Network surveying and mapping behavior anomaly detection method and system based on machine learning

Abstract

The embodiment of the invention provides a network surveying and mapping behavior anomaly detection method and system based on machine learning, and belongs to the technical field of network surveying and mapping behavior anomaly detection. The method comprises the steps of collecting double-source flow data, and generating a structured log data set through a double-source log fusion engine; performing sub-graph matching calculation to obtain a surveying and mapping behavior deviation degree; generating communication data containing the watermark identifier in a communication path corresponding to the session; and verifying whether an attack event carries the watermark identifier, and generating a network surveying and mapping behavior anomaly detection report. According to the method, the self-adaptive attack behavior model is constructed through the multi-modal feature vector based on the structured log and the graph protocol mapping rule base, the cognitive robustness of protocol camouflage and path drifting is fundamentally enhanced, a detection result real-time verification chain is established, and through cross verification of a watermark carrying state and a behavior track, the detection accuracy is improved. And traditional passive detection is converted into self-proof active defense.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network mapping behavior anomaly detection, and particularly relates to a network mapping behavior anomaly detection method and system based on machine learning. BACKGROUND

[0002] The cross-fusion of network space mapping technology and network security anomaly detection has become a key direction for the evolution of active defense systems. In the field of network mapping, asset topology modeling technology based on graph structure breaks through the limitations of traditional IP lists, and through multi-dimensional probe strategies, the dynamic characterization of infrastructure is realized. The automatic mapping framework has supported the coverage detection of multi-cloud environments. At the same time, anomaly detection technology has gradually transformed from threshold judgment to behavior pattern cognition. The behavior feature vector extraction mechanism defined by the International Telecommunication Union can integrate protocol interaction state transition features and service access space distribution features, providing a quantitative basis for complex attack chain identification.

[0003] However, the existing technology still has limitations, for example, attack chain rules rely on static rule libraries, and cannot perceive path drift in multi-step attacks. This leads to problems such as high false positives, low adaptability, and incomplete situation coverage in existing network defense systems. SUMMARY

[0004] The purpose of the application is to provide a network mapping behavior anomaly detection method and system based on machine learning, which realizes intelligent detection and tracing of network mapping behavior, and converts traditional passive detection into self-proving active defense.

[0005] In order to achieve the above purpose, the application provides a network mapping behavior anomaly detection method based on machine learning, comprising: collecting double-source traffic data based on a honeypot node, generating a structured log data set through a double-source log fusion engine; constructing an anomaly detection model and an attack chain segment based on the structured log data set, and generating attack behavior deduction rules according to the attack chain segment; based on the structured log data set and the attack behavior deduction rules, performing subgraph matching calculation to obtain a mapping behavior deviation; based on the mapping behavior deviation, generating communication data containing a watermark identifier on the communication path corresponding to the session; verifying whether the attack event carries the watermark identifier, and updating the anomaly detection model according to the verification result; generating a network mapping behavior anomaly detection report according to the output of the updated anomaly detection model and the mapping behavior deviation.

[0006] Optionally, the constructing an anomaly detection model and an attack chain fragment based on the structured log data set and generating an attack behavior deduction rule according to the attack chain fragment comprises: extracting an attack context label from the structured log data set; constructing a model analysis feature vector according to the attack context label in combination with protocol interaction timing characteristics and service access distribution characteristics; learning a sequence transfer mode of the attack context label by using a long short-term memory network, identifying statistical outliers of protocol interaction parameters by using an isolation forest algorithm, and constructing an anomaly detection model based on the model analysis feature vector; extracting a frequent item set from attack context sequences in the structured log data set by using a frequent pattern growth algorithm, and generating an attack chain fragment according to the frequent item set; and converting the attack chain fragment into an executable behavior deduction rule by using a protocol feature mapping method.

[0007] Optionally, the performing subgraph matching calculation based on the structured log data set and the attack behavior deduction rule to obtain a behavior deviation degree comprises: converting an attack chain fragment in the attack behavior deduction rule into an attack chain graph; extracting a protocol interaction event stream of a current session from the structured log data set, constructing a behavior trajectory graph, and labeling a timing relationship between events; searching for a subgraph matched with the attack chain graph in the behavior trajectory graph by using a graph structure matching algorithm, and calculating a structural similarity of the matched subgraph and the attack chain graph; performing time constraint verification on the matched subgraph, and calculating the behavior deviation degree based on a result of the structural similarity and the time constraint verification.

