Attack behavior modeling method and system based on correlation analysis

Abstract

The invention discloses an attack behavior modeling method and system based on correlation analysis, and the method comprises the steps: obtaining and preprocessing multi-dimensional security data collected by each data collection port, carrying out the analysis of the preprocessed multi-dimensional security data, recognizing an attack behavior, and carrying out the analysis of the attack behavior. Mining association rules between the attack behaviors and determining attack features of the attack behaviors; analyzing the association rule, determining a numerical value of a preset evaluation index, and evaluating the value of the association rule based on the numerical value of the preset evaluation index to obtain an association rule value evaluation value; determining a high-value association rule based on the association rule value evaluation value, and determining an attack mode based on the high-value association rule and the attack characteristics; and constructing an attack behavior model based on the attack pattern, the association rule and the attack feature to identify a potential attack behavior. According to the method, network security threats can be found and dealt with in time, more comprehensive security intelligence can be provided for security analysts, and the security analysts are helped to better understand and deal with continuously changing network security threats.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an attack behavior modeling method and system based on correlation analysis. Background Technology

[0002] With the rapid development and widespread application of information technology, cybersecurity has increasingly become a focus of attention for organizations and individuals. Cyberattacks take many forms and their methods are constantly evolving, rendering traditional security defenses inadequate to combat complex cybersecurity threats. Therefore, attack behavior modeling methods based on correlation analysis have emerged as an effective cybersecurity defense tool.

[0003] However, traditional methods struggle to discover potential correlation rules and patterns between attack behaviors, lack the ability to deeply explore and analyze the complex relationships between attack behaviors, resulting in the inability to identify various network attack behaviors in a timely and effective manner, the inability to respond to network security threats in a timely manner, and the inability to protect the security of information systems and data resources. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method and system for modeling attack behavior based on correlation analysis, comprising: Acquire multi-dimensional security data collected from each data acquisition port, and preprocess the multi-dimensional security data; The preprocessed multi-dimensional security data is analyzed to identify attack behaviors, mine the correlation rules between attack behaviors, and determine the attack characteristics of the attack behaviors. The association rules are analyzed to determine the values ​​of the preset evaluation indicators, and the value of the association rules is evaluated based on the values ​​of the preset evaluation indicators to obtain the value evaluation value of the association rules. High-value association rules are identified based on their value assessment, and attack patterns are determined based on these high-value association rules and attack characteristics. Attack behavior models are built based on attack patterns, association rules, and attack characteristics to identify potential attack behaviors.

[0005] Furthermore, the acquisition of multi-dimensional security data collected from each data acquisition port, and the preprocessing of the multi-dimensional security data, includes: Acquire multi-dimensional security data collected from various data acquisition ports, and preprocess the multi-dimensional security data, including data cleaning, data transformation, data integration and data standardization.

[0006] Furthermore, the analysis of the preprocessed multi-dimensional security data to identify attack behaviors includes: Determine the preprocessed multi-dimensional security data and identify abnormal behaviors in the multi-dimensional security data through anomaly detection algorithms; Identify behavioral data for anomalous behavior and define standard anomalous behavior data in the anomalous behavior database; Calculate the data similarity between the behavioral data of abnormal behavior and the standard abnormal behavior data in the abnormal behavior database, and identify the abnormal behavior with the highest similarity as the attack behavior.

[0007] Furthermore, the discovery of association rules between attack behaviors and the determination of attack characteristics include: The attack behavior is defined as an atomic unit, and a behavior database of the attack behavior is built based on the behavior data of the attack behavior; A relational network between attack behaviors is constructed based on atomic units and behavior databases, and the relationship network is mined based on the ALriori algorithm to obtain the association rules between attack behaviors. Feature extraction is performed on the attack behavior to obtain multiple candidate attack features, and the correlation between the candidate attack features and the attack behavior is determined. Candidate attack features with a correlation higher than a preset threshold are identified as attack features of the attack behavior.

