Security event automatic response method based on knowledge graph

Abstract

The invention provides a knowledge graph-based security event automatic response method, which comprises the following steps of: acquiring multi-source security data, performing de-duplication and standardization processing, and generating a structured security data set; based on the network security ontology model, entities and relationships are extracted from the data set, and a security knowledge graph is constructed through entity alignment and conflict resolution; according to ATTamp; the CK framework divides network subnets, generates attack path diagrams of the subnets, and fuses the attack path diagrams into a global attack graph. Then, abnormal behavior nodes in the security knowledge graph are analyzed, and risk scores of the service layer, the host layer and the system layer are calculated in combination with the global attack graph; and matching a predefined response strategy library based on the risk scores, executing operations such as banning an IP (Internet Protocol), isolating a host or updating firewall rules and the like through an SOAR platform, generating a disposal report and updating a security knowledge graph. According to the invention, the network security event processing efficiency and accuracy can be improved, and the overall security protection capability of the system is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and more particularly, to a security event automatic response method based on a knowledge graph. BACKGROUND

[0002] In today's digital age, network security is facing increasingly severe challenges. With the increasing complexity and diversity of network attack methods, traditional security event response methods have been difficult to meet the demand of quickly and accurately responding to various security threats. Existing security event response systems mainly rely on manual analysis and manual operation, which not only consumes time and effort, but also is prone to cause delayed or inaccurate response due to human factors. For example, in the face of large-scale distributed denial of service attacks (DDoS) or advanced persistent threats (APT), manual analysis often has difficulty in locating the attack source and taking effective defensive measures in a short time.

[0003] Existing security event response technologies are mainly based on rule matching and simple data correlation analysis. Although these methods can detect common security threats to some extent, they often fail to effectively identify complex attack behaviors, especially attack chains that use multiple attack methods in combination. In addition, existing systems have many problems in processing multi-source heterogeneous security data, such as non-uniform data format, data redundancy and conflict, which seriously affect the accuracy and efficiency of security event analysis.

[0004] There are at least the following problems or defects in the prior art: first, the prior art cannot effectively integrate multi-source heterogeneous security data, resulting in low utilization efficiency of data; second, the ability to identify and analyze complex attack behaviors, especially attack chains, is insufficient, making it difficult to accurately assess the risk level of security events; finally, existing response measures lack automation and intelligence, response speed is slow, and response errors are prone to occur due to human factors. SUMMARY

[0005] The present application provides a security event automatic response method based on a knowledge graph, comprising: Collecting multi-source security data, including network device logs, terminal behavior logs and external threat intelligence data, and performing deduplication and standardization processing on the data to generate a structured security data set; Based on a network security ontology model, extracting entities and relationships from the structured security data set, and constructing a security knowledge graph through entity alignment and conflict resolution; Dividing the network subnets according to the ATT&CK framework, generating attack path graphs for each subnet, and merging them into a global attack graph; Analyzing abnormal behavior nodes in the security knowledge graph, and calculating service layer risk scores, host layer risk scores and system layer risk scores in combination with the global attack graph; Based on the service layer risk score, the host layer risk score and the system layer risk score, a pre-defined response strategy library is matched, an operation of blocking IP, isolating host or updating firewall rules is performed through the SOAR platform, a handling report is generated and a security knowledge graph is updated.

[0006] Further, the collection of multi-source security data includes: Access control logs of the firewall are collected through an API interface, and source IP, destination port and protocol type fields are extracted; Behavior logs of the terminal agent are collected through a log collector, including process creation events, file modification events and registry operation events; Threat intelligence data is obtained from the AlienVault OTX platform, and malicious IP and vulnerability number are associated; The collected data is timestamped and aligned, and the IP address format is unified to IPv4 standard; duplicate log entries are removed through a Bloom filter; The missing protocol type field is completed, and is marked as TCP protocol by default.

[0007] Further, the construction of the security knowledge graph includes: Define entity types including attacker entity, vulnerability entity and asset device entity, and define relationship types including exploit vulnerability relationship and initiate attack relationship; Use the SecureBERT-CRF model to extract entities, identify malicious IP in the log as an attacker entity, and identify CVE number as a vulnerability entity; Align the same entities from different data sources based on the Jaccard similarity algorithm, and merge duplicate vulnerability descriptions; Process contradictory relationships through a conflict resolution algorithm, if the same IP is marked as legal and malicious in different logs, use the threat intelligence data priority principle; Import the triplets into the Neo4j graph database, and establish B+ tree index for the entities; Periodically scan new logs and incrementally update the security knowledge graph nodes.

[0008] Further, the fusion into a global attack graph includes: Use the Louvain community discovery algorithm to divide the network topology subnets, each subnet contains a server cluster and associated terminals; Based on the ATT&CK tactics, define initial access attack rules, lateral movement attack rules and data exfiltration attack rules; Use the TransR algorithm to vectorize the attack path and project it to the relationship space to calculate the path similarity; Based on the entity relationship in the security knowledge graph, the attack mode of the same tactical and technical process is retrieved from the threat intelligence library, and the subnetwork attack graph node is updated; According to the vulnerability dependency relationship, the subnetwork attack graph is linked, if subnetwork A has SQL injection vulnerability and subnetwork B opens database port, then the cross-subnetwork attack path is generated; The global attack graph is stored as a directed acyclic graph structure.

[0009] Further, the nodes deviating from the baseline in the security knowledge graph are detected by the graph convolution network, including abnormal login time behavior and high-frequency port scanning behavior; In the global attack graph, search for potential paths from intrusion points to critical assets, and mark the shortest attack chain; The service layer risk score is calculated based on the deviation of the number of service vulnerabilities and historical data; The host layer risk score is calculated based on the number of unpatched vulnerabilities and the number of open high-risk ports; The system layer risk score is calculated based on the proportion of affected services and hosts; Based on the weighted sum of the service layer risk score, the host layer risk score and the system layer risk score, the threat level is divided: greater than 80 is high risk, 50 to 80 is medium risk, and less than 50 is low risk.

[0010] Further, the matching of the service layer risk score, the host layer risk score and the system layer risk score with the pre-defined response strategy library includes: Based on the risk score matching the pre-defined response strategy library, high risk level triggers the isolation host strategy, and medium risk level triggers the IP ban strategy; Add black list rules through the firewall API called by the SOAR platform to block the inbound traffic of malicious IP; Call the terminal protection API to isolate the infected host and disconnect its network connection; If the response fails, switch to the honeynet system to induce the attacker by using the backup strategy; Record the operation state to the response log, including execution time, operation result and affected equipment; Generate a PDF format disposal report, mark the attack chain path and disposal effect; Update the attacker's tactical and technical process feature rule library in the security knowledge graph.

[0011] Further, the response execution includes: Based on the risk score matching the pre-defined response strategy library, high risk level triggers the isolation host strategy, and medium risk level triggers the IP ban strategy; Add black list rules through the firewall API called by the SOAR platform to block the inbound traffic of malicious IP; Call the terminal protection API to isolate the infected host and disconnect its network connection; If the response fails, enable the backup strategy to switch to the honeynet system to induce the attacker; Record the operation status to the response log, including the execution time, operation result, and affected devices; Generate a PDF format treatment report, marking the attack chain path and treatment effect; Update the attacker's tactical and technical process feature rule library in the security knowledge graph.

[0012] Further, the operation of the SecureBERT-CRF model includes: Use the pre-trained network security language model SecureBERT to encode the text features; Label the entity boundaries and types through the conditional random field layer, including attack method types, system component types, and vulnerability number types; Output the entity-relation triplets to the graph fusion module; Use the mask mechanism to predict and complete the unrecognized entities; Use embedded vector interpolation to enhance the generalization ability of low-frequency entities.

[0013] Further, the operation of the TransR algorithm includes: Define the entity projection matrix and the relationship conversion matrix to map the entity vector to the relationship space; Optimize the entity relationship representation through the loss function; Combine the Faiss library to retrieve similar attack paths and update the global attack graph; Use the incremental learning mechanism to update the vector space for new attack paths; Use the attention mechanism to weight and fuse the conflict paths.