[0008] Optionally, the generating communication data containing a watermark identifier on a communication path corresponding to a session based on the behavior deviation degree comprises: determining that a session has a potential attack risk when the behavior deviation degree exceeds a set deviation threshold; generating communication data containing a watermark identifier according to a corresponding watermark injection strategy of a current communication protocol when the session has a potential attack risk; and performing protocol specification compliance checking on the communication data containing the watermark identifier.

[0009] Optionally, the verifying whether the attack event carries the watermark identifier comprises: continuously monitoring whether the attack event carries the watermark identifier in a subsequent request of the attack event, and recording a carrying state of the watermark identifier; and performing behavior path verification by comparing a behavior trajectory of the attack event carrying the watermark identifier with an expected path in the attack behavior deduction rule.

[0010] Optionally, the updating the anomaly detection model according to the verification result comprises: if the attack event behavior track matches the attack chain rule and completely carries the watermark identifier, marking the data record of the attack as an attack chain matching normal sample; if the attack event behavior track deviates from the path or the watermark identifier is tampered with or deleted, marking the data record of the attack as an attack chain matching abnormal sample, and triggering the anomaly detection model adjustment.

[0011] Optionally, the updating the anomaly detection model according to the verification result further comprises: for the attack chain matching normal sample, increasing the confidence score of the corresponding rule in the attack chain rule; for the attack chain matching abnormal sample, based on the tampered mode of the watermark identifier, constructing an adversarial sample, adding the adversarial sample to the training set of the anomaly detection model, and adjusting the parameter weight of the anomaly detection model.

[0012] Optionally, the generating a network mapping behavior anomaly detection report according to the output of the updated anomaly detection model and the mapping behavior deviation degree comprises: combining the output of the updated anomaly detection model and the mapping behavior deviation degree, and determining the risk level of network mapping behavior anomaly according to the result of the behavior path verification; labeling the abnormal behavior type, and extracting the identifier of the attack chain segment and the mapping behavior deviation degree matched with the current behavior; labeling the affected infrastructure resources based on the structured log data set; and recording the time window of the abnormal behavior occurrence.

[0013] Optionally, the generating a network mapping behavior anomaly detection report according to the output of the updated anomaly detection model and the mapping behavior deviation degree further comprises: constructing and outputting a three-dimensional situation view, the three-dimensional situation view comprising an asset view, a behavior view and a threat view; integrating report fields, the report fields comprising the determination result of the risk level, the abnormal behavior type, the identifier of the attack chain segment, the mapping behavior deviation degree, the affected infrastructure resources and the time window, to obtain the network mapping behavior anomaly detection report.

[0014] In another aspect, the present application provides a network mapping behavior anomaly detection system based on machine learning, which is used to implement the network mapping behavior anomaly detection method based on machine learning, and comprises a control module, the control module comprising a memory, a processor and a computer program stored on the memory and executable on the processor, and the processor executes the computer program to implement the network mapping behavior anomaly detection method based on machine learning.

[0015] The technical scheme has the following advantages: the adaptive attack behavior model is constructed based on the structured log-based multi-modal feature vector and the graph protocol mapping rule library, which fundamentally enhances the cognitive robustness of protocol camouflage and path drift; secondly, the innovative communication watermark identification tracking system establishes a detection result real-time verification chain, and through the cross verification of the watermark carrying state and behavior trajectory, the traditional passive detection is converted into a self-proving active defense; the graph structure deviation degree algorithm and the three-dimensional situation engine deeply integrate asset topology, threat behavior and time window multi-source elements, and realize the essential characterization of complex attacks such as horizontal movement under the premise of low false alarm; a self-evolution closed loop of rule confidence iteration-adversarial sample feedback-model parameter adjustment is formed, which drives the system to continuously refine new attack modes in the adversarial environment, and systematically solves the shortcomings of verification delay, situation fragmentation and static rule library rigidity in traditional network mapping behavior anomaly detection.

[0016] Other features and advantages of the present application will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, and are used together with the following specific embodiments to explain the present application, but do not constitute a limitation on the present application. In the drawings: Figure 1 is a flowchart of network mapping behavior anomaly detection based on machine learning.

[0018] Figure 2 is a mapping behavior deviation degree calculation flowchart. DETAILED DESCRIPTION

[0019] The following will be described in detail in conjunction with the accompanying Figure 1 -Appendix Figure 2 The specific embodiments of the embodiments of the present application are described in detail. It should be understood that the specific embodiments described herein are only used to illustrate and explain the embodiments of the present application, and do not limit the embodiments of the present application.

