Network attack automatic association method based on knowledge graph

Abstract

The invention provides a network attack automatic association method based on a knowledge graph, and belongs to the field of network attack association methods. The method comprises the steps of collecting multi-source data based on multiple network data sources, and dynamically allocating weights for data streams with weight labels by utilizing a credibility evaluation model; preprocessing the data stream to generate a structured data stream; defining a knowledge graph, mapping the structured data stream into the knowledge graph, and generating a triple of the knowledge graph; generating a corresponding association result by utilizing an automatic association engine in combination with the selected association rule and / or the automatic association method, and converting the association result into visual output; generating a reasoning result by utilizing a reasoning engine and combining the selected reasoning rule and / or reasoning method; and displaying an automatic association result of the network attack by utilizing the selected display method. According to the method, global analysis is conveniently carried out on automatic association of network attacks, cross-system and cross-time hidden association is effectively captured, and an attack path is predicted and deduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network attack correlation method, in particular to a network attack automatic correlation method based on knowledge graph. BACKGROUND

[0002] The development of network attack automatic correlation method is derived from the intelligent evolution of attack technology. With the attack tools having the capabilities of automatic scanning, intelligent penetration, dynamic propagation, etc., the traditional defense means based on rules and manual analysis are difficult to cope with, and the defense technology evolves into three stages: traditional defense stage, relying on firewalls, IDS / IPS, etc. static protection; active defense stage, introducing dynamic analysis such as vulnerability scanning, behavior monitoring; intelligent defense stage, combining AI, big data, graph theory, etc. technology, realizing the automatic correlation analysis of attack behavior, forming a predictive defense system.

[0003] In the prior art, although the network attack automatic correlation method has developed, it still has the following defects: first, in the traditional security system, the data such as firewall logs, threat intelligence, and vulnerability library are stored in a scattered manner and have great format differences, resulting in a significant data island effect, which cannot realize global analysis; second, the advanced persistent threat attack involves multi-stage behavior, and the traditional single-point detection based on rules cannot capture the hidden correlation across systems and time; moreover, the traditional system relies on manual experience to configure rules, which is difficult to adapt to new attack variants in real time, and lacks attack path deduction capability. SUMMARY

[0004] The purpose of the present application is to provide a network attack automatic correlation method based on knowledge graph to solve the problems of significant data island effect, inability to realize global analysis, inability to capture hidden attack correlation across systems and time, and lack of attack path deduction capability in the prior art.

[0005] In order to achieve the above purpose, the present application provides a network attack automatic correlation method based on knowledge graph, which comprises: based on multiple network data sources, collecting multi-source data, and using a credibility evaluation model to dynamically assign weights to the data stream with weighted labels obtained through multi-source data; data preprocessing is performed on the data stream with weighted labels, and structured data stream is generated; define a knowledge graph, map the structured data stream into the knowledge graph, and generate triples of the knowledge graph; based on the triples of the knowledge graph, use an automatic correlation engine, combine selected correlation rules and / or automatic correlation methods, generate corresponding correlation results, and convert them into visual output; according to the correlation results, use a reasoning engine, combine selected reasoning rules and / or reasoning methods, generate reasoning results; based on the reasoning results, use selected display methods to display the results of network attack automatic correlation.

[0006] Optionally, the data preprocessing of the data stream with weight labels comprises: removing repeated data and noise data in the data stream with weight labels, and processing missing values; standardizing and normalizing the data stream with weight labels, and extracting key features; labeling the data stream with weight labels, and performing classification annotation and relationship annotation.

[0007] Optionally, the knowledge graph comprises node types and edge types, the node types represent entities, and the edge types represent relationships between entities, and a triple of the knowledge graph comprises a subject, a relationship, and an object.

[0008] Optionally, the association rules comprise time sequence association, spatial association, behavior association, and context association, wherein continuous behaviors of a same network attack source are clustered in a time window, network attack stage evolution is identified, time sequence association of events generated from the triples is implemented, network attack sources are clustered based on network IP geographic locations or network segments, regional network attack clusters are identified, spatial association of events generated from the triples is implemented, similar network attack modes are matched, similarity of network attack tactics is identified, behavior association of events generated from the triples is implemented, network environment information and network threat intelligence are fused, and context association of events generated from the triples is implemented.

[0009] Optionally, the automatic association method comprises a pattern matching method, a clustering analysis method, and a graph algorithm, wherein preset rule bases of the automatic association engine are utilized to match features of events generated from the triples, so as to discover association by the pattern matching method, unsupervised learning algorithms are adopted to group similar events, so as to discover unknown network attack modes, and association is discovered by the clustering analysis method, events generated from the triples are abstracted into a graph structure, so as to mine complex association, and association is discovered by the graph algorithm.

[0010] Optionally, the corresponding association result is generated and converted into a visual output, comprising: generating an association graph according to the association result, visualizing a network attack path through a graph structure; generating an association matrix according to the association result, quantifying association strength between events generated from the triples through a matrix; and generating an association report according to the association result, visualizing network attack chain analysis and disposal suggestions through a structured text report.

