A machine learning-based network attack behavior assessment identification method

Abstract

The application discloses a network attack behavior evaluation and identification method based on machine learning, which collects original security data from security devices and terminals in a network, converts the original security data into security device nodes with a unified format, mines cause-and-effect and time sequence logic association rules based on historical security device nodes by combining operation behavior anomaly analysis and security device node state anomaly analysis through a particle swarm optimization algorithm, and uses the rules as a judgment standard to associate discrete security device nodes, form directed edges representing single-step attack behaviors, and build attack chain segments from continuous multiple directed edges, so that high-credibility association rules are screened out through an optimization algorithm and anomaly verification, and potential attack step sequences are identified; all attack chain segments are fused to build a global attack activity graph, and the graph is stored in a graph database, so that dispersed attack chain segments are integrated to form a complete and visual attack scene view.

Description

Technical Field

[0001] This invention relates to the field of network attack security, and in particular to a method for evaluating and identifying network attack behaviors based on machine learning. Background Technology

[0002] As cyberattack techniques continue to evolve and attack chains become increasingly complex, traditional security attribution methods are gradually revealing their systemic flaws when dealing with advanced persistent threats (APTs) and complex multi-step attacks.

[0003] First, in terms of attack pattern discovery, traditional methods based on fixed rules or simple statistics have fundamental limitations. These methods rely on static rule templates predefined by security experts and cannot autonomously discover new attack patterns from massive amounts of historical security data. When faced with variant attacks employing zero-day vulnerabilities, covert channels, or social engineering, the rule base cannot keep up with the pace of attack technology evolution, resulting in a significant lag in the detection of unknown threats.

[0004] Secondly, in terms of attack assessment, existing solutions generally lack the ability to collaboratively analyze multi-source evidence. Most methods either focus only on the abnormal statistical characteristics of network traffic or analyze only the abnormal behavior of a single terminal, failing to establish the intrinsic relationship between network-side evidence and terminal-side behavior. This one-dimensional assessment perspective makes it difficult to capture the key causal-temporal logic in the attack chain, failing to accurately reconstruct the full picture of the attack and easily generating a large number of false alarms due to fluctuations in normal business operations.

[0005] Crucially, in the process of tracing the origins of cyberattacks, the rules governing the relationships between attack steps often exhibit high complexity and concealment. Traditional optimization algorithms tend to prematurely converge to certain "high-frequency rare combinations" with high apparent anomalies—rules with obvious statistical characteristics but limited actual threat. Meanwhile, key rules that seem ordinary and have low individual evaluation value, but can form a complete attack path when combined with specific sequences, are systematically ignored. This search bias causes the tracing system to only discover local attack fragments, failing to reconstruct a complete panorama of attack activities spanning multiple stages and components.

[0006] A deeper problem lies in the lack of a perspective for evaluating the overall value of an attack chain in existing methods. Over-reliance on single-point features (such as hash rareness) as evaluation criteria leads the search process into a "trees-missing-the-foreign-foreign-trees" dilemma. During optimization, the algorithm continuously reinforces rules containing rare hashes, potentially missing complete attack chains composed of multiple ordinary events that pose a greater real threat. Summary of the Invention

[0007] The purpose of this invention is to provide a method for evaluating and identifying network attack behavior based on machine learning, which solves the above-mentioned technical problems pointed out in the prior art.

[0008] This invention provides a method for evaluating and identifying network attack behaviors based on machine learning, comprising the following steps:

[0009] Raw security data is collected from security devices and terminals in the network; the raw security data is normalized to obtain security device nodes;

[0010] Historical security device nodes are collected and acquired. Based on these historical security device nodes, a particle swarm optimization algorithm is used in conjunction with anomaly analysis of each historical security device node to obtain causal and temporal logical association rules. Based on these causal and temporal logical association rules, association analysis is performed on the security device nodes to generate directed edges. Multiple consecutive directed edges are then used to construct attack chain segments.

[0011] All attack chain fragments are merged to construct a global attack activity graph, which is then stored in a graph database.

[0012] Preferably, based on historical security device nodes, a causal and temporal logical association rule is obtained by combining the particle swarm optimization algorithm with the anomaly analysis of each historical security device node. The specific steps include the following:

[0013] Based on the initialization of historical security device nodes, several undetermined causal and temporal logical association rules are obtained;

[0014] The credibility parameter value of the directed edge of the attack is calculated for the new undetermined causal and temporal logical association rules.

[0015] Select a new causal and temporal logic association rule to be determined that has a confidence parameter value greater than or equal to the confidence parameter value threshold. This rule is then used as the second causal and temporal logic association rule to be determined.

[0016] Based on the analysis of abnormal operation behavior and abnormal state of security device nodes in the second undetermined causal and temporal logical association rule, the causal and temporal logical association rule is obtained.

[0017] A preferred method for calculating the credibility parameter value of the directed attack edge is as follows: the credibility parameter value of the directed attack edge is calculated by combining the feature set of the predecessor and successor nodes in the directed attack edge established by the new causal and temporal logical association rules to be determined with the key field factor of the hash value.

[0018] Preferably, based on the second undetermined causal and temporal logical association rule, the causal and temporal logical association rule is obtained through the analysis of historical security device node operational behavior anomalies and security device node state anomalies, including the following operational steps:

[0019] A queue of historical security nodes is established by establishing historical security device nodes based on the second undetermined causal and temporal logical association rule.

[0020] Obtain two consecutive historical security device nodes from the historical security node queue to form a node group; take the predecessor timestamp of the predecessor node and the successor timestamp of the successor node in the node group, and use the predecessor timestamp and successor timestamp to construct a time window; collect operation behavior logs within the time window.

[0021] Perform combined anomaly verification processing on the operation behavior log to obtain the behavior verification score;

[0022] Collect the status information data of the security node devices in the node group; perform anomaly measurement processing on the status information data of the security node devices to obtain the node status verification score;

[0023] The behavior verification score and the node state verification score are weighted and summed to obtain the comprehensive verification score. Based on the comprehensive verification score, mutation judgment is performed through the verification score threshold, and mutation processing is performed on the second causal and temporal logical association rule to be determined to obtain the target causal and temporal logical association rule.

