Web application firewall attack real-time traceability system based on real-time monitoring

Abstract

The invention discloses a web application firewall attack real-time traceability system based on real-time monitoring, and relates to the technical field of monitoring analysis, and the system comprises the steps: carrying out the attack behavior fingerprint clustering analysis according to the attack technique difference data, obtaining the attack behavior fingerprint clustering data, carrying out the cross-session attack association evaluation based on the attack behavior fingerprint clustering data, and carrying out the cross-session attack association evaluation based on the cross-session attack association evaluation. Cross-session attack association data is obtained, and attacker group portrait estimation is carried out according to the cross-session attack association data to obtain attacker group portrait data; performing context influence factor identification on the attacker group portrait data to obtain a context influence factor, and performing portrait correction on the attacker group portrait data based on the context influence factor to obtain corrected attacker group portrait data; and carrying out attacker traceability model construction on the corrected attacker group portrait data to obtain an attacker traceability model so as to execute attack real-time traceability and alarm response. The method has the effect of improving the attack tracing efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of monitoring analysis, in particular to a web application firewall attack real-time tracing system based on real-time monitoring. BACKGROUND

[0002] In today's network security protection system, the web application firewall (WAF) is a key component to protect the security of web applications, which mainly detects and intercepts HTTP / HTTPS traffic through a pre-defined attack feature rule library. The existing post-tracing technology is mostly based on WAF log analysis, and its core idea is to aggregate, query and associate the security event logs that have been intercepted or recorded. For example, security operation and maintenance personnel can manually or with the help of a security information and event management system to conduct preliminary threat hunting by analyzing the source IP address, attack time, attack type and attack payload in the log.

[0003] In related technologies, the existing WAF attack tracing technology has fundamental limitations, making it difficult to deal with modern advanced persistent threats and organized attacks. The primary defect is the excessive reliance on source IP and other easily forged network layer identifiers, which cannot penetrate proxy pools, Tor networks or cloud services as intermediate stepping stones. The tracing result often stops at meaningless proxy nodes. The deeper defect is that the existing technology cannot perform intrinsic correlation analysis on attack sessions across multiple different source IPs and different time windows. Due to the lack of extraction and clustering capabilities for attacker "behavior fingerprints", such as unique Payload construction patterns, toolized scanning timing, specific directory traversal preferences, and attack phase evolution rules, it is impossible to identify seemingly scattered attack activities controlled by the same attacker or organization, which leads to the fragmentation of the security personnel's perspective into countless isolated security events when facing a carefully planned, low, slow and small multi-point penetration attack. It is impossible to build a complete attack chain and tactical portrait, thus failing to achieve effective attacker attribution and threat intelligence accumulation, making the tracing work difficult, and reducing the attack tracing efficiency. There is room for improvement. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application provides a web application firewall attack real-time tracing system based on real-time monitoring.

[0005] In the first aspect, the present application provides a web application firewall attack real-time tracing system based on real-time monitoring, comprising: The real-time monitoring module is configured to collect attack traffic data through the web application firewall, obtain an attack traffic dataset, perform attack behavior feature extraction analysis on the attack traffic dataset, obtain attack behavior feature data, perform attack method difference identification according to the attack behavior feature data, and obtain attack method difference data. The analysis module is configured to perform attack behavior fingerprint clustering analysis according to the attack method difference data, obtain attack behavior fingerprint clustering data, perform cross-session attack correlation evaluation based on the attack behavior fingerprint clustering data, obtain cross-session attack correlation data, perform attacker group portrait estimation according to the cross-session attack correlation data, and obtain attacker group portrait data. The correction module is configured to obtain network environment real-time context data, the network environment real-time context data including source IP geographic distribution information, proxy node hop change information and attack time sequence mode, perform context influence factor identification on the attacker group portrait data according to the network environment real-time context data, obtain a context influence factor, perform portrait correction on the attacker group portrait data based on the context influence factor, and obtain corrected attacker group portrait data. The response module is configured to perform attacker tracing model construction on the corrected attacker group portrait data through a deep learning clustering algorithm, obtain an attacker tracing model, and deploy the attacker tracing model to a cloud platform to perform attack real-time tracing and alarm response.

[0006] Preferably, the attack method difference identification according to the attack behavior feature data to obtain attack method difference data specifically includes: Attack traffic data is collected through the web application firewall to obtain an attack traffic dataset, and data cleaning and normalization processing are performed on the attack traffic dataset to obtain standardized attack traffic data. Attack behavior feature extraction analysis is performed on the standardized attack traffic data, and the attack behavior features include extracted Payload construction mode, request frequency fluctuation and target URL preference features, to obtain attack behavior feature data. Attack method difference identification is performed according to the attack behavior feature data, and attack method difference data is obtained according to the results of the attack method difference identification.

[0007] Preferably, the attacker group portrait estimation according to the cross-session attack correlation data to obtain attacker group portrait data specifically includes: Attack behavior fingerprint clustering extraction is performed on the attack traffic dataset according to the attack method difference data to obtain attack behavior fingerprint clustering data. Cross-session attack correlation evaluation is performed on the attack traffic dataset based on the attack behavior fingerprint clustering data to obtain cross-session attack correlation data. The attacker behavior pattern analysis is performed on the cross-session attack associated data, and attacker behavior pattern data is obtained according to the result of the attacker behavior pattern analysis; The attacker group portrait estimation is performed on the attack method difference data according to the attacker behavior pattern data, and attacker group portrait data is obtained.

[0008] Preferably, the cross-session attack association evaluation is performed on the attack traffic data set based on the attack behavior fingerprint clustering data, and cross-session attack associated data is obtained, specifically including: The Payload construction mode analysis of each attack session is performed on the attack behavior fingerprint clustering data, and Payload mode analysis data is obtained; The scan timing quantization of each attack session is performed on the attack behavior fingerprint clustering data according to the Payload mode analysis data, and scan timing quantization data is obtained; The target selection preference extraction of each attack session is performed on the attack traffic data set based on the scan timing quantization data, and target selection preference data is obtained; The behavior consistency compensation between different attack methods is performed on the scan timing quantization data according to the target selection preference data, and behavior consistency compensation data is obtained; The cross-session attack association evaluation is performed on the attack behavior fingerprint clustering data according to the behavior consistency compensation data, and cross-session attack associated data is obtained.

[0009] Preferably, the process of performing the behavior consistency compensation between different attack methods on the scan timing quantization data according to the target selection preference data specifically includes: The strategy key node profiling between different attack methods is performed according to the target selection preference data, the strategy key node including identifying attack phase transition points and tool switching marks, and strategy key node profiling data is obtained; The behavior sequence dynamic field data is obtained by performing the behavior sequence dynamic field simulation based on the strategy key node profiling data, and the node behavior entropy value data is obtained by performing the node behavior entropy value calculation on the behavior sequence dynamic field data; The behavior consistency compensation between different attack methods is performed on the scan timing quantization data according to the node behavior entropy value data, and behavior consistency compensation data is obtained.

