A network security threat research and judgment method based on abnormal risk prediction

Abstract

The application discloses a network security threat research and judgment method based on abnormal risk prediction, comprising: modeling the space-time correlation of abnormal behaviors to obtain an abnormal group with correlation of abnormal behaviors; calculating the matching score of the abnormal group and a preset behavior knowledge graph, the risk influence score of the abnormal group on key system assets, and the intention comprehensive score of the abnormal group, and comparing with a first threshold value, if greater than the first threshold value, marking the abnormal group; calculating the attack prediction score corresponding to the marked abnormal group, and comparing with a second threshold value, if greater than the second threshold value, the marked abnormal group is determined to have an attack intention; connecting a plurality of abnormal groups determined to have an attack intention into an attack chain, calculating the credibility of the attack chain, and comparing with a third threshold value, if greater than the third threshold value, confirming that the attack chain has potential attack behaviors, triggering early warning and response. The application can accurately identify complex attacks.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology, specifically relating to a method for assessing cybersecurity threats based on anomaly risk prediction. Background Technology

[0002] In the field of cyberspace security, cyberattack methods are becoming increasingly complex, with Advanced Persistent Threats (APTs) being a prime example. Attackers gradually breach defense systems through multi-stage, long-term penetration tactics, combined with techniques such as zero-day exploits. Typical characteristics of APT attacks include the discreteness of their spatiotemporal distribution (attack behaviors are not continuous in time and are distributed across spatial domains) and the concealment of their intent (attack steps are logically related but appear as isolated events), making traditional methods based on single-point anomaly detection or static rule matching difficult to effectively identify them.

[0003] Spatiotemporal correlation analysis is an important research direction in the field of network security detection. Its core lies in mining the potential correlations between discrete events in time series and topological space. Existing methods typically use graph models or finite state machines to model behavioral sequences, but when dealing with large-scale, high-dimensional log data, they face problems such as insufficient dynamic evolution modeling and low efficiency in fusing multi-source heterogeneous data. In addition, predicting anomalous behavior intent requires inferring potential targets by combining attacker behavior patterns, but traditional methods mostly rely on prior knowledge bases or fixed threat indicators (IoC), lacking the ability to dynamically extrapolate attack paths and quantitatively assess harm, resulting in a significant lag in early prediction of multi-stage attacks.

[0004] Currently, attack prediction technologies mainly fall into two categories: one is detection based on behavioral feature matching (such as signature-based IDS), which is limited by its inability to handle unknown attack patterns; the other is anomaly detection based on machine learning, which, while able to detect deviations from baseline behavior, often overlooks the causal logic between attack steps, resulting in a high false positive rate and difficulty in interpreting attack intent. Therefore, how to construct a detection framework that takes into account spatiotemporal correlation, intent reasoning ability, and real-time performance has become a key challenge in improving the accuracy of complex attack identification. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention provides a method for assessing cybersecurity threats based on anomaly risk prediction. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] This invention provides a method for assessing cybersecurity threats based on anomaly risk prediction, comprising:

[0007] A comprehensive spatiotemporal proximity measurement method is used to model the spatiotemporal correlation of abnormal behaviors, resulting in anomalous groups with correlation of abnormal behaviors. For each anomalous group, time, space and behavior attributes are extracted to construct a unified feature representation of abnormal behaviors.

[0008] Calculate the matching score between the abnormal group and the preset behavioral knowledge graph, and calculate the risk impact score of the abnormal group on key system assets; based on the matching score and the risk impact score, calculate the comprehensive intent score of the abnormal group, and compare it with the first threshold. If it is greater than the first threshold, then mark the abnormal group.

[0009] Calculate the attack prediction score corresponding to the marked abnormal group and compare it with the second threshold. If it is greater than the second threshold, the marked abnormal group is judged to have attack intent. Based on the criteria of temporal coherence, spatial coherence and reasonable intent stage, multiple abnormal groups judged to have attack intent are linked together to form an attack chain. Calculate the credibility of the attack chain and compare it with the third threshold. If it is greater than the third threshold, it is confirmed that the attack chain has potential attack behavior, triggering an early warning and response.

