path;

[0104] In combination with the timestamp information corresponding to each edge, all abnormal jump path edges are arranged in ascending order according to time sequence, and the earliest abnormal jump path edge in time is located; the starting communication node associated with the abnormal jump path edge is taken as the path source node, and in combination with the timestamp information of the first occurrence of the starting communication node in the three-domain communication event structure, the first abnormal communication event of the path is determined, and the backtracking positioning of the path source node is completed.

[0105] S5.4, according to the path source node, backtracking the jump nodes in the high-risk attack path candidate set, and connecting the path source node, the abnormal jump path and the candidate path endpoint in order to obtain the attack propagation chain.

[0106] Specifically, according to the path source node, all abnormal jump paths containing the path source node are filtered out from the high-risk attack path candidate set, and the communication order of the jump nodes in each abnormal jump path is arranged in ascending order according to the timestamp information in the three-domain communication event structure, the communication node pairs between the jump nodes are extracted, and the jump path sequence is formed by connecting in turn;

[0107] In combination with the communication node at the end of the jump path sequence, the termination node connected with it in the high-risk attack path candidate set is located as the candidate path endpoint; the path source node, the communication node pairs of the jump nodes in all abnormal jump paths, and the candidate path endpoint are connected in turn according to time sequence to form the final attack propagation chain.

[0108] S6, the attack propagation chain is displayed in the industrial network topology graph in a visual way, and output to the industrial security linkage to trigger real-time blocking, protection and early warning response.

[0109] S6.1, the attack propagation chain is structured and coded to convert into graphical representation of network node coordinates, connection edge attributes and identification information to form visual graphical input data.

[0110] Specifically, each communication node in the attack propagation chain is extracted as a node element, and numbered and sorted in a two-dimensional coordinate manner according to the time sequence and logical position of the communication node in the attack propagation chain, and the horizontal and vertical coordinate values of the node are allocated, for example, the horizontal coordinate is numbered in order according to the communication time, and the vertical coordinate is classified and layered according to the function type, to generate network node coordinates;

[0111] According to the connection relationship between the communication nodes in the attack propagation chain, the connection edge attribute is constructed by extracting the communication direction, and the communication protocol type, communication frequency, function code abnormality mark and state change information are attached as the connection edge attribute label;

[0112] The unique identification, device identification and function type of the communication node are extracted to generate node identification information, and the node coordinate set, connection edge attribute set and node identification set are output in a structured format to form the graphical visualization input data.

[0113] S6.2, based on the industrial network topology graph, the visualization graph input data is mapped to the network node coordinates and connection relationship in the industrial network topology graph to obtain the spatial structure of the attack propagation chain.

[0114] Specifically, the node identification information in the visualization graph input data is compared with the network node identification in the industrial network topology graph one by one, and the network node coordinates in the visualization graph input data are mapped to the actual physical coordinate position of the corresponding node in the industrial network topology graph according to the identification matching result;

[0115] According to the connection edge attribute extracted from the visualization graph input data, the corresponding edge connection relationship in the industrial network topology graph is found, if the edge connection exists, the connection attribute is kept unchanged, if the edge connection does not exist, a new connection edge is added in the industrial network topology graph, and the protocol type, communication frequency, function code abnormality mark and state change information in the visualization graph input data are attached;

[0116] After completing the mapping of all node coordinates and connection relationships, the path structure of the attack propagation chain in the industrial network topology graph is reconstructed according to the mapping result, and the spatial structure of the attack propagation chain is output.

[0117] S6.3, extracting the path starting node, abnormal jump path and victim node identification information from the spatial structure of the attack propagation chain, and generating the security linkage trigger instruction set.

[0118] Specifically, the path starting node identification information, the multi-dimensional label information of the nodes and edges involved in the abnormal jump path, and the victim node identification information are extracted from the spatial structure of the attack propagation chain; the path starting node, abnormal jump path and victim node are respectively coded with node identification, protocol type, communication frequency, function code abnormality mark and state change information to form a structured security linkage trigger instruction.

[0119] The structured security linkage trigger instruction set is combined according to the format, including instruction type, target node identification, time stamp and associated edge attribute; after completing the coding and organization of all related node and path information, the security linkage trigger instruction set is output.

[0120] S6.4, transmit the security linkage trigger instruction set to the linkage execution end to trigger real-time blocking, protection and early warning response.