[0008] Furthermore, the analysis of association rules, determination of preset evaluation index values, and evaluation of the value of association rules based on the preset evaluation index values ​​to obtain association rule value evaluation values ​​include: Determine the preset evaluation indicators for association rules, including support, confidence, and lift. Calculate the proportion of transactions containing association rules to the total number of transactions to obtain the support value; calculate the probability of the conclusion occurring when the preconditions of the association rule occur to obtain the confidence value; and calculate the degree of increase in the probability of the conclusion occurring in the association rule relative to the probability of the conclusion occurring under the preconditions to obtain the increase value. Based on the values ​​of the preset evaluation indicators, determine the average support, average confidence, and average lift of all association rules, and calculate the differences between the confidence value and the average confidence, the support value and the average support, and the lift value and the average lift. These differences are evaluated and values ​​are obtained to obtain the support evaluation value, confidence evaluation value, and lift evaluation value of the preset evaluation indicators; Determine the preset weights of the preset evaluation indicators, and calculate the value of the association rule based on the evaluation values ​​of the preset evaluation indicators and the preset weights.

[0009] Furthermore, the formula for calculating the value of the association rule is as follows: D = α*S + β*C + γ*L, Where D is the association rule value assessment value, α is the preset weight of support, S is the support assessment value, β is the preset weight of confidence, C is the confidence assessment value, γ is the preset weight of lift, and L is the lift assessment value.

[0010] Furthermore, the determination of high-value association rules based on the association rule value assessment includes: Determine a preset threshold and judge the relationship between the value assessment value of the association rule and the preset threshold. Based on the judgment result, determine the high-value association rule. If the association rule value assessment value of an association rule is greater than or equal to a preset threshold, then the association rule is determined to be a high-value association rule. If the value assessment value of an association rule is less than a preset threshold, then the association rule is determined to be a low-value association rule.

[0011] Furthermore, the determination of attack patterns based on high-value association rules and attack characteristics includes: Identify the antecedent and consequent in high-value association rules, and determine the attack behaviors involved based on the antecedent and consequent in high-value association rules; Identify the attack characteristics of these attack behaviors and determine the correlation between the antecedent and consequent terms in the high-value association rules and the attack characteristics; The preceding and following terms in the high-value association rule are matched with the relevant attack features to obtain the successfully matched attack features. The antecedent and consequent of the high-value association rule are combined with the attack features to obtain the feature combination; Calculate the frequency of each feature combination in different attack behaviors, and select the feature combination with the highest frequency. The selected feature combinations are matched with preset attack patterns in the attack pattern database, and the successfully matched preset attack patterns are determined as the actual attack patterns.

[0012] Furthermore, the construction of the attack behavior model based on attack patterns, association rules, and attack characteristics includes: A dataset is constructed based on attack patterns, association rules, and attack characteristics, and the dataset is divided into a training set and a test set. The training set and test set are respectively input into the preset neural network model for training and testing, until the training and testing results meet the preset requirements, and then the attack behavior model is obtained.

[0013] This invention also provides an attack behavior modeling system based on correlation analysis, comprising: The acquisition module is used to acquire multi-dimensional security data collected from each data acquisition port and to preprocess the multi-dimensional security data. The data mining module is used to analyze the pre-processed multi-dimensional security data, identify attack behaviors, mine the correlation rules between attack behaviors, and determine the attack characteristics of attack behaviors. The evaluation module is used to analyze association rules, determine the values ​​of preset evaluation indicators, and evaluate the value of association rules based on the values ​​of preset evaluation indicators to obtain the value evaluation value of association rules. The determination module is used to identify high-value association rules based on the association rule value assessment value, and to determine the attack pattern based on the high-value association rules and attack characteristics; The modeling module is used to build attack behavior models based on attack patterns, association rules, and attack characteristics to identify potential attack behaviors.