[0010] Preferably, the process of performing the cross-session attack association evaluation on the attack behavior fingerprint clustering data according to the behavior consistency compensation data specifically includes: The behavior change trajectory extraction between different attack methods is performed on the attack behavior fingerprint clustering data according to the behavior consistency compensation data, and behavior change trajectory data is obtained; The attack feature decomposition data is obtained by performing the attack feature balance decomposition based on the behavior change trajectory data and the behavior consistency compensation data; Feature weight matching is performed on the attack feature decomposition data to obtain feature weight matching data. Cross-session attack correlation evaluation is then performed based on the attack feature decomposition data and feature weight matching data to obtain cross-session attack correlation data.

[0011] Preferably, the process of estimating attacker group profiles based on attacker behavior pattern data and attack method difference data to obtain attacker group profile data specifically includes: Based on attacker behavior pattern data, attack lifecycle analysis is performed on attack method difference data to obtain attack lifecycle data; Based on attacker behavior pattern data, attack intensity periodic fluctuation analysis is performed on attack lifecycle data at different lifecycle stages to obtain attack intensity periodic fluctuation data. Based on the attack method difference data, the attack base increment data of different attack methods is defined in the attack life cycle data to obtain the attack base increment data; Attacker group profiles are estimated by analyzing the incremental attack base data and the periodic fluctuation data of attack intensity among different attack methods.

[0012] Preferably, the attacker group profile data is corrected based on contextual influence factors to obtain corrected attacker group profile data, specifically including: The attacker group profile data is processed by a convolutional neural network to obtain profile convolutional data, and real-time network environment context data is obtained. Based on the real-time network environment context data, the attacker group profile data is subjected to context influence factor identification to obtain context influence factors. Attacker group profiles are corrected by applying contextual influence factors to the convolutional profile data, resulting in corrected attacker group profile data.

[0013] Preferably, contextual influence factors are identified based on real-time network environment context data to determine the attacker group profile data, specifically including: Perform network topology layering analysis on real-time context data of the network environment to obtain network layered topology data; Attack path suppression assessment is performed on attacker group profile data based on network hierarchical topology data to obtain path suppression assessment data. The metabolic response function was fitted to the pathway inhibition assessment data to obtain the metabolic inhibition response function; Contextual influencing factors are identified based on the metabolic inhibition response function of the pathway inhibition assessment data.

[0014] Secondly, this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to execute the real-time tracing system for web application firewall attacks based on real-time monitoring as described above.

[0015] In summary, this application includes the following beneficial technical effects: This application provides a real-time attack tracing system for web application firewalls based on real-time monitoring. Through a real-time monitoring module, it accurately collects attack traffic from the web application firewall. After data cleaning and standardization, and extraction of core features such as payload construction and request frequency, it can effectively identify differences in various attack methods, providing a high-quality data foundation for tracing and avoiding analytical biases caused by data quality issues. By clustering attack behavior fingerprints and evaluating cross-session associations, it can uncover hidden connections between scattered attack behaviors, reconstruct the complete attack chain, overcome the limitations of single-session analysis, and improve the completeness of tracing. Furthermore, by combining contextual data such as network topology and the geographical distribution of source IPs, it identifies influencing factors, corrects attacker group profiles, eliminates interference from IP spoofing and proxy switching, and significantly improves profile accuracy. It also constructs an attacker tracing model and deploys it on a cloud platform to achieve real-time attack tracing and alerting, significantly shortening response time. This effectively improves the accuracy and efficiency of web application attack identification and tracing, helping administrators quickly locate threats and formulate defense strategies, thereby effectively reducing business losses caused by attacks. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of a system for real-time source tracing of web application firewall attacks based on real-time monitoring, according to an embodiment of this application. Detailed Implementation

[0018] The following is in conjunction with the appendix Figure 1 This application will be described in further detail. Example

[0019] This application discloses a real-time source tracing system for web application firewall attacks based on real-time monitoring.

[0020] Reference Figure 1 A real-time attack attribution system based on real-time monitoring of web application firewalls includes: The real-time monitoring module is used to collect attack traffic data through the web application firewall to obtain an attack traffic dataset, extract and analyze attack behavior features from the attack traffic dataset to obtain attack behavior feature data, and identify attack method differences based on the attack behavior feature data to obtain attack method difference data. The analysis module is used to perform attack behavior fingerprint clustering analysis based on attack method difference data to obtain attack behavior fingerprint clustering data. Based on the attack behavior fingerprint clustering data, cross-session attack correlation assessment is performed to obtain cross-session attack correlation data. Based on the cross-session attack correlation data, attacker group profile estimation is performed to obtain attacker group profile data. The correction module is used to acquire real-time network environment context data, which includes source IP geographical distribution information, proxy node jump information and attack time sequence patterns. Based on the real-time network environment context data, the attacker group profile data is identified by context influence factors to obtain context influence factors. Based on the context influence factors, the attacker group profile data is corrected to obtain the corrected attacker group profile data. The response module is used to construct an attacker attribution model from the corrected attacker group profile data using a deep learning clustering algorithm. The attacker attribution model is then deployed to the cloud platform to perform real-time attack attribution and alarm response.

[0021] Specifically, firstly, a web application firewall is deployed at the boundary of the office or business network to capture all network traffic accessing web applications in real time. Attack traffic containing abnormal request characteristics is filtered out, and the request header information, payload, request sending time, request frequency, target URL address, and source IP information of each attack traffic entry are recorded to form an attack traffic dataset. Next, the attack traffic dataset undergoes noise filtering and data format standardization to remove invalid and redundant data. Then, feature extraction algorithms are used to extract and analyze attack behavior characteristics from the attack traffic data, focusing on identifying payload construction patterns, request frequency fluctuations, and target URL preferences to obtain attack behavior feature data. Finally, the behavioral feature data of different attack traffic are compared to identify the differences in techniques used by various attacks. For example, the differences in payload construction between SQL injection and command injection, and the differences in request frequency between automated scanning tools and manual attacks, are distinguished to obtain attack technique difference data. Secondly, based on the attack method difference data, clustering algorithms such as K-means and DBSCAN are used to perform attack behavior fingerprint clustering analysis on the attack behavior feature data. Attack traffic with similar behavioral characteristics is grouped into the same fingerprint category, resulting in attack behavior fingerprint clustering data. Based on the attack behavior fingerprint clustering data, attack traffic records from different time periods and sessions are retrieved to analyze the correlation between attacks of the same fingerprint category in different sessions. For example, it is determined whether attacks launched by a certain source IP in different time periods belong to the same fingerprint category and whether there is continuity in attack targets, thus completing cross-session attack correlation assessment and obtaining cross-session attack correlation data. Based on the cross-session attack correlation data, the attacker's behavior patterns are further analyzed, such as attack initiation time preferences, characteristics of commonly used attack tools, and target selection logic. Combined with the attack scale and frequency, information such as the size, technical level, and attack intent of the attacker group is estimated, resulting in attacker group profile data. Next, real-time contextual data of the network environment is collected, including the geographical distribution information of source IPs obtained through IP location technology, proxy node hopping information obtained through network tracing technology, and the sequence pattern of attack initiation time. Based on the above contextual data, its impact on the attacker group profile data is analyzed. For example, if multiple source IPs come from the same geographical area and the proxy node hopping patterns are similar, they may belong to the same attack group, thus identifying the contextual influencing factor. The attacker group profile data obtained earlier is then corrected using this influencing factor, for example, by correcting the estimate of the attacker group size and adjusting the judgment of the attacker's technical level, resulting in the corrected attacker group profile data.Finally, deep learning clustering algorithms such as CNN and LSTM are used to construct an attacker attribution model using the corrected attacker group profile data, attack behavior feature data, and cross-session association data as training samples. The attacker attribution model can match the corresponding attacker group profile based on the real-time collected attack data to achieve attack attribution. The attacker attribution model is deployed to a cloud platform, which receives attack traffic data transmitted by the web application firewall in real time, calls the attacker attribution model to perform real-time attribution analysis, and immediately triggers an alarm mechanism once a known attack group or new attack behavior is identified, pushing the attribution results and attack warning information to the administrators and performing real-time attack attribution and alarm response.

