Method and system for dynamically constructing asset topological graph based on Suricata7 + Beaver
By dynamically constructing asset topology maps using the Suricata7+Beaver system, the problems of update lag and bandwidth consumption in traditional topology construction schemes are solved, enabling real-time, low-disturbance network management and security monitoring, and supporting dynamic interaction and risk visualization.
Patent Information
- Application Number
- CN202511561779.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-29
- Publication Date
- 2025-12-12
AI Technical Summary
Traditional asset topology construction solutions cannot meet the management requirements of real-time, correlation and low disturbance. They rely on static detection methods with long update cycles, lack analysis of protocol interaction relationships, and are disconnected from the topology structure. Active detection consumes bandwidth and cannot effectively utilize passive traffic information.
The system uses Suricata7+Beaver to construct a dynamic asset topology map through passive traffic parsing, multi-source log aggregation, Elasticsearch mapping, Flink window aggregation, time decay and PageRank enhancement algorithms, and adopts D3.js force-directed layout and WebSocket for real-time updates.
It enables real-time updates of the asset topology map, reduces bandwidth consumption by active probing, improves the correlation analysis capability of security events, supports dynamic interaction and risk visualization, and enhances the efficiency of network management and security monitoring.
Smart Images
Figure CN121125334A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to the technical field of network security, and in particular to a method and system for dynamically constructing an asset topology graph based on Suricata7+Beaver. BACKGROUND
[0002] The current enterprise network scale continues to expand, the asset type and the communication protocol are increasingly complex, and the traditional asset topology construction scheme has been difficult to meet the real-time, correlation and low disturbance management requirements, and mainly has three key defects: firstly, relying on the static detection mode such as Nmap scanning, the topology information update period is long, and the real-time network state cannot be synchronously reflected; secondly, the depth analysis ability of the protocol interaction relationship is lacked; and thirdly, the security event and the topology structure are seriously disconnected, and the alarm information generated by the security detection system such as OpenVAS only contains an isolated IP address or a vulnerability number, and an intelligent correlation mechanism is lacked between the asset database, and an operation and maintenance personnel is difficult to quickly judge the risk influence range.
[0003] Further, the mainstream solutions in the industry such as SolarWinds, Zabbix and the like still have significant limitations: on the one hand, an active detection mechanism is adopted, and network bandwidth resources are additionally occupied; on the other hand, the integration ability of passive flow monitoring data is lacked, and real-time communication information contained in the network mirror flow cannot be effectively utilized; in addition, the topology information refresh delay is significant, and the update period of SolarWinds and Zabbix is long, and it is difficult to meet the demand of the enterprise on real-time control of the network state. In view of this, a method and system for dynamically constructing an asset topology graph based on Suricata7+Beaver are explored and researched. SUMMARY
[0004] The application provides a method and system for dynamically constructing an asset topology graph based on Suricata7+Beaver, to solve the technical problems in the background art.
[0005] To solve the above problems, the technical scheme of the application is as follows: A method for dynamically constructing an asset topology graph based on Suricata7+Beaver, comprising the following steps: Step 1: data acquisition, real-time analysis of network flow by Suricata, and aggregation of firewall, proxy server and the like logs by Beaver; Step 2: data processing, IP asset mapping is performed to establish the corresponding relationship between IP and asset ID, threat events are aggregated by Flink sliding window, logs are cleaned and converted, and NVD vulnerability library is associated to supplement relevant information; Step 3: Data analysis, build a graph model with standardized asset ID as node, communication frequency between assets and CVE propagation path as edge, introduce time decay factor and PageRank initial value addition algorithm improvement of high-risk CVE association; Step 4: Data visualization, use D3.js dynamic topology map, force-directed layout, dynamic interaction, risk heat map, and real-time update through WebSocket.
[0006] Preferably, in step 1, Suricata uses eBPF technology to capture network traffic, uses BPF ring buffer to realize zero-copy kernel-user space communication, integrates pyasn library in user space program to realize real-time mapping of IP to ASN, generates structured EVE-JSON logs containing AS source / target IP, protocol type, CVE associated attack characteristics, etc., and EVE-JSON uses hierarchical structure to record alerts, HTTP requests, TLS handshake events, etc., and forwards them to the data processing layer through Logstash or Filebeat.