[0014] Compared with existing technologies, the attack behavior modeling method and system based on correlation analysis of this invention have the following advantages: This invention can accurately identify various attack behaviors through the analysis and processing of multi-dimensional security data, and by mining association rules, it can discover the correlation and patterns between different attack behaviors, helping to understand the connections and rules between attack behaviors; This invention, by evaluating the value of association rules, can determine which rules are more important for identifying attack behavior, which helps to optimize the model and screen high-value rules; This invention determines attack patterns based on association rules and attack characteristics, enabling more accurate, effective, and timely identification and classification of various attack behaviors; This invention strengthens network security defense and response capabilities by constructing an attack behavior model to monitor and predict potential attack behaviors in real time, thereby better identifying and responding to various network security attacks and improving security and stability. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the process structure of the attack behavior modeling method based on correlation analysis in an embodiment of the present invention; Figure 2 This is a schematic diagram of the attack behavior modeling system based on correlation analysis in an embodiment of the present invention. Detailed Implementation

[0016] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0017] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the platform or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0018] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of paths and nodes of the indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0019] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0020] like Figure 1 As shown in the embodiments of this application, an attack behavior modeling method based on correlation analysis is provided, including: S100: acquiring multi-dimensional security data collected from various data acquisition ports and preprocessing the multi-dimensional security data; S200: analyzing the preprocessed multi-dimensional security data, identifying attack behaviors, mining correlation rules between attack behaviors, and determining attack characteristics of attack behaviors; S300: analyzing the correlation rules, determining the values ​​of preset evaluation indicators, and evaluating the value of the correlation rules based on the values ​​of the preset evaluation indicators to obtain the correlation rule value evaluation value; S400: determining high-value correlation rules based on the correlation rule value evaluation value, and determining attack patterns based on high-value correlation rules and attack characteristics; S500: constructing an attack behavior model based on attack patterns, correlation rules, and attack characteristics to identify potential attack behaviors.

[0021] Furthermore, this invention, through the analysis and processing of multi-dimensional security data, can accurately identify various attack behaviors. By mining association rules, it can discover the correlations and patterns between different attack behaviors, helping to understand the connections and rules between them. By evaluating the value of association rules, this invention can determine which rules are more important for identifying attack behaviors, which helps to optimize the model and select high-value rules. Based on association rules and attack characteristics, this invention determines attack patterns, enabling more accurate, effective, and timely identification and classification of various attack behaviors. By constructing an attack behavior model, this invention monitors and predicts potential attack behaviors in real time, thereby strengthening network security defense and response capabilities, better identifying and responding to various network security attacks, and improving security and stability.

[0022] In the embodiments of this application, an attack behavior modeling method based on correlation analysis is provided. The step of acquiring multi-dimensional security data collected from each data acquisition port and preprocessing the multi-dimensional security data includes: acquiring multi-dimensional security data collected from each data acquisition port and preprocessing the multi-dimensional security data. The preprocessing includes data cleaning, data transformation, data integration and data standardization.

[0023] Specifically, in order to effectively monitor and respond to various security threats, it is usually necessary to obtain multi-dimensional security data from various data collection ports. This data can include network traffic data, log information, system event data, etc. Preprocessing this multi-dimensional security data is a very important step, which can improve data quality, accuracy and availability, and provide a reliable foundation for subsequent security analysis and modeling. Data cleaning refers to identifying, correcting, or deleting errors, missing, duplicates, or incomplete parts of a dataset. In multi-dimensional security data, there may be various noisy, abnormal, or missing data. Data cleaning can improve data quality and accuracy, and eliminate potential data quality problems. Data transformation includes processing data such as format conversion, standardization, and normalization to make the data conform to the requirements of the analysis model. In multi-dimensional security data, there may be data with different formats or inconsistent data units. Data transformation can unify the data format, facilitating subsequent data analysis and modeling. Data integration is the process of combining and merging data from different data sources to form a complete dataset. In the case of multi-dimensional security data, data from different security devices or systems may need to be integrated for comprehensive security analysis and modeling. Data standardization is the process of processing data according to certain standards to make the data comparable on the same scale. In multi-dimensional security data, different data items may have different dimensions or data ranges. Data standardization can eliminate these differences and ensure data consistency on the same scale. This step, through data cleaning and transformation, eliminates noise and errors in the data, improving its accuracy and quality. Data integration and standardization ensure consistent data formats and units, facilitating subsequent data analysis and modeling. Preprocessed multi-dimensional security data is more standardized and clear, helping to reduce the complexity and difficulty of data analysis. Preprocessed multi-dimensional security data is easier to understand and apply, improving its usability and practicality. Through the preprocessing of multi-dimensional security data, a reliable data foundation and support are provided for subsequent security analysis, attack behavior modeling, and security prediction. In the embodiments of this application, an attack behavior modeling method based on correlation analysis is provided. The step of analyzing preprocessed multi-dimensional security data to identify attack behaviors includes: determining the preprocessed multi-dimensional security data and identifying abnormal behaviors in the multi-dimensional security data through anomaly detection algorithms; determining the behavioral data of the abnormal behaviors and determining the standard abnormal behavior data in the abnormal behavior database; calculating the data similarity between the behavioral data of the abnormal behaviors and the standard abnormal behavior data in the abnormal behavior database, and identifying the abnormal behavior with the highest similarity as the attack behavior.