[0022] By employing the above technical solutions, precise data collection and feature extraction ensure timely capture of attack traffic and identification of differences in attack methods, providing a comprehensive data foundation for subsequent attribution and avoiding attribution bias caused by data gaps. The clustering and cross-session correlation functions of the analysis module can uncover hidden connections between scattered attack behaviors, breaking through the limitations of single-session analysis and improving the completeness of attack attribution. The correction module combines network environment context data to correct the profile, effectively eliminating the impact of factors such as proxy hiding and IP spoofing on the accuracy of the profile, making the attacker group profile more consistent with the actual situation. The deep learning model and cloud platform deployment of the response module realize the automation and real-time nature of attack attribution, significantly shortening the attribution response time, helping managers quickly locate the source of the attack and formulate defense strategies, effectively improving the security protection capabilities of web applications, and reducing business losses caused by attacks.

[0023] It should be noted that the process of identifying attack method differences based on attack behavior characteristic data to obtain attack method difference data specifically includes: Attack traffic data is collected through a web application firewall to obtain an attack traffic dataset. The attack traffic dataset is then cleaned and normalized to obtain standardized attack traffic data. The attack behavior features are extracted and analyzed from the standardized attack traffic data. The attack behavior features include extracting payload construction patterns, request frequency fluctuations, and target URL preference features to obtain attack behavior feature data. Attack method differences are identified based on attack behavior characteristic data, and attack method difference data are obtained based on the results of the attack method difference identification.

[0024] Specifically, firstly, the web application firewall intercepts and detects all network traffic accessing web applications in real time. Based on a pre-defined attack signature database, it filters out suspected attack traffic and collects complete data for each suspected attack traffic, including the request method, request headers, data payload, request timestamp, source IP address of the request, target URL path, and request response status code. This data is then integrated to form an attack traffic dataset. Subsequently, the attack traffic dataset undergoes data cleaning, removing duplicate data, malformed data, and redundant data without effective attack signatures caused by network fluctuations. Then, methods such as Min-Max normalization and Z-score standardization are used to convert feature data of different magnitudes into a unified numerical range, eliminating the impact of data magnitude differences on subsequent analysis, thereby obtaining standardized attack traffic data. Secondly, attack behavior feature extraction and analysis are performed on standardized attack traffic data. For payload construction patterns, syntax parsing algorithms are used to analyze the character composition, statement structure, and use of special symbols in the payload. For example, it identifies whether SQL injection attacks contain keywords such as "SELECT" and "UNION," and whether XSS attacks embed script tags. Regarding request frequency fluctuations, the number of requests from the same source IP to the same target URL within a unit of time is counted, and the trend of request frequency changes is analyzed to determine whether the requests are uniform, bursty, or periodic. Regarding target URL preference characteristics, the distribution of target URLs for different attack traffic is statistically analyzed to identify whether there are concentrated attacks on specific functional interfaces. Through the above extraction, attack behavior feature data containing these three types of characteristics is obtained. Finally, attack method differences are identified based on attack behavior characteristic data, and an attack method characteristic comparison model is constructed. This model can be trained using historical data. Behavioral characteristic data of different attack traffic are input into the model, and pairwise comparisons are performed across three dimensions: payload construction, request frequency, and target URL preference. For example, comparing SQL injection and command injection: SQL injection payloads often contain database operation keywords, request frequencies are mostly low to medium, and targets are mostly data query interfaces; while command injection payloads often contain system command statements, request frequencies are mostly high, and targets are mostly system management interfaces. Attack method categories are classified based on the comparison results, and the differences in performance across the three characteristic dimensions are recorded. For example, attacks with payloads containing database keywords and targets being data interfaces are classified as SQL injection, while attacks with payloads containing system commands and targets being system interfaces are classified as command injection. Attack method difference data is obtained based on the category classification and difference records.

[0025] By employing the above technical solutions, data cleaning and standardization processes can remove invalid data interference and unify data formats, providing high-quality data for subsequent feature extraction and differential identification, thus avoiding analytical errors caused by data quality issues. Three core features—payload construction, request frequency, and target URL preferences—are specifically extracted to comprehensively cover key differences in attack methods, ensuring comprehensive differential identification and avoiding misjudgments due to feature omissions. By constructing attack method categories through multi-dimensional feature comparison, different types of attack methods can be accurately distinguished, such as effectively differentiating between automated scanning attacks and manually targeted attacks. This provides a clear basis for attacker profiling and tracing, helping administrators quickly grasp attack types, formulate targeted defense strategies, and improve the accuracy and efficiency of web application firewalls in identifying and defending against attacks.

[0026] It should be noted that the process of estimating attacker group profiles based on cross-session attack correlation data, and obtaining attacker group profile data, specifically includes: Attack behavior fingerprint clustering is performed on the attack traffic dataset based on the differences in attack methods to obtain attack behavior fingerprint clustering data; Cross-session attack correlation evaluation is performed on the attack traffic dataset based on attack behavior fingerprint clustering data to obtain cross-session attack correlation data. Attacker behavior pattern analysis is performed on cross-session attack correlation data, and attacker behavior pattern data is obtained based on the results of the attacker behavior pattern analysis. Attacker group profile data is obtained by estimating the attacker group profile data based on the attacker behavior pattern data and the attack method difference data.

