Network attack defense method and device based on multi-dimensional intelligent analysis, equipment and medium

Abstract

The embodiment of the invention relates to the technical field of operation and maintenance, and discloses a network attack defense method and device based on multi-dimensional intelligent analysis, equipment and a medium. Performing atlas construction processing on the multi-dimensional attack features based on a graph neural network to generate an attack relation atlas, the attack relation atlas being used for associating a plurality of attack behavior features of each attacker and / or associating a plurality of attack behavior features of a plurality of attackers; atlas analysis is conducted on the attack relation atlas, attacker portraits are generated, and the attacker portraits are used for measuring attack levels of multiple attackers; and generating a defense strategy based on the attacker portrait, and executing the defense strategy. By analyzing the multi-dimensional behavior characteristics, combining with the graph neural network to dynamically construct the attack relation graph and generating the fine-grained attacker portrait, accurate association and attack level evaluation of a plurality of attackers and complex attack behaviors thereof are realized, the false killing rate is greatly reduced, and the recognition accuracy of novel variant network attacks is improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of operation and maintenance, in particular to a network attack defense method and device based on multi-dimensional intelligent analysis, equipment and medium. BACKGROUND

[0002] In the field of network security technology, the existing technology often performs network defense based on static defense rules and threshold methods. The static defense rules have insufficient dynamic adaptation capability and are difficult to identify new variant network attacks. The threshold judgment has a single judgment value and lacks accurate profiling ability for attackers, which is easy to misjudge network attacks. Therefore, it can be known that the existing network attack defense method has the problems of low identification accuracy of new variant network attacks and high false kill rate. SUMMARY

[0003] The purpose of the present application is to at least provide a network attack defense method and device based on multi-dimensional intelligent analysis, equipment and medium, which can at least solve the technical problems of low identification accuracy of new variant network attacks and high false kill rate of the existing network attack defense method, and at least achieve the purposes of improving the identification accuracy of new variant network attacks and reducing the false kill rate.

[0004] To solve the above technical problems, at least one embodiment of the present application provides a network attack defense method based on multi-dimensional intelligent analysis, comprising: acquiring multi-dimensional attack features, the multi-dimensional attack features comprising a plurality of attack behavior features of a plurality of attackers; performing graph construction processing on the multi-dimensional attack features based on a graph neural network to generate an attack relationship graph, the attack relationship graph being used to associate the plurality of attack behavior features of each attacker and / or the plurality of attack behavior features of a plurality of attackers; performing graph analysis on the attack relationship graph to generate an attacker portrait, the attacker portrait being used to measure the attack level of the plurality of attackers; generating a defense strategy based on the attacker portrait and executing the defense strategy, the defense strategy being used to defend against attacks of the plurality of attackers.

[0005] This solution collects multi-dimensional behavioral features from network traffic, dynamically constructs attack relationship graphs using graph neural networks, and generates fine-grained attacker profiles. This enables accurate correlation and attack level assessment of multiple attackers and their complex attack behaviors. Compared to traditional defense models that rely on static rules and fixed thresholds, this solution possesses adaptive learning capabilities, effectively identifying new variant attacks, low-frequency slow attacks, and the covert attack behaviors of Advanced Persistent Threat (APT) organizations, significantly improving the accuracy of network attack identification and response time. Through comprehensive analysis of multi-dimensional attack features, it avoids the false positives and false negatives caused by single threshold judgments, greatly reducing the false positive rate. This represents a defense upgrade from "passive rule matching" to "proactive intelligent cognition," enhancing the intelligence, refinement, and adaptive protection capabilities of the overall network security defense system.

[0006] In some examples, the step of performing graph analysis on the attack relationship graph to generate an attacker profile includes: acquiring a preset threat intelligence database containing multiple malicious attack identifiers; identifying at least one attack identifier level based on the preset threat intelligence database and the attack relationship graph; performing graph analysis on the attack relationship graph to obtain at least one attack pattern and at least one attack intent; and generating an attacker profile based on at least one attack identifier level, at least one attack pattern, and at least one attack intent; wherein the attack identifier level, the attack pattern, and the attack intent correspond one-to-one with the attack identifier, and the attack identifier is the attacker's unique identifier.

[0007] In some examples, generating an attacker profile based on at least one attack identifier level, at least one attack pattern, and at least one attack intent includes: for each attack identifier, if the attack identifier level corresponding to the attack identifier is a malicious attack level, and the attack pattern corresponding to the attack identifier is a group attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a lethal attack; if the attack identifier level corresponding to the attack identifier is a normal attack level, and the attack pattern corresponding to the attack identifier is a lone attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a medium attack level; if the attack intent corresponding to the attack identifier is scanning and probing, then the attack level corresponding to the attack identifier is a lightweight attack level; and forming an attacker profile based on each attack identifier and the attack level corresponding to the attack identifier.

[0008] In some examples, generating a defense strategy based on the attacker profile includes: for each attacker described in the attacker profile, if the attack level is a light attack, then the individual defense strategy for that attacker is an edge node rate limiting strategy; if the attack level is a medium attack, then the individual defense strategy for that attacker is a cloud scrubbing center traffic diversion strategy; if the attack level is a critical attack, then the individual defense strategy for that attacker is a carrier black hole blocking strategy; and combining the individual defense strategies for each attacker into a defense strategy.