[0024] Specifically, anomaly detection algorithms (such as Isolation Forest and LOF) are used to analyze preprocessed multi-dimensional security data to identify anomalous behaviors that significantly deviate from normal patterns. These anomalous behaviors may represent potential security threats or attack activities. Once anomalies are detected, their related behavioral data can be extracted. A database of standard anomalous behaviors is established, containing various known standard anomalous behavior data, including characteristics of previous attack events and patterns of malicious behavior. By calculating the similarity between the behavioral data of the anomalous behavior and the standard anomalous behavior data in the database, the correlation between the current anomalous behavior and known anomalous behaviors can be analyzed. Based on the similarity calculation results, the anomalous behavior with the highest similarity is identified as an attack, which helps to identify and respond to cybersecurity attacks in a timely manner. This step, through anomaly detection algorithms, can monitor anomalous behaviors in multi-dimensional security data in real time, helping to promptly discover potential cyberattack activities. By calculating data similarity, the most likely attack behavior can be automatically identified and determined, reducing manual intervention and improving identification efficiency.

[0025] In the embodiments of this application, an attack behavior modeling method based on correlation analysis is provided. The method for mining correlation rules between attack behaviors and determining attack features of attack behaviors includes: defining attack behaviors as atomic units and constructing an attack behavior database based on the behavior data of attack behaviors; constructing a relationship network between attack behaviors based on atomic units and the behavior database, and mining the relationship network based on the ALriori algorithm to obtain correlation rules between attack behaviors; extracting features from attack behaviors to obtain multiple candidate attack features, determining the correlation between candidate attack features and attack behaviors, and determining the attack features of attack behaviors based on candidate attack features with a correlation higher than a preset threshold.

[0026] Specifically, attack behaviors are defined as atomic units. An attack behavior database is constructed based on the behavioral data of these behaviors, containing information such as characteristics, patterns, and behavioral data of various attack behaviors. Using the attack behavior data in the database, a relationship network between attack behaviors is built to determine the connections and dependencies between different attack behaviors. The relationship network is then mined using the ALriori algorithm, a commonly used association rule mining algorithm, to obtain association rules between attack behaviors, revealing potential relationships and patterns. Features are extracted from the attack behavior data to describe and distinguish different attack behaviors. By calculating the correlation between candidate attack features and attack behaviors, candidate attack features with a correlation higher than a preset threshold are identified as attack features of the attack behaviors. These features help identify and distinguish different types of attack behaviors. This step, by constructing a relationship network and mining association rules, allows for a deeper understanding of the connections and dependencies between different attack behaviors, facilitating a comprehensive analysis and understanding of network attack behaviors. Through feature extraction and relevance calculation, key characteristics of attack behaviors can be automatically identified and determined, improving the accuracy and efficiency of attack behavior identification. Determining the attack characteristics of attack behaviors helps establish a more comprehensive attack behavior feature library, providing a reliable reference for subsequent security analysis and detection. By mining association rules and determining attack characteristics, the accuracy and timeliness of the attack detection system in identifying various attack behaviors can be improved.