[0011] Optionally, the reasoning rules include a rule base, logical reasoning rules and probabilistic reasoning rules, wherein historical network attack patterns and expert experience are coded into executable logical rules to form a rule base to generate a judgment benchmark of network attack threats; a first-order logic system is used to make deterministic derivation on the correlation results, emphasize the transitivity of network attack threat causality, and form logical reasoning rules; and a Bayesian network is used to quantify the uncertainty of the correlation results, comprehensively evaluate the possibility of network attack threat occurrence, and form probabilistic reasoning rules.

[0012] Optionally, the reasoning methods include a forward reasoning method, a backward reasoning method and a hybrid reasoning method, wherein the forward reasoning method starts from an event of a network attack threat alarm, derives potential subsequent network attack steps according to the selected reasoning rules; the backward reasoning method starts from a target threat event of a network attack, traces back an entry point and an attack path of the network attack; and the hybrid reasoning method generates a network attack hypothesis through the forward reasoning method, verifies the rationality of the network attack hypothesis through the backward reasoning method, and forms a self-modification cycle.

[0013] Optionally, the generation of the reasoning results includes discovering a network attack path, reconstructing a complete kill chain, and labeling key nodes of each stage of the network attack; generating a network attacker portrait to infer technical capabilities, strategic goals and organizational associations of the network attacker; and predicting future network attack threats to predict next-stage network attack targets, attack methods and time windows based on historical patterns.

[0014] Optionally, the use of the selected display method to display the results of the network attack automated correlation includes: displaying the results through a visual interface, and visually revealing the correlation and propagation path of the network attack threat through an interactive graph; monitoring the results and providing an overview of a security posture through a dashboard, providing a snapshot of a network security state and tracking of network attack threats; and generating a detailed analysis report to perform network attack trend analysis and network attack disposal effect statistics.

[0015] Through the above technical solutions, the application realizes multi-source heterogeneous data integration through unified collection structure and intelligent data preprocessing, facilitates the purpose of global analysis of network attack automated correlation; through the knowledge graph driven correlation engine and multi-dimensional correlation rules, the multi-stage behaviors involved in advanced persistent threat attacks can effectively capture cross-system and cross-time hidden correlations; through the hybrid reasoning engine and the dynamic response mechanism, new attack variants can be adapted in real time, and attack paths can be predicted and deduced.

[0016] Other features and advantages of the application will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings are included to provide a further understanding of embodiments of the application, and are incorporated in and constitute a part of the specification, illustrate embodiments of the application, and together with the description serve to explain the principles of the application. In the drawings: Figure 1 is a flowchart of the network attack automatic correlation method based on the knowledge graph of the present application Figure 1 ; Figure 2 is a flowchart of data preprocessing of data stream with weighted labels in the present application; Figure 3 is a flowchart of constructing a knowledge graph in the present application; Figure 4 is a flowchart of the network attack automatic correlation method based on the knowledge graph of the present application Figure 2 . DETAILED DESCRIPTION

[0018] The specific embodiments of the embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application.

[0019] It should be noted that the acquisition, transmission, storage, use, processing and the like of data in the technical scheme of the present application comply with the relevant provisions of national laws and regulations. In the embodiments of the present application, some industry existing schemes such as software, components, models and the like may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical scheme of the present application, but it does not mean that the applicant has or will necessarily use the scheme.

[0020] Please refer to Figure 1 , the network attack automatic correlation method based on the knowledge graph provided by the embodiments of the present application can comprise: Step S110: Based on multiple network data sources, collect multi-source data, and use a credibility evaluation model to dynamically assign weights to the data stream with weighted labels obtained through multi-source data.

[0021] In combination with Figure 1 and Figure 4 , in the embodiments of the present application, the multiple network data sources can include: logs of firewalls, intrusion detection systems, intrusion prevention systems; from public threat intelligence platforms or private threat intelligence libraries; from CVE databases, NVD databases or other vulnerability information sources; network security related discussions on social platforms such as Twitter, Reddit; phishing emails, spam emails, etc.; honeypot, penetration testing data, etc.

[0022] In the preferred embodiments of the present application, the data collection methods can include: collecting data through API interface, such as configuring OAuth authentication to call threat intelligence platform API, setting up timing task to incrementally pull data; collecting data from the Internet using crawler technology, such as designing adaptive crawler for public vulnerability forums, parsing dynamically loaded content, and complying with robots.txt rules to avoid being banned; deploying sensor devices to collect data, such as deploying traffic probes at network boundaries to mirror traffic in real time and parse it into session-level metadata.

[0023] In the preferred embodiments of the present application, a credibility evaluation model can also be established, which calculates and gives quantitative results representing the degree of credibility by collecting and analyzing various data and features related to the evaluation object and using specific methods and logical rules. These data and features can include multiple aspects.