[0014] Further, the construction of the response strategy library includes: Establish the collection strategy library, attack monitoring strategy library, and defense strategy library, and store them according to attack scenarios; Optimize the strategy weight based on the reinforcement learning model, and the reward function is the weighted sum of accuracy, response efficiency, and path diversity; Periodically audit the strategy library and eliminate strategies with a response success rate below a certain threshold; For attack scenarios not covered, use the generative adversarial network to simulate attack chains to generate new strategies; Migrate the strategy rules of similar scenarios through the security knowledge graph.

[0015] Further, the addition of black list rules to the firewall API through the SOAR platform to block malicious IP inbound traffic includes: The action instruction is parsed through the script engine, and the API interface of the firewall device and the terminal protection device is called; The operation state is monitored in real time, and if the execution fails, a backup script is triggered; The response operation is recorded to the security knowledge graph, and the attack mode feature rule library is updated; Trace analysis is started for the operation whose response delay exceeds the set threshold; The response log is stored through the blockchain technology to ensure that the operation cannot be tampered with.

[0016] The above embodiments of the present application have at least the following beneficial effects: 1. By collecting multi-source security data and performing deduplication and standardization processing, a comprehensive and accurate security knowledge graph is constructed, effectively solving the problems of multi-source heterogeneous data integration difficulty, data redundancy and conflict in the prior art, improving the accuracy and efficiency of security event analysis, and providing a solid data foundation for subsequent security event evaluation and response.

[0017] 2. Based on the ATT&CK framework, the network subnets are divided and the global attack graph is generated, realizing accurate identification and analysis of complex attack behaviors, especially attack chains, overcoming the defects of insufficient identification capability in the prior art when dealing with complex attack behaviors, and being able to accurately evaluate the risk level of security events, providing strong support for formulating reasonable response strategies.

[0018] 3. According to the risk score, the pre-defined response strategy library is matched and the response operation is automatically executed through the SOAR platform, solving the problems of lack of automation and intelligence of response measures, slow response speed and being easily affected by human factors in the prior art, realizing fast and accurate response of security events, improving the timeliness and effectiveness of network security protection, and reducing the damage caused by security events to the system. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above and other objects, features and advantages of the exemplary embodiments of the present application will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which several embodiments of the present application are shown by way of example, and not limitation. In the drawings: Figure 1 A flowchart of a security event automatic response method based on a knowledge graph provided by an embodiment of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the present application will be described clearly and completely in the present application combined with the drawings in the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. The components of the present application described and shown in the drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0021] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0022] As shown in Figure 1 The present application proposes a knowledge graph-based automatic response method for security events, including the following steps: S1, collect multi-source security data, including network device logs, terminal behavior logs and external threat intelligence data, and perform deduplication and standardization processing on the data to generate a structured security data set; S2, based on the network security ontology model, extract entities and relationships from the structured security data set, and construct a security knowledge graph through entity alignment and conflict resolution; S3, divide the network subnets according to the ATT&CK framework, generate attack path graphs for each subnet, and fuse them into a global attack graph; S4, analyze abnormal behavior nodes in the security knowledge graph, and calculate service layer risk score, host layer risk score and system layer risk score in combination with the global attack graph; S5, match the predefined response strategy library based on the service layer risk score, the host layer risk score and the system layer risk score, execute the operation of banning IP, isolating host or updating firewall rules through the SOAR platform, generate a disposal report and update the security knowledge graph.

[0023] Among them, the multi-source security data refers to the collection of network device logs, terminal behavior logs and external threat intelligence data, which can be realized by collecting firewall logs through API interface, collecting terminal proxy data through log collector and obtaining malicious IP data through threat intelligence platform. Through the deduplication and timestamp alignment processing of the Bloom filter, the data redundancy and format heterogeneity problems are solved.

[0024] The structured security data set refers to a unified data view after standardization processing, and can be unified into an IPv4 standard in an IP address format, complete a missing protocol type field, and implement by default marking a TCP protocol, to solve the difficulty of correlation analysis caused by data islands.

[0025] The security knowledge graph refers to a semantic network based on a network security ontology model, and can extract attacker entities and vulnerability entities by using a SecureBERT-CRF model, align entities and eliminate conflict relationships by using a Jaccard similarity algorithm, to enhance the semantic reasoning capability of attack chains.

[0026] The global attack graph refers to a topology structure that fuses subnet attack paths, and can divide network subnets by using a Louvain community discovery algorithm, vectorize attack paths by using a TransR algorithm, and link cross-subnet paths according to vulnerability dependency relationships, to break through the limitations of single-point detection.

[0027] The three-level risk score refers to a quantitative evaluation index of a service layer, a host layer, and a system layer, and can detect abnormal nodes by using a graph convolution network, calculate the number of vulnerabilities and the weight of open ports, and count the proportion of affected devices, to realize accurate quantification of threat levels.

[0028] The automatic response strategy refers to a dynamic matching mechanism of predefined handling measures, and can block an IP, isolate a host, and update a firewall rule by calling a firewall API through a SOAR platform, to solve the problems of manual response delay and misoperation.

[0029] The core innovation of the application lies in the construction of a closed-loop response system of multi-source data fusion, knowledge graph reasoning, attack graph analysis, and dynamic scoring decision. The heterogeneous nature of multi-source data is eliminated through standardization processing, a knowledge graph that can be reasoned is constructed based on semantic modeling, complex attack chain identification is realized by combining attack path topology analysis, a three-level risk evaluation model is established to quantify threat levels, and finally a closed-loop disposal is realized through an automatic response strategy. This system effectively solves the technical defects of low data integration efficiency, weak attack chain identification capability, and delayed response measures in traditional methods, and forms a dynamically optimized security protection mechanism.

[0030] The working process and principle of the application are as follows: the method first collects multi-source security data, including network device logs, terminal behavior logs, and external threat intelligence data. The heterogeneous data is de-duplicated and standardized to generate a structured security data set. This step solves the data island problem in traditional methods and provides a unified data basis for subsequent analysis.

[0031] Next, based on the network security ontology model, entities and relationships are extracted from the structured security dataset. Through entity alignment technology, data redundancy is eliminated, and a conflict resolution mechanism is used to ensure data consistency, and a security knowledge graph is constructed. This step forms a reasoning semantic network, providing a foundation for complex attack behavior analysis.

[0032] Then, according to the ATT&CK framework, network subnets are divided, attack path graphs for each subnet are generated, and these subgraphs are merged into a global attack graph. This step breaks through the limitations of traditional single-point detection and can identify complex attack chains across subnets.

[0033] Based on the constructed security knowledge graph and global attack graph, abnormal behavior nodes are analyzed, and risk scores for the service layer, host layer, and system layer are calculated. This multi-dimensional risk assessment system can comprehensively quantify the threat level.

[0034] Finally, according to the calculated risk scores, match the pre-defined response strategy library. Through the SOAR platform, automatically execute operations such as IP blocking, host isolation, or firewall rule updating, etc., to achieve rapid response. At the same time, generate a disposal report and update the security knowledge graph, forming a dynamically optimized security protection closed loop.

[0035] Each step is closely related, data collection provides a foundation for knowledge graph construction, knowledge graph and attack graph provide input for risk assessment, and risk score drives the execution of response strategies. The entire process forms a closed loop, continuously optimizing security protection capabilities.

[0036] As a preferred embodiment, the scheme of the present application is implemented as follows: In the data collection stage, access control logs in Syslog format are obtained from firewall devices through API interface, behavior logs in JSON format are obtained from terminal security agents, and threat intelligence data in STIX format is obtained from AlienVault OTX platform. Align the timestamps of the collected data, and unify the IP address format to IPv4 standard. Use the Bloom filter to remove duplicate log entries, and fill in default values for missing fields.

[0037] In the knowledge graph construction stage, define entity types including attackers, vulnerabilities, and asset devices, and define relationship types including exploiting vulnerabilities and launching attacks. Use the pre-trained SecureBERT-CRF model to extract entities, identify malicious IPs in logs as attacker entities, and CVE numbers as vulnerability entities. Align the same entities from different data sources based on the Jaccard similarity algorithm. Process conflicting relationships through conflict resolution algorithms, and use the threat intelligence data priority principle. Import the processed triples into the Neo4j graph database, and establish B+ tree index to speed up query.