[0121] Specifically, the security linkage trigger instruction set is sent to the linkage execution end through a communication link. After receiving the instruction, the linkage execution end parses the instruction content, identifies the target node identifier and the associated operation type respectively; according to the real-time blocking, protection and early warning response operation specified in the instruction, the corresponding network connection blocking operation, protection strategy start and early warning alarm generation are executed in turn; the operation state and response result are recorded during the execution process, the execution feedback of all instructions is completed, and the execution feedback information is returned to the security monitoring end.

[0122] The embodiment also provides a network attack path tracking system, comprising: a data processing module for collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure; a graph construction module for converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, generating an industrial network topology graph; a training and identification module for training a graph neural network model using the industrial network topology graph, identifying abnormal jump paths and attack chain segments, and generating a suspicious path set; a score calculation module for performing consistency calculation and weighted fusion on communication behavior, protocol call logic and physical state response in the suspicious path set, generating a credibility score vector; a path screening module for performing fusion calculation on the credibility score vector, selecting the path with the lowest credibility as the high-risk attack path, and combining time series, industrial network topology graph and abnormal jump path backtracking to reconstruct the attack path starting point, obtaining an attack propagation chain; a visualization module for displaying the attack propagation chain in the industrial network topology graph through a visual method and outputting to the industrial security linkage to trigger real-time blocking, protection and early warning response.

[0123] The embodiment also provides a computer device suitable for the network attack path tracking method based on the three-domain communication event structure, comprising: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the network attack path tracking method based on the three-domain communication event structure proposed in the above embodiment.

[0124] The computer device can be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved by WIFI, an operator network, NFC (Near Field Communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0125] The embodiment also provides a storage medium having a computer program stored thereon, the program being executed by a processor to implement the method for tracking a network attack path based on a three-domain communication event structure as described above. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic storage, a flash memory, a magnetic disk or an optical disk.

[0126] In summary, the present application achieves the fusion and unified expression of multi-source heterogeneous data by collecting and preprocessing original multi-source data and encoding the data into a three-domain communication event structure, breaks the data silos, and improves the integrity and consistency of the data. The three-domain communication event structure is converted into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph, which strengthens the semantic association and topological continuity of nodes and edges in the network, improves the expression ability of the model for complex interaction relationships, and thus effectively enhances the accuracy and robustness of subsequent attack path identification, and significantly improves the precision and efficiency of industrial network security situation awareness.

[0127] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced, without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A network attack path tracking method based on a three-domain communication event structure, characterized in that: The application relates to a method for detecting an attack path in an industrial network, and belongs to the field of industrial network security. The method comprises the following steps: Collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure, the specific steps being as follows: Collecting network communication traffic, industrial control protocol content and running state to form original multi-source data; Uniformly formatting the original multi-source data, aligning the time and filtering the abnormality, generating structured preprocessing data, and dividing the structured preprocessing data into a communication domain, a protocol domain and a state domain to form a three-domain communication event structure element; The three-domain communication event structure elements are sorted and numbered according to the event occurrence time to generate a three-domain communication event structure; The three-domain communication event structure is converted into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph, and the specific steps are as follows: Extracting the communication parties from the three-domain communication event structure as nodes, mapping the protocol type, communication frequency, abnormal function code mark and state change information into the multi-dimensional label of the edge, constructing and optimizing the heterogeneous graph structure, and generating an industrial network topology graph; Training a graph neural network model by using the industrial network topology graph to identify abnormal jump paths and attack chain segments, and generating a suspicious path set; Performing consistency calculation and weighted fusion on the communication behavior, protocol calling logic and physical state response in the suspicious path set to generate a credibility score vector; Fusing and calculating the credibility score vector, selecting the path with the lowest credibility as a high-risk attack path, and combining the time sequence, the industrial network topology graph and the abnormal jump path to backtrack and reconstruct the attack path starting point to obtain an attack propagation chain; 2. The network attack path tracking method based on a three-domain communication event structure of claim 1, wherein: The attack propagation chain is displayed in the industrial network topology graph in a visual manner and is output to an industrial security linkage to trigger real-time blocking, protection and early warning response. The specific steps of generating the suspicious path set are as follows: The industrial network topology graph is converted into a node feature matrix and an edge weight matrix, and the graph neural network model is iteratively trained until the loss converges to obtain the trained graph neural network model; 3. The network attack path tracking method based on a three-domain communication event structure of claim 1, wherein: The trained graph neural network model is used to reason the industrial network topology graph, extract complex nonlinear features, and identify abnormal jump paths and potential attack chain segments in the industrial network topology graph by using a path search method and an anomaly detection method to generate a suspicious path set. The specific steps of generating the credibility score vector are as follows: The communication behavior, protocol calling logic and physical state response involved in the suspicious path set are analyzed from the three-domain communication event structure, the corresponding function code sequence and parameter structure features are extracted, and the historical normal mode is matched to calculate the behavior consistency score, the logic consistency score and the state response consistency score; 4. The network attack path tracking method based on a three-domain communication event structure of claim 1, wherein: The behavior consistency score, the logic consistency score and the state response consistency score are weighted and fused and normalized to generate a multi-path credibility score vector. The specific steps of obtaining the attack propagation chain are as follows: The multi-path credibility score vector set is sorted in ascending order, the path with the lowest multi-path credibility score is extracted, and a high-risk attack path candidate set is constituted; Based on the communication node sequence and the time stamp information of the high-risk attack path candidate set, the event sequence in the path is rearranged to generate a time-consistent attack behavior chain. In the attack behavior chain, the industrial network topology graph is combined with the abnormal jump path, the first abnormal communication event is traced back, and the path source node is located; According to the path source node, the jump nodes in the high-risk attack path candidate set are traced back, and the path source node, the abnormal jump path and the candidate path endpoint are connected in order to obtain the attack propagation chain.