[0027] Specifically, firstly, attack behavior fingerprints are extracted from the attack traffic dataset based on attack method difference data. The payload construction patterns, request frequency fluctuations, and target URL preference characteristics of various attacks in the attack method difference data are combined to form a unique behavior fingerprint for each attack traffic instance. A hierarchical clustering algorithm is then used to cluster all attack behavior fingerprints, calculating the similarity between different fingerprints. Fingerprints with similarity exceeding a preset threshold are grouped into the same cluster, with each cluster representing a type of attack behavior with similar attack methods. This extraction yields attack behavior fingerprint clustering data. Secondly, cross-session attack correlation assessment is performed on the attack traffic dataset based on the attack behavior fingerprint clustering data. Records from different sessions in the attack traffic dataset are retrieved, and it is checked whether the attack behavior fingerprints of different sessions belong to the same cluster. If they belong to the same cluster, the correlation of attack targets, the consistency of attack tools, and the continuity of attack time are further analyzed. If at least two correlation conditions are met, an attack correlation is determined between different sessions, and the correlation relationship and its basis are recorded, yielding cross-session attack correlation data. Next, attacker behavior pattern analysis was performed on the cross-session attack correlation data. This involved statistically analyzing the distribution of attack initiation time, attack tool usage, attack target selection logic, and attack intensity changes within the correlated sessions. Through statistical analysis, fixed patterns and characteristics of attacker behavior were summarized, resulting in attacker behavior pattern data. Finally, attacker group profiles were estimated based on the attacker behavior pattern data and the attack method difference data. The technical complexity of various attacks in the attack method difference data was used to determine the attacker group's technical level; the attack scale in the cross-session correlation data was used to estimate the attacker group's size; and the attack time and target selection in the attacker behavior pattern data were used to infer the attacker group's attack intent. Integrating the technical level, size, intent, and behavioral characteristics, an attacker group profile was formed, resulting in attacker group profile data.

[0028] By employing the above technical solutions, attack behavior fingerprint clustering extraction can categorize scattered attack traffic according to methods, providing a unified feature basis for cross-session association and avoiding difficulties in association caused by fragmented attack methods. Cross-session attack association assessment breaks through the limitations of single-session analysis, identifying covert attacks launched by attackers through multiple sessions and multiple IPs, reconstructing the complete attack chain, and improving the comprehensiveness of source tracing. Attacker behavior pattern analysis can mine the behavioral patterns of attackers from the associated data, providing a specific basis for profile estimation and avoiding overly general profiles. Attacker group profile estimation based on multi-dimensional data can comprehensively reflect the technical capabilities, scale, and intent of the attacker group, making the profile more valuable and helping managers accurately locate the attack threat level and formulate differentiated defense and response strategies. For example, for attacks against advanced APT organizations, internal protection and threat intelligence sharing need to be strengthened, while for basic script attacks, rule interception can be strengthened to improve the targeted security protection of web applications.

[0029] Furthermore, based on attack behavior fingerprint clustering data, cross-session attack correlation evaluation is performed on the attack traffic dataset to obtain cross-session attack correlation data, specifically including: The Payload construction pattern of each attack session is parsed from the attack behavior fingerprint clustering data to obtain Payload pattern parsing data. Based on the Payload pattern parsing data, the attack behavior fingerprint clustering data is subjected to scanning time-series quantization for each attack session to obtain scanning time-series quantized data; Based on the scan time-series quantized data, target selection preference data is obtained by extracting the target selection preference data for each attack session in the attack traffic dataset. Based on the target selection preference data, behavioral consistency compensation is performed on the scanning time-series quantized data for different attack methods to obtain behavioral consistency compensation data. Based on the behavior consistency compensation data, cross-session attack association assessment is performed on the attack behavior fingerprint clustering data to obtain cross-session attack association data.

[0030] Specifically, firstly, the payload construction pattern of each attack session is parsed from the attack behavior fingerprint clustering data. The payload data of the attack sessions within each cluster is extracted from the attack behavior fingerprint clustering data. A syntax analyzer is used to perform structured parsing of the payload, identifying the core attack statements, parameter passing methods, and encoding methods in the payload. The similarity of core statements, the consistency of parameter positions, and the uniformity of encoding methods of payloads from different sessions within the same cluster are statistically analyzed. For example, if the payloads of different sessions all contain the core statement "UNIONSELECT" and the parameters are all located in the URL query string, it is determined that the payload construction pattern is highly consistent. The payload pattern parsing data is obtained through this parsing. Secondly, based on the payload pattern parsing data, the attack behavior fingerprint clustering data is used to quantize the scanning time sequence of each attack session. The attack request timestamp sequence of each attack session is extracted, the time interval between two adjacent requests is calculated, and the average, variance, and maximum value of the time interval are statistically analyzed. The changing trend of the time interval is analyzed to determine whether the attack is a uniform scan, gradient scan, or pulse scan. The scanning time sequence features are converted into quantitative indicators. For example, if the average time interval between adjacent requests in a session is 2 seconds and the variance is 0.5, it is quantized as (2, 0.5). This quantization yields the scan time sequence quantized data. Next, based on the scan time sequence quantized data, the target selection preference of each attack session is extracted from the attack traffic dataset. The path structure, function type, and access order of all target URLs in each attack session are statistically analyzed. The access ratio of different sessions within the same cluster to URLs of the same function type is calculated. For example, if session A accesses the login interface 60% of the time and session B accesses the login interface 55% of the time, the target selection preference is determined to be similar. The access order pattern of the target URLs is recorded, such as whether there is a fixed access chain of "homepage-login-data". This extraction yields the target selection preference data. Then, based on the target selection preference data, behavioral consistency compensation is performed on the scan time series quantification data for different attack methods. The commonalities and differences of different attack methods in target selection preferences are analyzed, and a behavioral consistency compensation model is constructed. The behavioral consistency compensation model can be obtained by training on historical data. If the target selection preferences of different attack methods are highly similar but the scan time series are significantly different, the weight of the time series quantification index is adjusted through the behavioral consistency compensation model. For example, if the similarity of target preferences reaches 90%, the influence weight of the time series difference is reduced by 30% to compensate for the behavioral inconsistency caused by the difference in methods, thus obtaining behavioral consistency compensation data.Finally, based on the behavior consistency compensation data, cross-session attack association assessment is performed on the attack behavior fingerprint clustering data. The comprehensive similarity of different sessions in three dimensions—Payload mode parsing data, compensated scan time-series quantization data, and target selection preference data—is calculated. A comprehensive similarity threshold is set. If the comprehensive similarity of different sessions is higher than the threshold, cross-session attack association is determined to exist. The associated session ID, association dimension, comprehensive similarity, and association basis are recorded. All association records are integrated to obtain cross-session attack association data.

[0031] By employing the above technical solutions, payload construction pattern parsing can delve into the core of attack data, identify commonalities in the technical implementation of different session attacks, provide key technical evidence for correlation, and avoid overlooking deep correlations due to superficial feature differences. Scanning time-series quantification transforms abstract time patterns into concrete numerical values, making the time-series characteristics of different sessions comparable and improving the objectivity of correlation analysis. Target selection preference extraction supplements the correlation dimension from the perspective of attack targets, covering the business logic level of attack behavior and avoiding the one-sidedness of correlation caused by relying solely on technical features. Behavioral consistency compensation effectively solves the interference of behavioral differences between different attack methods on correlation, ensuring accurate correlation even if the methods are slightly different, as long as the core behavior is consistent. Multi-dimensional comprehensive evaluation significantly improves the accuracy and comprehensiveness of cross-session correlation, enabling the identification of multi-session attacks launched by attackers by switching IPs and adjusting methods, providing complete attack chain information for subsequent attacker profiling and tracing, helping administrators to uncover covert attack strategies, and improving the depth of web application security defense.