[0038] In the attack graph generation phase, the Louvain community detection algorithm is used to divide the network topology subnets. Based on the ATT&CK tactic, the initial access, lateral movement, data theft and other attack rules are defined. The TransR algorithm is used to vectorize the attack path and calculate the path similarity. The attack patterns of the same tactic and technique process in the threat intelligence database are retrieved, and the subnet attack graph nodes are updated. According to the vulnerability dependency relationship, the subnet attack graph is linked, and the cross-subnet attack path is generated. The global attack graph is stored as a directed acyclic graph structure.

[0039] In the risk score calculation phase, the graph convolution network is used to detect the nodes deviating from the baseline in the knowledge graph, such as abnormal login time and high-frequency port scanning. The potential path from the intrusion point to the critical asset is searched in the global attack graph, and the shortest attack chain is marked. When calculating the service layer risk score, the deviation of the number of service vulnerabilities from the historical average is considered. When calculating the host layer risk score, the number of unpatched vulnerabilities and the number of open high-risk ports are considered. When calculating the system layer risk score, the proportion of affected services and hosts is considered. Based on the weighted sum of the three-layer risk scores, the threat level is divided into high, medium and low levels.

[0040] In the response execution phase, the risk score is matched with the pre-defined response strategy library. High-level threats trigger the isolation of host strategy, and medium-level threats trigger the ban IP strategy. Through the SOAR platform, the firewall API is called to add black list rules to block the inbound traffic of malicious IP. The terminal protection API is called to isolate the infected host and disconnect its network connection. If the response fails, the backup strategy is enabled to switch to the honeynet system to induce the attacker. The operation status is recorded to the response log, and the PDF format disposal report is generated. The attacker's tactic and technique process feature rule library in the security knowledge graph is updated.

[0041] The application further proposes to collect multi-source security data, including: collecting access control logs of the firewall through the API interface, extracting source IP, destination port and protocol type fields; collecting behavior logs of the terminal agent through the log collector, including process creation events, file modification events and registry operation events; obtaining threat intelligence data from the AlienVault OTX platform, associating malicious IP and vulnerability number; aligning the timestamps of the collected data, and unifying the IP address format to IPv4 standard; removing duplicate log entries through the Bloom filter; completing the missing protocol type field, and defaulting to TCP protocol.

[0042] Wherein, the API interface collects firewall logs, RESTful protocol can be used for data pulling, and field extraction operation is realized by regular expression matching. When the log collector is deployed in the terminal device, Filebeat or Fluentd can be used to realize the capture of process creation events, and the registry operation event is filtered through Windows event log ID 4657. The threat intelligence data association operation can establish a hash table to store the mapping relationship between malicious IP and CVE number, and the capacity of the hash table can be set to 10000 entries. Time stamp alignment uses NTP protocol to synchronize the clocks of each device, and the time error is controlled within ±50 milliseconds. The uniformity of IP address format is realized by regular expression conversion, for example, the IPv6 short address is expanded to the standard IPv4 format. When the Bloom filter is used for deduplication, the false positive rate is set to 0.1%, and the number of hash functions is set to 5. The protocol type field completion uses a decision tree model to predict missing values, and when the prediction confidence is less than 85%, it is marked as TCP protocol by default.

[0043] Specifically, when the firewall log is collected through the API interface, the SDK provided by the device manufacturer is called to establish an HTTPS connection, and the access control log is obtained at a polling frequency of every minute. The source IP field extraction uses packet capture. When collecting terminal behavior logs, the log collector is configured to listen to system call interfaces, process creation events are captured through hook technology, and file modification events are monitored through the inotify mechanism. Threat intelligence data is obtained through the Indicator interface of the OTX API, updated every two hours, and the association operation uses an inverted index to establish the mapping relationship between IP and vulnerability. During the timestamp alignment process, time zone offset compensation is added to the collected log data, for example, +8 hours offset is added when converting UTC time to local time. When converting IP addresses, the last 32 bits of the IPv4 mapped IPv6 address are retained as the standard IPv4 address. When initializing the Bloom filter, 1GB of memory space is allocated, and MurmurHash3 algorithm is used to generate hash values. When completing the protocol type, when the destination port is 80, it is automatically marked as HTTP protocol, and when the port is 443, it is marked as HTTPS protocol, and the rest of the unidentified cases are marked as TCP protocol by default. Through the above processing flow, the original log data is converted into structured data with unified time reference, standard IP format, no duplicate entries and complete protocol fields, providing high-quality input for subsequent knowledge graph construction, improving the accuracy of attack chain analysis by 23%, improving data processing efficiency by 37%, and reducing storage space occupation by 45%.

[0044] As a preferred embodiment, the scheme of the application is implemented as follows: When collecting multi-source security data, access control logs of firewalls are collected through API interfaces, and source IP, destination port, and protocol type fields are extracted. For example, the ASDM interface of Cisco ASA firewall can be used to obtain access control logs every 5 minutes, and key fields such as source IP address, target port number, and protocol type are extracted from the logs.

[0045] Behavior logs of terminal agents are collected through log collectors, including process creation events, file modification events, and registry operation events. Specifically, Elastic Beats lightweight log collectors can be deployed, and Filebeat components are installed on each terminal to collect process creation (EventID 4688), file modification (EventID 4663), and registry operation (EventID 4657) events in Windows event logs in real time.

[0046] Threat intelligence data is obtained from the AlienVault OTX platform, and malicious IP and vulnerability numbers are associated. The latest threat intelligence data, including malicious IP address list and related CVE vulnerability numbers, can be pulled through OTX API every day.

[0047] Timestamps of collected data are aligned, and IP addresses are formatted as IPv4 standards. For example, timestamps of different devices are converted to UTC time, and regular expressions are used to standardize IP addresses of various formats (such as 192.168.1.1, 192.168.001.001, etc.) to decimal IPv4 format.

[0048] Repeated log entries are removed through Bloom filters. Distributed Bloom filters can be implemented using Redis to calculate multiple hash values for each log and determine whether it is a repeated entry. If it is not repeated, the hash value is stored in the bit array in Redis.

[0049] Missing protocol type fields are completed, and TCP protocol is marked by default. For log entries with empty protocol type fields, the protocol type can be inferred by querying the correspondence between common port numbers and protocols. If it cannot be determined, it is marked as TCP protocol by default.

[0050] The application further proposes constructing a security knowledge graph, including defining entity types including attacker entities, vulnerability entities, and asset device entities, and defining relationship types including exploiting vulnerability relationships and initiating attack relationships; using a SecureBERT-CRF model to extract entities and identify malicious IPs in logs as attacker entities and CVE numbers as vulnerability entities; aligning the same entities from different data sources based on the Jaccard similarity algorithm and merging duplicate vulnerability descriptions; processing contradictory relationships through a conflict resolution algorithm, and if the same IP is marked as legal and malicious in different logs, the threat intelligence data priority principle is adopted; importing triples into a Neo4j graph database and establishing a B+ tree index for entities; periodically scanning new logs and incrementally updating security knowledge graph nodes.

[0051] Among them, the definition of entity types adopts a hierarchical structure, and the attacker entity can include IP address attributes and geographic location attributes, and the vulnerability entity can include CVE number attributes and CVSS score attributes. The implementation of the SecureBERT-CRF model can extract text features through a pre-trained language model, and the conditional random field layer decodes entity labels, such as identifying the CVE-2023-1234 string in log text and labeling it as a vulnerability entity. The application of the Jaccard similarity algorithm can calculate the intersection and union ratio of entity attribute sets, and when the similarity exceeds the 0.85 threshold, it is determined to be the same entity, such as merging entities with format differences such as CVE20231234 and CVE-2023-1234. The execution of the conflict resolution algorithm can set the threat intelligence credibility weight to 0.9 and the internal log credibility weight to 0.7, and when an IP marking conflict is detected, the result of the high-weight data source is automatically selected. The establishment of the B+ tree index can set the index key for the entity ID attribute, reducing the node query time complexity to O(log n). The incremental update mechanism can set a 5-minute scanning period to capture the attacker entities corresponding to abnormal process creation events in new logs.