[0010] The beneficial effects of this invention are:

[0011] First, risk aggregation and dynamic evolution modeling for distributed anomalies. Addressing the insufficient aggregation capabilities of existing technologies when handling cross-node and cross-time anomalies, this invention proposes a dynamic clustering method for anomalies based on risk proximity metrics. This method introduces an "entity-time-behavior" triple modeling approach, combining the occurrence sequence of behaviors, resource location, and functional association to measure the risk adjacency between behaviors. Through a risk correlation-driven clustering mechanism, discretely distributed anomalies are automatically aggregated into candidate high-risk behavior groups.

[0012] This method can not only effectively restore the inherent logical relationship between isolated fragmented anomalies, but also support incremental data updates and online evolution modeling. It can adapt to the dynamic changes in abnormal behavior patterns and provide a stable structural foundation for subsequent risk trend assessment and attack intent reasoning.

[0013] Second, an anomaly impact assessment mechanism based on risk path analysis. Addressing the lack of quantitative analysis capabilities in existing detection systems regarding the evolution trends and potential impact of anomalous behavior, this invention proposes an anomaly risk impact assessment method that integrates behavior graph matching and critical asset weight assessment. This method constructs dynamic behavior association chains, combining historical attack behavior knowledge graphs with the current system resource topology, to systematically analyze the sensitive resources, affected functional domains, and potential damage scope that anomalous behavior groups may reach.

[0014] In the risk assessment process, a multi-factor dynamic weighting mechanism based on access permissions, resource sensitivity levels, and contextual interaction strength is further introduced to generate a comprehensive intent score for the threat level of abnormal behavior. Compared with the static CVSS scoring model, this invention can dynamically adjust the scoring parameters according to the environmental state, accurately characterize the true risk level of abnormal behavior, and significantly improve the foresight and business awareness capabilities of threat analysis.

[0015] Third, an attack prediction and identification mechanism based on behavioral intent. Addressing the issue of traditional IDS relying on fixed feature libraries and insufficient logical coherence in machine learning models, this invention proposes a dynamic attack chain construction rule. This mechanism overcomes the problem of insufficient logical coherence between traditional IDS and machine learning models; it also utilizes a dynamic expansion mechanism to support the real-time fusion of new anomaly groups, ensuring continuous tracking of the attack chain and solving the problem of delayed response to unknown attack combinations in existing technologies.

[0016] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] Figure 1 This is a flowchart of a network security threat assessment method based on anomaly risk prediction provided in an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of a spatiotemporal correlation clustering method for abnormal behavior provided in an embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of an abnormal group behavior intent prediction method provided in an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of an attack prediction and chain construction method based on knowledge reasoning provided in an embodiment of the present invention. Detailed Implementation

[0021] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0022] Currently, attack analysis techniques are broadly based on two models: rule-based pattern matching detection and machine learning-based anomaly detection. Specific solutions are detailed below:

[0023] First, rule-based pattern matching detection.

[0024] Rule-based pattern matching detection uses rules, feature templates, or behavioral thresholds to identify attacks. This method primarily relies on expert experience or predefined rules to determine the anomalies of attack activity. By utilizing a predefined attack feature library to match known attack patterns, this method relies on expert experience and pattern extraction from historical attack data, offering strong interpretability and intuitiveness, but exhibiting significant limitations when facing unknown attacks.

[0025] Second, anomaly detection based on machine learning.

[0026] Machine learning-based anomaly detection methods achieve efficient threat identification by learning potential attack patterns and behavioral characteristics from source maps. The core process typically includes three stages: source map construction, feature modeling, and anomaly analysis. It can more effectively identify locations and complex attack paths, and has greater flexibility and adaptability, but it has high requirements for computing resources and data volume.