[0007] Preferably, in step 2, IP asset mapping is used to establish a mapping relationship between IP and asset ID using Elasticsearch, supplemented by GeoIP2 geographic information, and Elasticsearch index contains ip, asset_id, hostname, dept, tags, geo, asn, updated_at, etc. ; Flink sliding window aggregation uses 5-minute window and 1-minute step, uses FPGA acceleration rule matching to aggregate threat events in the window into spatio-temporal event stream, outputs JSON format metadata containing timestamp, AS number, CVE-ID, etc., and the same asset and CVE in the window are merged and counted, producing asset risk event stream; log cleaning is performed by Beaver engine to clean the original log, converting IP field to standard asset ID, retaining timestamp and risk label.
[0008] Preferably, in step 3, the communication edge weight of the graph model is the standardized communication frequency between assets, and the propagation edge adds and superimposes the risk propagation weight according to the same CVE alarm sequence between assets in the same window; the time decay factor applies a gain coefficient α∈[1.1,1.5] to the edge weight of the near window, and the default α=1.3, where the historical edge weight is updated according to the formula wt=wt−1⋅λ+Δw⋅α, where λ∈(0,1), wt is the current edge weight, wt−1 is the historical edge weight, and Δw is the incremental edge weight; the PageRank initial value increases the initial value of 0.2 for high-risk CVE associated assets with CVSS≥7.0, and the PageRank initial value of associated assets increases by 0.3 for CVE with CVSS≥9.0.
[0009] Preferably, in step 4, the asset node under force-directed layout scales the radius according to the PageRank value, and the edge width reflects the communication strength; dynamic interaction supports the click node to display the associated CVE list and repair suggestions, and double-click focuses on the sub-network; the risk heat map generates a geographical layer superimposed based on asset keyness and vulnerability density; the WebSocket receives the flow data processed by Beaver, triggers a smooth transition animation, and the WebSocket message contains information such as graph increment, node, edge, and alarm.
[0010] Preferably, the data analysis module includes a graph model construction unit and an algorithm optimization unit, the graph model construction unit is used to define asset nodes and communication and propagation edges, and the algorithm optimization unit is used to perform time decay factor calculation and PageRank initial value addition logic.
[0011] In addition, the application also provides a system for dynamically constructing an asset topology graph based on Suricata7+Beaver, which comprises a data acquisition module, a data processing module, a data analysis module and a data visualization display module.
[0012] Preferably, the data acquisition module deploys Suricata7.0+ as a flow sensor, and a Beaver log collection cluster composed of a Master node, a Broker node and a Datanode node, the Master node is responsible for metadata management and task scheduling, the Broker node processes query request routing, and the Datanode node serves as an actual storage and calculation unit.
[0013] The above technical scheme of the application has the following beneficial technical effects: The application effectively solves the pain points of traditional topology construction, such as "update lag, active detection occupies bandwidth, and security event isolation", through the cooperative collection of Suricata passive flow analysis and Beaver multi-source log aggregation, the fine processing of Elasticsearch asset mapping and Flink window aggregation, the intelligent analysis of time decay and PageRank addition, and the dynamic visualization of D3.js force-directed graph and WebSocket real-time update. BRIEF DESCRIPTION OF DRAWINGS
[0014] Figure 1 The flowchart of the application for dynamically constructing an asset topology graph based on Suricata7+Beaver. DETAILED DESCRIPTION
[0015] In order to make the objects, technical solutions and advantages of the present application clearer and more comprehensible, the present application will be further described in detail below with specific embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present application. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present application.
[0016] The following will be described in detail below with specific embodiments, and the accompanying drawings will be described. Figure 1 Further detailed description of the present application, a system for dynamically constructing asset topology based on Suricata7+Beaver, the system includes data acquisition module, data processing module, data analysis module and data visualization module.
[0017] In one embodiment, the data acquisition module deploys Suricata7.0+ as a traffic sensor, and a Beaver log collection cluster composed of Master node, Broker node and Datanode node, the Master node is responsible for metadata management and task scheduling, the Broker node handles query request routing, and the Datanode node is used as an actual storage and computing unit.
[0018] In one embodiment, the data analysis module includes a graph model construction unit and an algorithm optimization unit, the graph model construction unit is used to define asset nodes and communication and propagation edges, and the algorithm optimization unit is used to perform time decay factor calculation and PageRank initial value addition logic.
[0019] The present application also provides a method for dynamically constructing asset topology based on Suricata7+Beaver, comprising the following steps: Step 1: data acquisition, real-time analysis of network traffic by Suricata, and aggregation of firewall, proxy server and other logs by Beaver; Step 2: data processing, IP asset mapping is performed to establish the correspondence between IP and asset ID, threat events are aggregated by Flink sliding window, logs are cleaned and converted, and related information is supplemented by associating NVD vulnerability database; Step 3: data analysis, a graph model is constructed with standardized asset ID as nodes, asset communication frequency and CVE propagation path as edges, time decay factor and PageRank initial value addition algorithms related to high-risk CVE are introduced for improvement; Step 4: data visualization display, D3.js dynamic topology is used, force-directed layout is presented, dynamic interaction is supported, risk heat map is generated, and real-time update is realized through WebSocket.