[0032] Furthermore, the process of compensating for behavioral consistency across different attack techniques by applying target selection preference data to the scan time-series quantized data specifically includes: Based on the target selection preference data, the key strategic nodes between different attack methods are analyzed. The key strategic nodes include identifying attack phase transition points and tool switching markers to obtain key strategic node analysis data. Based on the analysis data of key nodes in the strategy, the dynamic field of the behavior sequence is simulated to obtain the dynamic field data of the behavior sequence. Then, the node behavior entropy value is calculated on the dynamic field data of the behavior sequence to obtain the node behavior entropy value data. Based on the node behavior entropy value data, behavior consistency compensation is performed on the scan time-series quantized data for different attack methods to obtain behavior consistency compensation data.

[0033] Specifically, firstly, based on target selection preference data, the key strategic nodes between different attack methods are analyzed. Target URL access records for various attack methods are extracted from the target selection preference data to analyze the target switching patterns during the attack process. Key strategic nodes are identified, including attack phase transition points and tool switching markers. The types, frequencies, and corresponding target URL characteristics of key nodes for different attack methods are recorded. For example, SQL injection phase transition points often correspond to data query interfaces, while XSS phase transition points often correspond to front-end form pages. This analysis yields key strategic node analysis data. Secondly, behavioral sequence dynamics simulation is performed based on the analysis data of key strategy nodes. The target access sequence of each attack session is regarded as a behavioral trajectory, and a behavioral sequence dynamics model is constructed with key strategy nodes as coordinate points. In the behavioral sequence dynamics model, each key node has "attraction," and attack behaviors will move towards key nodes with high attraction. According to the attraction of key nodes for different attack methods, the movement trajectory of attack behaviors in the dynamics field is simulated, and the overlap of behavioral trajectories of different methods is analyzed to obtain behavioral sequence dynamics data. The node behavioral entropy value is calculated on the behavioral sequence dynamics data. The entropy value is used to quantify the uncertainty of attack behaviors at key nodes. The lower the entropy value, the more fixed the behavior; the higher the entropy value, the more random the behavior. The Shannon entropy formula is used to calculate the behavioral entropy value of different attack methods at each key node. For example, at the login interface key node, the behavioral entropy values ​​of SQL injection and XSS are 0.3 and 0.4, respectively, indicating that the behavior of both at this node is highly deterministic. The node behavioral entropy value data is obtained through this calculation. Finally, based on the node behavior entropy data, behavioral consistency compensation is performed on the scan time-series quantization data for different attack methods. If the behavioral entropy values ​​of different attack methods at the same key node are all lower than the preset threshold, it indicates that the behavior of the two methods at that node is highly consistent. In this case, the weight of the time-series difference in the scan time-series quantization data is reduced. If the behavioral entropy value difference at a certain key node is large, the weight of the time-series difference remains unchanged. At the same time, the compensation coefficient is adjusted according to the overlap of key nodes of different methods in the strategy key node analysis data. The higher the overlap, the larger the compensation coefficient. The adjusted weights and compensation coefficients are applied to the scan time-series quantization data to correct the time-series difference values ​​between different methods. For example, if the original time-series difference between method A and method B is 0.6, after weight adjustment and coefficient compensation, the time-series difference is corrected to 0.3. Through this compensation, behavioral consistency compensation data is obtained.

[0034] By employing the aforementioned technical solutions, the commonalities of different attack techniques are extracted from the attack strategy level through key node analysis, identifying the core turning points of attack behavior and providing a strategic basis for judging behavioral consistency, avoiding compensation bias caused by focusing solely on tactical differences. Behavioral sequence dynamic field simulation transforms abstract attack behavior into a visualized trajectory model, making the behavioral similarities of different techniques more intuitive and facilitating the discovery of hidden behavioral connections. Node behavioral entropy calculation quantifies the determinism of behavior, providing an objective numerical standard for consistency judgment and avoiding judgment errors caused by subjective experience. A compensation algorithm based on entropy value and key node overlap can accurately adjust the impact of scanning timing differences, effectively compensating for behavioral differences between different attack techniques, ensuring that attack sessions with consistent core behaviors can be accurately associated, solving the problem of cross-session association breaks caused by technique switching, providing a more reliable data foundation for subsequent cross-session attack association assessment, and improving the continuity and accuracy of attack attribution.

[0035] Furthermore, the process of evaluating cross-session attack correlations based on attack behavior fingerprint clustering data using behavioral consistency compensation data specifically includes: Based on the behavior consistency compensation data, the behavior change trajectory between different attack methods is extracted from the attack behavior fingerprint clustering data to obtain behavior change trajectory data. Attack feature balance decomposition is performed based on behavior change trajectory data and behavior consistency compensation data to obtain attack feature decomposition data. Feature weight matching is performed on the attack feature decomposition data to obtain feature weight matching data. Cross-session attack correlation evaluation is then performed based on the attack feature decomposition data and feature weight matching data to obtain cross-session attack correlation data.

[0036] Specifically, firstly, based on the behavior consistency compensation data, the behavior change trajectory between different attack methods is extracted from the attack behavior fingerprint clustering data. The complete behavior record of each attack session (including payload construction, request frequency, and target URL access order) is retrieved from the attack behavior fingerprint clustering data. Combined with the corrected scan time sequence information in the behavior consistency compensation data, the behavior change trajectory of each session is constructed. The trajectory is plotted with time as the horizontal axis and "Payload type - target URL function - request frequency" as the vertical axis, marking the attack behavior status at each time point. The behavior trajectories of different sessions are analyzed to identify similar segments in the trajectory. The duration, occurrence time, and corresponding behavioral characteristics of similar trajectory segments are recorded. Through this extraction, the behavior change trajectory data is obtained. Secondly, attack features are balanced and decomposed based on behavioral change trajectory data and behavioral consistency compensation data, categorizing them into three types: "technical features," "temporal features," and "target features." The contribution of each type of feature to different attack methods is calculated; for example, in SQL injection, technical features contribute 40%, temporal features 30%, and target features 30%; in XSS, technical features contribute 30%, temporal features 20%, and target features 50%. Based on contribution, features are balanced and decomposed, enhancing features with low contribution and suppressing features with high contribution to ensure balanced weights in the association evaluation, preventing any one type of feature from excessively dominating the evaluation results. This yields the attack feature decomposition data. Next, feature weight matching is performed on the attack feature decomposition data, assigning sub-weights to each decomposed feature type. The similarity between different sessions on each feature type is calculated. The similarity of each feature type is multiplied by its corresponding sub-weight to obtain a weighted similarity. The weighted similarities of the three types of features are then summed to obtain the comprehensive feature similarity between different sessions. This matching process yields the feature weight matching data. Finally, cross-session attack association assessment is performed based on attack feature decomposition data and feature weight matching data. A comprehensive feature similarity threshold is set. If the comprehensive feature similarity of different sessions is higher than the threshold, a preliminary association is determined. The rationality of the association is further verified by checking whether the key policy nodes of the two are matched and whether there is a geographical association between the attacking IPs. If the verification is successful, the cross-session attack association is confirmed, and the associated session ID, comprehensive similarity, matching features, and verification basis are recorded. If the verification fails, the feature weights or thresholds are readjusted and the assessment is repeated. All confirmed association records are integrated to obtain cross-session attack association data.