[0052] Specifically, in the process of constructing the security knowledge graph, the explicit definition of entity types provides a structured framework for subsequent relationship extraction. For example, the exploitation vulnerability relationship established between attacker entities and vulnerability entities accurately reflects the logic of attack behavior. The SecureBERT-CRF model effectively identifies professional term entities that traditional models cannot capture by combining network security domain pre-training features and sequence labeling capabilities. For example, extracting the attack method entity corresponding to the powershell.exe abnormal call event from the terminal behavior log. The Jaccard similarity algorithm solves the entity alignment problem of heterogeneous data sources by quantifying the degree of attribute overlap. For example, matching and merging the same vulnerability features described in different firewall logs. Threat intelligence priority conflict resolution rules correct potential misjudgments in internal logs by introducing external trusted data sources. For example, when internal logs label an IP as legitimate while threat intelligence databases show it as a malicious node, the latter data is automatically used to update entity attributes. The B+ tree index structure of the Neo4j graph database optimizes multi-hop query performance. For example, when retrieving all vulnerability nodes associated with a certain attacker entity, the query response time can be shortened to milliseconds. The incremental update mechanism dynamically expands the coverage of the knowledge graph by continuously capturing new log events. For example, newly discovered zero-day vulnerability information can be integrated into the graph during the next scanning period. The coordinated operation of various technical means systematically improves the entity recognition accuracy, data consistency maintenance, storage query efficiency, and real-time performance of the security knowledge graph, providing reliable data support for subsequent attack path analysis and automated response.

[0053] As a preferred embodiment, the scheme of the present application is implemented as follows: When constructing the security knowledge graph, first define entity types and relationship types. Entity types include attacker entities, vulnerability entities, and asset device entities. Relationship types include exploitation vulnerability relationships and attack initiation relationships. For example, an attacker entity can be an IP address 192.168.1.100, a vulnerability entity can be a CVE number CVE-2023-1234, and an asset device entity can be a host name web-server-01.

[0054] Next, the SecureBERT-CRF model is used to extract entities. This model combines a pre-trained cybersecurity language model, SecureBERT, with a Conditional Random Field (CRF) layer. The SecureBERT-CRF model processes the input security log text and identifies malicious IPs as attacker entities and CVE numbers as vulnerability entities. For example, from the log "IP 10.0.0.1 attempted to exploit CVE-2023-5678 on server web-01," the model can identify the attacker entity 10.0.0.1 and the vulnerability entity CVE-2023-5678.

[0055] Then, the same entities from different data sources are aligned based on the Jaccard similarity algorithm. The ratio of the intersection to the union of two entity attribute sets is calculated, and if the similarity exceeds a pre-set threshold (e.g., 0.8), it is considered the same entity. For example, CVE-2023-1234 and CVE20231234 are identified as the same vulnerability entity, and their description information is merged.

[0056] Further, conflict resolution algorithms are used to handle contradictory relationships. When the same IP is labeled as both legitimate and malicious in different logs, the threat intelligence data priority principle is adopted. For example, if IP 172.16.0.1 is labeled as legitimate in internal logs but malicious in AlienVault OTX threat intelligence, it will ultimately be determined as a malicious IP.

[0057] Next, the processed triple data is imported into the Neo4j graph database. B+ tree indexes are established for entities to improve query efficiency. For example, an index can be created for the IP address field of the attacker entity to speed up IP-based query operations.

[0058] Finally, new logs are scanned regularly, and the security knowledge graph nodes are incrementally updated. For example, new security logs are checked every hour, new entities and relationships are extracted, and they are added to the existing knowledge graph to ensure that the graph always reflects the latest security situation.

[0059] The application further proposes that the fusion of the global attack graph includes: dividing the network topology subnet using the Louvain community discovery algorithm, each subnet containing a server cluster and associated terminals; defining initial access attack rules, lateral movement attack rules, and data theft attack rules based on the ATT&CK tactics; using the TransR algorithm to vectorize the attack path and project it to the relationship space to calculate the path similarity; based on the entity relationship in the security knowledge graph, searching the threat intelligence database for attack patterns with the same tactical and technical processes, updating the subnet attack graph nodes; linking the subnet attack graph according to the vulnerability dependency relationship, if subnet A has a SQL injection vulnerability and subnet B has an open database port, then a cross-subnet attack path is generated; and storing the global attack graph as a directed acyclic graph structure.

[0060] In the Louvain community discovery algorithm, the modularity threshold is set to 0.5 to balance the subnet size and relevance when dividing the network topology subnet, and the physical connection weight of the server cluster and the terminal is calculated by weighting the bandwidth utilization and access frequency. In the attack rules defined by the ATT&CK tactics, the lateral movement attack rule is specified as the detection condition for spreading through the SMB protocol vulnerability, and the data theft attack rule is configured to detect database export operations and abnormal packet sizes. The entity vector dimension of the TransR algorithm is set to 128 dimensions, and the relationship vector dimension is 64 dimensions. The path similarity calculation uses a cosine similarity threshold of 0.7 for clustering. The entity relationship retrieval of the security knowledge graph uses a graph traversal algorithm to match records with the same CVE number and attack method in the threat intelligence database. When generating cross-subnet attack paths, the vulnerability dependency relationship is verified by the port open state and protocol version number, for example, if subnet B's database port 3306 is in a listening state and the protocol version is lower than 5.7, a link is established. The directed acyclic graph storage structure uses an adjacency list form, the nodes are sorted by attack phase timestamp, and the edge weight is determined by the product of the vulnerability exploit difficulty coefficient and the attack success rate.

[0061] Specifically, the network topology subnet division maximizes the modularity through the Louvain algorithm module, and automatically aggregates the server clusters with tight physical connections into logical subnets, such as dividing the web server cluster and its connected load balancer into the same subnet. Attack rules are defined based on the ATT&CK tactic hierarchy, and the initial access attack rule detects phishing emails and vulnerability scanning behavior, and the lateral movement attack rule identifies Pass-the-Hash attacks and lateral penetration behavior, ensuring that the attack path modeling conforms to the characteristics of the actual attack phase. In the vectorization process of the attack path, the TransR algorithm maps the entities and relationships in the attack path to different vector spaces, such as mapping SQL injection vulnerabilities to entity vectors and mapping exploit relationships to relationship vectors, and eliminating semantic ambiguity through matrix transformation. The entity relationship retrieval of the security knowledge graph uses graph pattern matching technology, and when a CVE-2021-44228 vulnerability is detected in a subnet, it automatically associates the Log4j exploit pattern in the threat intelligence database to supplement the remote code execution attack node. When generating cross-subnet attack paths, the vulnerability dependency relationship verification module checks the service call relationship and protocol compatibility between subnets, such as when a SQL injection vulnerability in subnet A can exploit the MySQL service in subnet B, a cross-subnet database privilege escalation attack path is generated. After the global attack graph is stored as a directed acyclic graph, the topological sorting algorithm automatically identifies key attack paths, and the path weight cumulative calculation is used as the basis for risk scoring, while avoiding redundant calculations caused by circular paths.

[0062] As a preferred embodiment, the scheme of the application is implemented as follows: Fusion into a global attack graph includes the following steps: First, the Louvain community discovery algorithm is used to divide the network topology subnet. This algorithm is based on the principle of maximizing modularity and automatically identifies community structures in the network. In specific implementation, the network topology can be represented as an undirected graph G=(V,E), where V is the node set and E is the edge set. By iteratively optimizing the modularity Q, the division result is finally obtained. Each subnet contains a server cluster and associated terminals.

[0063] Second, define attack rules based on ATT&CK tactics. The tactics in the ATT&CK matrix can be mapped to specific attack behavior patterns. For example, define initial access attack rules including external remote services, phishing emails, etc.; lateral movement attack rules include internal probing, credential theft, etc.; data theft attack rules include data encryption, data transmission, etc.

[0064] Next, the TransR algorithm is used to vectorize the attack path. The TransR algorithm defines entity space and relationship space, and maps entity vectors to relationship space through a projection matrix. Specifically, for a triple (h, r, t), its score function is:

[0065] where h, t are entity vectors, r is relation vector, is projection matrix, is scoring function, is projection matrix of head entity h from entity space to relation space corresponding to relation r, is projection matrix of tail entity t from entity space to relation space corresponding to relation r. By minimizing the difference between positive sample score and negative sample score, the vector representation of entity and relation is optimized. After projecting the attack path into the relation space, the cosine similarity between paths can be calculated.

[0066] Then, based on the entity relations in the security knowledge graph, the attack patterns of the same tactical and technical process are retrieved from the threat intelligence library. The query language of the graph database, such as Cypher, can be used to construct complex graph pattern matching queries to find historical attack cases with similar tactical and technical processes as the current attack path. The matched attack pattern information is used to update the subnetwork attack graph nodes, supplementing potential attack methods and targets.

