A network attack behavior prediction method and system based on attack tactic logic constraint and a storage medium

Abstract

The application provides a network attack behavior prediction method and system based on attack tactic logic constraint and a storage medium, and the method comprises the following steps: step 1: constructing a knowledge graph for network attack prediction based on network range data; the network range data comprises attack party and attacked party information, asset information, attack means, vulnerability information and attack scene information; step 2: for a link prediction task in the knowledge graph, a link prediction reasoning framework based on graph random walk is adopted to automatically and explainably mine attack links. The application has the beneficial effects that the knowledge graph constructed based on the network range introduces and integrates external threat intelligence and internal asset knowledge, meanwhile, all kinds of relations and security events are encoded in stages according to the ATT&CK technique and tactic framework, key knowledge bases for mining hidden attack links are provided, and the problem of low computational efficiency faced by traditional massive log traceability analysis is overcome.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more particularly to the fields of artificial intelligence technology such as knowledge graphs and attack chain mining. In particular, it relates to a method, system and storage medium for predicting network attack behavior based on attack tactical logic constraints. Background Technology

[0002] Modern cyberattacks, especially Advanced Persistent Threat (APT) attacks, are no longer single, simple intrusions, but rather exhibit characteristics of long-term, phased, and highly covert operations. Attackers employ complex tactics, techniques, and procedures (TTPs) to progressively achieve their ultimate goals through multiple phases (such as initial access, persistence, lateral movement, and data exfiltration). Traditional single-point security devices (such as firewalls and intrusion detection systems (IDS)) often only capture a fragment of the attack, making it difficult to reconstruct the complete attack flow.

[0003] Large organizations typically deploy dozens or even hundreds of security products and services, including endpoint detection and response (EDR), network detection and response (NDR), firewalls, and cloud security components. These systems generate massive amounts of heterogeneous security alerts and log data. Because the data is isolated from each other, forming "data silos," security analysts find it difficult to perform effective manual correlation and analysis. Furthermore, the vast majority of alerts generated by security devices are false alarms or low-priority alerts, causing genuine high-risk threats to be drowned out by noise, leading to "alert fatigue" within security teams and making them highly susceptible to overlooking critical clues.

[0004] Following a security incident, a complete and accurate reconstruction of the attack chain is crucial for conducting root cause analysis, assessing the scope of impact, and developing response and remediation measures. This process aims to answer key questions such as "Who is the attacker?", "From where did the intrusion originate?", "What operations were performed?", and "What data was stolen?"

[0005] Current mainstream attack chain mining methods can be broadly categorized into two types: rule-based mining and graph-based mining. Rule-based methods connect isolated alerts from different sources using predefined association rules. However, this method relies on prior knowledge, struggles to address novel threats, and has a high false positive rate. Methods based on causal dependency graphs (also known as source graphs) focus not only on the temporal sequence of events but also on the causal dependencies between them. By collecting full, fine-grained system audit logs, parsing them, and constructing a massive "system behavior dependency graph," consecutive attack phases can be reconstructed using forward or backward tracing. However, this method involves extremely large amounts of data, places extremely high demands on storage and computing performance, and relies on efficient graph algorithms and visualization techniques.

[0006] Building upon this foundation, methods based on threat intelligence and knowledge graphs, as well as methods based on machine learning and anomaly detection, have emerged. The former focuses on integrating external knowledge (such as IP reputation databases and attacker TTP descriptions) with internally constructed knowledge (such as enterprise asset information and vulnerability information) to construct a security knowledge graph. This allows for the integration of external intelligence to uncover more concealed and broader-ranging connections. The latter utilizes unsupervised or semi-supervised machine learning models to learn baselines of normal network and system behavior, thereby detecting anomalous behavioral sequences that deviate from the baseline and associating them as potential attack chains. This method has the potential to discover unknown and novel attack patterns, but it also suffers from poor interpretability. Summary of the Invention

[0007] To address the problems in existing technologies, this invention provides a method for predicting network attack behavior based on attack tactical logic constraints, comprising:

[0008] Step 1: Construct a knowledge graph for network attack prediction based on network range data; network range data includes information on attackers and victims, asset information, attack methods, vulnerability information, and attack scenario information.

[0009] Step 2: For the link prediction task in the knowledge graph in Step 1, a link prediction inference framework based on graph random walk is adopted to automatically and interpretably mine the attack links.