[0024] Among them, the credibility evaluation model quantitatively evaluates the credibility of the target system through a systematic method, and the credibility evaluation model integrates the construction of evaluation dimensions, the design of index system, model selection and training, and verification and optimization mechanism. When constructing the evaluation dimensions, multiple core attributes need to be covered; when designing the index system, abstract core attributes are converted into quantifiable indicators, and the contribution of different indicators is determined through analytic hierarchy process or machine learning feature importance analysis to realize weight allocation; according to the task complexity, random forest or SVM model is selected and trained and optimized; the trained and optimized model is continuously iterated to adapt to new scenarios.

[0025] For example, a five-dimensional credibility evaluation model can be established, which dynamically allocates weights to data streams with weighted labels according to the authority of data sources (for example, national CERT scoring coefficient 0.9), historical accuracy, data freshness, cross-validation rate, and data integrity. The weight value will directly affect the priority of subsequent feature extraction.

[0026] Step S120: data preprocessing is performed on the data stream with weighted labels, and a structured data stream is generated.

[0027] Among them, the structured data stream refers to a stream formed by continuously transmitting data with clear and fixed structure in a certain order, which usually follows a predefined format, and each data element has a specific type, length and position. It is commonly used in relational databases, log files, CSV files and other scenarios. Data is organized into neat rows and columns for storage, management and analysis. For example, in a financial transaction system, each transaction data forms a structured data stream according to a fixed format (such as transaction time, transaction amount, transaction type, etc.), which facilitates real-time monitoring, risk assessment and statistical analysis.

[0028] Please refer to Figure 2In the embodiment of the present application, the data preprocessing of the data stream with weight labels can include steps S121-S123: Step S121: removing repeated data and noise data in the data stream with weight labels, and processing missing values.

[0029] For example, when removing repeated data, the log entries of the same attack source can be combined, for example, the same IP scans the same port multiple times within 5 minutes is considered as a single event; when removing noise data, false positives (for example, intrusion detection system rule false triggering) and irrelevant data (such as internal device intercommunication traffic) are filtered; when filling in missing values, the ARIMA model can be used to predict missing values for time series data, and the Bayesian network can be used to infer the most likely value for classification data.

[0030] Among them, the ARIMA model is an autoregressive integrated moving average model, which is widely used in time series analysis and prediction. Autoregression refers to using its own lag value as a predictor in the regression model, that is, the current value and the value of the past several periods have a linear relationship; integration is used to process non-stationary time series, which converts non-stationary series into stationary series through the method of difference; moving average means that the model considers that the current value of the time series can be represented as a linear combination of the current and past error terms.

[0031] Among them, the Bayesian network is a probabilistic graphical model, which is a directed acyclic graph composed of nodes representing variables and directed edges connecting these nodes. The node represents a random variable, which can be an abstraction of any problem, such as symptoms, events, etc.; the directed edge represents the causal relationship or conditional dependence relationship between variables, the node pointed by the arrow depends on the node at the start of the arrow, and the probability relationship between each node and its parent node is described by a conditional probability table. For nodes without parent nodes, use prior probability to describe, so that the Bayesian network can update the probability estimate of other variables according to the information of known variables, and realize the expression and reasoning of uncertain knowledge.

[0032] Step S122: standardizing and normalizing the data stream with weight labels, and extracting key features.

[0033] For example, when standardizing data of different formats, the time format can be unified as the UTC time zone, the IP address can be converted into an unsigned integer for storage, and the protocol name can be mapped to an enumeration value; when normalizing data to the same scale, numerical value type features (for example, the number of flow bytes) can be scaled to the interval [0, 1] to eliminate dimensional effects; for spatial-temporal feature construction, the IP address can be converted into an autonomous system number plus geographic coordinates, and the timestamp can be decomposed into periodic features (for example, hours or days of the week); for behavior feature extraction, entropy features can be constructed, and the port access entropy value and protocol distribution entropy value of the target IP can be calculated; for text feature processing, the vulnerability description can be extracted into a semantic vector through a BERT model, and then dimensionality reduction can be performed through a principal component analysis method.

[0034] Step S123: Labeling the data stream with a weight label, and performing classification annotation and relationship annotation.

[0035] For example, a label system can be established to label data and define hierarchical classification labels (for example, attack type -> exploit -> vulnerability number CVE-2023-1234); when performing classification annotation on data, automatic annotation can be performed based on a rule engine (for example, a log containing "cmd.exe / c" is marked as "command injection"); when annotating the relationship between data, the resolution relationship between IP and domain name and the association relationship between vulnerability and affected device can be established.

[0036] Step S130: Defining a knowledge graph, mapping the structured data stream into the knowledge graph, and generating triples of the knowledge graph.