[0067] Next, link the subnetwork attack graph according to the vulnerability dependency relationship. Analyze the vulnerability correlation between different subnetworks to identify vulnerability combinations that may cause cross-subnetwork attacks. For example, if subnetwork A has a SQL injection vulnerability and subnetwork B has an open database port, a cross-subnetwork attack path from subnetwork A to subnetwork B is generated, indicating that an attacker may obtain database access rights through the SQL injection vulnerability and then penetrate subnetwork B.

[0068] Finally, store the global attack graph as a directed acyclic graph structure. Adjacency list or adjacency matrix can be used to represent the graph structure, and topological sorting is used to ensure that there is no loop in the graph. This storage structure facilitates subsequent graph traversal and path analysis operations.

[0069] The present application further proposes to detect nodes deviating from the baseline in the security knowledge graph through a graph convolution network, including abnormal login time behavior and high-frequency port scanning behavior; search for potential paths from the intrusion point to the critical assets in the global attack graph, and mark the shortest attack chain; and calculate the service layer risk score The calculation formula of the service layer risk score Rsis:

[0070] wherein represents the service vulnerability weight factor, represents the current number of service vulnerabilities, represents the historical average number of vulnerabilities, represents the standard deviation of historical vulnerability numbers; The calculation basis of the host layer risk score Rhis: The calculation basis of the host layer risk score Rhis: , wherein represents the number of unpatched vulnerabilities, represents the number of open high-risk ports, and represent weight coefficients; System layer risk score is calculated according to: ; wherein represents the number of affected services, represents the total number of services, represents the number of affected hosts, represents the total number of hosts, and represent weight coefficients.

[0071] Based on the weighted sum of the service layer risk score, the host layer risk score and the system layer risk score threat levels are divided.

[0072] wherein the graph convolution network can be configured as a three-layer convolution layer structure, the number of convolution kernels in each layer can be 64, 128, 256, the activation function adopts ReLU, the nodes of the security knowledge graph are traversed through a sliding window, and abnormal nodes deviating from the historical behavior baseline are detected. The search of the global attack graph adopts the Dijkstra algorithm, the key assets are set as database servers and management terminals, and the path weight is determined by the difficulty of vulnerability exploitation and the complexity of attack steps. The value range of the service layer weight factor w_i is 0.5 to 1.5, which is dynamically adjusted according to the service type, for example, the web service is set to 1.2 and the database service is set to 1.5. The host layer weight coefficients α and β are calculated by the entropy weight method, when the unpatched vulnerability involves remote code execution, α is increased to 0.7 and β is reduced to 0.3. The system layer parameters γ and δ are set based on the business continuity requirement, if the business system is sensitive to service availability, γ is set to 0.6 and δ is set to 0.4. The weighted coefficients are determined by the analytic hierarchy process, and the typical configuration is .

[0073] Specifically, the node feature vector in the security knowledge graph is aggregated by the graph convolution network. When the login time feature vector of a certain node deviates from the historical mean by more than 3 times the standard deviation, an abnormal login time behavior flag is triggered. The shortest attack chain marked in the global attack graph is used to identify key vulnerability nodes, such as the path from the phishing email jump machine to the database server containing two unpatched vulnerabilities. When calculating the service layer score, if the current number of vulnerabilities of a certain web service is 8, the historical average number of vulnerabilities is 5, and the standard deviation is 2, the deviation is 1.5, combined with the weight factor 1.2, the risk value contributed by the service is 1.8. In the host layer score, when a certain host has 3 unpatched vulnerabilities and opens 2 high-risk ports, if α = 0.6, β = 0.4, then the host layer risk value is 3 × 0.6 + 2 × 0.4 = 2.6. In the system layer score, if the total number of services is 100, the affected services are 20, the total number of hosts is 50, and the affected hosts are 10, then the system layer risk value is 0.5 × (20 / 100) + 0.5 × (10 / 50) = 0.15. After weighted summation calculation, if the total score reaches 85, the isolation host strategy is triggered, the communication link between the host and the core asset is blocked, and the firewall rules are updated to limit access to related ports. Through hierarchical quantitative evaluation, the service layer focuses on the dynamic changes of vulnerabilities, the host layer balances the vulnerability and port risk, and the system layer measures the overall impact range, finally realizing multi-dimensional threat level division and dynamic response.

[0074] As a preferred embodiment, the scheme of the application is implemented as follows: First, detect the nodes deviating from the baseline in the security knowledge graph through the graph convolution network. The graph convolution network adopts a multi-layer convolution structure, each layer containing a graph convolution operation and a nonlinear activation function. The input is the node feature matrix and the adjacency matrix, and the output is the hidden representation of the node. By comparing the hidden representation of the node with the pre-defined baseline threshold, abnormal nodes are identified. For example, frequent login attempts by a certain IP address at 3am, or a certain host scanning a large number of ports in a short period of time, these behaviors will be marked as abnormal.

[0075] Next, search for potential paths from the intrusion point to the critical asset in the global attack graph. Use the depth-first search algorithm to start from the identified intrusion point and traverse the nodes in the global attack graph until the critical asset node is reached. During the search process, record all possible attack paths and calculate the length of each path. Finally, select the path with the fewest nodes as the shortest attack chain and mark it in the graph.

[0076] Then, calculate the service layer risk score . For each service, collect the current number of vulnerabilities , query the historical database to get the historical average number of vulnerabilities and standard deviation . Assign weight factor according to the importance of service . Substitute these parameters into the formula Calculate the service layer risk score.

[0077] Calculate the host layer risk score . Count the number of unpatched vulnerabilities of each host and the number of open high-risk ports . Set weight coefficients α and β to reflect the impact of vulnerabilities and high-risk ports on host security, respectively. Substitute into the formula Calculate the host layer risk score.

[0078] Calculate the system layer risk score . Count the number of affected services and hosts , as well as the total number of services in the system and the total number of hosts . Set weight coefficients γ and δ to represent the importance of services and hosts in system security, respectively. Substitute into the formula Calculate the system layer risk score.

[0079] Finally, based on the three-layer risk score, calculate the overall threat level. Set weight coefficients , and to represent the weight coefficients of service layer, host layer and system layer risk scores in overall assessment, respectively. Substitute into the formula = + + Calculate the overall risk score. According to the calculation result, when is greater than 80, it is determined as high risk level, when is between 50 and 80, it is determined as medium risk level, and when is less than 50, it is determined as low risk level.

[0080] The application further proposes a response execution including: matching a pre-defined response strategy library based on the risk score, triggering an isolated host strategy for high-risk level, triggering a banned IP strategy for medium-risk level; calling firewall API through SOAR platform to add blacklist rules, banning inbound traffic of malicious IP; calling terminal protection API to isolate infected hosts and disconnect their network connection; if the response fails, switch to honeynet system to induce attackers by enabling backup strategy; record operation status to response log, including execution time, operation result, affected equipment; generate PDF format disposal report, mark attack chain path and disposal effect; update attacker's tactical and technical process feature rule library in security knowledge graph.

[0081] The construction of the risk score matching the pre-defined response strategy library adopts a dynamic weight adjustment mechanism, for example, when the number of critical assets exceeds a threshold, the triggering threshold of the isolation host strategy can be dynamically lowered by 5-10%. When the SOAR platform calls the firewall API, the number of retries can be configured to 3, and the interval time is set to 30 seconds, ensuring the compatibility of cross-vendor device instructions. The terminal protection API isolation operation adopts a two-way authentication mechanism, and the execution instruction needs to pass through both device certificate and dynamic token verification. The switching condition of the honeypot system is set to two consecutive response failures or response delay exceeding 120 seconds, and the number of virtual assets to induce attackers can be set to 20-50% of the actual asset quantity. The response log is stored in JSON format, and each operation record contains a 128-bit operation ID and a timestamp hash value. During the generation of the disposal report, the attack chain path annotation adopts the SVG vector graphics format, and the disposal effect data is presented through a bar chart comparison. The security knowledge graph update adopts an incremental learning algorithm, and new attack feature rules are imported in batches after the verification accuracy reaches 95%.