[0027] In embodiments of this application, an attack behavior modeling method based on association analysis is provided. The method involves analyzing association rules, determining the values ​​of preset evaluation indicators, and evaluating the value of association rules based on these indicators to obtain an association rule value assessment. This includes: determining preset evaluation indicators for association rules, including support, confidence, and lift; calculating the proportion of transactions containing association rules to the total number of transactions to obtain the support value; calculating the probability of the conclusion occurring when the preconditions of the association rule occur to obtain the confidence value; and calculating the probability of the conclusion occurring within the association rule. To assess the increase in the probability of a conclusion occurring under given conditions, a lift value is obtained. Based on the values ​​of preset evaluation indicators, the average support, average confidence, and average lift of all association rules are determined. The differences between the confidence value and the average confidence, the support value and the average support, and the lift value and the average lift are calculated. These differences are evaluated to obtain the support evaluation value, confidence evaluation value, and lift evaluation value of the preset evaluation indicators. The preset weights of the preset evaluation indicators are determined, and the association rule value is calculated based on the evaluation values ​​of the preset evaluation indicators and the preset weights.

[0028] Specifically, support refers to the proportion of transactions containing association rules out of the total number of transactions, used to measure the generality of the rule; confidence refers to the probability of the conclusion occurring when the premises occur, used to measure the reliability of the rule; lift refers to the degree to which the probability of the conclusion occurring increases relative to the probability of the conclusion occurring under the premises, used to measure the degree of association of the rule. Support is calculated by dividing the number of transactions containing association rules by the total number of transactions; confidence is calculated by dividing the number of transactions where both the conclusion and premises occur by the number of transactions where the premises occur; lift is calculated by dividing the confidence by the probability of the conclusion occurring; the average support, average confidence, and average lift of all association rules are calculated, and the difference between the support, confidence, and lift of each rule and the average is calculated; the differences are evaluated to obtain the support evaluation value, confidence evaluation value, and lift evaluation value, and the preset weights of the preset evaluation indicators are determined. These preset weights can be set according to actual needs and business scenarios. The value evaluation value of the association rule is calculated based on the evaluation values ​​of the preset evaluation indicators and the preset weights, to measure the importance and contribution of the rule. This step objectively assesses the importance and effectiveness of association rules by calculating indicators such as support, confidence, and lift; it quantifies the contribution of each association rule by calculating the value assessment value, helping decision-makers better understand the meaning and role of the rules; and it allows for the adjustment and optimization of preset weights based on actual conditions to more accurately reflect the importance of rule evaluation.

[0029] In an embodiment of this application, an attack behavior modeling method based on correlation analysis is provided, wherein the formula for calculating the value assessment value of the correlation rule is: D = α*S + β*C + γ*L, Where D is the association rule value assessment value, α is the preset weight of support, S is the support assessment value, β is the preset weight of confidence, C is the confidence assessment value, γ is the preset weight of lift, and L is the lift assessment value.

[0030] In the embodiments of this application, an attack behavior modeling method based on association analysis is provided. The method for determining high-value association rules based on the association rule value assessment value includes: determining a preset threshold, judging the relationship between the association rule value assessment value and the preset threshold, and determining high-value association rules based on the judgment result; if the association rule value assessment value of the determined association rule is greater than or equal to the preset threshold, then the association rule is determined to be a high-value association rule; if the association rule value assessment value of the determined association rule is less than the preset threshold, then the association rule is determined to be a low-value association rule.

[0031] Specifically, the preset threshold is set based on business needs and data characteristics to filter high-value association rules. The value assessment value of each association rule is calculated based on previously preset evaluation indicators and weights. This value assessment value is then compared to the preset threshold. If the value assessment value is greater than or equal to the preset threshold, the rule is determined to be a high-value association rule; otherwise, it is determined to be a low-value association rule. This step, by setting a preset threshold, can quickly and effectively filter out high-value association rules, reducing the output of redundant rules. By judging the value of association rules, it avoids further analysis of low-value rules, improving the efficiency and accuracy of data mining. Identifying high-value association rules can provide decision-makers with more targeted information, helping them make more informed decisions.