[0027] Existing attack detection and behavior analysis technologies still face several core challenges when dealing with distributed, highly concealed, and complex evolving anomalous behaviors:

[0028] First, the distributed system lacks a unified risk aggregation capability for distributed anomaly behaviors. Most current mainstream detection systems are based on static analysis of single-point features, neglecting the potential sequential logic and target coupling between multiple anomalies. Due to the lack of a global perspective for integrated modeling of anomaly risks, it is difficult to analyze suspicious behaviors distributed across different nodes, time periods, and functional domains in a chain, thus hindering the complete identification and reconstruction of multi-stage attack activities.

[0029] Second, there is a lack of analytical mechanisms for the impact trends and intentions of abnormal behavior. Existing methods generally lack the ability to model the subsequent evolution path of abnormal behavior, and cannot effectively analyze the key resources that the behavior may reach, the functional modules it may affect, and the system entities it may impact. This static approach results in a delayed security response, making it impossible to identify potential impacts before the attack occurs, thus missing the window for intervention and limiting the system's proactive defense capabilities.

[0030] Third, the attack intent analysis and prediction mechanisms are weak, lacking dynamic evaluation capabilities. Traditional detection methods are mainly based on known rules or feature libraries. Faced with unknown threats or combined attacks, they often cannot infer the attacker's true intent through behavioral sequences and contextual relationships. Without a deep understanding of behavioral intent, the system struggles to accurately determine whether abnormal behavior constitutes an attack, and it is also difficult to issue timely, high-confidence warnings and take appropriate actions.

[0031] In summary, existing methods have significant shortcomings in risk integration, trend analysis, and intent reasoning of anomalous behavior, making it difficult to meet the current network security system's requirements for high-precision, high-real-time, and high-adaptive attack detection.

[0032] In view of this, the present invention provides a network security threat assessment method based on anomaly risk prediction. By performing multi-dimensional correlation modeling, behavioral trend prediction and intent reasoning on anomaly data, the method improves the key defects in anomaly analysis and attack assessment, and achieves more efficient and accurate attack identification and early warning capabilities.

[0033] The technical solution of this invention includes spatiotemporal correlation clustering of abnormal behavior, behavioral intent prediction based on spatiotemporal chains, and attack prediction and identification based on intent reasoning, and on this basis, attack chain construction and early warning generation are carried out. The specific implementation process consists of three main steps: abnormal spatiotemporal aggregation and correlation modeling, abnormal group behavioral intent analysis and impact prediction, and attack prediction and chain identification based on behavioral intent.

[0034] Please see Figure 1 , Figure 1 This is a flowchart of a network security threat assessment method based on anomaly risk prediction provided by an embodiment of the present invention. The network security threat assessment method based on anomaly risk prediction provided by the present invention includes:

[0035] S101. Using a comprehensive spatiotemporal proximity measurement method, the spatiotemporal correlation of abnormal behavior is modeled to obtain abnormal groups with correlation of abnormal behavior; for each abnormal group, time, space and behavior attributes are extracted to construct a unified feature representation of abnormal behavior.

[0036] Specifically, this embodiment breaks through the traditional isolated modeling method centered on single-point anomalies in detection and constructs an aggregation mechanism oriented towards event risk characteristics. By calculating the synergy between anomalous behaviors in time, topology, and resource domains, it identifies potentially related events, automatically divides high-risk behavior groups, and provides clear data support for subsequent attack intent reasoning and response.

[0037] To effectively address the fragmentation and isolation of anomalous behaviors in distributed, multi-stage attacks, a method for anomalous behavior aggregation and modeling based on spatiotemporal correlation is proposed. This method extracts the temporal, spatial, and behavioral attribute features of anomalous behaviors to construct a unified representation of anomalous behavior features, and automatically clusters anomalous events based on a comprehensive spatiotemporal proximity metric, thereby realizing anomalous grouping (…). The efficient identification of ( ) provides an accurate data foundation for subsequent prediction of abnormal behavior intentions and attack prediction.