[0024] Preferably, after determining the mutation based on the comprehensive verification score and passing the verification score threshold, mutation processing is performed on the second causal and temporal logical association rule to be determined, resulting in the target causal and temporal logical association rule, including the following steps:

[0025] Determine whether the comprehensive verification score is greater than or equal to the verification score threshold. If so, output the second causal and temporal logical association rule to be determined as the target causal and temporal logical association rule. If not, based on the second causal and temporal logical association rule to be determined, search for each second causal and temporal logical association rule in the pre-constructed search space at a preset search speed determined based on the hash value key field to obtain multiple new causal and temporal logical association rules to be determined. Then return to the above steps for processing and iterate again until the target causal and temporal logical association rule is output.

[0026] Preferably, for each second causal and temporal logical association rule to be determined, a search is performed within a pre-constructed search space at a preset search speed determined based on the hash value key field to obtain multiple new causal and temporal logical association rules to be determined, including the following steps:

[0027] For each second undetermined causal and temporal logical association rule, an attack chain fragment is established by combining it with each historical security device node; the attack association strength index is calculated for the attack chain fragment.

[0028] The preset search speed is adjusted based on the attack correlation strength index to obtain the preliminary adjusted search speed;

[0029] The second causal and temporal logic association rule to be determined is updated based on the initially adjusted search speed to obtain the third causal and temporal logic association rule to be determined, and the position vector of the third causal and temporal logic association rule is obtained; the overall diversity index of the particle swarm formed by each third causal and temporal logic association rule is calculated based on the position vector.

[0030] If the overall diversity index is greater than or equal to the overall diversity index threshold, the third causal and temporal logical association rule to be determined is determined as a new causal and temporal logical association rule to be determined, and the above steps are returned to the processing, and the process is iterated again until the target causal and temporal logical association rule is output; if not, multiple causal and temporal logical association rules to be mutated are randomly selected from all the current third causal and temporal logical association rules to be determined according to the preset mutation ratio parameter.

[0031] Obtain the number of iterations in the current particle swarm optimization process. Based on the number of iterations and the attack correlation strength index of the causal and temporal logic association rules to be mutated, perform mutation processing analysis to obtain new causal and temporal logic association rules to be determined.

[0032] A preferred method for calculating the attack association strength index is the average of the product of a weighted combination of hash criticality and network entity criticality and the product of the attack directed edge credibility parameter values ​​of all directed edges in the attack chain segment.

[0033] Preferably, mutation processing analysis is performed based on the number of iterations and the attack correlation strength index of the causal and temporal logical association rules to be mutated, to obtain new causal and temporal logical association rules to be determined, including the following steps:

[0034] The fragment attack association strength index is calculated for the causal and temporal logic association rules of the mutation to be calculated; the individualized mutation offset of the causal and temporal logic association rules of the mutation to be calculated in each dimension based on the fragment attack association strength index of the causal and temporal logic association rules of the mutation to be calculated in combination with the preset mutation offset and the number of iterations.

[0035] For each causal and temporal logical association rule to be mutated, the position vector is processed by vector addition based on the individualized mutation offset to obtain a new causal and temporal logical association rule to be determined. The above steps are then returned to the processing and iterated again until the target causal and temporal logical association rule is output.

[0036] A preferred method for calculating the individualized mutation offset is as follows: the individualized mutation offset is calculated by combining a preset mutation offset with a coefficient that decays exponentially with the number of iterations and a feedback weight of the attack association strength index brought by the fragment attack association strength index, and superimposing a random perturbation of the standard normal distribution.

[0037] In another aspect, the present invention also provides a storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for evaluating and identifying network attack behavior based on machine learning.

[0038] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0039] Analysis of the above-mentioned machine learning-based network attack behavior assessment and identification method provided by the present invention shows that, in specific applications, the raw security data is first collected from security devices and terminals in the network to achieve unified collection of multi-source heterogeneous data. Then, through normalization processing, these raw data are converted into security device nodes with a unified format.

[0040] Furthermore, based on historical security device nodes, a particle swarm optimization algorithm combined with operational behavior anomaly analysis and security device node state anomaly analysis is used to mine causal and temporal logical association rules as judgment criteria. Discrete security device nodes are linked together to form directed edges representing single-step attack behavior. Attack chain fragments are then constructed from multiple consecutive directed edges. Through optimization algorithms and anomaly verification, high-confidence association rules are selected to identify potential attack step sequences, providing attack path information for the construction of a global attack graph. Further, all attack chain fragments are merged, using entities (such as IP addresses and devices) as vertices and attack behaviors (i.e., directed edges) as edges, to construct a global attack activity graph. This graph is stored in a graph database, integrating scattered attack chain fragments to form a complete and visualized attack scenario view, revealing the overall structure and relationships of attack activities. This enables security analysts to quickly identify attack paths, key entities, and attack patterns, thereby improving the response capability and tracing efficiency of security incidents. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the main process of a machine learning-based network attack behavior assessment and identification method.

[0042] Figure 2 This is a schematic diagram simulating directed edges of an attack in a machine learning-based network attack behavior evaluation and identification method.

[0043] Figure 3This is a schematic diagram of a global attack activity graph simulation in a machine learning-based network attack behavior assessment and identification method.

[0044] Figure 4 This is a schematic diagram simulating the distribution curve of the credibility parameter value of the directed edge of an attack in a machine learning-based network attack behavior evaluation and identification method.

[0045] Figure 5 This is a schematic diagram simulating three verification score curves in a machine learning-based network attack behavior evaluation and identification method. Detailed Implementation

[0046] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] The present invention will now be described in further detail with reference to specific embodiments and accompanying drawings.

[0048] Example 1

[0049] like Figure 1 As shown, Embodiment 1 of the present invention provides a method for evaluating and identifying network attack behavior based on machine learning, including the following steps:

[0050] Step S10: Collect raw security data from security devices and terminals in the network. The security devices include firewalls, intrusion detection systems, and network traffic probes. The terminal data includes process creation logs and network connection logs. Normalize the raw security data into security device nodes with a unified format. Each security device node includes a timestamp, source IP address, destination IP address, source port, destination port, protocol type, operation behavior (operation behavior refers to the action performed by a terminal device at a corresponding timestamp, such as a user account issuing an instruction to the current terminal device at a certain timestamp to upload or download files), and hash value key fields.

[0051] Step S20: Collect historical security device nodes, and based on the historical security device nodes, use the particle swarm optimization algorithm combined with the anomaly analysis of each historical security device node to obtain causal and temporal logical association rules; based on the causal and temporal logical association rules, perform association analysis on the security device nodes, connect the discrete security device nodes into directed edges representing single-step attack behavior, and construct attack chain segments from multiple continuous directed edges.