[0020] Specifically, in step 1, Suricata captures network traffic using eBPF technology, implements zero-copy kernel-user space communication using a BPF ring buffer, and integrates a pyasn library in the user space program to realize real-time mapping of IP to ASN. The user space program generates structured EVE-JSON logs containing fields such as AS source / destination IP, protocol type, and CVE-associated attack features. EVE-JSON uses a hierarchical structure to record events such as alerts, HTTP requests, and TLS handshakes, and forwards them to the data processing layer via Logstash or Filebeat.
[0021] Specifically, in step 2, IP asset mapping is used to establish a mapping relationship database between IP and asset ID using Elasticsearch. GeoIP2 is used to supplement geographic information, and the Elasticsearch index contains fields such as ip, asset_id, hostname, dept, tags, geo, asn, and updated_at. Flink sliding window aggregation uses a 5-minute window and a 1-minute step, and uses FPGA-accelerated rule matching to aggregate threat events within the window into a spatio-temporal event stream. The output includes JSON-formatted metadata such as timestamps, AS numbers, and CVE-IDs. The same asset and CVE within the window are combined and counted, resulting in an asset risk event stream. Log cleaning is performed using the Beaver engine to clean the original logs, convert IP fields to standard asset IDs, and retain timestamps and risk labels.
[0022] Specifically, in step 3, the communication edge weight of the graph model is the standardized communication frequency between assets, and the propagation edge adds and superimposes a risk propagation weight based on the chronological relationship of the same CVE alerts between assets within the same window. The time decay factor applies a gain coefficient α∈[1.1,1.5] to the edge weight of the near window, with a default α=1.3. The historical edge weight is updated according to the formula wt=wt−1⋅λ+Δw⋅α, where λ∈(0,1), wt is the current edge weight, wt−1 is the historical edge weight, and Δw is the incremental edge weight. The PageRank initial value increases by 0.2 for assets associated with high-risk CVEs with a CVSS≥7.0, and increases by 0.3 for assets associated with CVEs with a CVSS≥9.0.
[0023] Specifically, in step 4, the asset node under the force-directed layout scales the radius according to the PageRank value, and the edge width reflects the communication strength; dynamic interaction supports the click node to display the associated CVE list and repair suggestions, and double-click focuses on the sub-network; the risk heat map generates a geographical layer superimposed based on asset keyness and vulnerability density; the WebSocket receives the flow data processed by Beaver, triggers a smooth transition animation, and the WebSocket message contains information such as graph increment, node, edge and alarm.
[0024] In summary, the application provides a method and system for dynamically constructing an asset topology graph based on Suricata7+Beaver, which effectively solves the pain points of traditional topology construction, such as "update lag, active detection bandwidth occupation, and security event isolation", through the cooperative collection of Suricata passive traffic analysis and Beaver multi-source log aggregation, the fine processing of Elasticsearch asset mapping and Flink window aggregation, the intelligent analysis of time decay and PageRank addition, the dynamic visualization of D3.js force-directed graph and WebSocket real-time update. Users can dynamically track and monitor the geographical location of assets, intuitively and dynamically grasp the geographical location distribution and status of devices, thereby significantly improving the efficiency of network management and security monitoring. The dynamic topology graph is rendered according to risk differences, supports clicking to check CVE details, and double-clicking to focus on the sub-network. Compared with 3D visualization, it is more suitable for operation and maintenance needs, and can be widely applied to network communication, network security, asset management and other scenarios, and finally realizes efficient, low-disturbance and intelligent asset management and control.
[0025] The above is only a preferred embodiment of the application, which is used to help understand the method and its core idea, and the protection scope of the application is not limited to the above-mentioned embodiments. Any technical solution within the scope of the application should be included in the protection scope of the application. It should be noted that for ordinary skilled persons in the art, some improvements and decorations without departing from the principles of the application should also be considered as the protection scope of the application. The above-mentioned is only a preferred embodiment of the application, which is used to help understand the method and its core idea, and the protection scope of the application is not limited to the above-mentioned embodiments. Any technical solution within the scope of the application should be included in the protection scope of the application. It should be noted that for ordinary skilled persons in the art, some improvements and decorations without departing from the principles of the application should also be considered as the protection scope of the application.