[0010] As a further improvement of the present invention, step 1 further includes:

[0011] The first step is to model an attack as a 5-tuple, including attacker, attack method, victim, attack stage, and scenario ID.

[0012] The second step is to integrate host asset information and asset-related vulnerability information into the constructed scenario knowledge graph, and further associate the attack techniques in the ATT&CK framework corresponding to the vulnerabilities, and model and analyze the attacker's behavior by combining multi-dimensional information.

[0013] As a further improvement of the present invention, the second step further includes:

[0014] Based on the attack method relationships in the quintuple data, a mapping is made with the ATT&CK technical and tactical framework to assign a unique ID to each attack method. At the same time, according to the sequence of the technical chain in the ATT&CK technical and tactical framework, the attack stage to which it belongs is determined, and continuous security events that occur under the constraint of attack relationships are judged as an attack chain.

[0015] In the second step, asset information relationships, vulnerability information relationships, and associated potential attack relationships are used as prior knowledge for other security events, and are uniformly assigned an attack phase code ID: 0 to distinguish them from dynamic attack behaviors.

[0016] As a further improvement of the present invention, in step 2, the link prediction reasoning framework based on graph random walk includes a rule learning module and a rule application module. The rule learning module is used to automatically mine potential attack behavior rules in the knowledge graph and generate an interpretable security behavior rule base. The rule application module is used to apply the rules generated by the rule learning module to downstream tasks, including link prediction and event risk assessment.

[0017] As a further improvement of the present invention, the rule learning module performs the following steps:

[0018] Step s1: Extract effective inference rules by performing random walks along the attack phase links in the knowledge graph. The execution method of the random walk in the knowledge graph is defined by formula (1), which is as follows:

[0019] (1),

[0020] in, , , , This represents the instantiated data in the dataset. This represents the set of edges of the rule body obtained when performing a random walk from the head entity of the rule head to the tail entity. Represents the head entity and the tail entity. This represents the relationship pattern between the head entity and the tail entity. For attacking the middle of the road The next entity found through a random walk. This indicates the attack phase ID corresponding to the event. This indicates a relationship within the ATT&CK framework. The corresponding attack phase, , , This represents the attack phase constraint of an edge during a random walk of a graph. For the rule header, The rule body, rule header, and rule body together constitute the connection between two identical variables. X and Y Two different paths, For constraints; and the meaning of a rule being true is: if the rule body in formula (1) is true under the attack chain constraint, then the rule head is in the stage c l+1It was also established in China;

[0021] During the random walk, the attack phase follows a non-decreasing order constraint;

[0022] Step s2: During the training phase, set the rule length for the random walk. L and number of walks N， Based on the relation data in the relation set, a random walk is performed on the knowledge graph, while all rules learned during the walk are saved. A confidence score is calculated for each rule, and this confidence score is used to quantify the rule. R The reliability of the rule confidence is determined and applied to subsequent rule reasoning processes. The formula for calculating rule confidence is as follows:

[0023] (2)

[0024] Among them, body support represents the number of instances that satisfy the rule body and meet the attack phase constraints, while rule support is the additional number of instances that satisfy the rule header on top of body support.

[0025] As a further improvement of the present invention, step s1 further includes:

[0026] Step s10: Randomly sample an edge of relation type and use it as the rule header;

[0027] Step s11: Iteratively sample the adjacent edges of the current object entity using a random walk until a length of [length missing] is obtained. l The walk path; the incremental random walk follows the ATT&CK tactical constraints, which only allow backward traversal or visits to neighboring nodes with the same attack phase; and defines the reverse relationship for each relationship, and generates new data by swapping the head and tail entities in the original data.

[0028] As a further improvement of the present invention, in the rule application module, the prediction task aims to predict possible target nodes in the potential attack phase. e 1, r h , ? , c l+1 That is, inferring future attack phases based on prior information provided by existing knowledge graphs. c l+1 The potential attack risks faced by different nodes in the network.

[0029] As a further improvement of the present invention, the rule application module performs the following steps:

[0030] Step a1: For each learned rule in the rule base, perform rule matching in the subgraph that satisfies the attack phase constraints;

[0031] Step a2: Retrieve the target entities instantiated by the rule body and give a comprehensive score to each target entity. The scoring mechanism includes scoring based on rule confidence and constraint scoring based on differences between attack phases.