[0038] In this embodiment, each abnormal behavior record can be abstracted into a triple, represented as follows:

[0039] ;

[0040] ;

[0041] in, Indicates abnormal behavior The timestamp of the occurrence Indicates abnormal behavior The spatial location information it belongs to (such as IP address, network topology node, physical coordinates, etc.). Indicates abnormal behavior The attributes and characteristics (such as behavior type, degree of abnormality, etc.) Indicates abnormal behavior The timestamp of the occurrence Indicates abnormal behavior Spatial location information, Indicates abnormal behavior The attributes and characteristics.

[0042] To characterize any two abnormal behaviors and The proximity between them is defined by a comprehensive spatiotemporal proximity metric function. It is composed of a weighted combination of temporal and spatial distances, and is represented as:

[0043] ;

[0044] in, Indicates abnormal behavior and abnormal behavior Proximity between them Indicates abnormal behavior and abnormal behavior Standardized time difference Indicates abnormal behavior and abnormal behavior Standardized spatial distance The parameter represents the weight that controls the effect of time. The parameter represents the control space's influence on the weights. .

[0045] Specifically, time distance can be defined as:

[0046] ;

[0047] in, This represents the normalization factor for time standardization. Here, it can be the observation window length, meaning that the time distance is normalized using the observation window length.

[0048] Specifically, spatial distance can be defined differently depending on the actual scenario. For example, in the context of IP addresses, hash mapping distance can be used, while in the context of physical coordinates, Euclidean distance can be used. Abstractly represented as:

[0049] ;

[0050] in, This represents a function used to calculate the distance between two objects. Optionally, the spatial distance can be selected as hash map distance (IP environment) or Euclidean distance (physical coordinates) depending on the scenario.

[0051] To address the issue that existing single-dimensional (temporal or spatial) clustering methods cannot simultaneously capture the temporal and spatial correlation features of anomalous behaviors, this embodiment proposes a comprehensive spatiotemporal proximity metric function that combines temporal distance and spatial distance. This function can accurately identify cross-spatial and spatiotemporal distribution of anomalous behavior correlations while ensuring computational efficiency.

[0052] like Figure 2 As shown, Figure 2 This is a schematic diagram of a spatiotemporal correlation clustering method for abnormal behaviors provided in an embodiment of the present invention. After obtaining the comprehensive proximity between all pairs of abnormal behaviors, a density-based clustering algorithm is used to automatically cluster the abnormal behaviors. During the clustering process, when the proximity between any two abnormal behaviors is less than a threshold... If the two abnormal behaviors are then classified as belonging to the same abnormal group, the expression is as follows:

[0053] ;

[0054] in, This indicates the same group. It should be noted that the threshold can be dynamically adjusted. To adapt to abnormal distribution densities in different network environments.

[0055] By using the aforementioned spatiotemporal proximity measurement and automatic clustering method, the originally scattered and isolated abnormal behaviors are effectively divided into multiple related abnormal groups. It serves as the basic analytical unit for subsequent behavioral intent prediction and attack prediction and identification.

[0056] For each abnormal group The following feature vectors can be extracted:

[0057] 1. Time characteristics (such as earliest time of anomaly, duration of anomaly);

[0058] 2. Spatial characteristics (such as the number of nodes involved and the network topology span);

[0059] 3. Behavioral characteristics (such as distribution of exception types and operation permission levels);

[0060] These features serve as the basis for subsequent pattern matching and risk assessment.

[0061] like Figure 2 As shown, by extracting the temporal, spatial, and behavioral attribute features of abnormal behavior, a unified representation of abnormal behavior features is constructed, and abnormal events are automatically clustered based on a comprehensive spatiotemporal proximity metric, thereby achieving efficient identification of abnormal groups.

[0062] S102. Calculate the matching score between the abnormal group and the preset behavioral knowledge graph, and calculate the risk impact score of the abnormal group on key system assets; based on the matching score and the risk impact score, calculate the comprehensive intent score of the abnormal group, and compare it with the first threshold. If it is greater than the first threshold, then mark the abnormal group.