Claims
1. A method for dynamically constructing an asset topology map based on Suricata7+Beaver, characterized in that, Includes the following steps: Step 1: Data collection. Network traffic is analyzed in real time using Suricata, and Beaver is used to aggregate logs from firewalls, proxy servers, etc. Step 2: Data processing, IP asset mapping to establish the correspondence between IP and asset ID, aggregation of threat events through Flink sliding window, cleaning and transformation of logs, and association with NVD vulnerability database to supplement relevant information; Step 3: Data analysis, constructing a graph model with standardized asset IDs as nodes, inter-asset communication frequency and CVE propagation path as edges, and introducing algorithm improvements such as time decay factor and PageRank initial value addition for high-risk CVE association; Step 4: Data visualization is presented using a dynamic topology map based on D3.js, with a force-oriented layout that supports dynamic interaction, generates a risk heat map, and updates it in real time via WebSocket.
2. The method for dynamically constructing an asset topology map based on Suricata7+Beaver according to claim 1, characterized in that, In step 1, Suricata uses eBPF technology to capture network traffic, utilizes the BPF ring buffer to achieve zero-copy kernel-user space communication, integrates the pyasn library into the user-space program to achieve real-time mapping from IP to ASN, and generates structured EVE-JSON logs containing fields such as AS source / target IP, protocol type, and CVE-related attack characteristics. The EVE-JSON uses a hierarchical structure to record events such as alarms, HTTP requests, and TLS handshakes, and forwards them to the data processing layer via Logstash or Filebeat.
3. The method for dynamically constructing an asset topology map based on Suricata7+Beaver according to claim 1, characterized in that, In step 2, IP asset mapping uses Elasticsearch to establish a mapping relationship database between IP and asset ID, and GeoIP2 is used to supplement geographical information. The Elasticsearch index contains fields such as ip, asset_id, hostname, dept, tags, geo, asn, updated_at; Flink sliding window aggregation uses a 5-minute window and a 1-minute step size. It uses FPGA to accelerate rule matching and aggregates threat events within the window into a spatiotemporal event stream. It outputs metadata in JSON format, including timestamps, AS numbers, and CVE-IDs. The same CVE for the same asset is merged and counted within the window to produce an asset risk event stream. Log cleaning uses the Beaver engine to clean the raw logs, converting the IP field into a standard asset ID while retaining the timestamp and risk label.
4. The method for dynamically constructing an asset topology map based on Suricata7+Beaver according to claim 1, characterized in that, In step 3, the communication edge weights of the graph model are standardized inter-asset communication frequencies, and the propagation edges are added and superimposed with risk propagation weights based on the order of the same CVE alarms among assets within the same window. The time decay factor applies a gain coefficient α∈[1.1,1.5] to the edge weights near the window, with a default α=1.
3. The historical edge weights are updated according to the formula wt=wt−1⋅λ+Δw⋅α, where λ∈(0,1), wt is the current edge weight, wt−1 is the historical edge weight, and Δw is the increment of the new edge weight. The initial PageRank value is increased by 0.2 for high-risk CVEs with CVSS ≥ 7.0, and by 0.3 for CVEs with CVSS ≥ 9.
0.
5. The method for dynamically constructing an asset topology map based on Suricata7+Beaver according to claim 1, characterized in that, In step 4, the radius of asset nodes in the force-directed layout is scaled according to the PageRank value, and the edge width reflects the communication strength; dynamic interaction supports clicking on nodes to display the associated CVE list and remediation suggestions, and double-clicking to focus on subnetworks; the risk heatmap generates a geographic layer overlay based on asset criticality and vulnerability density; the streaming data processed by Beaver is received via WebSocket, triggering a smooth transition animation, and the WebSocket message contains information such as graph increment, nodes, edges and alarms.
6. A system for dynamically constructing asset topology maps based on Suricata7+Beaver, characterized in that, The system includes a data acquisition module, a data processing module, a data analysis module, and a data visualization module.
7. A system for dynamically constructing asset topology maps based on Suricata7+Beaver according to claim 6, characterized in that, The data acquisition module deploys Suricata 7.0+ as a traffic sensor and a Beaver log collection cluster consisting of a Master node, Broker node, and Datanode node. The Master node is responsible for metadata management and task scheduling, the Broker node handles query request routing, and the Datanode node serves as the actual storage and computing unit.
8. A system for dynamically constructing asset topology maps based on Suricata7+Beaver according to claim 6, characterized in that, The data analysis module includes a graph model construction unit and an algorithm optimization unit. The graph model construction unit is used to define asset nodes and communication and propagation edges, while the algorithm optimization unit is used to perform time decay factor calculation and PageRank initial value addition logic.