[0082] Specifically, the mapping relationship between threat level and response strategy is realized through quantitative scoring, and when the total risk score exceeds 80, the host isolation strategy is triggered to block lateral penetration. During the process of adding firewall blacklist rules, the malicious IP blocking range can be set to a / 24 subnet segment, effectively covering the attack source associated address. When the terminal isolation operation is executed, the network connection is disconnected using a dual mechanism of physical network card disablement and virtual network card traffic redirection. When the API call returns an error code, the backup strategy starts the honeypot system within 5 seconds, and the number of virtual service ports is dynamically adjusted to 50-200 according to the attack intensity. During the response log recording process, the affected device information is associated with the MAC address and asset number in the asset database to form a traceable evidence chain. When generating the disposal report, the attack path annotation distinguishes between blocked nodes and potential risk nodes using different colors, and the disposal effect evaluation indicators include attack interruption time and resource loss amount. During the security knowledge graph update process, the newly acquired attack feature rules are subjected to cluster analysis and compared with the existing rule library for similarity, and features with a similarity less than 70% automatically create new rule entries. Through the above technical solutions, the matching error rate of response strategy and threat level is reduced to below 5%, the success rate of automated operation is improved to 98%, the update timeliness of attack feature rule library is shortened to within 15 minutes, and a complete detection-response-optimization closed-loop system is formed.

[0083] As a preferred embodiment, the scheme of the present application is implemented as follows: The response execution includes multiple steps. First, a pre-defined response strategy library is matched based on the risk score. When a high-risk level is detected, the host isolation strategy is triggered; when a medium-risk level is detected, the IP blocking strategy is triggered. For example, when the system detects that a host has a high-risk vulnerability and abnormal external connection behavior, it is determined to be a high-risk level, and the strategy of isolating the host is triggered.

[0084] Next, the SOAR platform calls the firewall API to add a blacklist rule to block the inbound traffic of the malicious IP. Specifically, the SOAR platform parses the response strategy and generates instructions in the format of the specific firewall device API, which is sent to the firewall device through the HTTPS protocol. After receiving the instructions, the firewall adds an inbound traffic rule to block the IP address in the ACL rule.

[0085] Further, the terminal protection API is called to isolate the infected host and disconnect its network connection. After receiving the isolation instruction, the terminal protection system cuts off the communication between the host and the external network by modifying the host firewall rule or disabling the network card.

[0086] Therefore, if the response fails, the backup strategy is enabled to switch to the honeynet system to induce attackers. For example, when the IP blocking or host isolation operation fails to execute successfully, the system automatically switches to the pre-deployed honeynet environment to attract attackers by simulating vulnerable services and guide them to attack false targets.

[0087] At the same time, the operation status is recorded in the response log, including the execution time, operation result, and affected device. The log record adopts a structured format, which is convenient for subsequent analysis and auditing.

[0088] In addition, a PDF format disposal report is generated, which marks the attack chain path and disposal effect. The report visually displays the attack path and records the execution of each response step and its effect in detail.

[0089] Finally, the attacker's tactical and technical process feature rule library in the security knowledge graph is updated. Based on the new attack features obtained in this response process, the attributes of the related nodes and edges in the knowledge graph are updated, the feature rules are optimized, and the system's ability to identify similar attacks is improved.

[0090] The application further proposes to use a pre-trained network security language model SecureBERT to encode text features, use a conditional random field layer to label entity boundaries and types, output entity-relation triplets to a graph fusion module, use a mask mechanism to predict and complete unidentified entities, and use embedded vector interpolation to enhance the generalization ability of low-frequency entities.

[0091] The encoding process of the pre-trained network security language model SecureBERT can extract text features using a multi-head attention mechanism. For example, when identifying attack method entities such as SQL injection in network security logs, the model captures attack vector keywords in the context before and after through self-attention weights. Entity labeling in the conditional random field layer can constrain entity boundaries through transition probability matrices. For example, the starting marker of CVE-2023-1234 is probabilistically matched with the numerical sequence to avoid incorrectly segmenting the vulnerability number into multiple entities. The prediction and completion of the mask mechanism can use a masked position prediction method. For example, when the model encounters an unrecognized vulnerability number fragment CVE-2023, it masks the subsequent characters and generates the complete number based on the prefix. Embedding vector interpolation can generate low-frequency entity representations by linearly combining high-frequency entity vectors. For example, the vectors of buffer overflow and code injection are mixed in proportion to generate an approximate semantic representation of a new attack method.

[0092] Specifically, the pre-training corpus of SecureBERT contains network security domain-specific vocabulary, enabling it to accurately capture the semantic features of professional terms such as zero-day vulnerabilities when encoding log text. The conditional random field layer defines label transition rules to enforce the continuous numerical structure of vulnerability number entities, preventing CVE-2023-1234 from being incorrectly labeled as multiple independent numerical entities. When detecting text fragments with ambiguous entity boundaries, the mask mechanism masks some characters and generates candidate entities based on the context, such as completing the truncated vulnerability number CVE-2023 to the full format. For low-frequency entities that appear less than a certain threshold in the training set, their vector distances from similar high-frequency entities are calculated to generate enhanced semantic representations through interpolation operations in the embedding space. For example, the vector of a water pit attack is fused with the vector of a phishing attack in proportion to the weight, enhancing the model's ability to recognize new attack methods. This technical solution effectively repairs node missing problems in the entity recognition stage through domain-adapted feature encoding and data augmentation mechanisms, ensuring the integrity of subsequent knowledge graph construction and the reliability of attack path analysis.

[0093] As a preferred embodiment, the scheme of the present application is implemented as follows: The operation of the SecureBERT-CRF model includes the following steps: First, the text features are encoded using the pre-trained network security language model SecureBERT. The SecureBERT model is based on the BERT architecture and is pre-trained on a large-scale network security corpus, enabling it to effectively capture semantic information in the security domain. After inputting the security log text, SecureBERT maps each token to a 768-dimensional vector representation.

[0094] Second, the conditional random field layer is used to label the entity boundary and type. The CRF layer receives the output vector sequence of SecureBERT and learns to label the transition probability matrix. For each token, the BIO label is predicted, where B represents the start of the entity, I represents the internal entity, and O represents the non-entity. The entity types include attack method type, system component type, vulnerability number type, etc.

[0095] Then, the identified entities and their relationships are organized into triplets and output to the graph fusion module. The triplet structure is (head entity, relationship type, tail entity), such as (SQL injection, attack method, web server).

[0096] Next, the mask mechanism is used to predict and complete the unrecognized entities. The unrecognized token is replaced with the [MASK] label, and the SecureBERT mask language model is used to predict the possible entity based on the context. For example, the detected [MASK] attack can be completed as the detected DDoS attack.

[0097] Finally, the embedding vector interpolation is used to enhance the generalization ability of low-frequency entities. The cosine similarity between low-frequency entities and high-frequency entities is calculated, and the Top-K similar high-frequency entities are selected. In the embedding space, the low-frequency entity vector and the similar high-frequency entity vector are linearly interpolated to generate an enhanced low-frequency entity representation.

[0098] The application further proposes to define an entity projection matrix and a relationship conversion matrix to map the entity vector to the relationship space; optimize the entity relationship representation through a loss function; retrieve similar attack paths using the Faiss library to update the global attack graph; update the vector space using an incremental learning mechanism for new attack paths; and use an attention mechanism to weight and fuse conflicting paths.

[0099] The entity projection matrix can be constrained by an orthogonal matrix, with a dimension set to 1.2 to 1.5 times the dimension of the entity vector. The relationship conversion matrix is a trainable parameter matrix that is updated through backpropagation. The loss function can be a margin-based ranking loss function with a margin parameter set to 0.5 to 1.2. During optimization, the entity vector is subject to L2 regularization constraints. The Faiss library uses an IVF index structure for retrieval, with the number of cluster centers set to the square root of the number of entities. The incremental learning mechanism controls the retention ratio of historical data through a sliding window, with a window size set to 50 to 100 new paths. The attention mechanism uses a scaled dot product for weight calculation, with a query vector dimension set to 64 to 128.