[0032] In embodiments of this application, an attack behavior modeling method based on correlation analysis is provided. The method for determining attack patterns based on high-value correlation rules and attack features includes: determining the antecedent and consequent of high-value correlation rules, and determining the relevant attack behaviors based on the antecedent and consequent of high-value correlation rules; determining the attack features of these attack behaviors, and determining the correlation between the antecedent and consequent of high-value correlation rules and the attack features; matching the antecedent and consequent of high-value correlation rules with the correlated attack features to obtain successfully matched attack features; combining the antecedent and consequent of high-value correlation rules with the attack features to obtain feature combinations; statistically analyzing the frequency of each feature combination in different attack behaviors, and selecting the feature combination with the highest frequency; matching the selected feature combinations with preset attack patterns in an attack pattern database, and determining the successfully matched preset attack patterns as the actual attack patterns.

[0033] Specifically, through the aforementioned evaluation and screening process, high-value association rules are identified. These high-value association rules are then broken down into predicates and consequents, representing the conditions and conclusions within the rule, respectively. These high-value association rules are associated with known attack behaviors to determine the specific attack behaviors involved. Based on the attack behaviors and a known attack signature database, the attack features involved in the rules are identified. The correlation between the predicates and consequents of the high-value association rules and the attack features is analyzed to determine the degree of correlation. The predicates and consequents of the high-value association rules are matched with the attack features to obtain successfully matched attack features. The successfully matched attack features are combined to form feature combinations. The frequency of each feature combination in different attack behaviors is statistically analyzed, and the feature combination with the highest frequency is matched with preset attack patterns in the attack pattern database to determine the successfully matched preset attack patterns as the actual attack patterns. This step, through association rule mining and feature combination matching, can help discover new attack patterns and behaviors. By statistically analyzing the frequency of feature combinations and matching preset attack patterns, it can help quickly and accurately identify and respond to different types of attacks. Applying the discovered attack patterns to security defense systems can help improve network security capabilities and efficiency.

[0034] In the embodiments of this application, an attack behavior modeling method based on correlation analysis is provided. The method for constructing an attack behavior model based on attack patterns, correlation rules, and attack features includes: constructing a dataset based on attack patterns, correlation rules, and attack features, and dividing the dataset into a training set and a test set; inputting the training set and the test set into a preset neural network model for training and testing, respectively, until the training and testing results meet the preset requirements, thereby obtaining the attack behavior model.

[0035] Specifically, the process involves identifying data containing attack patterns, association rules, and attack characteristics to construct a dataset; preprocessing the data, such as cleaning and feature extraction, to prepare it for subsequent input into the neural network model; dividing the constructed dataset into training and testing sets according to a predetermined ratio to ensure the independence and accuracy of model training and evaluation; inputting the training set into the neural network model for training, optimizing model parameters to enable it to accurately learn attack behavior patterns; using the testing set to train and test the trained model, verifying its generalization ability and accuracy; and repeating the training and testing process until the model's performance meets the predetermined requirements. This step, through the training and testing of the neural network model, enables automatic detection and identification of attack behaviors, improving the automation level of network security; the neural network model can learn complex attack behavior patterns, improving the accuracy and efficiency of detection; and after establishing the attack behavior model, real-time monitoring and response to network attacks can be achieved, enhancing network security defense capabilities.

[0036] like Figure 2As shown in the embodiments of this application, an attack behavior modeling system based on correlation analysis is provided, including: an acquisition module, used to acquire multi-dimensional security data collected from various data acquisition ports and preprocess the multi-dimensional security data; a mining module, used to analyze the preprocessed multi-dimensional security data, identify attack behaviors, mine correlation rules between attack behaviors, and determine the attack characteristics of attack behaviors; an evaluation module, used to analyze the correlation rules, determine the values ​​of preset evaluation indicators, and evaluate the value of the correlation rules based on the values ​​of the preset evaluation indicators to obtain the correlation rule value evaluation value; a determination module, used to determine high-value correlation rules based on the correlation rule value evaluation value, and determine the attack pattern based on the high-value correlation rules and attack characteristics; and a modeling module, used to construct an attack behavior model based on the attack pattern, correlation rules, and attack characteristics to identify potential attack behaviors.