[0037] In the embodiments of the present application, the knowledge graph can include node types and edge types, the node types represent entities (for example, attacker IP, victim host, CVE vulnerability, malicious file hash, attack organization, etc.), and the edge types represent the relationship between entities (for example, "exploit" (vulnerability -> device), "belongs to" (IP -> attack organization), "communication" (inter-host traffic)), and the triples of the knowledge graph can include a subject, a relationship, and an object (for example, <attacker IP, initiates attack, victim host>).

[0038] Please refer to Figure 3 In the preferred embodiments of the present application, constructing the knowledge graph can include steps S131-S134: Step S131: Defining entity types, attribute and relationship models, and forming a structured semantic framework to form a logical framework of the knowledge graph.

[0039] In the embodiments of the present application, firstly, the application scenario of the knowledge graph (for example, network security) is determined, the core concepts (for example, "attacker", "vulnerability", "host") and their hierarchical relationships (for example, "vulnerability" is a subclass of "threat") are determined; secondly, the characteristics of the entities (for example, the CVE number, severity level, etc. of "vulnerability") are described, and the relationships between the entities (for example, "vulnerability can be exploited" connects "vulnerability" and "host") are defined; then, the ontology is described using the OWL language, supporting logical constraints (for example, "the state of the victim host must be 'compromised'") to ensure data consistency.

[0040] Step S132: aligning the preprocessed structured data stream to the framework defined by the ontology, to convert the original data into graph entities through data mapping.

[0041] In the embodiments of the present application, firstly, the key objects are identified from the data sources (for example, logs, databases, etc.) and mapped to the pre-defined entity types (for example, the IP address in the log is mapped to the "attacker" node); secondly, the data characteristics are extracted to fill the entity attributes (for example, the log timestamp is taken as the "occurrence time" attribute of the "attack event" node); then, the preliminary links between the entities are established according to the data correlation (for example, "attacker IP -> target IP" in the log entry is mapped to the relationship prototype of "attacker-target host").

[0042] Step S133: generating "subject-relation-object" triples to form the data basis of the knowledge graph, to constitute the basic unit of the knowledge graph.

[0043] In the embodiments of the present application, firstly, the standardized triples are generated based on the data mapping results (for example, <attacker IP, initiates attack, victim host>); secondly, the relationship types are distinguished (for example, spatial relationship "located in", action relationship "exploit"), to enhance the accuracy of knowledge expression; then, the contradictions of multi-source data are processed (for example, the same IP is marked as both "attacker" and "victim" in different logs), and unified through rules or voting mechanism.

[0044] Step S134: persistently storing the triples in the graph database, supporting complex relationship traversal, to realize efficient knowledge management and query.

[0045] In the embodiments of the present application, firstly, the graph database is selected to optimize the storage and query performance of nodes and edges; secondly, the graph structure modeling is performed, the nodes represent entities (for example, "host", "vulnerability"), the edges represent relationships (for example, "causes damage", "belongs to network"), and the attributes represent the characteristics attached to the nodes or edges (for example, the operating system type of "host"); then, the index is created for the high-frequency query attributes (for example, "IP address") to speed up the search (for example, "find all hosts attacked by a certain IP").

[0046] In the preferred embodiment of the present application, Neo4j can be used as a graph database, and efficient path queries (e.g., tracing attack propagation links) can be implemented through the Cypher language; RDF or SPARQL language can also be used to describe the knowledge graph, to standardize the description of vulnerability knowledge semantics and realize cross-platform knowledge sharing; GraphDB can also be used for knowledge graph management and query, to handle billions of triples, support reasoning rule extension (e.g., automatic deduction of vulnerability exploitation chains).

[0047] Step S140: Based on the triples of the knowledge graph, an automatic association engine is used to generate corresponding association results in combination with selected association rules and / or automatic association methods, and the results are converted into visual output.

[0048] The automatic association engine is a technical system that automatically identifies, extracts and establishes the association between dynamic data, can automatically identify and extract dynamically changing data in the system, and then associate based on predefined association rules, learn association patterns from historical data using machine learning models to adapt to complex scenarios, then locate dynamic data through boundary recognition technology, process structured data streams within a time window using engines such as Flink to realize real-time index calculation, and finally integrate heterogeneous data to support association analysis through data standardization and feature engineering.

[0049] In the embodiment of the present application, the association rules include time series association, spatial association, behavior association and context association, and the use of an automatic association engine in combination with selected association rules can include: clustering the continuous behavior of the same network attack source in a time window (e.g., 5 minutes) to identify the evolution of network attack stages and implement time series association of events generated by triples, wherein the size of the time window needs to be dynamically adjusted according to the type of network attack (e.g., the window of advanced persistent threat attacks can last for several months).

[0050] For example, the application scenario of time series association can be port scanning (event A) → vulnerability exploitation (event B) → data theft (event C) to form a vertical attack chain.

[0051] In the preferred embodiment of the present application, network attack sources are clustered based on network IP geographic location (e.g., latitude and longitude) or network segment, and regional network attack clusters are identified to implement spatial association of events generated by triples, wherein real-time positioning can be achieved in combination with an IP geographic database (e.g., MaxMind).