[0032] As a further improvement of the present invention, step a2 further includes:

[0033] The steps for scoring rule confidence are as follows: For the target entity predicted in the dataset, the confidence of the predicted target entity is linearly weighted and scored based on the confidence of different rule bodies with the same rule head in the rule base;

[0034] Constraint scoring steps for differences between attack phases: Based on the phase differences of the ATT&CK technical and tactical framework, the predicted target entity is scored in the target entity prediction based on the exponential function of the difference between the query attack phase and the rule body attack phase.

[0035] The score fusion step involves fusing the scores of the rule confidence score and the constraint score of the difference between attack stages, calculating the final score of all candidate entities, and using this to complete the link prediction.

[0036] The present invention also discloses a network attack behavior prediction system based on attack tactical logic constraints, comprising: a memory, a processor, and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the method described in the present invention when invoked by the processor.

[0037] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0038] The beneficial effects of this invention are: 1. This invention, based on a knowledge graph constructed from a network test range, introduces and integrates external threat intelligence and internal asset knowledge. Simultaneously, it encodes various relationships and security events in stages according to the ATT&CK technical and tactical framework, thus providing a key knowledge foundation for uncovering covert attack chains. This method effectively overcomes the problem of low computational efficiency faced by traditional methods based on massive log source tracing analysis; 2. This invention can provide network security analysts with highly interpretable prediction results and demonstrates excellent predictive performance and practical value in practical applications. Attached Figure Description

[0039] Figure 1 This is a diagram of the inference model architecture of this invention;

[0040] Figure 2 This is a schematic diagram of the random walk based on attack phase constraints of the present invention (the part in parentheses represents the attack phase).

[0041] ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge, an open-source framework developed by MITRE. It can also be abbreviated as ATT&CK.

[0042] This invention integrates asset information, vulnerability information, and related attack information from various network target ranges to construct a knowledge graph for network attack prediction. For the link prediction task within the knowledge graph, a random walk strategy based on attack phases is proposed, along with an interpretable reasoning framework capable of extracting attack link rules.

[0043] This invention discloses a method for predicting network attack behavior based on attack tactical logic constraints, comprising:

[0044] Step 1: Construct a knowledge graph for network attack prediction based on network range data. Range attack data typically includes attacker and victim information, asset information, attack methods, vulnerability information, and attack scenario information. This invention models an attack as a five-tuple: (Attacker (head entity), Attack Method, Victim (tail entity), Attack Stage, Scenario ID). This model effectively represents security events in range attack and defense exercises and real network attack environments. Based on this, this invention integrates host asset information and asset-related vulnerability information into the constructed scenario knowledge graph, and further associates the attack techniques in the ATT&CK framework corresponding to the vulnerabilities, thereby comprehensively modeling and analyzing attacker behavior based on multi-dimensional information.

[0045] Table 1. Correspondence between partial relationships and attack phases

[0046]

[0047] To more effectively uncover continuous attack behaviors in network environments, this invention maps the "attack method" relationship in the five-tuple data to the ATT&CK tactical framework, assigning a unique ID to each attack method. Simultaneously, it determines the attack stage based on the sequence of the technology chains within the ATT&CK framework. As shown in Table 1, when processing relational data, a unique ID is assigned based on the attack method type, and further, an attack stage ID is assigned by referring to the corresponding technology in ATT&CK. For example, "collecting victim host information" corresponds to ATT&CK technology T1592, and "active scanning" corresponds to T1595; both belong to the "reconnaissance" tactical stage, and therefore are assigned the same attack stage ID: 1 in the dataset. Continuous security events occurring under attack relationship constraints will be identified as an attack chain. The knowledge graph construction method based on attack stage encoding can effectively characterize the continuous behavioral patterns of attackers in such complex network attacks.

[0048] Furthermore, asset information relationships (contain), vulnerability information relationships (affected), and related potential attack relationships (relatedattack), as prior knowledge of other security events, are uniformly assigned an attack stage code ID: 0 to distinguish them from dynamic attack behaviors. This dataset construction method provides a high-quality, structured knowledge foundation for attack chain mining and link prediction tasks.

[0049] Step 2: For the link prediction task in the knowledge graph in Step 1, a link prediction inference framework based on graph random walk is adopted to automatically and interpretably mine the attack links.

