Network security supervision system based on network security operation

Abstract

The invention relates to the technical field of security monitoring, in particular to a network security supervision system based on network security operation, which comprises the following steps: processing multi-dimensional feature data by adopting an anomaly detection module to obtain an anomaly detection report; performing deep simulation analysis on the anomaly detection report through the dynamic sandbox test model to obtain a sandbox test report; performing action prediction and causal reasoning on the anomaly detection report and the sandbox test report by adopting a deep learning prediction model to obtain an attack behavior prediction set; multi-dimensional deep analysis and comprehensive evaluation are carried out on the anomaly detection report, the sandbox test report and the attack behavior prediction set to generate a blocking strategy; according to the invention, the problem that the false alarm rate is high due to the lack of joint analysis capability for multi-dimensional features such as protocol distribution, geographic position, time sequence trend and the like due to the fact that most of the existing schemes carry out anomaly detection based on single-dimensional features such as traffic and protocol types is solved.

Description

Technical Field

[0001] This invention relates to the field of security monitoring technology, and more specifically to a network security supervision system based on network security operation. Background Technology

[0002] Currently, there are numerous methods for cybersecurity supervision, but most existing solutions rely on single-dimensional features such as traffic volume and protocol type for anomaly detection. They lack the ability to jointly analyze multi-dimensional features such as protocol distribution, geographical location, and time-series trends, leading to high false positive rates. Secondly, traditional sandboxes, which simulate attack paths using pre-set configuration files, struggle to cope with advanced attack methods that bypass detection, such as encrypted communication decryption and multi-stage attack chains, and their vulnerability detection coverage is limited. Furthermore, existing methods typically employ a binary judgment logic of "whether the predicted result is completely consistent with the actual action set," failing to consider dynamic factors such as action sequence and frequency, resulting in high false positive rates. Finally, existing methods rely on pre-built static whitelists to obtain log file space, failing to dynamically identify unknown programs or abnormal call chains, thus limiting their ability to respond to new threats.

[0003] Therefore, the present invention provides a network security monitoring system based on network security operation to solve the above problems. Summary of the Invention

[0004] In order to overcome the shortcomings of the prior art, this invention provides a network security monitoring system based on network security operation. This system addresses the problem that most existing solutions rely on single-dimensional features such as traffic volume and protocol type for anomaly detection, lacking the ability to jointly analyze multi-dimensional features such as protocol distribution, geographical location, and time series trends, resulting in a high false alarm rate.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A network security monitoring system based on network security operation includes:

[0007] The data acquisition module acquires network traffic in real time; it parses the network traffic to obtain quintuple information and metadata.

[0008] The anomaly detection module analyzes the quintuple information and meta-information to construct multidimensional feature data; it dynamically updates the preset threshold library based on the standard deviation of historical traffic fluctuations; it compares and analyzes the preset threshold library and the multidimensional feature data to obtain the first detection result; when anomaly feature data is found in the first detection result, the preset anomaly detection algorithm is used to analyze the multidimensional feature data to obtain an anomaly detection report.

[0009] The sandbox testing module uses a preset dynamic fuzzy testing model to perform mutation testing and behavior monitoring on anomaly detection reports, and obtains sandbox test reports.

[0010] The behavior prediction module uses a deep learning prediction model to perform action prediction and causal reasoning on anomaly detection reports and sandbox test reports to obtain an attack behavior prediction set.

[0011] The protection response module uses evidence theory to fuse anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain fused data. Based on the fused data, anomaly detection reports, sandbox test reports, and attack behavior prediction sets, a comprehensive risk assessment report is determined. The comprehensive risk assessment report is then subjected to dynamic whitelist verification, call chain monitoring, and predicted action set matching to determine the blocking strategy.

[0012] Preferably, the analysis of the quintuple information and meta-information to construct multi-dimensional feature data includes: statistically analyzing the proportions of TCP, UDP, and ICMP, calculating protocol entropy values, and obtaining protocol distribution characteristics; using the GeoIP2 library to parse the latitude and longitude coordinates of the source IP, generating a geographic scatter plot density distribution, and obtaining geographic distribution characteristics; and using a sliding window to calculate the mean and standard deviation of traffic, and obtaining the time series characteristics of the standardized sequence.

[0013] Preferably, the step of analyzing multidimensional feature data using a preset anomaly detection algorithm to obtain an anomaly detection report includes: determining the neighborhood radius and minimum sample number of the improved DBSCAN algorithm based on historical traffic fluctuations, and identifying outliers in the multidimensional feature data; determining initial anomaly data when the density of outliers is less than the corresponding dynamic threshold; evaluating the degree of anomaly of the multidimensional feature data using the random path length of the isolated forest algorithm to obtain a first confidence level; and determining high-risk anomaly data and generating an anomaly detection report when the first confidence level corresponding to the initial anomaly data is greater than a preset confidence threshold.