[0037] In summary, this invention provides a method and system for attack behavior modeling based on correlation analysis, comprising: acquiring and preprocessing multi-dimensional security data collected from various data acquisition ports; analyzing the preprocessed multi-dimensional security data to identify attack behaviors, and mining correlation rules between attack behaviors and determining attack characteristics; analyzing the correlation rules to determine the values ​​of preset evaluation indicators, and evaluating the value of the correlation rules based on these indicators to obtain correlation rule value evaluation values; determining high-value correlation rules based on the correlation rule value evaluation values, and determining attack patterns based on these rules and attack characteristics; and constructing an attack behavior model based on the attack patterns, correlation rules, and attack characteristics to identify potential attack behaviors. This invention can promptly detect and respond to cybersecurity threats, and also provide security analysts with more comprehensive security intelligence, helping them better understand and respond to ever-changing cybersecurity threats.

[0038] Finally, it should be noted that those skilled in the art can obviously make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0039] The above description is merely one embodiment of the present invention, and should not be construed as limiting the scope of the invention. Any structural changes made based on the present invention, as long as they do not depart from the essence of the invention, should be considered as falling within the protection scope of the present invention and subject to its restrictions. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process and related descriptions of the platform described above can be referred to the corresponding processes in the foregoing platform embodiments, and will not be repeated here.

[0040] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, platform, article, or device / platform that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to those processes, platforms, articles, or devices / platforms.

[0041] The technical solutions of the present invention have been described in conjunction with the accompanying drawings and further embodiments. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to closely related technical features, and the technical solutions resulting from such changes or substitutions will all fall within the scope of protection of the present invention.

[0042] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.

Claims

1. A method for modeling attack behavior based on correlation analysis, characterized in that, include: Acquire multi-dimensional security data collected from each data acquisition port, and preprocess the multi-dimensional security data; The preprocessed multi-dimensional security data is analyzed to identify attack behaviors, mine the correlation rules between attack behaviors, and determine the attack characteristics of the attack behaviors. The association rules are analyzed to determine the values ​​of the preset evaluation indicators, and the value of the association rules is evaluated based on the values ​​of the preset evaluation indicators to obtain the value evaluation value of the association rules. High-value association rules are identified based on their value assessment, and attack patterns are determined based on these high-value association rules and attack characteristics. Attack behavior models are built based on attack patterns, association rules, and attack characteristics to identify potential attack behaviors.

2. The attack behavior modeling method based on correlation analysis as described in claim 1, characterized in that, The acquisition of multi-dimensional security data collected from each data acquisition port, and the preprocessing of the multi-dimensional security data, include: Acquire multi-dimensional security data collected from various data acquisition ports, and preprocess the multi-dimensional security data, including data cleaning, data transformation, data integration and data standardization.

3. The attack behavior modeling method based on correlation analysis as described in claim 2, characterized in that, The analysis of preprocessed multi-dimensional security data to identify attack behaviors includes: Determine the preprocessed multi-dimensional security data and identify abnormal behaviors in the multi-dimensional security data through anomaly detection algorithms; Identify behavioral data for anomalous behavior and define standard anomalous behavior data in the anomalous behavior database; Calculate the data similarity between the behavioral data of abnormal behavior and the standard abnormal behavior data in the abnormal behavior database, and identify the abnormal behavior with the highest similarity as the attack behavior.

4. A method for modeling attack behavior based on correlation analysis as described in claim 3, characterized in that, The association rules between mining attack behaviors and the attack characteristics used to determine these behaviors include: The attack behavior is defined as an atomic unit, and a behavior database of the attack behavior is built based on the behavior data of the attack behavior; A relational network between attack behaviors is constructed based on atomic units and behavior databases, and the relationship network is mined based on the ALriori algorithm to obtain the association rules between attack behaviors. Feature extraction is performed on the attack behavior to obtain multiple candidate attack features, and the correlation between the candidate attack features and the attack behavior is determined. Candidate attack features with a correlation higher than a preset threshold are identified as attack features of the attack behavior.