[0052] Step S30: Merge all attack chain fragments generated in step S20, construct a global attack activity graph with entities as vertices and attack behaviors as directed edges, and store the graph in a graph database.

[0053] It should be noted that the above-described embodiments of this application collect raw security data from security devices (such as firewalls, intrusion detection systems, and network traffic probes) and terminals (such as process creation logs and network connection logs) in the network, achieving unified collection of multi-source heterogeneous data. Subsequently, through normalization processing, this raw data is converted into security device nodes with a unified format. Each node contains key fields such as timestamp, source IP address, destination IP address, source port, destination port, protocol type, operation behavior, and hash value, eliminating format differences between data sources and constructing a standardized and structured data foundation. This provides consistent and processable data input for subsequent correlation analysis and rule mining, ensuring the reliability and scalability of the tracing process. Furthermore, based on historical security device nodes, a particle swarm optimization algorithm is used in conjunction with anomaly analysis of operation behavior and anomaly analysis of security device node states to mine causal and temporal logical correlation rules as judgment criteria, linking discrete security device nodes to form directed edges representing single-step attack behavior, such as... Figure 2 As shown, attack chain segments are further constructed from multiple consecutive directed edges. Through optimization algorithms and anomaly verification, high-confidence association rules are selected to identify potential attack step sequences, providing attack path information for the construction of a global attack graph. Further, step S30 merges all attack chain segments generated in step S20, using entities (such as IP addresses and devices) as vertices and attack behaviors (i.e., directed edges) as edges to construct a global attack activity graph, such as... Figure 3 As shown, Figure 3 In the graph, thin arrows represent directed edges for normal traffic data transmission, while thick arrows represent attack activity graphs composed of attack chains from global attack activities. These graphs are stored in a graph database, integrating scattered attack chain fragments to form a complete and visualized view of the attack scenario. This reveals the overall structure and relationships of attack activities, enabling security analysts to quickly identify attack paths, key entities, and attack patterns, thereby improving the response capability and tracing efficiency of security incidents.

[0054] Specifically, in step S20, based on the historical security device nodes, the causal and temporal logical association rules are obtained by combining the particle swarm optimization algorithm with the anomaly analysis of each historical security device node. The specific steps include the following:

[0055] Step S21: Obtain multiple causal and temporal logical association rules to be determined based on the initialization of historical security device nodes;

[0056] It should be noted that the causal and temporal logical association rules to be determined in the above embodiments of this application are particles in the particle swarm optimization algorithm. Each particle does not represent one or more security device nodes, but rather a logical formula or judgment criterion used to determine whether any two security device nodes should be connected to form a directed edge representing a certain step of the attack behavior (i.e., the directed edge representing the single-step attack behavior mentioned above). In this embodiment of the application, a particle can be used as a rule template, i.e., "IF the [operation behavior] of the predecessor node is _____ AND the [destination port] is _____; AND the [operation behavior] of the successor node is _____ AND the [protocol type] is _____; AND the [time difference] between the two is less than _____ seconds; THEN create a directed edge between them". The position information of a particle (i.e., the particle position vector) is the specific value filled into the empty value in the above rule template. Specifically, the position of a particle may be: (process creation, 443, network external connection, TCP, 120), then the rule represented by the particle is:

[0057] "If a 'process creation' node (action = process creation, destination port = 443) is followed by a 'network outbound' node (action = network outbound, protocol type = TCP) within 120 seconds, then a directed edge is created between the two nodes."

[0058] It should also be noted that before processing, the historical security device nodes in the above-described embodiments need to be normalized. For example, the timestamps, source IP addresses, destination IP addresses, source ports, destination ports, protocol types, operation behaviors, and hash values ​​corresponding to files or objects of the historical security device nodes need to be normalized. According to the data normalization rules, the collected data is format-converted so that each security device node has the same data structure, resulting in a set of historical security device node data with a unified format and complete fields, providing a unified data input for subsequent behavioral activity analysis and rule mining.

[0059] Step S22: Calculate the attack directed edge credibility parameter value for the new undetermined causal and temporal logic association rules;

[0060] The calculation method for the credibility parameter value of the directed edge attack is as follows:

[0061] ;

[0062] In the formula, Let F be a feature pair set (containing key feature combinations used to evaluate the credibility of directed edges in an attack, F = {(operation behavior, operation behavior), (destination port, protocol type)}, that is, in this application embodiment, the main considerations are the transfer from "operation behavior of the predecessor node" to "operation behavior of the successor node", and the matching from "destination port of the predecessor node" to "protocol type of the successor node"), and f be a feature pair in the feature pair set. For hash value key field factors, This is the chain multiplication operator. For the attack directed edge constructed by the new undetermined causal and temporal logical association rules, the feature value appears in two consecutive historical security device nodes. Number of times, For the attack directed edge constructed by the new undetermined causal and temporal logical association rules, the predecessor node of the two consecutive historical security device nodes appears as a feature value. And the successor node has an eigenvalue. Number of times, and The Laplace smoothing factor (handles rare combinations not seen in history, prevents the denominator from being zero and shrinks the probability estimate toward a prior value, increasing computational robustness).

[0063] It should be noted that in the above embodiments of this application, the credibility parameter value of the attack directed edge is calculated by combining the feature set of the predecessor and successor nodes in the attack directed edge established by the new causal and temporal logic association rules to be determined with the hash value key field factor.

[0064] Among them, fractions The calculation is to estimate the transition probability, i.e., P( | The higher the probability, the more common the behavioral sequence is, and the more likely it is to be a normal operation. The lower the value (because the embodiments of this invention take the negative logarithm of the probability), the rarer and more suspicious the behavioral sequence is. The higher the value, the better. Values ​​can be compressed into a more manageable range; hash value key field factor The credibility of attack edges involving high attack correlation strength indices, rare malware, or files is amplified. Through calculations in the embodiments of this application, the credibility of directed attack edges in the operational behavior chain and network context chain is evaluated.