[0014] Preferably, the step of using a preset dynamic fuzzy testing model to perform mutation testing and behavior monitoring on the anomaly detection report to obtain a sandbox test report includes: selecting abnormal traffic packets whose confidence ranking belongs to a preset interval from the anomaly detection report as input data; using the AFL++ tool to perform mutation testing on the target program of the abnormal traffic packets to obtain an initial mutation strategy; using a genetic algorithm to optimize the initial mutation strategy, covering unexecuted code paths, to obtain a target mutation strategy; and performing behavior monitoring at all times during the mutation testing process to obtain an alarm list; and obtaining a sandbox test report based on the target mutation strategy and the alarm list.

[0015] Preferably, the step of continuously monitoring behavior and obtaining an alarm list during the mutation test includes: using psutil to monitor CPU consumption, adding an alarm to the list when CPU consumption exceeds a first consumption value and the duration exceeds a first preset time; using auditd to record write permission access operations, adding an alarm to the list when the creation of hidden files or modification of critical configuration files is detected; using netstat to trace non-business port connection information, adding an alarm to the list when an encrypted tunnel is established; and using strace to monitor the API call chain, adding an alarm to the list when unexpected process injection or privilege escalation is detected.

[0016] Preferably, the step of using a deep learning prediction model to perform action prediction and causal inference on anomaly detection reports and sandbox test reports to obtain an attack behavior prediction set includes: obtaining feature sequences from anomaly detection reports and sandbox test reports; processing the feature sequences using gating and attention mechanisms in LSTM networks to obtain action probability distributions and first confidence levels; aggregating the feature sequences using GraphSAGE in GNN networks and performing causal inference on the feature sequences using a preset causal propagation formula to obtain an attack behavior prediction set.

[0017] Preferably, the preset causal propagation formula is:

[0018] P(a→c)=αP(a)+(1-α)Σ b∈pre(c) P(a→b→c),

[0019] Where P(a→c) is the probability that action a leads to result c, α is the topological sorting confidence coefficient, P(a) is the probability that action a occurs, b∈pre(c) is the set of predecessor nodes of intermediate node b belonging to result c, and P(a→b→c) is the probability that action a leads to intermediate node b, and then intermediate node b leads to result c.

[0020] Preferably, the method of fusing anomaly detection reports, sandbox test reports, and attack behavior prediction sets using evidence theory to obtain fused data includes: defining basic probability distribution functions for anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain basic probability allocation information; and merging multiple basic probability allocation information using Dempster's combination rule to obtain fused data.

[0021] Preferably, determining the comprehensive risk assessment report based on the fused data, anomaly detection report, sandbox test report, and attack behavior prediction set includes: determining the risk level based on the relationship between the fused data and the corresponding preset risk threshold; and integrating the risk level with the corresponding anomaly detection report, sandbox test report, and attack behavior prediction set to obtain the comprehensive risk assessment report.

[0022] Preferably, the process of performing dynamic whitelist verification, call chain monitoring, and predicted action set matching on the comprehensive risk assessment report to determine the blocking strategy includes: performing dynamic whitelist correction based on temporary trust policies and hash verification processes; constructing a communication matrix between processes and performing anomaly detection based on the relationship between API call frequency, parameter characteristics, and dynamic thresholds; determining the action matching degree based on the action matching degree when an anomaly exists; and determining the blocking strategy based on the action matching degree.

[0023] The beneficial effects of this invention are as follows:

[0024] 1. This invention processes multi-dimensional feature data using an anomaly detection module to obtain an anomaly detection report; performs in-depth simulation analysis on the anomaly detection report using a dynamic sandbox testing model to obtain a sandbox testing report; uses a deep learning prediction model to perform action prediction and causal reasoning on the anomaly detection report and the sandbox testing report to obtain an attack behavior prediction set; generates a blocking strategy by performing multi-dimensional in-depth analysis and comprehensive evaluation of the anomaly detection report, the sandbox testing report, and the attack behavior prediction set; and executes the blocking strategy according to a preset priority, achieving a perfect closed loop from monitoring to defense. Furthermore, this invention solves the problem that most existing solutions rely on single-dimensional features such as traffic volume and protocol type for anomaly detection, lacking the ability to jointly analyze multi-dimensional features such as protocol distribution, geographical location, and time series trends, leading to a high false alarm rate.