[0037] By employing the above technical solutions, the evolution of attack behavior is fully presented from a temporal perspective through behavioral change trajectory extraction, enabling a more comprehensive comparison of behaviors across different sessions. This allows for the discovery of attack associations where short-term segments are similar but the overall trajectory is consistent. Attack feature balancing decomposition effectively addresses evaluation biases caused by differences in feature contribution among different attack methods, ensuring that technical, temporal, and target features all play a role in the association, thus improving the objectivity of the evaluation. Feature weight matching achieves comprehensive consideration of multiple features through weighted calculation, avoiding false associations caused by high similarity of a single feature but inconsistent overall behavior. Multi-dimensional verification further improves the accuracy of associations, eliminating false associations caused by accidental similarities. Finally, the cross-session attack association evaluation can accurately identify the association relationships of multi-session and multi-method attacks, providing a complete behavioral chain for subsequent attacker group profiling, helping administrators to reconstruct the full picture of the attack, formulate targeted defense strategies, and improve the web application's ability to trace the source of complex attacks.

[0038] Furthermore, the process of estimating attacker group profiles based on attacker behavior pattern data and attack method difference data to obtain attacker group profile data specifically includes: Based on attacker behavior pattern data, attack lifecycle analysis is performed on attack method difference data to obtain attack lifecycle data; Based on attacker behavior pattern data, attack intensity periodic fluctuation analysis is performed on attack lifecycle data at different lifecycle stages to obtain attack intensity periodic fluctuation data. Based on the attack method difference data, the attack base increment data of different attack methods is defined in the attack life cycle data to obtain the attack base increment data; Attacker group profiles are estimated by analyzing the incremental attack base data and the periodic fluctuation data of attack intensity among different attack methods.

[0039] Specifically, firstly, based on attacker behavior pattern data, attack lifecycle analysis is performed on attack method difference data to identify different attack methods. Complete behavioral sequences of various attack methods are extracted from the attacker behavior pattern data. Combined with the technical characteristics of different methods in the attack method difference data, attack lifecycle stages are defined. The duration, attack tools used, and corresponding target URL types of each stage are statistically analyzed. The commonalities and differences in lifecycle stage division, duration, and tool usage among different attack methods are analyzed. For example, both SQL injection and command injection lifecycles include the information probing to data theft stage, but the vulnerability exploitation stage of command injection is shorter. This analysis yields attack lifecycle data. Secondly, based on attacker behavior pattern data, periodic fluctuation analysis of attack intensity at different lifecycle stages is performed on the attack lifecycle data. Attack traffic data for each lifecycle stage is extracted, and attack intensity is calculated. The changes in attack intensity over different time periods are statistically analyzed to identify periodic patterns in intensity fluctuations. For example, attack intensity peaks between 2:00-4:00 AM daily, and weekday attack intensity is higher than weekend intensity. The fluctuation differences between different lifecycle stages are analyzed; for example, intensity fluctuations are small during the information probing stage and large during the vulnerability exploitation stage. This analysis yields periodic fluctuation data of attack intensity. Next, based on the attack method difference data, the attack base increment of the attack lifecycle data is defined for different attack methods. The number of originating IPs and associated sessions for each attack method are extracted from the attack method difference data. Combined with the attack coverage of each stage in the attack lifecycle data, the attack base is calculated. The growth of the base within the attack lifecycle is statistically analyzed to define the attack base increment. The differences in base increment for different attack methods are analyzed; for example, APT attacks have a small base increment, while automated script attacks have a large base increment. This definition yields the attack base increment data. Finally, attacker group profiles are estimated based on the attack base increment data and attack intensity periodic fluctuation data for different attack methods. Multi-dimensional data is integrated: the technical complexity of the attack method difference data indicates the group's technical level; the base size of the attack base increment data indicates the group's size; the completeness of the attack lifecycle data stages and the time pattern of the attack intensity periodic fluctuation data indicate the group's attack intent; and behavioral characteristics from the attacker behavior pattern data are combined to form a complete attacker group profile, recording the specific performance of each dimension, thus obtaining attacker group profile data.

[0040] By employing the above technical solutions, the entire attack process is fully reconstructed through attack lifecycle analysis, providing a basis for attack strategy-level profiling and avoiding the one-sidedness of profiling caused by focusing on only a single stage. Attack intensity periodic fluctuation analysis uncovers the temporal patterns of attacks, enabling the inference of attackers' work and rest habits and avoidance strategies, making profiling more targeted. Attack base increment definition quantifies the attack group from a scale perspective, distinguishing between automated and manual attacks, and large organizations and small teams, improving the accuracy of profiling. The attacker group profile formed by multi-dimensional integration comprehensively covers core dimensions such as technology, scale, intent, and behavior, providing managers with a clear attack threat profile, facilitating the formulation of differentiated defense strategies, improving the accuracy and effectiveness of web application security defense, and reducing business losses caused by attacks.

[0041] It should be noted that the attacker group profile data is corrected based on contextual influence factors, resulting in the corrected attacker group profile data, which specifically includes: The attacker group profile data is processed by a convolutional neural network to obtain profile convolutional data, and real-time network environment context data is obtained. Based on the real-time network environment context data, the attacker group profile data is subjected to context influence factor identification to obtain context influence factors. Attacker group profiles are corrected by applying contextual influence factors to the convolutional profile data, resulting in corrected attacker group profile data.