[0065] The above-described embodiments of this application construct directed edges (i.e., an attack hypothesis of a predecessor node and a successor node) between various security nodes based on new undetermined causal and temporal logic association rules. Then, the credibility parameter value of the attack directed edge is calculated. The above particles (i.e., new undetermined causal and temporal logic association rules) are initially screened using this credibility parameter value. New undetermined causal and temporal logic association rules with attack directed edge credibility parameter values ​​higher than the credibility parameter value threshold are further verified and screened. This results in a more credible causal and temporal logic association rule that is both theoretically (the theoretical optimization result of particle swarm optimization) and physically (i.e., the actual operational behavior and actual state information of the security device node). This ensures the accuracy of tracing the network attack chain of the current security device node.

[0066] Step S23: Select a new causal and temporal logic association rule to be determined that has a confidence parameter value greater than or equal to the confidence parameter value threshold as the second causal and temporal logic association rule to be determined;

[0067] Step S24: Based on the analysis of abnormal operation behavior and abnormal state of security device nodes in the second causal and temporal logic association rule to be determined, obtain the causal and temporal logic association rule.

[0068] It should be noted that, as Figure 4As shown, the above embodiment of this application first initializes and generates multiple causal and temporal logical association rules to be determined based on the normalized historical security device nodes. Each "particle" in the particle swarm optimization algorithm is defined as an executable association rule template. This template explicitly specifies the logical conditions for connecting two security device nodes to form an attack directed edge (such as the operation behavior of the predecessor node, the destination port, the operation behavior of the successor node, the protocol type, and the maximum time difference between the two). Then, by calculating the new causal and temporal logical association rules to be determined, the attack directed edge confidence parameter value (EC) is obtained. This calculation evaluates the rarity of the "feature pair sequence" (such as operation behavior chain, port-protocol combination) defined by the rule in historical data and strengthens it by combining the hash value key field factor, thereby quantifying the suspiciousness of the attack edge constructed by the rule. This completes the first coarse-grained screening of massive candidate rules, retaining the rules that are theoretically more likely to represent attack behavior (i.e., rules with high EC values) and sending them to subsequent processes, reducing the high cost of subsequent processes. The computational burden of fine-grained verification is reduced. Furthermore, based on a preset confidence parameter threshold, rules with a confidence parameter value greater than or equal to the threshold for the directed edge of the attack are selected from the output of step S22 and defined as "second causal and temporal logic association rules to be determined." A binary decision-making process is implemented to ensure that only rules that have passed preliminary theoretical evaluation and possess a high potential attack association strength index can enter the final, rigorous physical evidence verification stage, guaranteeing the input quality of subsequent analysis processes. Further, the second causal and temporal logic association rules to be determined undergo actual operational behavior anomaly analysis and security device node state anomaly analysis, moving from "theoretical optimization" to "physical verification." By combining the contextual anomaly degree of the behavioral sequence with the real-time state anomaly degree of the terminal device, the rules undergo secondary fine-grained screening and final confirmation, ensuring that the final output causal and temporal logic association rules are not only rare in statistical patterns but also supported by anomaly evidence at the level of real operational behavior and system state, thereby improving the accuracy and reliability of the attack chain tracing results.

[0069] Specifically, in step S24, based on the second causal and temporal logical association rule to be determined, the abnormal operation behavior and abnormal state of the historical security device nodes are analyzed to obtain the causal and temporal logical association rule, which includes the following steps:

[0070] Step S241: Establish a historical security node queue for the historical security device nodes according to the second causal and temporal logic association rule to be determined; (The historical security node queue is established by the historical security device nodes according to the second causal and temporal logic association rule to be determined, that is, according to the logic of "IF the [operation behavior] of the predecessor node is _____ AND the [destination port] is _____; AND the [operation behavior] of the successor node is _____ AND the [protocol type] is _____; AND the [time difference] between the two is less than _____ seconds; THEN create a directed edge between them", the historical security device nodes are established to obtain a continuous attack path directed edge, and the continuous historical security device nodes on the path from the starting point of the historical security device node to the ending point of the historical security device node on the attack path directed edge is the continuous historical security node queue).

[0071] Step S242: Obtain two consecutive historical security device nodes from the historical security node queue to form a node group (the node group will contain two consecutive historical security device nodes from the historical security node queue, which are the predecessor node and the successor node in the node group); take the predecessor timestamp of the predecessor node and the successor timestamp of the successor node in the node group, and construct a time window using the predecessor timestamp and the successor timestamp; collect the operation behavior logs within the time window (the operation behavior logs include the session stream, user ID, process tree, command line, file operation, network connection sequence and other behavior logs associated with the time window).

[0072] Step S243: Perform combined anomaly verification processing on the operation behavior log to obtain the behavior verification score;

[0073] It should be noted that the above embodiments of this application perform combined anomaly verification processing on the operation behavior log to obtain a behavior verification score. Specifically, this refers to calculating the Z-score or the first anomaly score based on historical quantiles for key fields (such as command frequency, upload / download volume, number of external domains), with a value range of [0,1]; using an n-gram or Markov chain model to evaluate the likelihood of the operation sequence from the predecessor node to the successor node in normal behavior (i.e., the second anomaly score), with a value range of [0,1]; detecting whether the successor node involves rare operations (such as rare hash values ​​or uncommon ports), calculating the rareness weight (i.e., the third anomaly score), with a value range of [0,1]; calculating the anomaly probability based on the historical behavior spectrum of the entity (such as a user or process), with a value range of [0,1]; checking whether there is a direct evidence chain (such as the consistency between the file hash generated by the predecessor node and the file hash uploaded by the successor node), generating a hash matching flag (i.e., the fourth anomaly score), with a value of 0 or 1 (or a strength value of [0,1]).

[0074] Then, the first, second, third, and fourth abnormal scores are weighted and summed to obtain the behavior verification score. The behavior verification score is calculated by re-verifying the candidate directed edges (i.e., the attack hypothesis between the predecessor node and the successor node) constructed by the second causal and temporal logic association rules to assess the degree of abnormality of the operation behavior. The higher the value, the stronger the evidence of abnormal behavior.