[0025] 2. This invention overcomes the limitations of traditional single-dimensional detection through a multi-dimensional feature fusion mechanism, achieving joint analysis of protocol distribution, geographical location, and time series. Furthermore, it simulates a mutation-driven testing environment through a dynamic sandbox and fuzz testing approach, covering known vulnerability exploitation methods. This helps address the problem that traditional sandboxes, which simulate attack paths using preset configuration files, struggle to handle advanced attack methods that bypass detection, such as encrypted communication decryption and multi-stage attack chains, and have limited vulnerability detection coverage. Secondly, this invention combines GNN causal reasoning with LSTM temporal analysis, improving the accuracy of attack chain identification; and through dynamic threshold adjustment and temporary trust strategies, it enhances the system's response speed to new threats.

[0026] 3. In the protection response module, the present invention sequentially verifies the dynamic whitelist, monitors and analyzes the call chain, and matches the predicted action set. It determines the response action set by filtering those with a matching degree greater than a set value. This helps to solve the problem of high false alarm rate caused by the binary judgment logic of "whether the predicted result is completely consistent with the actual action set" commonly used in existing methods, which does not consider dynamic factors such as action order and frequency. Attached Figure Description

[0027] Figure 1 This is a schematic block diagram of a network security monitoring system based on network security operation according to the present invention. Detailed Implementation

[0028] The following will refer to the attached reference. Figure 1 The various embodiments of the present invention will be described in detail below. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0029] In one embodiment of the present invention, a network security monitoring system based on network security operation is provided, as shown in the appendix. Figure 1 As shown, it includes: a data acquisition module, which acquires network traffic in real time; and a module that parses network traffic to obtain quintuple information and metadata.

[0030] The process involves capturing network traffic using the PCAP tool and parsing the 5-tuple information, which includes source IP / port, destination IP / port, and protocol type. Meta-information data such as timestamps and packet lengths are also extracted.

[0031] The anomaly detection module analyzes the quintuple information and meta-information to construct multidimensional feature data; it also dynamically updates the preset threshold library based on the standard deviation of historical traffic fluctuations; it compares and analyzes the preset threshold library and the multidimensional feature data to obtain the first detection result; when abnormal feature data is found in the first detection result, the preset anomaly detection algorithm is used to analyze the multidimensional feature data to obtain an anomaly detection report.

[0032] This invention enhances adaptability to sudden traffic surges by dynamically updating the thresholds of various features in a pre-defined threshold library based on the standard deviation of historical traffic fluctuations. An improved DBSCAN algorithm is employed to identify outliers in traffic data, such as high-frequency abnormal access or a sudden increase in the proportion of unknown protocols, by defining a neighborhood radius and a minimum sample size. An alarm is triggered when the confidence level of the detection result exceeds a pre-set confidence level, reducing false alarm rates. Simultaneously, it provides high-value suspicious traffic samples for subsequent sandbox testing, ensuring resources are focused on high-risk events. Furthermore, the dynamic threshold setting method improves the model's adaptability and the accuracy of anomaly detection.

[0033] The sandbox testing module uses a preset dynamic fuzzy testing model to perform mutation testing and behavior monitoring on anomaly detection reports, resulting in a sandbox test report.

[0034] The sandbox test report includes vulnerability type, attack path, remediation suggestions, risk score, etc. The sandbox test module transforms static traffic characteristics into executable attack scenarios for verification and supplements the attack and defense confrontation data in model training.

[0035] The behavior prediction module uses a deep learning prediction model to perform action prediction and causal reasoning on anomaly detection reports and sandbox test reports to obtain an attack behavior prediction set.

[0036] Specifically, the process involves acquiring feature sequences from anomaly detection reports and sandbox test reports; initializing the deep learning prediction model by loading the pre-trained EfficientNetB0 model and freezing the basic convolutional layers; fine-tuning the top fully connected layers on a private enterprise dataset and using mixed-precision training to accelerate convergence; defining a state space when using reinforcement learning for action prediction, with parameters including threat score, vulnerability type, and historical similarity; designing an action set including blocking requests, logging, and escalating protection; and setting parameters for the Q-learning algorithm, including the learning rate, discount factor, and exploration rate, for example, a learning rate of 0.001, a discount factor of 0.95, and an exploration rate of 0.1.

[0037] Then, temporal modeling optimization is performed by introducing a gating mechanism into the LSTM unit to solve the problem of gradient vanishing in long sequences; and an attention mechanism is added to highlight the importance weights of recent actions.