[0050] In step 2, the link prediction reasoning framework based on graph random walk includes a rule learning module and a rule application module. The rule learning module is used to automatically mine potential attack behavior rules in the knowledge graph and generate an interpretable security behavior rule base. The rule application module is used to apply the rules generated by the rule learning module to downstream tasks, including link prediction and event risk assessment.

[0051] The link prediction inference framework based on graph random walks proposed in this invention is as follows: Figure 1 As shown, the rule learning module also includes: Step s1: First, a random walk is performed along the attack phase link in the knowledge graph to extract effective reasoning rules. The execution method of the random walk in the knowledge graph is defined by formula (1), as follows:

[0052] (1),

[0053] in, Represents the head entity and the tail entity. Indicates the attack phase ID corresponding to this event. This represents the relationship pattern between the head entity and the tail entity. For attacking the middle of the road The next entity found through a random walk. , , , This represents the instantiated data in the dataset. This indicates a relationship within the ATT&CK framework. The corresponding attack phase, such as a computer scanning certain data, belongs to the reconnaissance phase under the ATT&CK tactic. , , These represent the attack phase to which an edge belongs during a random walk of the graph, and they represent the attack phase constraints of the walking edge. The left side of equation (1) For the rule header, on the right side The rule body, rule header, and rule body together constitute the connection between two identical variables. X and Y Two different paths; This represents the set of edges of the rule body obtained when performing a random walk from the head entity of the rule head to the tail entity. Constraints. This indicates that when a random walk of a graph is performed within a rule body, the corresponding attack phase should satisfy the logical constraint of an increasing relationship. The meaning of a valid rule is: if the rule body in formula (1) is valid under the attack chain constraint, then the rule head is in phase... c l+1 It was also established in China;

[0054] Step s1 also includes:

[0055] Step s10: Randomly sample a relation of type edge Use it as the rule header, where , It belongs to An instance of an entity, that is, a head entity and a tail entity of a rule head randomly sampled, finds another path in the graph during a random walk that forms a closed loop with the rule head. This can be considered a valid reasoning path, that is, a rule body. In this way, reasoning can be performed based on these rule bases.

[0056] Step s11: Subsequently, as Figure 2 As shown, a random walk iteratively samples the adjacent edges of the current object entity until a length of [value missing] is obtained. lThe walk path can be understood as follows: each walk involves the head entity moving to the tail entity via an edge, and then moving to the next entity via the tail entity. Due to the walk, the current tail entity becomes the head entity of the next walk edge. This entity, which connects the preceding and following steps, is the object entity. This incremental random walk follows the ATT&CK tactical constraints, which only allow backward traversal or visits to neighboring nodes with the same attack phase. "Incremental" refers to the principle of adhering to attack constraints. The attack phases are progressively increasing. "Walking" refers to iteratively sampling the adjacent edges of the current object entity using a random walker until a line of length [length missing] is obtained. l The invention defines a reverse relationship for each relation and generates new data by swapping the head and tail entities in the original data to achieve bidirectional traversal capability when sampling neighbor edges. Figure 2 The word "Contain" in a knowledge graph means to contain or include certain assets (software, systems, etc.) contained in a host (entity). "Affected" indicates what kind of vulnerabilities exist in a certain software, system, host, etc., and what impact they have.

[0057] like Figure 2 As shown, there are two different paths from IP1 to IP5, corresponding to the rule header and rule body in formula (1), respectively. This mechanism can provide key evidence support for subsequent link reasoning tasks. During the random walk, the attack phase follows a non-decreasing order constraint. As shown in the figure, when a random walk starts from IP3, its "active scanning" behavior towards IP6 is ignored. This is because the present invention assumes that in a complete attack link, the tactical steps must maintain an increasing order, thereby ensuring that the attack path conforms to the actual evolution logic.

[0058] Step s2: During the training phase, first set the rule length for the random walk. L and number of walks N Based on the various relation data in the relation set, a random walk is performed on the knowledge graph, while all rules learned during the walk are saved. Then, a confidence score is calculated for each rule, which is used to quantify the rule. R The reliability of the rule confidence is assessed and applied to subsequent rule reasoning processes. The formula for calculating rule confidence is as follows:

[0059] (2),

[0060] Among them, body support represents the number of instances that satisfy the rule body and meet the attack phase constraints, while rule support is the additional number of instances that satisfy the rule header on top of body support.