[0052] For example, the application scenario of spatial association can be that IP segments in a certain country launch phishing attacks in batches, or IP in the same city scan government networks in batches.

[0053] In the preferred embodiment of the present application, the similar network attack patterns are matched, the similarity of network attack tactics is identified (for example, the same exploit sequence, backdoor file hash), the behavior correlation is implemented for the events generated by the triplets, and the behavior feature library needs to be preset during the behavior correlation.

[0054] For example, the application scenario of the behavior correlation can be that the same backdoor file appears on multiple hosts or the same exploit tool is repeatedly used.

[0055] In the preferred embodiment of the present application, the network environment information (for example, network topology, asset importance) and network threat intelligence (for example, malicious IP label) are fused, and the context correlation is implemented for the events generated by the triplets.

[0056] For example, the application scenario of the context correlation can be that when an IP is marked as a C&C server by threat intelligence, all communication behaviors of the IP automatically trigger an alarm, and the abnormal login behavior of a high-value asset (for example, a database server) is upgraded to a high-risk event.

[0057] In the preferred embodiment of the present application, the automatic correlation method includes a pattern matching method, a clustering analysis method and a graph algorithm, and the automatic correlation engine is used in combination with the selected automatic correlation method, including that the preset rule library (for example, Snort rule or ATT&CK pattern) of the automatic correlation engine can be used to match the features of the events generated by the triplets, so as to discover the correlation by the pattern matching method.

[0058] In the pattern matching method, the network attack features (for example, T1595-active scanning corresponding to port scanning log) are defined first, then the log events are matched with the feature library in real time, if a hit is found, the events are classified into the same attack sequence rule library, and in addition, the method needs to be continuously updated to cover new attack methods.

[0059] In the preferred embodiment of the present application, the unsupervised learning algorithm can be used to group similar events and discover unknown network attack patterns, so as to discover the correlation by the clustering analysis method, for example, the unsupervised learning algorithm can be applied to grouping according to the feature vector (for example, IP, port, time), and the sparse distribution events (for example, low-frequency slow DDoS attack) are clustered based on the density, in addition, the clustering analysis method can be applied to identifying new botnets.

[0060] In the preferred embodiment of the present application, the events generated by the triplets can be abstracted into a graph structure, and complex correlations can be mined, so as to discover the correlation by the graph algorithm, for example, the graph algorithm can be applied to identifying key nodes (for example, high-frequency C&C server), dividing attack gangs (for example, internal nodes are closely connected and external nodes are sparse), in addition, the graph algorithm is suitable for multi-hop attack path analysis (for example, attacker→proxy IP→victim host).

[0061] In the preferred embodiments of the present application, generating corresponding association results and converting into visualized outputs can include: generating an association graph according to the association results, visualizing the network attack path through the graph structure (node = entity, edge = relationship), for example, the association graph can be applied to show the multi-hop path (attacker IP → exploit vulnerability CVE-2023-1234 → control host 192.168.1.5 → steal data), highlight the key nodes (for example, mark the C&C server in red).

[0062] In the preferred embodiments of the present application, an association matrix can be generated according to the association results, and the association strength between events generated by the triplets is quantified through the matrix, wherein the rows / columns of the matrix can represent events, and the matrix values can represent the association degree. The proportion of multiple events sharing the same IP is taken as the IP sharing rate, and the proportion of event occurrence time overlap is taken as the time sequence coincidence degree, both of which are taken as calculation indexes of the association matrix.

[0063] In the preferred embodiments of the present application, an association report can be generated according to the association results, and the network attack chain analysis and disposal suggestions are visualized through the structured text report, wherein the network attack timeline can be represented by showing the attack stages in sequence (for example, scanning → penetration → lateral movement), the impact range can be represented by counting the number of victim hosts, data types (for example, 100 GB of user data leakage), and the disposal measures can be represented by recommending to block malicious IP and patch specific vulnerabilities.

[0064] In the preferred embodiments of the present application, the visualized output further includes generating a three-dimensional attack sand table according to the association results, and the three-dimensional attack sand table can include: coloring the network attack stages in the X-axis timeline dimension of the three-dimensional attack sand table to intuitively display the attack life cycle; rendering the global heat in the Y-axis space dimension of the three-dimensional attack sand table to locate the network attack hotspot area; and generating a layered penetration view in the Z-axis asset layer of the three-dimensional attack sand table to expose the weak points of the network's defense in depth.

[0065] Step S150: according to the association results, using a reasoning engine, combining selected reasoning rules and / or reasoning methods, generating reasoning results.