[0020] It should be noted that the acquisition, transmission, storage, use, processing and the like of data in the technical scheme of the present application comply with the relevant provisions of national laws and regulations. In the embodiments of the present application, some industry existing schemes such as software, components, models and the like may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical scheme of the present application, but does not mean that the applicant has or will necessarily use the scheme.

[0021] The present inventors found in the process of realizing the present application that the prior art has the defects of verification delay, situation fragmentation and static rule library rigidity in traditional network mapping behavior anomaly detection.

[0022] Embodiment 1 ReferenceFigures 1-2 For the first embodiment of the present application, the embodiment provides a network mapping behavior anomaly detection method based on machine learning, comprising: S100: Based on the honeypot node, collect double-source traffic data, and generate structured log data set through double-source log fusion engine.

[0023] Specifically, a high-interaction honeypot cluster is deployed in the network core area, which adopts modular architecture design and contains dozens of common service types (such as web server, database service, industrial control protocol simulation, etc.). Through port mirroring technology, two types of core data are captured in real time: first, the full flow mirror data packet of the production environment is obtained, and the deep packet inspection (DPI) technology is used to strip the transport layer load; At the same time, attack behavior metadata generated during the interaction of the honeypot system is recorded, including attack vector, vulnerability exploit payload and session state machine information. The double-source log fusion engine integrates the two types of data sources based on the timestamp alignment mechanism, parses the original log content through the pre-defined regular expression rule library, analyzes the original traffic using the diamond model analysis framework, extracts the five-tuple basic features (source Internet protocol address, source Transmission Control Protocol port, transport layer protocol type, target Internet protocol address, target Transmission Control Protocol port) Label traffic type tag (normal business request / network mapping behavior / attack exploit behavior) Aggregates session-level behavior sequence features (port access frequency, protocol interaction order, request payload entropy value) to obtain a labeled structured log data set.

[0024] Preferably, attack behavior metadata (attack vector, vulnerability exploit payload) is captured by deploying a high-interaction honeypot cluster, and full flow mirror of production environment is obtained based on port mirroring technology, and a labeled structured log data set is generated by using double-source log fusion engine (based on timestamp alignment mechanism and regular expression rule library) to provide standardized input for subsequent anomaly detection.

[0025] S200: Based on the structured log data set, construct an anomaly detection model and an attack chain fragment, and generate attack behavior deduction rules according to the attack chain fragment.

[0026] Further, an attack context label is extracted from the structured log data set; a model analysis feature vector is constructed according to the attack context label in combination with protocol interaction timing characteristics and service access distribution characteristics; based on the model analysis feature vector, a sequence transfer mode of the attack context label is learned by using a Long Short-Term Memory (LSTM), a statistical outlier of a protocol interaction parameter is identified by using an Isolation Forest algorithm, and an anomaly detection model is constructed; a frequent item set is extracted from an attack context sequence in the structured log data set by using a frequent pattern growth algorithm, and an attack chain fragment is generated according to the frequent item set; and the attack chain fragment is converted into an executable behavior deduction rule by using a protocol feature mapping method.

[0027] Specifically, first, attack context labels are extracted from the structured log dataset. Through parsing the annotated traffic type labels, such as attack exploitation behaviors and corresponding five-tuple features, session-level behavior sequence features, such as port access frequency and request payload entropy, combined with attack vectors, exploit payloads and other metadata, an initial label set is constructed. Subsequently, according to the attack context labels, the protocol interaction timing features (such as the Markov transition probability matrix of protocol interaction order) and service access distribution features (such as the target port access frequency histogram) are fused after dimensionality reduction. A high-dimensional feature vector is constructed; among them, the timing features are processed by sliding window segmentation and normalization, and the distribution features are encoded by entropy-weighted multi-dimensional histogram. Then, the bidirectional LSTM network is used to train the timing sequence of the attack context labels, and the gate unit is used to capture the dependency between attack stages and learn the probability model of attack stage transition; at the same time, the isolated forest algorithm is used to detect single-dimensional and multi-dimensional outliers for protocol parameters such as payload length distribution variance; combined with the Local Outlier Factor (LOF) score to quantify the degree of abnormality, the sequence transition probability output by the LSTM and the outlier score of the isolated forest are weighted and fused to obtain a hybrid anomaly detection model. Subsequently, based on the frequent pattern growth algorithm, the frequent item sets in the attack context sequence are mined, the minimum support threshold is set to filter high-frequency attack chain patterns, and attack chain fragments are generated through association rule confidence evaluation. Finally, the protocol feature mapping method is used to convert the attack chain fragments into executable rules. Each attack stage in the frequent item set is mapped to the feature template of the corresponding protocol layer, a state machine model is constructed through conditional logic expressions, and the Tactics, Techniques, and Procedures (TTPs) number of the MITRE ATT&CK framework (The MITRE Corporation Adversarial Tactics, Techniques, and Common Knowledge) is annotated for semantic annotation to form behavior inference rules with explainability.