[0063] Specifically, in this embodiment, based on the initial merging of abnormal behavior groups, the present invention proposes a risk trend analysis method oriented towards behavior sequences. By combining historical attack trajectories, system topology and resource dependencies, it assesses the key entities that abnormal behaviors may reach, the functional paths that are affected, and the potential scope of damage, providing a basis for early blocking.

[0064] After completing the spatiotemporal aggregation of abnormal behaviors, for each abnormal group This embodiment proposes a behavioral intent analysis method that combines attack pattern graph matching and system asset risk assessment. This method aims to infer the attack targets that anomaly groups may form and their potential impact range, thereby supporting subsequent attack prediction and chain identification.

[0065] Considering that complex attacks have a phased development characteristic, anomaly groups After initial aggregation, accurate intent inference may not be possible due to insufficient information. Therefore, this embodiment designs a dynamic maintenance and incremental update mechanism for abnormal groups. For abnormal groups that cannot currently complete intent inference, the system will retain their state and continue to monitor them. Once new abnormal behaviors are added to the group, the intent analysis process will be retried, thereby adapting to the gradual evolution of attack behaviors.

[0066] Please see Figure 3 , Figure 3 This is a schematic diagram of an abnormal group behavior intent prediction method provided in an embodiment of the present invention. This embodiment constructs a behavior knowledge graph G based on system knowledge using historical system operation data, and incorporates expert knowledge as a supplement, including typical business behavior nodes and their sequential logic. For abnormal groups... Calculate its matching score with the behavioral knowledge graph G to assess the consistency between abnormal behavior and normal business processes.

[0067] Specifically, the matching score between the anomaly group and the preset behavioral knowledge graph is calculated and expressed as:

[0068] ;

[0069] in, This indicates the similarity of the characteristics of nodes in the abnormal group. Indicates the logical similarity of the sequence of abnormal behaviors. and These represent the weight parameters, .

[0070] Furthermore, to assess the potential threat of anomalous behavior to critical system assets, an asset risk impact analysis mechanism is introduced, defining anomalous groups. For assets The risk impact score is:

[0071] ;

[0072] in, This indicates the sensitivity level of critical system assets (such as confidentiality, integrity, and availability requirements). This indicates the permission level of the exception group involved in operations on critical system assets. This indicates the extent to which the abnormal group consumes or occupies critical system assets and resources. , and They represent the weighting coefficients, .

[0073] Finally, by combining the behavioral matching score and the asset risk score, the overall intent score of the abnormal group is calculated. , represented as:

[0074] ;

[0075] in, and This represents the combined weight of pattern matching and risk assessment.

[0076] This indicates that the maximum value is taken for matching all candidate behaviors with the asset impact, in order to highlight the most severe risk.

[0077] Based on the overall intent score, a first threshold is set. Determine whether the abnormal group has a clear attack intent:

[0078] if If the inference is successful, the process proceeds to the subsequent attack chain identification and early warning stage, and the abnormal group is marked.

[0079] if If any abnormal behavior is found, the abnormal group will be temporarily stored and re-analyzed after new abnormal behaviors are added, and then designated as an abnormal group to be marked.

[0080] Existing methods based on rule matching or machine learning models lack the ability to systematically reason about behavioral intent. This embodiment innovatively combines behavioral knowledge graph matching with asset risk assessment, quantifying the potential harm of abnormal behavior through a comprehensive intent score. The knowledge graph contains attack patterns extracted from expert experience, while the asset risk assessment dynamically calculates the impact of abnormal behavior on critical resources. This dual verification mechanism reduces false positives while maintaining accuracy, and provides early warnings even when attacks actually cause harm.