[0042] Specifically, firstly, the attacker profile data is processed using a convolutional neural network (CNN) to convert the multi-dimensional information in the attacker profile data into feature vectors. A lightweight CNN model is constructed, consisting of an input layer, two convolutional layers, one pooling layer, and one fully connected layer. The feature vectors are input into the lightweight CNN model. The input layer receives the vectors and passes them to the convolutional layers, which extract deep features from the profile data through convolutional kernels. The pooling layer performs dimensionality reduction on the convolutional features, retaining key features. The fully connected layer outputs the processed profile feature vectors, resulting in the profile convolutional data. Secondly, real-time network environment context data is acquired, including source IP geographic distribution information obtained through an IP geographic location query interface, proxy node jump information tracked by the Traceroute tool, and attack time series patterns obtained through attack traffic timestamp statistics. The context data is preprocessed, converting geographic distribution information into regional codes, proxy node jump information into quantitative indicators, and time series patterns into periodic codes, forming standardized real-time network environment context data. Next, based on real-time network environment context data, contextual influencing factors were identified in the attacker group profile data. The correlation between contextual data and profile data in various dimensions was analyzed: if the source IPs all come from the same city, then "geographical concentration" becomes a factor affecting the group size; if the proxy node jump frequency is high, then "proxy stealth" becomes a factor affecting the technical level; if the attack time series pattern is a regular attack in the early morning, then "time avoidance" becomes a factor affecting the attack intent. Correlation analysis algorithms were used to calculate the correlation coefficient between each contextual factor and the profile dimension. Factors with correlation coefficients higher than the threshold were identified as contextual influencing factors. The profile dimension and direction of influence corresponding to each factor were recorded to obtain the contextual influencing factors. Finally, attacker group profiling is corrected based on contextual influence factors in the convolutional data of the profiling, and a correction model is constructed: the contextual influence factors are converted into correction coefficients (e.g., "high geographic concentration" corresponds to a size correction coefficient of 1.2, and "high proxy stealth" corresponds to a technical level correction coefficient of 1.1); the feature vectors of each dimension in the profiling convolutional data are multiplied by the corresponding correction coefficients to adjust the feature vector values. For example, the original size feature vector [0,1,0] (small team) becomes [0,1.2,0] after correction for "high geographic concentration," and is still classified as a small team; the original technical level vector [0,1,0] (intermediate) becomes [1.1,0,0] after correction for "high proxy stealth," and is corrected to advanced; the attacker group profiling is regenerated based on the adjusted feature vectors. For example, the original profiling "technical level: intermediate; size: small team; intent: data theft" becomes "technical level: advanced; size: small team; intent: covert data theft," and the corrected profiling data of the attacker group is obtained.

[0043] By employing the above technical solutions, convolutional neural network processing can extract deep features from profile data and uncover hidden correlations between various dimensions, making profile features more representative and providing a high-quality feature foundation for subsequent corrections. The introduction of real-time network environment context data overcomes the limitations of traditional profiles that rely solely on attack behavior, combining actual network environment factors to make profiles more closely resemble real attack scenarios. Contextual influencing factor identification accurately locates key environmental factors affecting the profile, avoiding interference from irrelevant environmental data and improving the targeting of corrections. Profile adjustments based on correction coefficients achieve quantitative correction, ensuring the objectivity and controllability of the correction process, effectively eliminating the misleading influence of factors such as IP spoofing and proxy hiding on the profile, making the corrected profile more accurately reflect the true situation of the attacker group, providing a reliable basis for subsequent attack tracing and defense strategy formulation, and improving the scientific nature of web application security protection decisions.

[0044] Furthermore, based on real-time network environment context data, contextual influence factors are identified in the attacker group profile data to obtain contextual influence factors, which specifically include: Perform network topology layering analysis on real-time context data of the network environment to obtain network layered topology data; Attack path suppression assessment is performed on attacker group profile data based on network hierarchical topology data to obtain path suppression assessment data. The metabolic response function was fitted to the pathway inhibition assessment data to obtain the metabolic inhibition response function; Contextual influencing factors are identified based on the metabolic inhibition response function of the pathway inhibition assessment data.

[0045] Specifically, firstly, a network topology layering analysis is performed on real-time network environment context data to extract network architecture information, web application deployment locations, and firewall deployment nodes. The network is then layered into topologies, marking device types, IP ranges, and data transmission paths at each layer. The transmission trajectory of attack traffic between topology layers is analyzed, and the filtering of attack traffic at each layer is recorded. This analysis yields layered network topology data. Secondly, attack path suppression assessment is performed on attacker profile data based on the layered network topology data. The attacker's target layer and attack tool characteristics are extracted from the attacker profile data, combined with the defense strength of each layer in the layered network topology data. The degree of suppression of attack paths at each layer is assessed, and the suppression rate is calculated using the difference between the defense strength score and the attack penetration capability score: Suppression rate = (Defense strength score - Attack penetration capability score) / Defense strength score × 100%. For example, an access layer defense strength score of 8 and an attack penetration capability score of 8 result in a suppression rate of 0%; an aggregation layer defense strength score of 5 and an attack penetration capability score of 8 result in a suppression rate of -60%. The suppression rate at each layer and the factors affecting suppression are recorded, yielding path suppression assessment data. Next, the path inhibition assessment data were processed by fitting a metabolic response function. The inhibition rate of the attack path was regarded as the "metabolic reaction," and the transmission efficiency of the attack traffic was regarded as the "metabolic products." Transmission efficiency data corresponding to different inhibition rates were collected (e.g., 0% inhibition rate corresponds to 90% transmission efficiency, -60% inhibition rate corresponds to 100% transmission efficiency, and 50% inhibition rate corresponds to 40% transmission efficiency). A nonlinear fitting algorithm was used to fit the metabolic response function, with the function form y=a×e^(bx)+c (where y is the transmission efficiency, x is the inhibition rate, and a, b, and c are the fitting parameters). The parameter values ​​were determined by fitting (e.g., a=80, b=-0.02, c=10) so that the function could accurately reflect the relationship between the inhibition rate and the transmission efficiency (e.g., when x=0, y=90, consistent with the actual data), thus obtaining the metabolic inhibition response function. Finally, contextual impact factors were identified based on the metabolic inhibition response function of the path inhibition assessment data. The derivative of the metabolic inhibition response function was considered as the "impact sensitivity." The larger the absolute value of the derivative, the more sensitive the factor corresponding to the inhibition rate is to transmission efficiency. The inhibition rate and impact sensitivity of each inhibition factor in the path inhibition assessment data were analyzed. For example, the inhibition rate corresponding to the access layer intrusion detection rule was 0%, and the impact sensitivity was 0.5; the inhibition rate corresponding to the aggregation layer filtering rule was -60%, and the impact sensitivity was 1.2; the inhibition rate corresponding to the core layer firewall rule was 50%, and the impact sensitivity was 0.8. Factors with impact sensitivity higher than the threshold were identified as contextual impact factors, and the factor name, corresponding network layer, affected object, and direction of impact were recorded. At the same time, combined with other factors in the real-time context data of the network environment, the same method was used to identify factors with high impact sensitivity. All high-sensitivity factors were integrated to obtain the contextual impact factors.

[0046] By employing the above technical solutions, network architecture and attack transmission paths are clearly presented through network topology layering analysis, providing a clear spatial dimension for subsequent evaluation and avoiding misjudgments of influencing factors due to unclear network structure. Attack path suppression assessment quantifies the impact of each level from the perspective of defense and attack confrontation, covering the actual effect of network defense and making the identification of influencing factors more closely aligned with security protection scenarios. Metabolic response function fitting transforms the relationship between suppression rate and transmission efficiency into a mathematical model, providing an objective basis for the calculation of impact sensitivity and improving the scientific nature of factor identification. High-sensitivity screening ensures that the identified contextual influencing factors are all key factors that significantly affect attack behavior and profiling, avoiding interference from irrelevant factors and improving the accuracy of subsequent profiling correction. Finally, the identified contextual influencing factors comprehensively cover dimensions such as network topology, defense rules, and geographical distribution, providing a multi-layered and reliable basis for revising attacker group profiling, helping managers to more accurately grasp the impact of the attack environment on attack behavior, and improving the accuracy and reliability of web application attack tracing.