[0038] Secondly, to enhance causal reasoning capabilities, the GNN module employs a GraphSAGE architecture with weighted averaging as the aggregation method. Causal reasoning is performed using a pre-defined causal propagation formula, and after sorting and filtering, a set of predicted attack behaviors is output. This invention quantifies attack paths, clarifies the dependencies between actions, and identifies key attack steps; it improves the prediction confidence of high-risk actions through causal weight allocation; and it provides a priority basis for blocking strategies.

[0039] By employing deep learning prediction models to perform action prediction and causal reasoning on anomaly detection reports and sandbox test reports, an attack behavior prediction set is obtained. This set can be trained using historical data to improve the ability to predict future unknown attacks, providing prior knowledge for real-time response.

[0040] The protection response module uses evidence theory to fuse anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain fused data. Based on the fused data, anomaly detection reports, sandbox test reports, and attack behavior prediction sets, a comprehensive risk assessment report is determined. The comprehensive risk assessment report undergoes dynamic whitelist verification, call chain monitoring, and predicted action set matching to determine the blocking strategy. The blocking strategy is executed according to a preset priority, and a protection execution log is generated. This invention can obtain comprehensive and objective prediction results through multimodal data fusion and risk assessment, and then transform the prediction results into executable security response actions, achieving a closed loop from monitoring to defense. Furthermore, this invention sequentially uses dynamic whitelist verification, call chain monitoring and analysis, and predicted action set matching, selecting response action sets with a matching degree greater than a set value. This helps to solve the problem of high false alarm rates caused by the binary judgment logic of "whether the predicted result is completely consistent with the actual action set" commonly used in existing methods, which does not consider dynamic factors such as action order and frequency.

[0041] Through the above-described configuration, this invention uses an anomaly detection module to process multi-dimensional feature data to obtain an anomaly detection report; it then uses a dynamic sandbox testing model to perform in-depth simulation analysis on the anomaly detection report to obtain a sandbox testing report; finally, it uses a deep learning prediction model to perform action prediction and causal reasoning on the anomaly detection report and the sandbox testing report to obtain an attack behavior prediction set; and finally, it generates a blocking strategy by performing multi-dimensional in-depth analysis and comprehensive evaluation of the anomaly detection report, the sandbox testing report, and the attack behavior prediction set. The blocking strategy is then executed according to a preset priority, achieving a perfect closed loop from monitoring to defense. Furthermore, this invention solves the problem that most existing solutions rely on single-dimensional features such as traffic volume and protocol type for anomaly detection, lacking the ability to jointly analyze multi-dimensional features such as protocol distribution, geographical location, and time series trends, leading to a high false alarm rate.

[0042] This invention overcomes the limitations of traditional single-dimensional detection through a multi-dimensional feature fusion mechanism, enabling joint analysis of protocol distribution, geographical location, and time series. Furthermore, it achieves mutation-driven environment simulation through a dynamic sandbox and fuzz testing approach, covering known vulnerability exploitation methods. This helps address the shortcomings of traditional sandboxes, which simulate attack paths using preset configuration files, struggling to handle advanced attack methods that bypass detection, such as encrypted communication decryption and multi-stage attack chains, and having limited vulnerability detection coverage. Secondly, this invention combines GNN causal reasoning with LSTM temporal analysis, improving the accuracy of attack chain identification; and through dynamic threshold adjustment and temporary trust strategies, it enhances the system's response speed to new threats.

[0043] In one embodiment of the present invention, the analysis of the quintuple information and meta-information to construct multi-dimensional feature data includes: statistically analyzing the proportions of TCP, UDP, and ICMP, calculating protocol entropy values, and obtaining protocol distribution characteristics; using the GeoIP2 library to parse the latitude and longitude coordinates of the source IP, generating a geographic scatter plot density distribution, and obtaining geographic distribution characteristics; and using a sliding window to calculate the mean and standard deviation of traffic, and obtaining the time series characteristics of the standardized sequence.

[0044] This embodiment breaks through the limitations of traditional single-dimensional detection by analyzing multi-dimensional features, and realizes the joint analysis of protocol distribution, geographical location and time series.

[0045] In one embodiment of the present invention, the step of analyzing multidimensional feature data using a preset anomaly detection algorithm to obtain an anomaly detection report includes: determining the neighborhood radius and minimum sample number of the improved DBSCAN algorithm based on historical traffic fluctuations, and identifying outliers in the multidimensional feature data; determining initial anomaly data when the density of outliers is less than the corresponding dynamic threshold; evaluating the degree of anomaly of the multidimensional feature data using the random path length of the isolated forest algorithm to obtain a first confidence level; and determining high-risk anomaly data and generating an anomaly detection report when the first confidence level corresponding to the initial anomaly data is greater than a preset confidence threshold.