[0075] Step S244: Collect security node device status information data of the node group; the security node device status information data includes terminal monitoring indicators (such as CPU utilization, memory usage, disk I / O, network interface speed, number of processes, suspicious process paths, command lines, startup items, service status, kernel logs), security device warnings (such as IDS alarm level, firewall blocking logs, and session anomaly indicators of traffic probes), and device integrity check data (such as file system snapshot signatures and key file hash modification records);

[0076] Anomaly measurement processing is performed on the status information data of security node devices to obtain the node status verification score;

[0077] It should be noted that the above embodiments of this application perform anomaly measurement processing on the security node device status information data to obtain a node status verification score. Specifically, this refers to calculating the Z-score or percentile difference of each monitoring indicator relative to the historical baseline, and taking the average value as the first status verification score, with a value range of [0,1]; assigning a score based on process path, signature matching degree, and known malicious signs (i.e., the second verification score), with a value range of [0,1]; assigning a score based on file hash not matching the baseline or the addition of key files (i.e., the third verification score), with a value range of [0,1]; and assigning a score based on abnormal external connection session count, file read / write frequency, abnormal child process chain, etc. (i.e., the fourth verification score), with a value range of [0,1].

[0078] Then, the first verification score, the second verification score, the third verification score and the fourth verification score are weighted and summed to obtain the node status verification score. The above embodiment of this application re-verifies the nodes (especially terminal nodes) involved in the second causal and temporal logic association rule to assess whether the device is in a controlled or abnormal state. The higher the value, the stronger the evidence of abnormal device status.

[0079] Step S245: Perform a weighted summation of the behavior verification score and the node state verification score to obtain a comprehensive verification score. Determine whether the comprehensive verification score is greater than or equal to the verification score threshold. If so, output the second causal and temporal logical association rule to be determined as the target causal and temporal logical association rule. If not, based on the second causal and temporal logical association rule to be determined, search for each second causal and temporal logical association rule in the pre-constructed search space at a preset search speed determined based on the hash value key field to obtain multiple new causal and temporal logical association rules to be determined. Then return to the processing of S22 above and iterate again until the target causal and temporal logical association rule is output.

[0080] It should be noted that the pre-constructed search space mentioned above refers to a search space constructed by combining the timestamps, source IPs, destination IPs, source ports, destination ports, protocol types, operational behaviors, and hash value key fields of historical security device nodes (hash value key fields are determined by the rarity of the file or object appearing in the log and the global propagation range, and are used to indicate the criticality of the security device node). Specifically, each particle (the particle is the aforementioned causal and temporal logical association rule to be determined) represents a candidate set of association rules, that is, a candidate connection scheme from discrete security device nodes to single-step attack behavior (directed edge). Each candidate rule set involves multiple causal and temporal logical association rules to be determined, denoted as i (where i=1,2,…,L, and L is the total number of causal and temporal logical association rules to be determined), and the network entities involved are denoted as j (e.g., source or destination IPs, and the total number of entities is denoted as O). This constructs a search space containing the characteristics of each security device node and hash value strength indicators, providing multi-dimensional feature inputs for subsequent searches of the particle swarm.

[0081] The aforementioned search based on a preset search speed determined by the hash value key field refers to allocating more refined local exploration with smaller step sizes for security device nodes with high hash value strength (high importance, rare anomalies) in order to explore local optima in depth, and allocating larger step sizes for security device nodes with low hash value strength to conduct breadth exploration to prevent missing global solutions due to local optima; thereby updating the position of particles and obtaining new causal and temporal logical association rules to be determined;

[0082] like Figure 5 As shown, Figure 5The three curves show similar ranking trends, indicating that behavioral anomalies are correlated with state anomalies. The scores of different rule samples differ significantly, reflecting the continuous distribution of attack evidence strength. Among them, the behavioral verification score is usually higher than the state verification score because the behavioral log provides more direct attack evidence. The comprehensive score is between the two, reflecting the weighted balance effect. The threshold line divides the rule samples into two regions: "passed verification" and "requires re-iteration". About 30% of the rule samples pass verification, which is consistent with the statistical law that real attacks are a minority in security incidents.

[0083] Specifically, in step S245, each second causal and temporal logical association rule to be determined is searched within a pre-constructed search space at a preset search speed determined based on the hash value key field, resulting in multiple new causal and temporal logical association rules to be determined, including the following steps:

[0084] Step S2451: For each second undetermined causal and temporal logical association rule, combine it with each historical security device node to establish an attack chain segment; calculate the attack association strength index for the attack chain segment;

[0085] The attack association strength index is calculated as the average of the product of the weighted combination of hash criticality and network entity criticality and the credibility parameter values ​​of all directed edges in the attack chain segment.

[0086] ;

[0087] In the formula, L is the number of nodes in the attack chain segment. Let k be the directed edge in the attack chain segment. Let be the confidence parameter value of the directed edge in the k-th directed edge of the attack chain segment. For the k-th node in the attack chain segment, Let be the overall importance score of the k-th node in the attack chain segment, where ,in, The hash value key field factor of the k-th node in the attack chain segment. The criticality of the network entity involved in the k-th node of the attack chain segment (the network entity refers to the source IP address or destination IP address) is determined based on the frequency of the entity's appearance in historical attack events. This is a weighting factor (balancing the impact of key fields in the hash value and the criticality of network entities).

[0088] It should be noted that in the above embodiments of this application, the second causal and temporal logic association rule to be determined (i.e., the particles in the above particle swarm optimization algorithm process) is used to establish an attack chain of historical security device node attack events, and each node in the attack chain is a historical security device node.

[0089] This application's embodiments evaluate the overall attack correlation strength index (i.e., the aforementioned attack correlation strength index) of attack chain segments constructed from the second set of causal and temporal logical association rules to be determined, rather than relying solely on the hash value key field of individual nodes. This helps identify seemingly ordinary rules that, when combined, possess an attack correlation strength index, thus avoiding premature convergence to local optima.

[0090] Step S2452: Adjust the preset search speed based on the attack association strength index to obtain the preliminarily adjusted search speed;

[0091] It should be noted that in the above embodiments of this application, firstly, a smaller base speed is allocated to the search dimension involving security device nodes with high hash value strength to achieve fine-grained local exploration; for the search dimension involving nodes with low hash value strength, a larger base speed is allocated to perform rapid breadth exploration. Then, the fragment attack association strength index corresponding to each second causal and temporal logic association rule to be determined is obtained from step S281 above. This score quantifies the overall attack association strength index of the attack chain constructed by the association rule represented by this particle. In addition, based on the hash value key field strength of all security device nodes associated with the particle, an average hash key strength is calculated as an aggregation index of hash influence; based on the obtained particle attack association strength... The FVS (Frequency Value of Attack Correlation) index is used to calculate a velocity adjustment factor guided by the FVS. Specifically, the particle's FVS value is compared with a preset FVS threshold, and the difference is scaled by a sensitivity coefficient before being input into a hyperbolic tangent function for smooth mapping. For high FVS segments (FVS above the threshold), a positive acceleration factor is generated; for low FVS segments (FVS below the threshold), a negative deceleration factor is generated. Furthermore, the saturation characteristics of the hyperbolic tangent function are used to smoothly limit the adjustment range within a reasonable range, avoiding drastic velocity jumps.