[0081] S103. Calculate the attack prediction score corresponding to the marked abnormal group and compare it with the second threshold. If it is greater than the second threshold, the marked abnormal group is judged to have attack intent. Based on the criteria of temporal continuity, spatial continuity and reasonableness of intent stage, connect multiple abnormal groups judged to have attack intent into an attack chain, calculate the credibility of the attack chain and compare it with the third threshold. If it is greater than the third threshold, it is confirmed that the attack chain has potential attack behavior, and triggers warning and response.

[0082] Specifically, in this embodiment, based on the prediction of behavioral trends and the scope of impact, the present invention further proposes an attack prediction and identification method based on behavioral intent. By reasoning about the goal-oriented characteristics reflected in the future development path of the behavior, it determines whether the behavior possesses attack intent; if its intent targets sensitive system resources or destructive objectives, it further combines the time-series characteristics of the behavior, the affected objects, and the possible consequences to identify potential attack chains. This mechanism achieves a progressive identification from behavioral intent to attack intent, which can improve the system's ability to detect unknown attacks and its response timeliness.

[0083] Please see Figure 4 , Figure 4 This is a schematic diagram of an attack prediction and chain construction method based on knowledge reasoning provided in an embodiment of the present invention. It utilizes knowledge reasoning to dynamically infer whether there are potential attack intentions within anomaly groups, considering the interactions, behavioral sequences, and system dependencies among multiple anomaly groups to infer the anomaly groups. Does it conform to the evolutionary pattern of the attack chain, and is a dynamic update strategy used to maintain the scalability of the attack chain?

[0084] Specifically, the temporal development trend of each anomaly group is calculated based on temporal reasoning methods (e.g., Markov chains) and graph reasoning methods (e.g., Bayesian networks), and the attack prediction score of the reasoning is calculated. And set a second threshold. Attack prediction is made based on the reasoning results. The attack prediction rules are expressed as follows:

[0085] ;

[0086] in, The attack prediction score calculated by the network inference model represents the anomaly group. Does it conform to the reasoning pattern of a potential attack? This indicates the preset attack detection threshold.

[0087] if Then the abnormal group If deemed to have malicious intent, the attack chain construction phase begins; if If the attack chain is not constructed, the anomaly group will enter observation mode and await further updates.

[0088] Furthermore, for all anomalous groups initially identified as having malicious intent, a chain is constructed according to the following rules:

[0089] 1. Temporal continuity: The time sequence of the abnormal groups conforms to the evolution logic of the attack behavior, that is, the time difference between the abnormal groups does not exceed the set window.

[0090] 2. Spatial coherence: The spatial locations involved in the anomaly group have topological adjacency or network access correlation.

[0091] 3. Reasonableness of the intent phase: The inferred intent corresponding to different anomaly groups conforms to the sequence of typical attack phases (such as reconnaissance, infiltration, control, expansion, etc.).

[0092] To further evaluate the credibility of the attack chain and prevent misidentification or overexpansion, a chain credibility score is introduced. The definition is as follows:

[0093] ;

[0094] in, Indicates the number of anomalous groups in the attack chain. This represents the overall score of the intent of each abnormal group. The score represents the rationality of the attack chain structure, calculated based on the degree to which the sequence of stages conforms to the attack pattern. This represents the weighting coefficient for structural rationality.

[0095] if If the value exceeds the third threshold, i.e., the credibility threshold, then the chain is confirmed to have potential attack behavior, triggering an alert and response; otherwise, the chain enters an observation state, waiting for new data to be added.

[0096] Furthermore, considering the progressive and dynamic nature of attacks, this embodiment supports the dynamic updating and expansion of the attack chain:

[0097] When a new exception group When a new anomaly group emerges, assess its temporal, spatial, and intent-related correlation with existing attack chains.

[0098] If the expansion conditions are met (temporal coherence, spatial correlation, and consistency of intent logic), the new anomaly group is integrated into the corresponding attack chain; if the expansion conditions are not met, it is determined whether the new anomaly group and the existing anomaly group can form a new attack chain.

[0099] Through a dynamic chain management mechanism, this invention can adapt to the changing characteristics of attack behavior over time, ensuring that the attack identification system has the ability to continuously monitor and track the dynamic evolution of the attack chain.