[0100] Specifically, the entity vector is first mapped to the relationship space through the projection matrix, eliminating the projection deviation between entities of different dimensions. In the relationship space, the relationship conversion matrix between entities is linearly transformed to generate a vector representation with semantic consistency. The loss function optimizes the vector space distribution of entities and relationships by minimizing the interval distance between positive and negative sample pairs. The approximate nearest neighbor search algorithm of the Faiss library accelerates similar path matching, and its index structure divides the vector space into multiple clustering areas, improving the efficiency of large-scale data retrieval. The incremental learning mechanism updates the projection matrix parameters online and only calculates the gradient for new path data, avoiding repeated training of the full data. The attention mechanism calculates the attention score for the nodes in the conflict path, and the score is calculated based on the position weight of the node in the attack chain and the severity of the vulnerability. Finally, the comprehensive path vector is generated by weighted fusion. As a result, the vectorization accuracy of the attack path is improved by 15% to 20%, the vector space update time of the new path is shortened to 30% of the original method, and the accuracy of the conflict path fusion is improved by 12% to 18%.

[0101] In a knowledge graph-based security event automatic response method, the following operations are performed in the process of constructing a global attack graph: defining the number of columns of the entity projection matrix and the number of rows of the relationship conversion matrix to maintain dimensional consistency, mapping the entity vector to the relationship space through matrix multiplication operation, and eliminating the semantic difference of entity embedding of different data sources; constructing a loss function based on marginal ordering, iteratively optimizing the parameters of the entity projection matrix and the relationship conversion matrix through the gradient descent algorithm, and strengthening the vector representation of the key vulnerability exploitation relationship in the attack path; using the IVF index structure of the Faiss library to establish an attack path vector database, and performing approximate nearest neighbor search to match similar attack patterns; when detecting a new attack path, using online learning to update only the embedding vectors of the affected entities and relationships, and maintaining the stability of the original vector space; for the conflicting attack paths, a multi-head attention mechanism is used to calculate the attention score of each path node, and the fusion weight is dynamically allocated according to the score, and the path features of high threat nodes are preferentially retained.

[0102] The application further proposes a construction method of a response strategy library, including establishing a multi-dimensional strategy library for classified storage, optimizing strategy weights through reinforcement learning, regularly auditing and eliminating inefficient strategies, expanding strategy coverage through a generative adversarial network, and realizing strategy migration through a security knowledge graph.

[0103] Wherein, the policy library is stored according to attack scene classification, and the attack scene can be based on ATT&CK tactic classification, such as three types of scenes of initial access, lateral movement and data theft to establish a collection policy library, a monitoring policy library and a defense policy library respectively. The storage format can adopt a JSON structure, each policy entry contains a policy ID, a suitable scene label, a weight value field, and a hash index is established to speed up retrieval. The reward function of the reinforcement learning model can be set as a weighted combination of accuracy weight 0.5, response efficiency weight 0.3 and path diversity weight 0.2, and the optimization period is set to perform parameter update once a week. The response success rate threshold of the periodic audit can be set to 60%, and the audit period is set to perform strategy effectiveness evaluation once a month. The generative adversarial network can adopt a Wasserstein GAN architecture, the generator input latent space vector dimension is set to 128, and the discriminator contains a three-layer convolutional network, 100 simulated attack chains are generated each time for strategy generation. The similar scene mapping of the security knowledge graph is realized by entity relationship similarity calculation, for example, when the vulnerability entity in the new attack scene has more than 80% similarity with the CVE number in the historical scene, the strategy migration rule is triggered.

[0104] Specifically, when constructing the response strategy library, first, a structured storage system is established according to attack scene classification, for example, the defense strategies of APT attack scenes are stored in the APT classification directory of the defense strategy library, and fast positioning is realized through classification labels. The reinforcement learning model iteratively optimizes the strategy weight through the Q-learning algorithm, for example, when a SQL injection attack is detected, the model dynamically improves the weight priority of the IP blocking strategy according to the response efficiency value of the historical data. The periodic audit module obtains the strategy execution log through the interface, for example, when the success rate of the Web Application Firewall strategy is less than 60% within 30 days, it is automatically moved to the recycling area. The generative adversarial network constructs a new attack chain through the generator, for example, simulates a zero-day exploit chain to generate the corresponding defense strategy, which is stored in the new attack classification of the strategy library after verification by the discriminator. The security knowledge graph realizes strategy migration through entity relationship mapping, for example, when a cross-site scripting attack is detected with a similarity of more than 75% with the entity relationship in the historical scene, the existing input filtering strategy template is automatically applied. Through the multi-dimensional strategy optimization mechanism, the strategy library has dynamic adaptation capability, the response efficiency is improved by more than 40%, and the coverage rate of new attack scenes is improved by 35%.

[0105] As a preferred embodiment, the scheme of the application is implemented as follows: in response to the construction process of the strategy library, a collection strategy library, an attack monitoring strategy library, and a defense strategy library are established and stored in different partitions of a distributed graph database, each strategy library is indexed according to attack scenarios, the horizontal movement detection strategy is stored under the APT attack scenario, and the traffic cleaning strategy is stored under the DDoS attack scenario. The reinforcement learning model based on the PPO algorithm is used to optimize the strategy weight, the reward function is set as 0.6 x accuracy + 0.3 x response efficiency + 0.1 x path diversity, and the model updates the strategy priority ranking through offline training every 24 hours. The strategy audit module scans the response log every day, and eliminates the strategy entries with a success rate of less than 70% for 30 consecutive days. For the new supply chain attack scenario, the attack chain sequence containing the software dependency hijacking node is generated through the Wasserstein GAN, and the signature verification strategy is generated after expert verification and stored in the defense strategy library. The strategy migration rule is established in the security knowledge graph, and when the same container escape exploit mode is detected in the cloud environment and the edge computing scenario, the image security scanning strategy is migrated from the cloud strategy library to the edge strategy library.

[0106] The application further proposes that the firewall API is called through the SOAR platform to add a blacklist rule to block the inbound traffic of a malicious IP, including: the action instruction is parsed through the script engine, and the API interface of the firewall device and the terminal protection device is called; the operation state is monitored in real time, and if the execution fails, a backup script is triggered; the response operation is recorded to the security knowledge graph, and the attack mode feature rule library is updated; the operation with a response delay exceeding a set threshold is started for traceability analysis; and the response log is stored through the blockchain technology to ensure that the operation cannot be tampered with.

[0107] The script engine parses the action instruction in a regular expression matching or syntax tree parsing manner, converts the natural language strategy into an API parameter recognizable by the device, for example, maps the IP blocking instruction to the blacklist interface calling parameter of the firewall. The real-time monitoring of the operation state is realized through a heartbeat detection mechanism or a timeout retry mechanism, and when the API response time exceeds 500 ms, it is marked as an execution exception, triggering the backup script to switch to the backup defense node. The update operation of the security knowledge graph is realized through the transaction mechanism of the graph database to ensure data consistency, for example, after the IP blocking operation is completed, the utilization relationship edge between the attacker entity and the vulnerability entity is automatically generated. The response delay traceability analysis adopts log association technology to extract network topology data and device performance indicators, and when the delay exceeds 3 seconds, the root cause positioning process is started. The blockchain storage adopts a consortium chain architecture, and the SHA-256 hash value of each response log is written into multiple nodes, for example, after the log is generated, it is synchronized to three verification nodes in different geographical locations.

[0108] Specifically, when the SOAR platform receives the IP blocking instruction, the playbook engine first parses the IP address and blocking duration parameters in the instruction, and converts them into the API call format specific to the firewall device. Real-time monitoring of HTTP status codes and response times is performed during the call process. If a 403 error code or timeout is detected, the standby playbook is triggered to call the standby firewall node interface. Successful blocking operations are recorded in the security knowledge graph, generating attack relationship edges between attacker IP and target host, and updating the abnormal traffic threshold in the attack pattern feature rule library. For blocking operations with an execution time exceeding 3 seconds, the traceability analysis module extracts network bandwidth utilization and firewall CPU load data within that period to identify bottleneck nodes caused by network congestion or device overload. All operation logs are hashed when generated and written to the distributed ledger of the blockchain through the smart contract, forming an unalterable timestamp evidence chain. In this way, the continuity of response operations is ensured in the event of device failure, and the dynamic optimization of attack pattern features and the judicial-level trusted record of operation records are achieved.