[0092] Furthermore, based on the average hash key strength of the second causal and temporal logical association rule to be determined, a speed enhancement factor for hash key is calculated through a linear weighting process, providing an additional adjustment amount for speed based on traditional hash key.

[0093] Finally, based on the base search speed, the speed adjustment factor guided by the attack correlation strength index FVS, and the speed enhancement factor of hash criticality, the preliminary adjusted search speed of each particle in each dimension is obtained through multiplicative superposition, so that the base speed is simultaneously modulated by the feedback of the attack correlation strength index FVS and the hash criticality.

[0094] However, in the actual execution process, the initially adjusted search speed strategy systematically guides particles to gather in the region where the current high attack correlation strength index attack chain fragment is located. Although this accelerates convergence, it also inevitably leads to a rapid decrease in particle swarm diversity, causing the search process to be prematurely limited to a few suspected optimal solutions. This prevents the effective exploration of other potential optimal regions in the search space that may be composed of seemingly ordinary rules that combine to form key attack chains. Therefore, further mutation processing is needed to obtain new globally optimal causal and temporal logical correlation rules to be determined, thereby further analyzing and obtaining the target causal and temporal logical correlation rules.

[0095] Step S2453: Update the second causal and temporal logic association rule to be determined according to the preliminary adjusted search speed to obtain the third causal and temporal logic association rule to be determined, and obtain the position vector of the third causal and temporal logic association rule to be determined; calculate the overall diversity index of the particle swarm composed of each third causal and temporal logic association rule to be determined based on the position vector.

[0096] It should be noted that the above-described embodiment of this application uses the position vector of each third causal and temporal logical association rule to calculate the average standard deviation of the third causal and temporal logical association rule in each dimension, and obtains the overall diversity index of the particle swarm, which quantifies the dispersion of particle positions. The average value is processed to integrate the situation of each dimension, and finally a single index reflecting the exploration range of the entire population is obtained.

[0097] Step S2454: Determine whether the overall diversity index is greater than or equal to the overall diversity index threshold. If so, the third causal and temporal logical association rule to be determined is determined as a new causal and temporal logical association rule to be determined, and return to the processing of S22 above to iterate again until the target causal and temporal logical association rule is output. If not, multiple causal and temporal logical association rules to be mutated are randomly selected from all the current third causal and temporal logical association rules to be determined according to the preset mutation ratio parameter.

[0098] Step S2455: Obtain the number of iterations in the current particle swarm optimization process, and perform mutation processing analysis based on the number of iterations and the attack correlation strength index of the causal and temporal logic association rules to be mutated, so as to obtain new causal and temporal logic association rules to be determined.

[0099] It should be noted that the above-described embodiments of this application utilize a second causal and temporal logic association rule to connect discrete historical security device nodes into attack chain segments and calculate the attack association strength index of the segment. This elevates the evaluation granularity from a single directed edge to a complete attack chain. The index quantifies the potential threat intensity of the entire attack scenario constructed by the rules by comprehensively calculating the credibility of all edges and the importance of all nodes in the chain. This achieves the transformation from evaluation of local features to global attack patterns, providing a more comprehensive and reliable basis for subsequent search direction adjustments. Furthermore, based on the attack association strength index and the average hash key strength, a preliminary adjusted search speed is obtained. A negative feedback adjustment mechanism is introduced, assigning higher speeds to rules (particles) that generate high attack association strength indices, guiding the population to conduct fine-grained searches (utilization) in the surrounding areas with attack association strength indices. Rules that generate low indices are de-speeded, encouraging them to explore a wider range. This allows the search process to adaptively respond to the potential attack association strength indices of different rules, thereby more intelligently balancing global exploration and local development.

[0100] Furthermore, after updating the third causal and temporal logical association rule to be determined based on the new speed, the overall diversity index of the particle swarm is obtained by calculating the average standard deviation of all particle position vectors. This provides a key health diagnosis of the search state, transforming the dispersion of the population distribution into a quantifiable metric that reflects whether the search process is at risk of premature convergence, and provides a basis for decision-making on whether mandatory intervention is necessary.

[0101] Furthermore, the calculated overall diversity index is compared with a preset threshold, and branching is performed based on the result. If the diversity is sufficient, the current population is accepted and iteration continues; if the diversity is insufficient, a portion of the rules are randomly selected as mutation targets to avoid getting trapped in local optima. Then, by combining the number of iterations (to achieve decay) and the attack association strength index (to achieve attack association strength index feedback), a personalized position offset is generated for each rule to be mutated. This allows rules with low attack association strength index to be "launched" to explore more distant regions, while rules with high attack association strength index are only slightly perturbed in their neighborhood. New causal and temporal logical association rules to be determined are output, forcibly injecting new diversity into the stagnant population, helping the algorithm escape the local optimum trap and restart a more effective exploration of the search space.

[0102] Specifically, in step S2455, mutation processing analysis is performed based on the number of iterations and the attack correlation strength index of the causal and temporal logical association rules to be mutated, to obtain new causal and temporal logical association rules to be determined, including the following steps:

[0103] Step S24551: Calculate the corresponding fragment attack association strength index for the causal and temporal logic association rule to be mutated (the calculation method of the fragment attack association strength index is the same as the above attack association strength index, except that the fragment here refers to a fragment in the attack chain, that is, a part of the attack chain composed of some historical network security device nodes involved in the network attack process); calculate the individualized mutation offset of the causal and temporal logic association rule to be mutated in each dimension based on the fragment attack association strength index of the causal and temporal logic association rule to be mutated, combined with the preset mutation offset and the number of iterations.

[0104] The individualized mutation offset is calculated as follows: based on the preset mutation offset, combined with the coefficient that decays exponentially with the number of iterations and the attack association strength index brought by the fragment attack association strength index, and superimposed with the random perturbation of the standard normal distribution, the individualized mutation offset is calculated.