[0046] The preset reliability threshold can be adjusted according to the actual situation. For example, the preset reliability threshold can be 80% or 75%.

[0047] Specifically, the improved DBSCAN algorithm is used to process and analyze multidimensional feature data, including: identifying outliers based on the density distribution of data points, with outliers being abnormal traffic; dynamically calculating the neighborhood radius based on historical traffic distribution, with an initial minimum sample size of 4, which is temporarily increased to 6 if a sudden traffic surge is detected; and determining the initial abnormal data when the density of outliers is less than the corresponding dynamic threshold.

[0048] The Isolation Forest algorithm is used to process and analyze multidimensional feature data. Specifically, the degree of anomaly of the samples is assessed by the length of random paths; the shorter the path, the higher the anomaly. The average path length of the samples is calculated to obtain the first confidence level. When the first confidence level corresponding to the initial anomaly data is greater than a preset confidence threshold, it is identified as high-risk anomaly data, and an anomaly detection report is generated based on the high-risk anomaly data.

[0049] The anomaly detection report includes a timestamp, traffic ID, anomaly score, and confidence quadruple.

[0050] By employing the above method, this invention only submits high-confidence anomalies to the sandbox testing module, avoiding resource waste. Low-confidence events are logged for subsequent manual review; high-risk events directly trigger alarms. Furthermore, dynamically adjusting thresholds improves the system's responsiveness to sudden traffic surges.

[0051] In one embodiment of the present invention, the step of using a preset dynamic fuzzy testing model to perform mutation testing and behavior monitoring on anomaly detection reports to obtain a sandbox test report includes: selecting abnormal traffic packets whose confidence ranking belongs to a preset interval from the anomaly detection reports as input data; using the AFL++ tool to perform mutation testing on the target program of the abnormal traffic packets to obtain an initial mutation strategy; using a genetic algorithm to optimize the initial mutation strategy, covering unexecuted code paths, to obtain a target mutation strategy; and performing behavior monitoring at all times during the mutation testing process to obtain an alarm list; and obtaining a sandbox test report based on the target mutation strategy and the alarm list.

[0052] Specifically, the top 10% or 20% of abnormal traffic packets with the highest confidence levels are selected from the anomaly detection reports as input data for the sandbox testing module. In terms of environment configuration, process-level isolation is enabled in Cuckoo Sandbox, limiting the number of CPU cores and memory; for example, limiting the number of CPU cores to ≤2 and memory to ≤2GB. Virtual network card drivers are installed to simulate a real network communication environment. Next, AFL++ is used to perform mutation tests on the target program, setting a maximum number of mutations and employing a genetic algorithm to optimize the mutation strategy, focusing on covering unexecuted code paths to refine the mutation and obtain the target mutation strategy. Behavior monitoring is performed continuously during the mutation test, detecting alarm events and adding the alarm times to the alarm list. Finally, the target mutation strategy and the alarm list are processed to obtain the sandbox test report.

[0053] Through the configuration method of this embodiment, the present invention can transform static traffic characteristics into executable attack scenario verification, supplementing the attack and defense confrontation data in model training.

[0054] Furthermore, in one embodiment of the present invention, the step of continuously monitoring behavior and obtaining an alarm list during the mutation test includes: using psutil to monitor CPU consumption, and adding an alarm to the alarm list when CPU consumption exceeds a first consumption value and the duration exceeds a first preset time; using auditd to record write permission access operations, and adding an alarm to the alarm list when the creation of hidden files or modification of critical configuration files is detected; using netstat to track non-business port connection information, and adding an alarm to the alarm list when an encrypted tunnel is established; and using strace to monitor the API call chain, and adding an alarm to the alarm list when unexpected process injection or privilege escalation is detected.

[0055] The first consumption value is 90%, and the first preset time is 5 seconds, which can be adjusted according to the actual situation.

[0056] Specifically, the process involves continuous behavioral monitoring during mutation testing. This monitoring includes: using psutil to obtain real-time utilization and monitor CPU consumption; adding an alert when CPU consumption exceeds 90% for more than 5 seconds; using auditd to record write access permissions and monitor file operations, adding an alert when hidden files are created or critical configuration files are modified; using netstat to trace non-business port connections and monitor network connectivity, adding an alert when encrypted tunnels are established; and using strace to capture system calls and monitor API call chains, adding an alert when unexpected process injection or privilege escalation is detected. The data in the alert lists is then analyzed for vulnerabilities, categorized, and labeled with vulnerability types. Corresponding attack path topology diagrams are generated, key intermediate nodes are marked, and a sandbox test report is output, facilitating subsequent targeted protection.