[0028] Preferably, the semantic feature extractor of the bidirectional encoder representation architecture is deployed to pre-train the historical mapping data, and the deep semantic features of the protocol interaction are mined through the attention mechanism; on the other hand, a feature enhancement module based on the generative adversarial network is constructed to generate probe behavior samples simulating advanced persistent threat organizations, so as to expand the coverage of the feature library, and a feature importance evaluation algorithm (such as SHAP value calculation, Shapley additive explanation value calculation) is used to screen a key feature set and generate an interpretable detection rule set. In the accurate identification stage of the mapping subject, first, a multi-modal feature fusion unit is established to integrate network layer features, including five-tuple, Transport Layer Security (TLS fingerprint), application layer features (service identification information, application programming interface call sequence), and time features (access period, scanning rhythm); then, a graph neural network module is deployed to analyze the mapping subject association based on a knowledge graph containing IP (Internet Protocol)-domain name-vulnerability-CVE (Common Vulnerabilities and Exposures) multi-dimensional association; finally, an intent inference engine is implemented to generate a mapping subject maliciousness score by integrating a diamond model analysis engine and an anti-mapping alarm fusion device, and the mapping subject maliciousness score is integrated into a subsequent network mapping behavior anomaly detection report.

[0029] Preferably, the LSTM time series modeling and isolated forest statistical outlier detection method are fused to construct a hybrid anomaly detection model, which significantly improves the detection accuracy and interpretability; at the same time, high-frequency attack paths are mined to generate attack chain fragments and form executable behavior inference rules.

[0030] S300: Based on the structured log data set and the attack behavior inference rule, subgraph matching calculation is performed to obtain the mapping behavior deviation.

[0031] Further, the attack chain fragments in the attack behavior inference rule are converted into an attack chain graph; the protocol interaction event stream of the current session is extracted from the structured log data set to construct a behavior trajectory graph, and the time sequence relationship between events is labeled; a graph structure matching algorithm is used to search for a subgraph matching the attack chain graph in the behavior trajectory graph, and the structural similarity of the matched subgraph and the attack chain graph is calculated; the matched subgraph is subjected to time constraint verification, and based on the structural similarity and the result of the time constraint verification, the mapping behavior deviation is calculated.

[0032] Specifically, first, the attack chain segment in the attack behavior deduction rule is converted into an attack chain graph. Based on the MITREATT and CK tactic level relationship and protocol interaction dependency relationship, a directed acyclic graph is constructed, wherein the nodes represent attack stages such as vulnerability exploit payload delivery and horizontal movement detection, and the edges represent time sequence dependency or resource association relationship. The node attributes include protocol features, payload features and time constraints. Subsequently, the protocol interaction event stream of the current session is extracted from the structured log data set, the session is reorganized according to the five-tuple, the protocol interaction sequence is captured by using the time window sliding method, and the behavior trajectory graph is constructed, wherein the nodes represent the protocol interaction events (including transmission layer security protocol version, transmission control protocol window size and other metadata), the edges represent the event time sequence relationship, and the event interval is marked by the time stamp difference. A subgraph matching strategy based on the VF2++ algorithm is used to search for a subgraph in the behavior trajectory graph that matches the topology of the attack chain graph. When calculating the structural similarity, the graph edit distance is introduced as a measurement index to quantify the node attribute matching degree and edge connection consistency. The matched subgraph is subjected to time constraint verification, including the statistical time window parameters corresponding to each stage of the attack chain graph, such as the maximum interval time from vulnerability detection to permission maintenance, and the event time stamp sequence of the corresponding subgraph in the behavior trajectory graph is compared to calculate whether the time offset exceeds the preset threshold, and the fast dynamic time warping algorithm is used to correct the time sequence deviation of the asynchronous event sequence. Finally, the behavior deviation degree is calculated by weighted fusion of the structural similarity and the time verification score, and the calculation formula of the behavior deviation degree is:

[0033] wherein, represents the behavior deviation degree, and both represent weight coefficients, which are adjusted according to the time sequence sensitivity of historical attack data, represents the structural similarity, represents the time verification score.