[0105] ;

[0106] In the formula, This is the preset mutation offset. The attenuation coefficient is... This represents the current iteration number. This is the correlation strength index for fragment attacks. It provides the direction and amplitude of random jumps for the standard normal distribution random number generation function;

[0107] Step S24552: For each causal and temporal logical association rule to be mutated, the position vector is processed by vector addition based on the individualized mutation offset to obtain a new causal and temporal logical association rule to be determined, and the process of S22 above is returned to iterate again until the target causal and temporal logical association rule is output.

[0108] It should be noted that the embodiments of this application increase the diversity of particle swarm optimization through the above-mentioned mutation execution process, realizing an exploration mechanism with memory and guidance. That is, not only by randomly jumping to redistribute some particles in the search space, thereby instantly restoring the diversity of the population on a macroscopic level and breaking the premature convergence deadlock caused by velocity adjustment; but also, on a microscopic level, by associating the mutation offset with the particle's attack correlation strength index (FVS) and the number of iterations, a 'survival of the fittest' type of intelligent perturbation is achieved. Particles with low attack correlation strength index are given a larger mutation amplitude, enabling them to completely escape the current unfavorable search area; while particles with high attack correlation strength index are protected and only undergo small perturbations, thus exploring the known high attack correlation strength index region while also taking into account the exploration of its neighborhood. In addition, the characteristic of the mutation amplitude decaying with the number of iterations ensures that bold global exploration is carried out in the early stage of optimization, while gradually shifting to refined local development in the later stage of optimization, ultimately ensuring that the algorithm has a strong global exploration capability while also being able to stably converge to a high-quality solution.

[0109] In summary, the machine learning-based network attack behavior assessment and identification method proposed in this invention collects raw security data from network security devices (such as firewalls, intrusion detection systems, and network traffic probes) and terminals (such as process creation logs and network connection logs), achieving unified collection of multi-source heterogeneous data. Subsequently, through normalization processing, this raw data is converted into security device nodes with a unified format. Each node contains key fields such as timestamp, source IP address, destination IP address, source port, destination port, protocol type, operation behavior, and hash value, eliminating format differences between data sources and constructing a standardized and structured data foundation. This provides consistent and processable data input for subsequent correlation analysis and rule mining, ensuring the reliability and scalability of the tracing process. Furthermore, based on historical security device nodes, a particle swarm optimization algorithm combined with anomaly analysis of operation behavior and anomaly analysis of security device node status is used to mine... Causal and temporal logical association rules are used as judgment criteria to associate discrete security device nodes, forming directed edges that represent single-step attack behavior. Further, multiple consecutive directed edges are used to construct attack chain fragments. Through optimization algorithms and anomaly verification, high-confidence association rules are selected to identify potential attack step sequences, providing attack path information for the construction of a global attack graph. Further, step S30 merges all attack chain fragments generated in step S20, using entities (such as IP addresses and devices) as vertices and attack behaviors (i.e., directed edges) as edges to construct a global attack activity graph. This graph is stored in a graph database, integrating the scattered attack chain fragments to form a complete and visualized attack scenario view, revealing the overall structure and relationships of attack activities. This enables security analysts to quickly identify attack paths, key entities, and attack patterns, thereby improving the response capability and tracing efficiency of security incidents.

[0110] In the further processing, the particles in the particle swarm optimization algorithm are defined as executable causal and temporal logic association rule templates, where each particle position vector corresponds to specific parameter values ​​in the rule template (such as operation behavior, destination port, protocol type, time difference, etc.), realizing the structured and automated initialization of association rules, providing a set of candidate solutions with clear features and unified format for subsequent optimization search, overcoming the limitations of traditional methods that rely on manually defined rules, and improving the efficiency and scalability of rule generation;

[0111] Furthermore, by calculating the transition rareness of feature sequences (such as operational behavior chains and port-protocol combinations) in historical data (based on the negative logarithm of conditional probability) and strengthening it with key hash value field factors, the credibility of attack edges is quantified, completing the first coarse-grained screening of massive candidate rules. Utilizing statistical rareness and key evidence amplification mechanisms, highly suspicious rules are quickly identified, reducing the computational overhead of subsequent fine-grained verification and improving the overall efficiency of the tracing process. Based on a preset credibility parameter threshold, a binary decision is made on the rules, selecting only rules higher than the threshold as the second rule to be determined, ensuring that only potentially high-value rules that pass theoretical evaluation enter the physical verification stage, optimizing resource allocation, and improving the input quality and reliability of subsequent analysis processes.

[0112] Furthermore, by combining operational behavior anomaly analysis (combined verification based on behavior logs) and security device node status anomaly analysis (based on terminal monitoring indicators and security warnings), the rules are jointly verified at the behavioral and status levels, moving from pure theoretical optimization to multi-evidence physical verification. By integrating behavioral context anomaly degree and device real-time status anomaly degree, the output rules are ensured to have both statistical significance and physical evidence support, thereby improving the accuracy and robustness of attack chain tracing.

[0113] Furthermore, by introducing an attack association strength index, the overall threat strength of the rule is evaluated by calculating the average of the credibility of all edges and the importance of all nodes (a weighted combination based on hash criticality and network entity criticality) in the attack chain segment. This improves the evaluation granularity from a single edge to the complete attack chain, overcoming the shortcomings of traditional methods that only focus on local features. It can identify key attack paths composed of combinations of ordinary events and avoid local optima traps in rule mining.

[0114] Meanwhile, by comparing diversity indicators with preset thresholds, the algorithm automatically decides whether to trigger mutation operations, ensuring that the mutation mechanism is activated only when diversity is insufficient, avoiding unnecessary computational disturbances and maintaining algorithm stability. When performing mutation processing, the algorithm calculates individualized mutation offsets by combining the number of iterations (exponential decay) and the attack association strength index (value feedback weight), and achieves particle position jumps through random perturbations. This allows low-value rules to be significantly mutated to explore new areas, while high-value rules are protected with only minor perturbations. This restores population diversity while ensuring global search capabilities and breaking local optimum stagnation.

[0115] In another aspect, the present invention also provides a storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for evaluating and identifying network attack behavior based on machine learning.