[0100] In existing technologies, attack detection schemes lack verification of the logical coherence of the attack chain. This embodiment proposes a triple verification rule of temporal coherence, spatial correlation, and the rationality of intent stages, ensuring the high credibility of the attack chain construction. The dynamic expansion mechanism can integrate newly discovered anomaly groups in real time and continuously track the attack evolution, achieving a detection effect that traditional analysis methods cannot match.

[0101] In summary, the network security threat assessment method based on anomaly risk prediction provided by this invention has the following beneficial effects:

[0102] First, risk aggregation and dynamic evolution modeling for distributed anomalies. Addressing the insufficient aggregation capabilities of existing technologies when handling cross-node and cross-time anomalies, this invention proposes a dynamic clustering method for anomalies based on risk proximity metrics. This method introduces an "entity-time-behavior" triple modeling approach, combining the occurrence sequence of behaviors, resource location, and functional association to measure the risk adjacency between behaviors. Through a risk correlation-driven clustering mechanism, discretely distributed anomalies are automatically aggregated into candidate high-risk behavior groups.

[0103] This method can not only effectively restore the inherent logical relationship between isolated fragmented anomalies, but also support incremental data updates and online evolution modeling. It can adapt to the dynamic changes in abnormal behavior patterns and provide a stable structural foundation for subsequent risk trend assessment and attack intent reasoning.

[0104] Second, an anomaly impact assessment mechanism based on risk path analysis. Addressing the lack of quantitative analysis capabilities in existing detection systems regarding the evolution trends and potential impact of anomalous behavior, this invention proposes an anomaly risk impact assessment method that integrates behavior graph matching and critical asset weight assessment. This method constructs dynamic behavior association chains, combining historical attack behavior knowledge graphs with the current system resource topology, to systematically analyze the sensitive resources, affected functional domains, and potential damage scope that anomalous behavior groups may reach.

[0105] In the risk assessment process, a multi-factor dynamic weighting mechanism based on access permissions, resource sensitivity levels, and contextual interaction strength is further introduced to generate a comprehensive intent score for the threat level of abnormal behavior. Compared with the static CVSS scoring model, this invention can dynamically adjust the scoring parameters according to the environmental state, accurately characterize the true risk level of abnormal behavior, and significantly improve the foresight and business awareness capabilities of threat analysis.

[0106] Third, an attack prediction and identification mechanism based on behavioral intent. Addressing the problem of traditional IDS relying on fixed feature libraries and insufficient logical coherence of machine learning models, this invention proposes a dynamic attack chain construction rule.

[0107] Through the above mechanism, this invention overcomes the problem of insufficient logical coherence in traditional IDS and machine learning models. It utilizes a dynamic expansion mechanism to support the real-time fusion of new anomaly groups, ensuring continuous tracking of the attack chain and solving the problem of delayed response to unknown attack combinations in existing technologies.

[0108] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0109] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0110] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for assessing cybersecurity threats based on anomaly risk prediction, characterized in that, include: A comprehensive spatiotemporal proximity measurement method is used to model the spatiotemporal correlation of abnormal behaviors, thereby obtaining anomalous groups with correlation of abnormal behaviors; For each of the aforementioned abnormal groups, time, space, and behavioral attributes are extracted to construct a unified representation of abnormal behavior features; Calculate the matching score between the abnormal group and the preset behavioral knowledge graph, and calculate the risk impact score of the abnormal group on key system assets; calculate the comprehensive intent score of the abnormal group based on the matching score and the risk impact score, and compare it with a first threshold; if it is greater than the first threshold, then mark the abnormal group. Calculate the attack prediction score corresponding to the marked abnormal group and compare it with a second threshold. If it is greater than the second threshold, the marked abnormal group is determined to have an attack intent. Based on the criteria of temporal continuity, spatial continuity, and reasonableness of intent stage, multiple abnormal groups determined to have an attack intent are linked together to form an attack chain. Calculate the credibility of the attack chain and compare it with a third threshold. If it is greater than the third threshold, it is confirmed that the attack chain has potential attack behavior, triggering an early warning and response. It also includes: dynamically updating and expanding the attack chain; When a new anomaly group appears, assess the temporal correlation, spatial correlation, and intent correlation between the new anomaly group and the existing attack chain; If the expansion condition is met, the new anomaly group is integrated into the corresponding attack chain; if the expansion condition is not met, it is determined whether the new anomaly group and the existing anomaly group can form a new attack chain.