[0061] During the rule application phase, this framework serves the link prediction task. Specifically, this task aims to predict potential target nodes during the potential attack phase. e 1, r h , ? , c l+1 That is, inferring future attack phases based on prior information provided by existing knowledge graphs. The attack risks that different nodes in the network may face; the question mark (?) means that when performing link prediction tasks, there are usually missing / unpredictable head or tail entities. For example, in the next stage of reconnaissance, host A may take action B to attack host A. Here, the question mark (?) represents the target entity to be predicted.

[0062] The rules application module operates as follows:

[0063] Step a1: For each learned rule in the rule base, perform rule matching in the subgraph that satisfies the attack phase constraints.

[0064] Step a2: Retrieve targets instantiated from the rule body and assign a comprehensive score to each target entity. The scoring mechanism consists of two parts: the first part scores based on rule confidence, and the second part introduces a constraint score based on the differences between attack phases. The specific steps are as follows:

[0065] The steps for scoring rule confidence are as follows: First, for the target entities predicted in the dataset, the confidence scores of the predicted target entities are linearly weighted based on the confidence scores of different rule bodies with the same rule head in the rule base.

[0066] Constraint scoring steps for differences between attack phases: Secondly, based on the phase differences of the ATT&CK technical and tactical framework, the predicted target entity is scored according to the exponential function of the difference between the attack phase of the query and the attack phase of the rule body in the target entity prediction. Events that are closer and more closely related to each other between attack phases should have higher weight in the target entity prediction.

[0067] Score fusion step: Finally, by fusing the two scores, namely the score of rule confidence and the score of constraint score of difference between attack stages, the final score of all candidate entities is calculated, and the link prediction is completed accordingly.

[0068] The rule base built during the rule learning phase provides interpretability support for the results of link prediction tasks. Prediction results can be backtracked and verified based on rules of different confidence levels in the rule base, thereby enhancing the transparency and credibility of the inference process. Furthermore, because the dataset incorporates the coverage relationship between attack methods and internal information during the modeling process, this invention can extract high-confidence attack chains from the learned rules. This mechanism helps cybersecurity analysts conduct rule-based attribution and in-depth analysis of potential attack behaviors.

[0069] Innovation of this invention:

[0070] 1. This invention addresses network attack analysis scenarios and innovatively proposes modeling the potential sequential relationships in network security events from the perspective of attack phases. By correlating this model with the ATT&CK (Attack, Trial, and Criterion) framework, it establishes explicit phased relationships between multiple security events in a dataset. This is the first time that the attack phase sequence has been introduced as a core dimension into the construction of a knowledge graph. Therefore, this invention seeks protection for this innovative approach of applying phased modeling to event sequences in knowledge graphs. Its applicability is not limited to network security but also includes other data domains with temporal and phased logic, such as medicine and finance.

[0071] 2. Based on the constructed attack phase knowledge graph, this invention further proposes a method for attack link mining and prediction under attack phase constraints. This method combines graph random walks and phase semantic constraints to achieve automated and interpretable mining of complex attack links. This is also the first study on attack behavior link mining based on knowledge graphs and phase constraints. Therefore, this invention claims protection for the knowledge graph link mining method based on graph random walks and attack phase constraints, and its related applications.

[0072] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for predicting network attack behavior based on attack tactical logic constraints, characterized in that, include: Step 1: Construct a knowledge graph for network attack prediction based on network range data; network range data includes information on attackers and victims, asset information, attack methods, vulnerability information, and attack scenario information. Step 2: For the link prediction task in the knowledge graph in Step 1, a link prediction reasoning framework based on graph random walk is adopted to automatically and interpretably mine the attack links. Step 1 also includes: The first step is to model an attack as a 5-tuple, including attacker, attack method, victim, attack stage, and scenario ID. The second step is to integrate the host's asset information and asset-related vulnerability information into the constructed scenario knowledge graph, and further associate the attack techniques in the ATT&CK framework corresponding to the vulnerabilities, and model and analyze the attacker's behavior by combining multi-dimensional information. In step 2, the link prediction reasoning framework based on graph random walk includes a rule learning module and a rule application module. The rule learning module is used to automatically mine potential attack behavior rules in the knowledge graph and generate an interpretable security behavior rule library. The rule application module is used to apply the rules generated by the rule learning module to downstream tasks, including link prediction and event risk assessment. The rule learning module operates under the following steps: Step s1: Extract valid inference rules by performing random walks along the attack phase links in the knowledge graph; Step s1 further includes: Step s10: Randomly sample an edge of relation type and use it as the rule header; Step s11: Iteratively sample the adjacent edges of the current object entity using a random walk until a length of [length missing] is obtained. l The walk path; the incremental random walk follows the ATT&CK tactical constraints, that is, it only allows backward traversal or visits to neighbor nodes with the same attack phase; and defines its reverse relationship for each relationship, and generates new data by swapping the head entity and tail entity in the original data.