[0066] Among them, the reasoning engine is the core component of the expert system to realize the knowledge-based reasoning, is a computer program based on a certain strategy to infer new facts or conclusions from existing facts and knowledge, the reasoning engine first needs to obtain relevant reasoning rules and fact data from the knowledge base, according to the specific problem and demand, the reasoning engine will select the appropriate reasoning method, according to the selected reasoning method, the known facts and reasoning rules are logically operated and deduced, in this process, the reasoning engine will constantly match the reasoning rule conditions, and gradually derive new conclusions, finally the reasoning result is fed back to the user or other system components, providing support for decision-making.

[0067] In the embodiment of the application, the reasoning rule includes a rule base, a logical reasoning rule and a probabilistic reasoning rule, and the reasoning engine is used in combination with the selected reasoning rule, including: encoding historical network attack patterns and expert experience into executable logical rules to form a rule base and generate a network attack threat judgment benchmark.

[0068] Among them, the rule base can include expert rules and behavior rules, for example, if a host has an unpatched high-risk vulnerability and is scanned, a high-probability intrusion risk can be used as an expert rule, and if the same IP attempts multiple exploit tools within 5 minutes, an automated attack tool behavior can be used as a behavior rule, in addition, the rules are updated in real time through threat intelligence, and new rule patterns are automatically discovered through data mining, and the rule base is maintained.

[0069] In the preferred embodiment of the application, the first-order logic system is used to determine the correlation result, emphasizing the transitivity of the network attack threat causal relationship, forming a logical reasoning rule, for example, the application scene of the logical reasoning rule can include: if "attack tool A exploits vulnerability B", then deduce "all devices with B are threatened by A", and if "attacker controls host X and X is connected to host Y", then deduce "Y may be laterally penetrated".

[0070] In the preferred embodiment of the application, the Bayesian network is used to quantify the uncertainty of the correlation result, and the possibility of network attack threat occurrence is evaluated comprehensively, forming a probabilistic reasoning rule, for example, the input parameters of the Bayesian network can be probability values such as vulnerability CVSS score (exploitability), asset value weight, attack activity frequency (for example, input 0.7, 0.9, 0.6), and the output result can be a calculated comprehensive threat probability (for example, output 0.82), supporting risk priority ranking.

[0071] In the embodiments of the present application, the reasoning method includes a forward reasoning method, a backward reasoning method and a hybrid reasoning method. By using the reasoning engine and combining the selected reasoning method, the forward reasoning method can derive potential subsequent network attack steps from the event of network attack threat warning according to the selected reasoning rule. For example, the application scenario of the forward reasoning method can include triggering the rule to derive the risk of data leakage or system paralysis if the "ransomware encryption behavior" is detected, and deriving the possibility of subsequent data export if the "C&C communication" is found.

[0072] In the preferred embodiments of the present application, the backward reasoning method traces back the entry point and attack path of the network attack from the target threat event of the network attack (for example, data leakage). For example, the application scenario of the backward reasoning method can include tracing back the possible path of "vulnerability exploitation" or "phishing email initial access" after confirming data leakage, and tracing back the "vulnerability exploitation point" or "weak password login record" for a ransom event.

[0073] In the preferred embodiments of the present application, the hybrid reasoning method generates a network attack hypothesis by the forward reasoning method, and verifies the rationality of the network attack hypothesis by the backward reasoning method to form a self-modification cycle. For example, the hybrid reasoning method can include generating the hypothesis of "abnormal login as credential theft" by the forward reasoning method, and verifying whether it matches known tactics, techniques and procedures by the backward reasoning method.

[0074] In the embodiments of the present application, the reasoning result can be a tactical level response basis and a strategic level prediction. Generating the reasoning result can include finding the network attack path, reconstructing the complete kill chain, and labeling the key nodes of each stage of the network attack. For example, the kill chain can be reconnaissance (port scanning) → weaponization (exploit package) → exploitation (vulnerability number CVE-2023-1234) → control (backdoor implant) → action (data theft).

[0075] In the preferred embodiments of the present application, a network attacker profile is generated to speculate the technical ability, strategic target and organizational association of the network attacker. The technical ability can be tool complexity (for example, using customized malware vs. public exploit tools), the strategic target can be data theft (for example, targeted database access) or service paralysis (for example, continuous DDoS), and the organizational association can be matching known tactics of advanced persistent threat organizations (for example, the phishing template of Lazarus Group).

[0076] In the preferred embodiment of the present application, the future network attack threat is predicted to predict the next stage network attack target, attack method and time window based on historical patterns, for example, the historical network attack sequence can be learned by the LSTM model, and the high-risk asset list in the next 72 hours is output, and the threat scenario prediction can be "the probability of launching a ransom attack on weekends rises" or "advanced persistent threat attack on financial systems during the lunchtime trading peak".

[0077] Step S160: based on the reasoning result, the result of network attack automation correlation is displayed by using the selected display method.

[0078] In the embodiment of the present application, the result of network attack automation correlation is displayed by using the selected display method, which can include: displaying the result through a visual interface, using interactive graphics to intuitively reveal the correlation and propagation path of network attack threats, and the core components of the visual interface can include interactive knowledge graph, attack geographic heat map and network asset topology graph.