[0034] Preferably, the attack chain segment in the attack behavior deduction rule is converted into an attack chain graph, the protocol interaction event stream of the current session is extracted from the structured log data set, the behavior trajectory graph is constructed, and the time sequence relationship between events is marked. The VF2++ algorithm is used to search for a subgraph in the behavior trajectory graph that matches the attack chain graph, the structural similarity is calculated, and the time offset is evaluated in combination with the time constraint verification mechanism to determine whether it meets the expectation. Finally, the behavior deviation degree is calculated by weighted fusion of the structural similarity and the time verification score, which is used to quantify the deviation degree between the current behavior and the known attack mode, realize the objective and dynamic evaluation of the attack path deviation degree, and reduce the risk of subjective misjudgment.

[0035] S400: Based on the behavior deviation degree, communication data containing a watermark identifier is generated on the communication path corresponding to the session.

[0036] Further, when the mapping behavior deviation exceeds the set deviation threshold, it is determined that the session has a potential attack risk; when the session has a potential attack risk, a corresponding watermark injection strategy is selected according to the current communication protocol, and communication data containing a watermark identifier is generated; the communication data containing the watermark identifier is checked for protocol specification compliance.

[0037] Specifically, when the mapping behavior deviation exceeds the dynamic threshold (set based on historical attack data distribution), it is determined that the current session has a potential attack risk. First, the protocol adapter is triggered according to the communication protocol type, and a corresponding watermark injection template is selected from the preset strategy library, for example, under the HTTP protocol (Hypertext Transfer Protocol), a sixty-four hexadecimal encoded watermark identifier is embedded in the server field of the response header, under the TCP (Transmission Control Protocol Options) protocol, a specific byte sequence is injected in the TCP selection field of the three-way handshake, and under the ICMP protocol (Internet Control Message Protocol), the low bit of the identifier field is modified. The watermark generation adopts a redundancy encoding algorithm, such as Hamming code check, which combines and encodes the unique session ID (Identifier), timestamp hash value, and attack chain fragment identifier to ensure that the watermark is within the legal range of the protocol field.

[0038] Further, after generating the communication data containing the watermark, protocol specification compliance checking is performed. First, the protocol parsing library is called to verify the field value range, and then the L4 / L3 layer checksum is regenerated through the checksum calculation module, such as the TCP pseudo-header checksum; finally, the protocol state machine simulator is deployed to detect the interaction continuity. If it is found that the field is out of bounds or the state is abnormal, the watermark re-injection mechanism is triggered, the bit width of the watermark is reduced by adjusting the encoding parameters, and the data packet that conforms to the protocol specification is regenerated. For multi-stage attack scenarios, a recursive watermark injection strategy is adopted to continuously embed the sequence number associated with the initial watermark in the subsequent interaction data stream, ensuring the integrity of the attack path tracking.

[0039] Preferably, when the mapping behavior deviation exceeds the set threshold, it is determined that the session has a potential attack risk, and a corresponding watermark injection strategy is selected according to the current communication protocol to embed a unique watermark identifier in the communication data; then the communication data containing the watermark is checked for field legality, checksum recalculation, and state machine simulation verification to ensure that the watermark injection still conforms to the protocol specification; for multi-stage attack scenarios, a recursive watermark injection strategy is adopted to continuously track the attack path, enhancing the attack tracing ability and closed-loop control mechanism.

[0040] S500: Verify whether the attack event carries the watermark identifier, and update the anomaly detection model according to the verification result.

[0041] Further, the carrying state of the watermark identifier is continuously monitored in the subsequent request of the attack event, and the carrying state of the watermark identifier is recorded; by comparing the behavior track of the attack event carrying the watermark identifier with the expected path in the attack behavior deduction rule, behavior path verification is performed.

[0042] Specifically, the watermark verification engine is deployed to continuously monitor the watermark identifier carrying state in the subsequent request of the attack event. First, the protocol analysis module is used to extract the encoded watermark data from the specific field of the data packet (such as the TCP option field), and the cyclic redundancy check is used to verify the integrity, and the pre-shared key is used to decrypt the hash of the session ID and timestamp in the watermark to verify the authenticity. Subsequently, the behavior track graph of the attack event is dynamically compared with the expected path in the attack chain rule: the continuity of the watermark carrying node in the behavior track graph is detected by the subgraph isomorphism matching algorithm, and the node coverage (such as the attack stage completion ratio) and the timing consistency (such as the dynamic time warping distance) of the actual path and the expected path are counted, and the behavior path verification is completed.

[0043] Further, if the attack event behavior track matches the attack chain rule and completely carries the watermark identifier, the data record of the attack is marked as an attack chain matching normal sample; if the attack event behavior track deviates from the path, or the watermark identifier is tampered with or deleted, the data record of the attack is marked as an attack chain matching abnormal sample, and the anomaly detection model is adjusted.