[0057] Through the configuration method of this embodiment, the present invention covers the exploitation methods of many known vulnerabilities by using dynamic sandbox testing and vulnerability discovery, thereby improving the accuracy of vulnerability diagnosis and helping to improve network security protection measures in the future.

[0058] In one embodiment of the present invention, the step of using a deep learning prediction model to perform action prediction and causal inference on anomaly detection reports and sandbox test reports to obtain an attack behavior prediction set includes: obtaining feature sequences from anomaly detection reports and sandbox test reports; processing the feature sequences using gating and attention mechanisms in LSTM networks to obtain action probability distributions and first confidence levels; aggregating the feature sequences using GraphSAGE in GNN networks and performing causal inference on the feature sequences using a preset causal propagation formula to obtain an attack behavior prediction set.

[0059] Furthermore, the pre-defined causal propagation formula is as follows:

[0060] P(a→c)=αP(a)+(1-α)Σ b∈pre(c) P(a→b→c),

[0061] Where P(a→c) is the probability that action a leads to result c, α is the topological sorting confidence coefficient, P(a) is the probability that action a occurs, b∈pre(c) is the set of predecessor nodes of intermediate node b belonging to result c, and P(a→b→c) is the probability that action a leads to intermediate node b, and then intermediate node b leads to result c.

[0062] Preferably, the attack behavior prediction set includes a probability distribution of high-risk actions, confidence intervals, and associated evidence chains.

[0063] Specifically, feature sequences from anomaly detection reports and sandbox test reports are obtained, and these features are mapped to a unified format to generate feature sequences with a time window of 30 days. Because EfficientNetB0 performs excellently and is parameter-efficient in image classification tasks, it is adopted as the base model. Convolutional layers are frozen, and only the top fully connected layer is fine-tuned. FP16 accuracy is used to reduce memory usage while maintaining training stability. The state space and action set are determined. State space parameters include threat score, vulnerability type, and historical similarity; the action set includes blocking requests, logging, and escalating protection. The reward function, state parameters, and action update rules are designed using the Q-learning algorithm. Subsequently, the gating and attention mechanisms of the LSTM network are used for processing. The specific process includes: using a forget gate to control the degree of forgetting of historical information, using an input gate to control the degree of accepting new information, and using an output gate to control the output of hidden states; then, the hidden states are weighted through the attention mechanism to increase their weight; finally, the action probability distribution and the first confidence value are output after weighted averaging and sorting; the attack path labels in the sandbox test report are used as supervision signals to optimize the accuracy of temporal action prediction and obtain the adjusted action probability distribution information.

[0064] In the GNN network, a graph is constructed using process call relationships in the attack chain as edges. Node attributes include process ID, API call frequency, and permission level. GraphSAGE weighted average aggregation is used, and a pre-defined causal propagation formula is used to perform causal inference on the feature sequences to obtain an attack behavior prediction set.

[0065] By adopting the configuration method of this embodiment, the present invention can use the attack behavior prediction set as the core input for multimodal fusion in subsequent steps, support risk classification and judgment, help identify network vulnerabilities, and make targeted additions to the protection response module to improve network security protection.

[0066] In one embodiment of the present invention, the method of fusing anomaly detection reports, sandbox test reports, and attack behavior prediction sets using evidence theory to obtain fused data includes: defining basic probability distribution functions for anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain basic probability allocation information; and merging multiple basic probability allocation information using Dempster's combination rule to obtain fused data.

[0067] Specifically, a basic probability allocation function is defined for each data source in the anomaly detection report, sandbox test report, and attack behavior prediction set. This basic probability allocation function represents the degree of trust in the data source. The Dempster combination rule is used to merge multiple basic probability allocation information into a single joint probability allocation information. This joint probability allocation information is then integrated to obtain fused data. First, the detection results from the anomaly detection report and the test results from the sandbox test report are combined to obtain the first joint probability allocation information. Then, the first joint probability allocation information is combined with the prediction results from the attack behavior prediction set to obtain the second joint probability allocation information, i.e., the fused data.

[0068] In one embodiment of the present invention, determining a comprehensive risk assessment report based on fused data, anomaly detection reports, sandbox test reports, and attack behavior prediction sets includes: determining a risk level based on the relationship between fused data and corresponding preset risk thresholds; and integrating the risk level with the corresponding anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain a comprehensive risk assessment report.