[0079] In the preferred embodiment of the present application, the interactive knowledge graph can include entity relationship mapping and dynamic updating mechanism, the entity relationship mapping can convert the entities (such as attacker IP, vulnerability number CVE-ID) and relationships (such as "exploit" or "control") output by the reasoning engine into graph nodes and edges, support multi-hop path expansion (such as clicking the node to display the complete link of "attacker → proxy IP → victim host"), and the dynamic updating mechanism can synchronize the reasoning result in real time (such as newly identified advanced persistent threat organization node), and through color or size coding attributes (such as red node representing high-risk attacker).

[0080] In the preferred embodiment of the present application, the attack geographic heat map can include spatial mapping logic and linkage analysis, the spatial mapping logic can render the malicious IP density marked by the reasoning engine into a heat gradient (such as the deep red area representing the attack source intensive area) according to the IP geographic location database (such as MaxMind).

[0081] In the preferred embodiment of the present application, the network asset topology graph can generate a topology graph to show the attack propagation chain based on the asset dependency relationship output by the reasoning result (such as "database server affected by firewall configuration error"), for example, the arrow direction represents the risk transmission path.

[0082] In the preferred embodiments of the present application, the result monitoring and security posture overview are performed through the dashboard to provide a snapshot of the network security status and tracking of network attack threats, wherein the security posture overview can include the distribution of active threats and vulnerability risks, the active threats can be sorted by the threat probability of the inference engine (for example, ransomware (for example, probability 0.89) > advanced persistent threat organization (for example, probability 0.82)), the attack type, the confidence, and the number of affected assets are displayed, the proportion of vulnerability types can be shown through a ring chart (for example, configuration error (for example, 45%) > unpatched vulnerability (for example, 30%)) to show the distribution of vulnerability risks; the result monitoring can include a rolling event list and a disposition status marker, the rolling event list can dynamically display the associated events newly triggered by the inference engine (for example, “14:05: lateral movement detected (for example, confidence 0.85)”), support filtering by time and confidence, and the disposition status marker can be associated with the response module data to mark the event processing progress (for example, “blocked” or “to be verified”).

[0083] In the preferred embodiments of the present application, a detailed analysis report is generated to analyze the network attack trends and the network attack disposition effect statistics, the analysis report can be a periodic report (daily report or weekly report) and a special analysis report, the periodic report (daily report or weekly report) can include attack trend analysis and disposition effect statistics, the threat prediction data output by the inference engine can be counted (for example, “the frequency of ransom attacks increased by 30% this week”), the attack trend analysis can be realized by comparing with the historical baseline, and the disposition effect statistics can be realized by summarizing the success rate of response actions (for example, “vulnerability repair rate 92%” or “malicious IP blocking rate 85%”); the special analysis report can include attack chain review and predictive recommendations, based on the reconstructed kill chain of the inference engine, step-level analysis is generated (for example, “initial access point: phishing email → lateral movement path: SMB exploit”), to realize attack chain review, and defense strategies are output combined with threat prediction results (for example, “prioritize hardening web server cluster in the next 72 hours”), to generate predictive recommendations.

[0084] Accordingly, the embodiment of the present application provides a network attack automatic association method based on a knowledge graph, the network attack automatic association method comprises the following steps: based on multiple network data sources, collecting multi-source data, and using a credibility evaluation model to dynamically assign weights to the data stream with weighted labels obtained through the multi-source data; performing data preprocessing on the data stream with weighted labels, and generating a structured data stream; defining a knowledge graph, mapping the structured data stream into the knowledge graph, and generating triples of the knowledge graph; based on the triples of the knowledge graph, using an automatic association engine, combining selected association rules and / or automatic association methods, generating corresponding association results, and converting into visual output; according to the association results, using an inference engine, combining selected inference rules and / or inference methods, generating inference results; based on the inference results, using selected display methods, displaying the results of the network attack automatic association. The embodiment of the present application realizes multi-source heterogeneous data integration through unified collection structure and intelligent data preprocessing, which facilitates the purpose of global analysis of network attack automatic association; through the knowledge graph driven association engine and multi-dimensional association rules, for the multi-stage behaviors involved in advanced persistent threat attacks, the hidden associations across systems and time can be effectively captured; through the hybrid inference engine and dynamic response mechanism, new attack variants can be adapted in real time, and attack paths can be predicted and deduced.

[0085] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The device that implements the functions specified in one flow or multiple flows and / or blocks.

[0087] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0089] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0090] The memory can include non-persistent memory and / or volatile memory, such as a random access memory (RAM) including a cache area for the temporary storage of data. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), flash memory, or a combination of non-volatile memories in different forms. The memory is an example of computer readable storage media.

[0091] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprising", "comprises" or other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0093] The above embodiments are only used to illustrate the present application, but not to limit it. Instead of the above, various modifications and changes can be made to the application by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall fall into the scope of the claims of the application.