5. The network attack path tracking method based on a three-domain communication event structure of claim 1, wherein: The trigger real-time blocking, protection and early warning response, the specific steps are as follows, The attack propagation chain is structured and coded, and is converted into a graphical representation of network node coordinates, connection edge attributes and identification information, forming a visual graphical input data; Based on the industrial network topology graph, the visual graphical input data is mapped to the network node coordinates and connection relationship in the industrial network topology graph to obtain the spatial structure of the attack propagation chain; The path starting node, abnormal jump path and victim node identification information are extracted from the spatial structure of the attack propagation chain to generate a security linkage trigger instruction set; The security linkage trigger instruction set is transmitted to the linkage execution end to trigger real-time blocking, protection and early warning response.

6. The network attack path tracking system based on the three-domain communication event structure according to any one of claims 1 to 5, characterized in that: It includes, The data processing module is used for collecting and preprocessing original multi-source data, and coding into a three-domain communication event structure, and the specific steps are as follows, Collect network communication traffic, industrial control protocol content and running state to form original multi-source data; The original multi-source data is uniformly formatted, time-aligned and filtered to generate structured preprocessed data, and is divided into communication domain, protocol domain and state domain to form three-domain communication event structure elements; The three-domain communication event structure elements are sorted and numbered according to the event occurrence time to generate a three-domain communication event structure; The graph construction module is used for converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph, and the specific steps are as follows, The communication parties are extracted from the three-domain communication event structure as nodes, the protocol type, communication frequency, function code abnormal mark and state change information are mapped into the multi-dimensional label of the edge, the heterogeneous graph structure is constructed and optimized, and the industrial network topology graph is generated; The training and recognition module is used for training the graph neural network model using the industrial network topology graph to identify abnormal jump paths and attack chain segments to generate a suspicious path set; The score calculation module is used for consistency calculation and weighted fusion of communication behavior, protocol call logic and physical state response in the suspicious path set to generate a credibility score vector; The path screening module is used for fusion calculation of the credibility score vector, selects the path with the lowest credibility as the high-risk attack path, and combines the time sequence, industrial network topology graph and abnormal jump path to reconstruct the attack path starting point to obtain the attack propagation chain; The visualization module is used for displaying the attack propagation chain in the industrial network topology graph in a visualized manner and outputting to the industrial security linkage to trigger real-time blocking, protection and early warning response.

7. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that: The processor executes the computer program to realize the steps of the network attack path tracking method based on the three-domain communication event structure according to any one of claims 1-5.

8. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by a processor to realize the steps of the network attack path tracking method based on the three-domain communication event structure according to any one of claims 1-5.

Images