2. The network attack behavior prediction method according to claim 1, characterized in that, The second step also includes: Based on the attack method relationships in the quintuple data, a mapping is made with the ATT&CK technical and tactical framework to assign a unique ID to each attack method. At the same time, according to the sequence of the technical chain in the ATT&CK technical and tactical framework, the attack stage to which it belongs is determined, and continuous security events that occur under the constraint of attack relationships are judged as an attack chain. In the second step, asset information relationships, vulnerability information relationships, and associated potential attack relationships are used as prior knowledge for other security events, and are uniformly assigned an attack phase code ID: 0 to distinguish them from dynamic attack behaviors.

3. The network attack behavior prediction method according to claim 1, characterized in that, The execution method of random walk in the knowledge graph is defined by formula (1), which is as follows: （1）, in, , , , This represents the instantiated data in the dataset. This represents the set of edges of the rule body obtained when performing a random walk from the head entity of the rule head to the tail entity. Representing the head entity and the tail entity, This represents the relationship pattern between the head entity and the tail entity. For attacking the middle of the road The next entity found through a random walk. This indicates the attack phase ID corresponding to the event. This indicates a relationship within the ATT&CK framework. The corresponding attack phase, , , This represents the attack phase constraint of an edge during a random walk of a graph. For the rule header, The rule body, rule header, and rule body together constitute the connection between two identical variables. X and Y Two different paths, For constraints; and the meaning of a rule being true is: if the rule body in formula (1) is true under the attack chain constraint, then the rule head is in the stage c l+1 It was also established in China; During the random walk, the attack phase follows a non-decreasing order constraint; The rule learning module also performs the following steps: Step s2: During the training phase, set the rule length for the random walk. L and number of walks N， Based on the relation data in the relation set, a random walk is performed on the knowledge graph, while all rules learned during the walk are saved. A confidence score is calculated for each rule, and this confidence score is used to quantify the rule. R The reliability of the rule confidence is determined and applied to subsequent rule reasoning processes. The formula for calculating rule confidence is as follows: （2） Among them, body support represents the number of instances that satisfy the rule body and meet the attack phase constraints, while rule support is the additional number of instances that satisfy the rule header on top of body support.

4. The network attack behavior prediction method according to claim 3, characterized in that, In the rule application module, the prediction task aims to predict possible target nodes during the potential attack phase. e 1, r h , ? , c l+1 That is, inferring future attack phases based on prior information provided by existing knowledge graphs. c l+1 The attack risks that different nodes in the network may face, represented by ?, indicate the target entity to be predicted.

5. The network attack behavior prediction method according to claim 4, characterized in that, The rule application module performs the following steps: Step a1: For each learned rule in the rule base, perform rule matching in the subgraph that satisfies the attack phase constraints; Step a2: Retrieve the target entities instantiated by the rule body and give a comprehensive score to each target entity. The scoring mechanism includes scoring based on rule confidence and constraint scoring based on differences between attack phases.

6. The network attack behavior prediction method according to claim 5, characterized in that, Step a2 further includes: The steps for scoring rule confidence are as follows: For the target entity predicted in the dataset, the confidence of the predicted target entity is linearly weighted and scored based on the confidence of different rule bodies with the same rule head in the rule base; Constraint scoring steps for differences between attack phases: Based on the phase differences of the ATT&CK tactical framework, the predicted target entity is scored in the target entity prediction based on the exponential function of the difference between the query attack phase and the rule body attack phase. The score fusion step involves fusing the scores of the rule confidence score and the constraint score of the difference between attack stages, calculating the final score of all candidate entities, and using this to complete the link prediction.

7. A network attack behavior prediction system based on attack tactical logic constraints, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-6 when invoked by the processor.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-6 when invoked by a processor.

Images