[0116] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0117] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; those skilled in the art can modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for evaluating and identifying network attack behaviors based on machine learning, characterized in that, The following steps are included: Raw security data is collected from security devices and terminals in the network; the raw security data is normalized to obtain security device nodes; Historical security device nodes are collected and acquired. Based on these historical security device nodes, a particle swarm optimization algorithm is used in conjunction with anomaly analysis of each historical security device node to obtain causal and temporal logical association rules. Based on these causal and temporal logical association rules, association analysis is performed on the security device nodes to generate directed edges. Multiple consecutive directed edges are then used to construct attack chain segments. All attack chain fragments are merged to construct a global attack activity graph, and the attack activity graph is stored in a graph database; Based on historical security device nodes, and through particle swarm optimization algorithm combined with anomaly analysis of each historical security device node, causal and temporal logical association rules are obtained. The specific steps include the following: Based on the initialization of historical security device nodes, several undetermined causal and temporal logical association rules are obtained; The credibility parameter value of the directed edge of the attack is calculated for the new undetermined causal and temporal logical association rules. Select a new causal and temporal logic association rule to be determined that has a confidence parameter value greater than or equal to the confidence parameter value threshold. This rule is then used as the second causal and temporal logic association rule to be determined. Based on the analysis of abnormal operation behavior and abnormal state of security device nodes in the second undetermined causal and temporal logical association rule, the causal and temporal logical association rule is obtained. Based on the analysis of operational anomalies and state anomalies of historical security device nodes using the second undetermined causal and temporal logical association rule, the causal and temporal logical association rule is obtained, including the following operational steps: A queue of historical security nodes is established by establishing historical security device nodes based on the second undetermined causal and temporal logical association rule. Obtain two consecutive historical security device nodes from the historical security node queue to form a node group; take the predecessor timestamp of the predecessor node and the successor timestamp of the successor node in the node group, and use the predecessor timestamp and successor timestamp to construct a time window; collect operation behavior logs within the time window. Perform combined anomaly verification processing on the operation behavior log to obtain the behavior verification score; Collect security node device status information data of the node group; Anomaly measurement processing is performed on the status information data of security node devices to obtain the node status verification score; The behavior verification score and the node state verification score are weighted and summed to obtain the comprehensive verification score. Based on the comprehensive verification score, mutation judgment is performed through the verification score threshold, and mutation processing is performed on the second causal and temporal logical association rule to be determined to obtain the target causal and temporal logical association rule.

2. The method for evaluating and identifying network attack behavior based on machine learning according to claim 1, characterized in that, The confidence parameter value of the directed attack edge is calculated as follows: the confidence parameter value of the directed attack edge is calculated by combining the feature set of the predecessor and successor nodes in the directed attack edge established by the new causal and temporal logic association rules to be determined with the key field factor of the hash value.

3. The method for evaluating and identifying network attack behavior based on machine learning according to claim 2, characterized in that, Based on the comprehensive verification score and after determining the mutation through the verification score threshold, mutation processing is performed on the second causal and temporal logical association rule to be determined, resulting in the target causal and temporal logical association rule. The process includes the following steps: Determine whether the comprehensive verification score is greater than or equal to the verification score threshold. If so, output the second causal and temporal logical association rule to be determined as the target causal and temporal logical association rule. If not, based on the second causal and temporal logical association rule to be determined, search for each second causal and temporal logical association rule in the pre-constructed search space at a preset search speed determined based on the hash value key field to obtain multiple new causal and temporal logical association rules to be determined. Then return to the above steps for processing and iterate again until the target causal and temporal logical association rule is output.

4. The method for evaluating and identifying network attack behavior based on machine learning according to claim 3, characterized in that, For each second causal and temporal logical association rule to be determined, a search is performed within a pre-constructed search space at a preset search speed determined based on the hash value key field, resulting in multiple new causal and temporal logical association rules to be determined, including the following steps: For each second undetermined causal and temporal logical association rule, an attack chain fragment is established by combining it with each historical security device node; the attack association strength index is calculated for the attack chain fragment. The preset search speed is adjusted based on the attack correlation strength index to obtain the preliminary adjusted search speed; The second causal and temporal logic association rule to be determined is updated based on the initially adjusted search speed to obtain the third causal and temporal logic association rule to be determined, and the position vector of the third causal and temporal logic association rule is obtained; the overall diversity index of the particle swarm formed by each third causal and temporal logic association rule is calculated based on the position vector. If the overall diversity index is greater than or equal to the overall diversity index threshold, the third causal and temporal logical association rule to be determined is determined as a new causal and temporal logical association rule to be determined, and the above steps are returned to the processing, and the process is iterated again until the target causal and temporal logical association rule is output; if not, multiple causal and temporal logical association rules to be mutated are randomly selected from all the current third causal and temporal logical association rules to be determined according to the preset mutation ratio parameter. Obtain the number of iterations in the current particle swarm optimization process. Based on the number of iterations and the attack correlation strength index of the causal and temporal logic association rules to be mutated, perform mutation processing analysis to obtain new causal and temporal logic association rules to be determined.

5. The method for evaluating and identifying network attack behavior based on machine learning according to claim 4, characterized in that, The attack association strength index is calculated as the average of the product of the weighted combination of hash criticality and network entity criticality and the credibility parameter values ​​of all directed edges in the attack chain segment.

6. The method for evaluating and identifying network attack behavior based on machine learning according to claim 5, characterized in that, Based on the number of iterations and the attack correlation strength index of the causal and temporal logical association rules to be mutated, mutation processing analysis is performed to obtain new causal and temporal logical association rules to be determined, including the following steps: The fragment attack association strength index is calculated for the causal and temporal logic association rules of the mutation to be calculated; the individualized mutation offset of the causal and temporal logic association rules of the mutation to be calculated in each dimension based on the fragment attack association strength index of the causal and temporal logic association rules of the mutation to be calculated in combination with the preset mutation offset and the number of iterations. For each causal and temporal logical association rule to be mutated, the position vector is processed by vector addition based on the individualized mutation offset to obtain a new causal and temporal logical association rule to be determined. The above steps are then returned to the processing and iterated again until the target causal and temporal logical association rule is output.

7. The method for evaluating and identifying network attack behavior based on machine learning according to claim 6, characterized in that, The individualized mutation offset is calculated as follows: based on the preset mutation offset, combined with the coefficient that decays exponentially with the number of iterations and the attack association strength index brought by the fragment attack association strength index, and superimposed with the random perturbation of the standard normal distribution, the individualized mutation offset is calculated.

8. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the machine learning-based network attack behavior assessment and identification method described in any one of claims 1-7.

Images