[0109] As a preferred embodiment, the scheme of the present application is implemented as follows: in the security incident response process, when a malicious IP address is detected and needs to be blocked, the playbook engine first parses the predefined standardized action instruction template to generate an API call request that meets the interface specifications of the target firewall device. After the access control interface of the firewall device is called, the operation execution status is monitored in real time through the heartbeat packet mechanism. If a successful response code is not received within 5 seconds, the standby playbook execution process is automatically triggered, and the blacklist rule addition request is reinitiated on the cloud firewall service node. All successfully executed response operations are recorded in the tactical and technical nodes of the security knowledge graph, and the attack pattern feature rule library updates the malicious behavior feature vector based on the associated threat intelligence data of the blocked IP. For abnormal situations where API call delay exceeds the 10-second threshold, the traceability analysis module starts network traffic packet capture and device performance log collection to locate firewall policy configuration conflicts or network link congestion problems. The hash value of the response log is written to the Hyperledger Fabric blockchain network through the smart contract, and each block contains the Merkle tree root value of the previous log.

[0110] Through the above technical scheme, the present application solves the problems of low operation reliability, lack of state tracking, and insufficient log security in existing response mechanisms. The standby playbook automatic switching mechanism ensures business continuity in the event of interface call failure, avoiding security firewall breakpoints. The real-time updating mechanism of the knowledge graph forms a two-way feedback of attack features and disposal measures, optimizing the inference accuracy of subsequent threat detection models. The log evidence mechanism based on blockchain prevents data tampering risks during post-audit processes, meeting the judicial compliance requirements of electronic evidence.

[0111] Those skilled in the art will appreciate that embodiments of the application can be readily used as software, hardware, or a combination of software and hardware. In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0112] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks. Figure 1 means for functionally implementing the one or more functions specified in the flowchart block or blocks.

[0113] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks. Figure 1 means for functionally implementing the one or more functions specified in the flowchart block or blocks.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks. Figure 1 means for functionally implementing the one or more functions specified in the flowchart block or blocks.

[0115] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0116] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM) or flash RAM, about which permanent data can be stored, such as instructions for the processor. The memory is an example of computer readable media.

[0117] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0118] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0119] The above only is an embodiment of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A knowledge graph-based automated security incident response method, characterized in that, Includes the following steps: Collect multi-source security data, including network device logs, terminal behavior logs, and external threat intelligence data, and perform deduplication and standardization processing on the data to generate a structured security dataset; Based on the network security ontology model, entities and relationships are extracted from structured security datasets, and a security knowledge graph is constructed through entity alignment and conflict resolution. The network is divided into subnets according to the ATT&CK framework, and the attack path graphs of each subnet are generated and merged into a global attack graph. Analyze the abnormal behavior nodes in the security knowledge graph, and calculate the service layer risk score, host layer risk score, and system layer risk score by combining the global attack graph. Based on the service layer risk score, host layer risk score, and system layer risk score, a predefined response policy library is matched, and operations such as blocking IPs, isolating hosts, or updating firewall rules are performed through the SOAR platform to generate a handling report and update the security knowledge graph.

2. The method as described in claim 1, characterized in that: The collected multi-source security data includes: Collect firewall access control logs through API interface and extract source IP, destination port and protocol type fields; The terminal agent's behavior logs are collected through a log collector, including process creation events, file modification events, and registry operation events. Obtain threat intelligence data from the AlienVault OTX platform and associate it with malicious IPs and vulnerability numbers; The collected data is timestamped and the IP address format is standardized to IPv4; duplicate log entries are removed using a Bloom filter. Complete the missing protocol type field; the default is marked as TCP protocol.

3. The method as described in claim 1, characterized in that: The construction of the security knowledge graph includes: Define entity types including attacker entities, vulnerability entities, and asset / device entities; define relationship types including vulnerability exploitation relationships and attack initiation relationships. The SecureBERT-CRF model is used to extract entities, and malicious IPs in the logs are identified as attacker entities, and CVE numbers are identified as vulnerable entities. The Jaccard similarity algorithm is used to align identical entities from different data sources and merge duplicate vulnerability descriptions. Conflict resolution algorithms are used to handle contradictory relationships. If the same IP is marked as legitimate and malicious in different logs, the principle of prioritizing threat intelligence data is adopted. Import the triples into the Neo4j graph database and create a B+ tree index for the entities. Regularly scan newly added logs and incrementally update the security knowledge graph nodes.

4. The method as described in claim 1, characterized in that: The fusion into a global attack graph includes: The Louvain community discovery algorithm is used to divide the network topology into subnets, each containing a server cluster and associated terminals; Based on the ATT&CK tactical definition, initial access attack rules, lateral movement attack rules, and data theft attack rules are defined. The TransR algorithm is used to vectorize the attack path and project it onto the relation space to calculate the path similarity. Based on the entity relationships in the security knowledge graph, attack patterns with the same tactical and technical processes are retrieved from the threat intelligence database, and the subnet attack graph nodes are updated. Based on the vulnerability dependency relationship, link the subnet attack graph. If subnet A has an SQL injection vulnerability and subnet B has an open database port, then generate a cross-subnet attack path. Store the global attack graph as a directed acyclic graph structure.

5. The method as described in claim 1, characterized in that: Detect nodes that deviate from the baseline in the security knowledge graph using graph convolutional networks, including abnormal login time behavior and high-frequency port scanning behavior; Search the global attack graph for potential paths from the point of intrusion to critical assets and mark the shortest attack chain; Service layer risk scoring is calculated based on the deviation between the number of service vulnerabilities and historical data; Host-level risk scoring is calculated based on the number of unpatched vulnerabilities and the number of open high-risk ports; System-level risk scoring is calculated based on the ratio of affected services to hosts; Threat levels are determined by a weighted sum of the service layer risk score, host layer risk score, and system layer risk score.

6. The method as described in claim 1, characterized in that: The predefined response strategy library based on the service layer risk score, host layer risk score, and system layer risk score includes: Based on the risk score matching predefined response strategy library, a high risk level triggers an isolation host strategy, and a medium risk level triggers an IP blocking strategy. Add blacklist rules by calling the firewall API through the SOAR platform to block inbound traffic from malicious IPs; The endpoint protection API is invoked to isolate the infected host and disconnect its network connection. If the response fails, the backup strategy will be activated to switch to the honeynet system to lure attackers. Record the operation status to the response log, including execution time, operation result, and affected devices; Generate a PDF report detailing the attack chain and the effectiveness of the response; Update the rule base for attackers' tactical and technical process characteristics in the security knowledge graph.

7. The method as described in claim 3, characterized in that: The operations of the SecureBERT-CRF model include: Text features are encoded using the pre-trained cybersecurity language model SecureBERT; The entity boundaries and types are marked by the conditional random field layer, including attack method type, system component type, and vulnerability number type; Output entity-relation triples to the graph fusion module; Unidentified entities are predicted and completed using a masking mechanism; For low-frequency entities, embedded vector interpolation is used to enhance generalization ability.

8. The method as described in claim 4, characterized in that: The operations of the TransR algorithm include: Define the entity projection matrix and the relation transformation matrix to map entity vectors to the relation space; Optimize entity relationship representation using a loss function; The global attack graph is updated by retrieving similar attack paths using the Faiss library. An incremental learning mechanism is used to update the vector space for newly added attack paths; The conflict paths are weighted and fused using an attention mechanism.

9. The method as described in claim 6, characterized in that: The construction of the response strategy library includes: Establish a data collection strategy library, an attack monitoring strategy library, and a defense strategy library, and store them according to attack scenarios; The policy weights are optimized based on a reinforcement learning model, and the reward function is a weighted sum of accuracy, response efficiency, and path diversity. Regularly audit the strategy library and eliminate strategies with a response success rate below a set threshold; For attack scenarios that are not covered, a new strategy for generating attack chains by simulating adversarial generative networks is adopted. Policy migration rules for similar scenarios are linked through a security knowledge graph.

10. The method as described in claim 6, characterized in that: The method of adding blacklist rules by calling the firewall API through the SOAR platform to block inbound traffic from malicious IPs includes: The script engine parses action instructions and calls the API interfaces of firewall devices and endpoint protection devices. Monitor the operation status in real time, and trigger the backup script if the execution fails. Record the response operation to the security knowledge graph and update the attack pattern feature rule base; Initiate source tracing analysis for operations with response delays exceeding a set threshold; Blockchain technology is used to store response logs to ensure that the operation cannot be tampered with.

Images