[0044] Further, for the attack chain matching normal sample, the confidence score of the corresponding rule in the attack chain rule is increased; for the attack chain matching abnormal sample, based on the tampering mode of the watermark identifier, an adversarial sample is constructed, the adversarial sample is added to the training set of the anomaly detection model, and the parameter weight of the anomaly detection model is adjusted.

[0045] Preferably, for the normal sample, the exponential weighted moving average (EWMA) algorithm is used to update the confidence score of the corresponding attack chain rule, and the confidence score updating formula is as follows:

[0046] wherein, represents the updated rule confidence, represents the decay weight of the historical confidence, represents the historical confidence before updating, represents the current attack event path matching quality.

[0047] Further, for abnormal samples, first extract watermark tampering patterns such as specific field bit flipping, payload offset offset through differential analysis, build an adversarial sample generator to simulate the attacker's strategy to bypass detection, inject adversarial samples into the training set of the anomaly detection model in proportion (such as 20%), and use online incremental learning framework such as FTRL optimizer to dynamically adjust the weight of the gating unit of the LSTM network and the outlier factor calculation parameter of the isolation forest. Finally, update the model evaluation indicators through the confusion matrix, when the recall rate improvement rate exceeds the preset threshold, solidify the model parameter update and synchronize to the real-time detection module of the honeypot cluster.

[0048] Preferably, deploy real-time five-tuple filters in the traffic access layer to intercept 90% of non-threat traffic; transplant computationally intensive modules such as LSTM / subgraph matching to GPU cluster processing, and watermark-related operations are accelerated by FPGA smart NIC hardware; through Kubernetes (helmsman, commonly known as k8s) automatic scaling mechanism, dynamically expand the number of data analysis Pod (container group) instances during business peak, and realize the optimal balance between resource efficiency and detection performance.

[0049] Preferably, by monitoring whether the watermark identifier is carried in the subsequent request of the attack event, and recording its carrying state; dynamically compare the behavior trajectory graph of the attack event with the expected path in the attack chain rule to complete behavior path verification; if the attack event path matches and the watermark is carried completely, it is marked as a normal sample and the corresponding rule confidence is improved; if the path deviates or the watermark is tampered with / deleted, it is marked as an abnormal sample and the model adjustment mechanism is triggered, and adversarial samples are constructed to join the training set, and online incremental learning framework is used to optimize model parameters, realizing adaptive update and performance optimization of the anomaly detection model.

[0050] S600: According to the output of the updated anomaly detection model and the mapping behavior deviation degree, a network mapping behavior anomaly detection report is generated.

[0051] Further, combine the output of the updated anomaly detection model and the mapping behavior deviation degree, and according to the result of the behavior path verification, determine the risk level of network mapping behavior anomaly; label the abnormal behavior type, and extract the identifier of the attack chain segment matched with the current behavior and the mapping behavior deviation degree; based on the structured log data set, label the affected infrastructure resources; record the time window of abnormal behavior occurrence.

[0052] Further, the result of behavior path verification includes attack chain matching degree, and the calculation formula of attack chain matching degree is as follows:

[0053] The index is used to evaluate the matching degree of attack behavior and preset attack mode. To further improve the accuracy, the logical coherence between nodes can be verified by combining subgraph isomorphism matching algorithm, and node weight mechanism is introduced to distinguish key attack stages.

[0054] Further, the following is the risk level determination standard based on the two core dimensions of mapping behavior deviation and attack chain matching degree, see Table 1.

[0055] Table 1 Risk level determination standard table

[0056] Further, the special scene processing rules in Table 1 are shown in Table 2.

[0057] Table 2 Special scene processing rule table

[0058] Further, through the attack chain rule matching engine, the behavior trajectory graph is associated with the attack chain segment library for analysis, and the abnormal behavior type (such as network scanning, vulnerability exploitation, and horizontal movement) is labeled, and the unique identifier of the matched attack chain segment and the mapping behavior deviation are extracted.

[0059] Further, based on the five-tuple information of the structured log data set, the affected infrastructure resources are located in combination with the asset management system database, and the abnormal behavior time window is recorded through the time series analysis module, including the start timestamp, end timestamp and duration.

[0060] Further, a three-dimensional situation view is constructed and output, including asset view, behavior view and threat view; the report field is integrated, including the determination result of the risk level, the abnormal behavior type, the identifier of the attack chain segment, the mapping behavior deviation, the affected infrastructure resources and the time window, to obtain a network mapping behavior anomaly detection report.