[0069] The system queries the corresponding chain of evidence based on the risk level, and generates a comprehensive risk assessment report based on the risk level, key evidence chains, and recommended measures. For example, the risk level is high (confidence = 95%); the related evidence chains are: real-time anomaly detection (confidence = 85%), sandbox testing (confidence = 75%), and behavior prediction (confidence = 80%); the recommended measures are: immediately block related services and activate the emergency response plan.

[0070] In one embodiment of the present invention, the process of performing dynamic whitelist verification, call chain monitoring, and predicted action set matching on the comprehensive risk assessment report to determine the blocking strategy includes: performing dynamic whitelist correction based on a temporary trust strategy and hash verification process; constructing a communication matrix between processes and performing anomaly detection based on the relationship between API call frequency and parameter characteristics and dynamic thresholds; determining the action matching degree based on the action matching degree when an anomaly exists; and determining the blocking strategy based on the action matching degree.

[0071] Specifically, when determining the blocking strategy, the following steps are performed sequentially: dynamic whitelist correction, identification of abnormal data in call chain monitoring, and blocking matching of predicted action sets. First, dynamic whitelist correction is performed based on a temporary trust policy and hash verification process, using SHA-256 signature comparison. Traffic information not yet included in the whitelist is automatically added to an observation period, during which the network access range of the user corresponding to that traffic information is restricted. Next, call chain monitoring is performed on the traffic information added to the observation period, constructing an inter-process communication matrix and recording API call frequency and parameter characteristics. When the API call frequency and parameter characteristics do not meet the corresponding dynamic threshold conditions, it is marked as abnormal data. The action matching degree is determined based on the action matching degree; the blocking strategy is determined based on the action matching degree; and the blocking is implemented according to the blocking strategy. The priority of the blocking strategy is: terminate process > disconnect network > reset session. Alarm information is also sent via email, SMS, and Webhook. This invention sequentially verifies the response action set by using dynamic whitelist verification, call chain monitoring and analysis, and predictive action set matching, and selects the action set with a matching degree greater than a set value. This helps to solve the problem of high false alarm rate caused by the binary judgment logic of "whether the predicted result is completely consistent with the actual action set" in existing methods, which does not consider dynamic factors such as action order and frequency.

[0072] Furthermore, through the configuration method of this embodiment, the present invention overcomes the limitations of traditional single-dimensional detection by using a multi-dimensional feature fusion mechanism, achieving joint analysis of protocol distribution, geographical location, and time series; and through a dynamic sandbox and fuzz testing collaboration, it achieves mutation test-driven environment simulation, covering known vulnerability exploitation methods. This helps solve the problem that traditional sandboxes, which simulate attack paths through preset configuration files, are unable to cope with advanced attack methods that bypass detection, such as encrypted communication decryption and multi-stage attack chains, and have limited vulnerability detection coverage. Secondly, the present invention combines GNN causal reasoning with LSTM time series analysis, improving the accuracy of attack chain identification; and through dynamic threshold adjustment and temporary trust strategies, it improves the system's response speed to new threats.

[0073] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0074] It should be noted that in the description of this invention, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0075] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0076] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0077] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0078] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0079] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0080] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A network security monitoring system based on network security operation, characterized in that, include: The data acquisition module acquires network traffic in real time. Analyze network traffic to obtain quintuple information and metadata; The anomaly detection module analyzes the quintuple information and meta-information to construct multi-dimensional feature data; it dynamically updates the preset threshold library based on the standard deviation of historical traffic fluctuations. The preset threshold library and multidimensional feature data are compared and analyzed to obtain the first detection result; when abnormal feature data is found in the first detection result, the preset anomaly detection algorithm is used to analyze the multidimensional feature data to obtain an anomaly detection report. The sandbox testing module uses a preset dynamic fuzzy testing model to perform mutation testing and behavior monitoring on anomaly detection reports, and obtains sandbox test reports. The behavior prediction module uses a deep learning prediction model to perform action prediction and causal reasoning on anomaly detection reports and sandbox test reports to obtain an attack behavior prediction set. The protection response module uses evidence theory to fuse anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain fused data; A comprehensive risk assessment report is determined based on the fused data, anomaly detection reports, sandbox test reports, and attack behavior prediction sets. The comprehensive risk assessment report is dynamically whitelisted, monitored by the call chain, and matched with predicted action sets to determine the blocking strategy.