Claims

1. A method for automatically associating network attacks based on knowledge graphs, characterized in that, The automated network attack correlation method includes: Based on multiple network data sources, multi-source data is collected, and a credibility assessment model is used to dynamically assign weights to the weighted data streams obtained from the multi-source data. Perform data preprocessing on the weighted data stream and generate a structured data stream; Define a knowledge graph, map the structured data stream to the knowledge graph, and generate triples for the knowledge graph; Based on knowledge graph triples, an automated association engine is used to generate corresponding association results by combining selected association rules and / or automated association methods, and then the results are transformed into visual output. Based on the association results, the inference engine is used to generate inference results by combining the selected inference rules and / or inference methods; Based on the reasoning results, the results of automated correlation of network attacks are displayed using the selected display method.

2. The automated network attack correlation method according to claim 1, characterized in that, The data preprocessing of the weighted labeled data stream includes: Remove duplicate and noisy data from the weighted data stream and handle missing values; The weighted data stream is standardized and normalized, and key features are extracted. The data stream with weighted labels is labeled, and classification and relationship annotations are performed.

3. The automated network attack correlation method according to claim 1, characterized in that, The knowledge graph includes node types and edge types. Node types represent entities, and edge types represent relationships between entities. The triples of the knowledge graph include subject, relation, and object.

4. The automated network attack correlation method according to claim 1, characterized in that, The association rules include time-series association, spatial association, behavioral association, and contextual association. Among them, continuous behaviors from the same network attack source are aggregated by time window to identify the evolution of network attack stages and to realize time series correlation of events generated by the triples; Based on network IP geographic location or network segment clustering, network attack sources are identified, regional network attack clusters are identified, and spatial correlation is achieved for events generated by the triples. Matching similar network attack patterns, identifying the similarity of network attack tactics, and establishing behavioral associations for events generated by the triples; By integrating network environment information and network threat intelligence, context association is achieved for the events generated by the triples.

5. The automated network attack correlation method according to claim 1, characterized in that, The automated association method includes pattern matching methods, clustering analysis methods, and graph algorithms. Specifically, the pre-built rule base of the automated association engine is used to match the features of events generated by triples in order to discover associations through pattern matching methods; Unsupervised learning algorithms are used to group similar events to discover unknown network attack patterns, and then cluster analysis methods are used to find correlations. The events generated by triples are abstracted into a graph structure to mine complex relationships, so as to discover the relationships through graph algorithms.

6. The automated network attack correlation method according to claim 4, characterized in that, The process of generating the corresponding association results and converting them into visual output includes: Based on the association results, an association graph is generated, and the network attack path is visualized through the graph structure. Based on the association results, an association matrix is ​​generated, and the association strength between events generated by triples is quantified through the matrix. Based on the correlation results, a correlation report is generated, which visualizes the network attack chain analysis and handling recommendations through structured text reports.

7. The automated network attack correlation method according to claim 1, characterized in that, The reasoning rules include a rule base, logical reasoning rules, and probabilistic reasoning rules. Among them, historical network attack patterns and expert experience are encoded into executable logical rules to form a rule base and generate a benchmark for judging network attack threats. Using a first-order logic system, deterministic deductions are made to the associated results, emphasizing the transitivity of causal relationships in network attack threats, and forming logical reasoning rules. By using Bayesian networks, the uncertainty of correlation results is quantified, and the probability of network attack threats is assessed by comprehensively considering multiple factors, thus forming probabilistic inference rules.

8. The automated network attack correlation method according to claim 1, characterized in that, The reasoning methods include forward reasoning, backward reasoning, and hybrid reasoning. Among them, the forward reasoning method starts from the event of a network attack threat alert and deduces the potential subsequent network attack steps according to the selected reasoning rules; The reverse reasoning method starts from the target threat event of the cyberattack and traces back the entry point and attack path of the cyberattack. The hybrid reasoning method generates cyberattack hypotheses through forward reasoning and verifies their validity through backward reasoning, thus forming a self-correcting cycle.

9. The automated network attack correlation method according to claim 1, characterized in that, The generated reasoning results include: Discover network attack paths, reconstruct the complete kill chain, and mark the key nodes at each stage of the network attack; Generate cyber attacker profiles to infer their technical capabilities, strategic objectives, and organizational affiliations; Predict future cyberattack threats by forecasting the next phase of cyberattack targets, attack methods, and time windows based on historical patterns.

10. The automated network attack correlation method according to claim 1, characterized in that, The method of displaying the results of automated correlation of network attacks using the selected display method includes: The results are presented through a visual interface, using interactive graphics to intuitively reveal the correlation and propagation path of cyberattack threats; Monitor results and gain a security posture overview through the dashboard, providing a snapshot of network security status and tracking of network attack threats; Generate detailed analysis reports, conduct network attack trend analysis, and statistically analyze the effectiveness of network attack response.

Images