[0061] Specifically, in the three-dimensional situation view construction stage, the asset view adopts a topological graph form to display the network hierarchical relationship of the attacked assets, such as core switch→web server→database, the behavior view presents the attack behavior distribution through a time sequence heat map (X axis is time window, Y axis is attack stage, and color depth represents frequency), and the threat view displays the association relationship between attack chain segment, CVE (Common Vulnerabilities and Exposures, Common Vulnerabilities and Exposures) and APT organization based on knowledge graph, such as CVE-2023-1234→APT29 (number 29 of advanced persistent threat organization).

[0062] Further, the risk level, the anomaly type, the attack chain identifier, the mapping deviation value, the affected asset list (including asset name, IP address, service type), the time window parameter are packaged into a standardized JSON (JavaScript Object Notation, script language object representation) structure, and a visual component is attached to generate an interactive three-dimensional situation map (supporting web graphics library rendering), forming a complete network mapping behavior anomaly detection report and output.

[0063] Preferably, the mapping behavior deviation index is output by the comprehensive anomaly detection model, the abnormal behavior is graded according to the preset risk level determination standard, the anomaly type is marked in combination with the behavior path verification result, and the attack chain segment identifier and the affected infrastructure resource are extracted. The attack influence range is displayed through a three-dimensional situation view (asset view, behavior view, threat view), and the key information is packaged into a standardized JSON format output, realizing the automatic analysis, accurate determination and efficient response of the network mapping behavior, facilitating integrated calling and visual presentation, and clearly showing the attack influence range, providing accurate basis for post-evidence collection, vulnerability repair and defense reinforcement.

[0064] The application also provides a network mapping behavior anomaly detection system based on machine learning, which is used to realize the network mapping behavior anomaly detection method based on machine learning.

[0065] The application provides a storage medium having a program stored thereon, and the program is executed by a processor to realize the network mapping behavior anomaly detection method based on machine learning.

[0066] The application provides a processor, which is used to run a program, and the program is executed to realize the network mapping behavior anomaly detection method based on machine learning.

[0067] The application provides a device, which includes a processor, a memory and a program stored in the memory and executable on the processor, and the processor is executed to realize the network mapping behavior anomaly detection method based on machine learning. The device herein can be a server, a PC, a PAD, a mobile phone or the like.

[0068] The application also provides a computer program product, which is suitable for executing the network mapping behavior anomaly detection method based on machine learning when executed on a data processing device.

[0069] Those skilled in the art will appreciate that embodiments of the application can be practiced in a network computing environment. FIG. 1 illustrates an example of one embodiment of a network computing device 100. The computing device 100 includes one or more processors 102, a memory 104, an input / output interface 106, and a network interface 108. The computing device 100 can be a server, a desktop computer, a laptop computer, a handheld computer, a network appliance, a PDA, a cell phone, or any other computing device.

[0070] The present application is described in reference to the flowchart illustrations and / or block diagrams according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing system or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart Figure 1 one or more functions specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks.

[0071] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart Figure 1 one or more functions specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks.

[0072] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart Figure 1 one or more functions specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks.

[0073] In one typical configuration, the computing device includes one or more processors (CPU's), input / output interfaces, network interfaces, and memory.

[0074] The memory can include non-persistent memory and / or persistent memory, such as flash memory or other non-volatile memory, random access memory (RAM), etc. in a computer-readable medium, and can be used to load and store computer program instructions. The memory is an example of computer-readable media.

[0075] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0076] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0077] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method for detecting anomalies in network mapping behavior based on machine learning, characterized in that, include: Based on honeypot nodes, dual-source traffic data is collected, and a structured log dataset is generated through a dual-source log fusion engine; An anomaly detection model and attack chain fragments are constructed based on the structured log dataset, and attack behavior inference rules are generated based on the attack chain fragments. Based on the structured log dataset and the attack behavior inference rules, subgraph matching calculation is performed to obtain the mapping behavior deviation. Based on the deviation of the mapping behavior, communication data with watermark identifiers is generated in the communication path corresponding to the session; Verify whether the attack event carries the watermark identifier, and update the anomaly detection model based on the verification result; Based on the output of the updated anomaly detection model and the deviation of the mapping behavior, a network mapping behavior anomaly detection report is generated.