[0047] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention, they should all fall within the protection scope of the present invention.

[0048] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0049] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A real-time attack tracing system for web application firewalls based on real-time monitoring, characterized in that, include: The real-time monitoring module is used to collect attack traffic data through the web application firewall to obtain an attack traffic dataset, extract and analyze attack behavior features from the attack traffic dataset to obtain attack behavior feature data, and identify attack method differences based on the attack behavior feature data to obtain attack method difference data. The analysis module is used to perform attack behavior fingerprint clustering analysis based on attack method difference data to obtain attack behavior fingerprint clustering data. Based on the attack behavior fingerprint clustering data, cross-session attack correlation assessment is performed to obtain cross-session attack correlation data. Based on the cross-session attack correlation data, attacker group profile estimation is performed to obtain attacker group profile data. The correction module is used to acquire real-time network environment context data, which includes source IP geographical distribution information, proxy node jump information and attack time sequence patterns. Based on the real-time network environment context data, the attacker group profile data is identified by context influence factors to obtain context influence factors. Based on the context influence factors, the attacker group profile data is corrected to obtain the corrected attacker group profile data. The response module is used to construct an attacker attribution model from the corrected attacker group profile data using a deep learning clustering algorithm. The attacker attribution model is then deployed to the cloud platform to perform real-time attack attribution and alarm response.

2. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 1, characterized in that, The process of identifying attack method differences based on attack behavior characteristic data to obtain attack method difference data specifically includes: Attack traffic data is collected through a web application firewall to obtain an attack traffic dataset. The attack traffic dataset is then cleaned and normalized to obtain standardized attack traffic data. The attack behavior features are extracted and analyzed from the standardized attack traffic data. The attack behavior features include extracting payload construction patterns, request frequency fluctuations, and target URL preference features to obtain attack behavior feature data. Attack method differences are identified based on attack behavior characteristic data, and attack method difference data are obtained based on the results of the attack method difference identification.

3. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 1, characterized in that, The process of estimating attacker group profiles based on cross-session attack correlation data, and obtaining attacker group profile data, specifically includes: Attack behavior fingerprint clustering is performed on the attack traffic dataset based on the differences in attack methods to obtain attack behavior fingerprint clustering data; Cross-session attack correlation evaluation is performed on the attack traffic dataset based on attack behavior fingerprint clustering data to obtain cross-session attack correlation data. Attacker behavior pattern analysis is performed on cross-session attack correlation data, and attacker behavior pattern data is obtained based on the results of the attacker behavior pattern analysis. Attacker group profile data is obtained by estimating the attacker group profile data based on the attacker behavior pattern data and the attack method difference data.

4. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 3, characterized in that, Cross-session attack correlation evaluation is performed on attack traffic datasets based on attack behavior fingerprint clustering data, resulting in cross-session attack correlation data, specifically including: The Payload construction pattern of each attack session is parsed from the attack behavior fingerprint clustering data to obtain Payload pattern parsing data. Based on the Payload pattern parsing data, the attack behavior fingerprint clustering data is subjected to scanning time-series quantization for each attack session to obtain scanning time-series quantized data; Based on the scan time-series quantized data, target selection preference data is obtained by extracting the target selection preference data for each attack session in the attack traffic dataset. Based on the target selection preference data, behavioral consistency compensation is performed on the scanning time-series quantized data for different attack methods to obtain behavioral consistency compensation data. Based on the behavior consistency compensation data, cross-session attack association assessment is performed on the attack behavior fingerprint clustering data to obtain cross-session attack association data.

5. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 4, characterized in that, The process of compensating for behavioral consistency across different attack techniques by applying target selection preference data to scan time-series quantized data specifically includes: Based on the target selection preference data, the key strategic nodes between different attack methods are analyzed. The key strategic nodes include identifying attack phase transition points and tool switching markers to obtain key strategic node analysis data. Based on the analysis data of key nodes in the strategy, the dynamic field of the behavior sequence is simulated to obtain the dynamic field data of the behavior sequence. Then, the node behavior entropy value is calculated on the dynamic field data of the behavior sequence to obtain the node behavior entropy value data. Based on the node behavior entropy value data, behavior consistency compensation is performed on the scan time-series quantized data for different attack methods to obtain behavior consistency compensation data.

6. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 4, characterized in that, The process of evaluating cross-session attack correlations based on attack behavior fingerprint clustering data using behavioral consistency compensation data specifically includes: Based on the behavior consistency compensation data, the behavior change trajectory between different attack methods is extracted from the attack behavior fingerprint clustering data to obtain behavior change trajectory data. Attack feature balance decomposition is performed based on behavior change trajectory data and behavior consistency compensation data to obtain attack feature decomposition data. Feature weight matching is performed on the attack feature decomposition data to obtain feature weight matching data. Cross-session attack correlation evaluation is then performed based on the attack feature decomposition data and feature weight matching data to obtain cross-session attack correlation data.

7. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 3, characterized in that, The process of estimating attacker group profiles based on attacker behavior pattern data and attack method difference data to obtain attacker group profile data specifically includes: Based on attacker behavior pattern data, attack lifecycle analysis is performed on attack method difference data to obtain attack lifecycle data; Based on attacker behavior pattern data, attack intensity periodic fluctuation analysis is performed on attack lifecycle data at different lifecycle stages to obtain attack intensity periodic fluctuation data. Based on the attack method difference data, the attack base increment data of different attack methods is defined in the attack life cycle data to obtain the attack base increment data; Attacker group profiles are estimated by analyzing the incremental attack base data and the periodic fluctuation data of attack intensity among different attack methods.

8. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 1, characterized in that, The attacker group profile data is corrected based on contextual influence factors, resulting in the corrected attacker group profile data, which specifically includes: The attacker group profile data is processed by a convolutional neural network to obtain profile convolutional data, and real-time network environment context data is obtained. Based on the real-time network environment context data, the attacker group profile data is subjected to context influence factor identification to obtain context influence factors. Attacker group profiles are corrected by applying contextual influence factors to the convolutional profile data, resulting in corrected attacker group profile data.

9. The real-time attack tracing system for web application firewalls based on real-time monitoring according to claim 8, characterized in that, Based on real-time network environment context data, contextual influence factors are identified from attacker profile data to obtain contextual influence factors, which specifically include: Perform network topology layering analysis on real-time context data of the network environment to obtain network layered topology data; Attack path suppression assessment is performed on attacker group profile data based on network hierarchical topology data to obtain path suppression assessment data. The metabolic response function was fitted to the pathway inhibition assessment data to obtain the metabolic inhibition response function; Contextual influencing factors are identified based on the metabolic inhibition response function of the pathway inhibition assessment data.

10. A computer-readable storage medium, characterized in that: The system stores instructions that, when executed on a computer, cause the computer to perform the real-time tracing system for web application firewall attacks based on real-time monitoring as described in any one of claims 1 to 9.

Images