2. The network security threat assessment method based on anomaly risk prediction according to claim 1, characterized in that, Also includes: The abnormal groups whose overall intent score is less than or equal to the first threshold are designated as abnormal groups to be labeled.

3. The network security threat assessment method based on anomaly risk prediction according to claim 1, characterized in that, Also includes: The marked abnormal groups whose attack prediction scores are less than or equal to the second threshold are designated as abnormal groups to form an attack chain.

4. The network security threat assessment method based on anomaly risk prediction according to claim 1, characterized in that, Using a comprehensive spatiotemporal proximity metric, multiple anomalous behaviors are clustered to obtain anomalous groups with correlated anomalous behaviors, including: The proximity between any two anomalous behaviors is calculated using a comprehensive spatiotemporal proximity metric function, and its expression is as follows: ； ； ； ； ； in, Indicates abnormal behavior and abnormal behavior Proximity between them Indicates abnormal behavior and abnormal behavior Standardized time difference Indicates abnormal behavior and abnormal behavior Standardized spatial distance The parameter represents the weight that controls the effect of time. The parameter represents the control space's influence on the weights. , Indicates abnormal behavior The timestamp of the occurrence Indicates abnormal behavior Spatial location information, Indicates abnormal behavior The attributes and characteristics, Indicates abnormal behavior The timestamp of the occurrence Indicates abnormal behavior Spatial location information, Indicates abnormal behavior The attributes and characteristics, The normalization factor representing time standardization. This represents a function used to calculate the distance between two objects; When the proximity between any two abnormal behaviors is less than a threshold If the two abnormal behaviors are then classified as belonging to the same abnormal group, the expression is as follows: ； in, Indicates the same group.

5. The network security threat assessment method based on anomaly risk prediction according to claim 1, characterized in that, The matching score between the anomaly group and the preset behavioral knowledge graph is calculated and expressed as: ； in, This indicates the similarity of the characteristics of nodes in the abnormal group. Indicates the logical similarity of the sequence of abnormal behaviors. and These represent the weight parameters, , Indicates an abnormal group. Represents a behavioral knowledge graph.

6. The network security threat assessment method based on anomaly risk prediction according to claim 5, characterized in that, The risk impact score of the anomaly group on critical system assets is calculated as follows: ； in, Indicates the sensitivity level of critical system assets. This indicates the permission level of the exception group involved in operations on critical system assets. This indicates the extent to which the abnormal group consumes or occupies critical system assets and resources. , and They represent the weighting coefficients, , Indicates assets.

7. The network security threat assessment method based on anomaly risk prediction according to claim 6, characterized in that, The overall intent score for the abnormal group is calculated and expressed as follows: ； in, and This represents the combined weight of pattern matching and risk assessment. This represents the overall score of the intent of each abnormal group.

8. The network security threat assessment method based on anomaly risk prediction according to claim 1, characterized in that, The attack prediction score corresponding to the marked anomaly group is calculated based on temporal reasoning and graph reasoning methods.

9. The network security threat assessment method based on anomaly risk prediction according to claim 1, characterized in that, The credibility of the attack chain is calculated and expressed as: ； in, Indicates the number of anomalous groups in the attack chain. This represents the overall score of the intent of each abnormal group. The score indicates the reasonableness of the attack chain structure. This represents the weighting coefficient for structural rationality. Indicates an abnormal group.

Images