2. The network security monitoring system according to claim 1, characterized in that, The analysis of the quintuple information and meta-information to construct multi-dimensional feature data includes: statistically analyzing the proportions of TCP, UDP, and ICMP, calculating protocol entropy values, and obtaining protocol distribution characteristics; using the GeoIP2 library to parse the latitude and longitude coordinates of the source IP, generating a geographic scatter plot density distribution, and obtaining geographic distribution characteristics; and using a sliding window to calculate the mean and standard deviation of traffic, and obtaining the time series characteristics of the standardized sequence.

3. The network security monitoring system according to claim 1, characterized in that, The method of analyzing multidimensional feature data using a preset anomaly detection algorithm to obtain an anomaly detection report includes: determining the neighborhood radius and minimum sample number of the improved DBSCAN algorithm based on historical traffic fluctuations, and identifying outliers in the multidimensional feature data; determining initial anomaly data when the density of outliers is less than the corresponding dynamic threshold; evaluating the degree of anomaly of the multidimensional feature data using the random path length of the isolated forest algorithm to obtain a first confidence level; and determining high-risk anomaly data and generating an anomaly detection report when the first confidence level corresponding to the initial anomaly data is greater than a preset confidence threshold.

4. The network security monitoring system according to claim 1, characterized in that, The method of using a preset dynamic fuzzy testing model to perform mutation testing and behavior monitoring on anomaly detection reports to obtain a sandbox test report includes: selecting abnormal traffic packets with confidence rankings within a preset range from the anomaly detection reports as input data; using the AFL++ tool to perform mutation testing on the target program of the abnormal traffic packets to obtain an initial mutation strategy; using a genetic algorithm to optimize the initial mutation strategy, covering unexecuted code paths, to obtain a target mutation strategy; and continuously monitoring behavior during the mutation testing process to obtain an alarm list; and obtaining a sandbox test report based on the target mutation strategy and the alarm list.

5. The network security monitoring system according to claim 4, characterized in that, The aforementioned behavior monitoring during mutation testing, resulting in an alarm list, includes: using psutil to monitor CPU consumption, adding an alarm when CPU consumption exceeds a first consumption value and lasts for a period exceeding a first preset time; using auditd to record write permission access operations, adding an alarm when hidden files are created or critical configuration files are modified; using netstat to trace non-business port connection information, adding an alarm when an encrypted tunnel is established; and using strace to monitor the API call chain, adding an alarm when unexpected process injection or privilege escalation is detected.

6. The network security monitoring system according to claim 1, characterized in that, The method of using a deep learning prediction model to perform action prediction and causal inference on anomaly detection reports and sandbox test reports to obtain an attack behavior prediction set includes: obtaining feature sequences from anomaly detection reports and sandbox test reports; processing the feature sequences using gating and attention mechanisms in LSTM networks to obtain action probability distributions and first confidence levels; aggregating the feature sequences using GraphSAGE in GNN networks and performing causal inference on the feature sequences using a preset causal propagation formula to obtain an attack behavior prediction set.

7. The network security monitoring system according to claim 6, characterized in that, The pre-defined causal propagation formula is: P(a→c)=αP(a)+(1-α)Σ b∈pre(c) P(a→b→c), Where P(a→c) is the probability that action a leads to result c, α is the topological sorting confidence coefficient, P(a) is the probability that action a occurs, b∈pre(c) is the set of predecessor nodes of intermediate node b belonging to result c, and P(a→b→c) is the probability that action a leads to intermediate node b, and then intermediate node b leads to result c.

8. The network security monitoring system according to claim 1, characterized in that, The method of fusing anomaly detection reports, sandbox test reports, and attack behavior prediction sets using evidence theory to obtain fused data includes: defining basic probability distribution functions for anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain basic probability allocation information; and using Dempster's combination rule to merge multiple basic probability allocation information to obtain fused data.

9. The network security monitoring system according to claim 1, characterized in that, The process of determining a comprehensive risk assessment report based on fused data, anomaly detection reports, sandbox test reports, and attack behavior prediction sets includes: determining the risk level based on the relationship between fused data and corresponding preset risk thresholds; and integrating the risk level with the corresponding anomaly detection reports, sandbox test reports, and attack behavior prediction sets to obtain a comprehensive risk assessment report.

10. The network security monitoring system according to claim 1, characterized in that, The process of performing dynamic whitelist verification, call chain monitoring, and predictive action set matching on the comprehensive risk assessment report to determine the blocking strategy includes: dynamic whitelist correction based on temporary trust policies and hash verification procedures; constructing a communication matrix between processes and performing anomaly detection based on the relationship between API call frequency, parameter characteristics, and dynamic thresholds; determining the action matching degree based on the action matching degree when anomalies are found; and determining the blocking strategy based on the action matching degree.

Images