2. The network mapping behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The process of constructing an anomaly detection model and attack chain fragments based on the structured log dataset, and generating attack behavior inference rules based on the attack chain fragments, includes: Extract attack context labels from the structured log dataset; Based on the attack context label, a model is constructed to analyze the feature vector by combining the protocol interaction timing characteristics and service access distribution characteristics. Based on model analysis of feature vectors, the sequence transition pattern of the attack context label is learned using a long short-term memory network, and the statistical outliers of the protocol interaction parameters are identified using the isolated forest algorithm to construct an anomaly detection model. The frequent pattern growth algorithm is used to extract frequent itemsets from the attack context sequence in the structured log dataset, and attack chain fragments are generated based on the frequent itemsets. The attack chain fragments are converted into executable behavior inference rules using the protocol feature mapping method.

3. The network mapping behavior anomaly detection method based on machine learning according to claim 1, characterized in that, The subgraph matching calculation based on the structured log dataset and the attack behavior inference rules to obtain the mapping behavior deviation includes: Transform the attack chain fragments in the attack behavior deduction rules into an attack chain graph; Extract the protocol interaction event stream of the current session from the structured log dataset, construct a behavior trajectory graph, and annotate the temporal relationships between events; A graph structure matching algorithm is used to search for subgraphs that match the attack chain graph in the behavior trajectory graph, and the structural similarity between the matched subgraphs and the attack chain graph is calculated. The matched subgraphs are subjected to time constraint verification, and the deviation of the mapping behavior is calculated based on the structural similarity and the result of the time constraint verification.

4. The method for detecting anomalies in network mapping behavior based on machine learning according to claim 1, characterized in that, The step of generating watermarked identifier-containing communication data in the corresponding communication path of the session based on the mapping behavior deviation includes: When the deviation of the mapping behavior exceeds the set deviation threshold, the session is determined to have a potential attack risk; When a session has a potential attack risk, the corresponding watermark injection strategy is selected according to the current communication protocol to generate communication data containing watermark identifiers. The communication data containing the watermark identifier is checked for protocol compliance.

5. The method for detecting anomalies in network mapping behavior based on machine learning according to claim 1, characterized in that, Whether the verification attack event carries the watermark identifier includes: In subsequent requests following an attack, continuously monitor whether the watermark identifier is carried and record the carrying status of the watermark identifier; Behavioral path verification is performed by comparing the behavioral trajectory of the attack event carrying the watermark identifier with the expected path in the attack behavior inference rules.

6. The method for detecting anomalies in network mapping behavior based on machine learning according to claim 5, characterized in that, The step of updating the anomaly detection model based on the verification results includes: If the attack event's behavior trajectory matches the attack chain rules and fully carries the watermark identifier, then the data record of that attack is marked as a normal sample matching the attack chain. If the attack event's behavior trajectory deviates from the path, or if the watermark identifier is tampered with or deleted, the data record of that attack will be marked as an abnormal sample in the attack chain matching, and the anomaly detection model will be adjusted.

7. The method for detecting anomalies in network mapping behavior based on machine learning according to claim 6, characterized in that, The step of updating the anomaly detection model based on the verification result further includes: For attack chain matching normal samples, increase the confidence score of the corresponding rule in the attack chain rules; For attack chain matching anomaly samples, adversarial samples are constructed based on the pattern of watermark identifier being tampered with. The adversarial samples are added to the training set of the anomaly detection model, and the parameter weights of the anomaly detection model are adjusted.

8. The method for detecting anomalies in network mapping behavior based on machine learning according to claim 5, characterized in that, The step of generating a network mapping behavior anomaly detection report based on the updated anomaly detection model output and the mapping behavior deviation includes: By combining the output of the updated anomaly detection model with the deviation of the mapping behavior, and based on the results of the behavior path verification, the risk level of the network mapping behavior anomaly is determined. Label the abnormal behavior type, and extract the identifier of the attack chain segment that matches the current behavior and the deviation of the mapping behavior; Based on the structured log dataset, the affected infrastructure resources are labeled; Record the time window in which abnormal behavior occurs.

9. The method for detecting anomalies in network mapping behavior based on machine learning according to claim 8, characterized in that, The step of generating a network mapping behavior anomaly detection report based on the updated anomaly detection model output and the mapping behavior deviation also includes: Construct and output a three-dimensional situational view, which includes an asset view, a behavior view, and a threat view; By integrating the report fields, which include the risk level determination result, the abnormal behavior type, the identifier of the attack chain segment, the deviation of the mapping behavior, the affected infrastructure resources, and the time window, a network mapping behavior anomaly detection report is obtained.

10. A machine learning-based network mapping behavior anomaly detection system, characterized in that, The system includes a control module, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the machine learning-based network mapping behavior anomaly detection method according to any one of claims 1-9.

Images