5. A method for modeling attack behavior based on correlation analysis as described in claim 4, characterized in that, The process of analyzing association rules, determining the values ​​of preset evaluation indicators, and evaluating the value of association rules based on the values ​​of preset evaluation indicators to obtain the association rule value evaluation value includes: Determine the preset evaluation indicators for association rules, including support, confidence, and lift. Calculate the proportion of transactions containing association rules to the total number of transactions to obtain the support value; calculate the probability of the conclusion occurring when the preconditions of the association rule occur to obtain the confidence value; and calculate the degree of increase in the probability of the conclusion occurring in the association rule relative to the probability of the conclusion occurring under the preconditions to obtain the increase value. Based on the values ​​of the preset evaluation indicators, determine the average support, average confidence, and average lift of all association rules, and calculate the differences between the confidence value and the average confidence, the support value and the average support, and the lift value and the average lift. These differences are evaluated and values ​​are obtained to obtain the support evaluation value, confidence evaluation value, and lift evaluation value of the preset evaluation indicators; Determine the preset weights of the preset evaluation indicators, and calculate the value of the association rule based on the evaluation values ​​of the preset evaluation indicators and the preset weights.

6. The attack behavior modeling method based on correlation analysis according to claim 5, characterized in that, The formula for calculating the value of the association rule is as follows: D = α*S + β*C + γ*L Where D is the association rule value assessment value, α is the preset weight of support, S is the support assessment value, β is the preset weight of confidence, C is the confidence assessment value, γ is the preset weight of lift, and L is the lift assessment value.

7. A method for modeling attack behavior based on correlation analysis as described in claim 5, characterized in that, The process of determining high-value association rules based on association rule value assessment includes: Determine a preset threshold and judge the relationship between the value assessment value of the association rule and the preset threshold. Based on the judgment result, determine the high-value association rule. If the association rule value assessment value of an association rule is greater than or equal to a preset threshold, then the association rule is determined to be a high-value association rule. If the value assessment value of an association rule is less than a preset threshold, then the association rule is determined to be a low-value association rule.

8. A method for modeling attack behavior based on correlation analysis as described in claim 7, characterized in that, The method of determining attack patterns based on high-value association rules and attack characteristics includes: Identify the antecedent and consequent in high-value association rules, and determine the attack behaviors involved based on the antecedent and consequent in high-value association rules; Identify the attack characteristics of these attack behaviors and determine the correlation between the antecedent and consequent terms in the high-value association rules and the attack characteristics; The preceding and following terms in the high-value association rule are matched with the relevant attack features to obtain the successfully matched attack features. The antecedent and consequent of the high-value association rule are combined with the attack features to obtain the feature combination; Calculate the frequency of each feature combination in different attack behaviors, and select the feature combination with the highest frequency. The selected feature combinations are matched with preset attack patterns in the attack pattern database, and the successfully matched preset attack patterns are determined as the actual attack patterns.

9. A method for modeling attack behavior based on correlation analysis as described in claim 8, characterized in that, The attack behavior model constructed based on attack patterns, association rules, and attack characteristics includes: A dataset is constructed based on attack patterns, association rules, and attack characteristics, and the dataset is divided into a training set and a test set. The training set and test set are respectively input into the preset neural network model for training and testing, until the training and testing results meet the preset requirements, and then the attack behavior model is obtained.

10. An attack behavior modeling system based on correlation analysis, characterized in that, include: The acquisition module is used to acquire multi-dimensional security data collected from each data acquisition port and to preprocess the multi-dimensional security data. The data mining module is used to analyze the pre-processed multi-dimensional security data, identify attack behaviors, mine the correlation rules between attack behaviors, and determine the attack characteristics of attack behaviors. The evaluation module is used to analyze association rules, determine the values ​​of preset evaluation indicators, and evaluate the value of association rules based on the values ​​of preset evaluation indicators to obtain the value evaluation value of association rules. The determination module is used to identify high-value association rules based on the association rule value assessment value, and to determine the attack pattern based on the high-value association rules and attack characteristics; The modeling module is used to build attack behavior models based on attack patterns, association rules, and attack characteristics to identify potential attack behaviors.

Images