[0009] In some examples, after executing the defense strategy, the method further includes: real-time monitoring of defense strategy feedback information and defense resource consumption information; adjusting the defense strategy based on the defense strategy feedback information and the defense resource consumption information to obtain an updated defense strategy.

[0010] In some examples, adjusting the defense strategy based on the defense strategy feedback information and the defense resource consumption information to obtain an updated defense strategy includes: if the defense strategy feedback information contains new multi-dimensional attack features, adjusting the defense strategy based on the new multi-dimensional attack features to obtain a first updated defense strategy; if the defense resource consumption information does not conform to preset defense resource consumption information, then using a defense strategy with an attack level higher than the attack level corresponding to the defense strategy as a second updated defense strategy; and forming an updated defense strategy based on the first updated defense strategy and the second updated defense strategy.

[0011] In some examples, the method further includes: setting attack decoy information simulating vulnerabilities in a business system; attracting an attacker to attack the business system based on the attack decoy information; obtaining the attacker's standard multi-dimensional attack characteristics, attack identifiers, and attack timelines, wherein the description format of the standard multi-dimensional attack characteristics conforms to the standardized description format of threat intelligence; generating an attack report based on the standard multi-dimensional attack characteristics, the attack identifiers, and the attack timelines, and storing the attack report using blockchain notarization technology.

[0012] At least one embodiment of this application also provides a network attack defense device based on multi-dimensional intelligent analysis, comprising: an acquisition unit, configured to acquire multi-dimensional attack features, the multi-dimensional attack features including multiple attack behavior features against multiple attackers; a processing unit, configured to perform graph construction processing on the multi-dimensional attack features based on a graph neural network to generate an attack relationship graph, the attack relationship graph being used to associate multiple attack behavior features of each attacker and / or associate multiple attack behavior features of multiple attackers; a generation unit, configured to perform graph analysis on the attack relationship graph to generate an attacker profile, the attacker profile being used to measure the attack level of the multiple attackers; the generation unit is further configured to generate a defense strategy based on the attacker profile and execute the defense strategy, the defense strategy being used to defend against attacks from the multiple attackers.

[0013] At least one embodiment of this application also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described network attack defense method based on multi-dimensional intelligent analysis.

[0014] At least one embodiment of this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described network attack defense method based on multi-dimensional intelligent analysis. Attached Figure Description

[0015] One or more embodiments are illustrated by way of example with reference to the accompanying drawings, and these illustrative descriptions do not constitute a limitation on the embodiments.

[0016] Figure 1 This is a flowchart illustrating a network attack defense method based on multi-dimensional intelligent analysis provided in one embodiment of this application; Figure 2 This is a schematic diagram illustrating a generation defense strategy provided in one embodiment of this application; Figure 3 This is a schematic diagram illustrating an embodiment of this application that provides a way to induce an attacker to launch an attack; Figure 4 This is a schematic diagram illustrating another process for generating a defense strategy, provided in one embodiment of this application. Figure 5 This is a schematic diagram of the structure of a network attack defense device based on multi-dimensional intelligent analysis provided in another embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the various embodiments of this application to help readers better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0018] It should be noted that the acquisition or use of data in the embodiments of this application requires the user's consent. The relevant data can only be obtained after the user's authorization, and the acquisition or use of the data complies with the provisions of relevant laws and regulations.

[0019] To facilitate understanding of the embodiments of this application, we will first introduce the relevant content of the network attack defense method based on multi-dimensional intelligent analysis.

[0020] In the field of cybersecurity technology, existing technologies often rely on static defense rules and threshold methods for network defense. Static defense rules lack dynamic adaptability and struggle to identify new variants of network attacks. Threshold judgments, due to their simplistic criteria, lack the ability to accurately profile attackers and are prone to misjudging network attacks. Therefore, it is evident that existing network attack defense methods suffer from low accuracy in identifying new variants of network attacks and a high false positive rate.

[0021] To address the technical problems of low accuracy in identifying new variant network attacks and high false positive rates in existing network attack defense methods, this invention proposes a network attack defense method based on multi-dimensional intelligent analysis. The implementation details of this embodiment of the network attack defense method based on multi-dimensional intelligent analysis are described below. The following content is only for ease of understanding and is not necessary for implementing this solution.

[0022] Example 1: The network attack defense method based on multi-dimensional intelligent analysis in this embodiment can be applied to electronic devices with communication, computing, and data storage capabilities. Its specific process can be as follows: Figure 1 As shown, it includes: Step 110: Obtain multi-dimensional attack features, which include various attack behavior features targeting multiple attackers.

[0023] Among these, various attack behavior characteristics include at least attack paths, tool fingerprints, and request timing characteristics. Request timing characteristics can include high-frequency access information, i.e., request frequency, unconventional time windows, etc.; tool fingerprints can be special HTTP header tags of automated attack tools; and attack paths can include lateral movement and node jump patterns.

[0024] Specifically, multi-dimensional attack characteristics are structured features extracted from raw traffic data that can be used for analysis. Specifically, the sliding window algorithm can be used to analyze the temporal behavior in the raw traffic, effectively extracting request temporal features such as request frequency, access cycle, and burstiness.

[0025] The raw traffic collection information includes raw traffic data from network devices (such as firewalls, IDS, WAF, load balancers, etc.). This raw traffic data includes HTTP / HTTPS request logs, network packet captures, API call records, and user access behavior logs, serving as the basic data source for multi-dimensional attack characteristics.

[0026] Step 120: Based on graph neural networks, perform graph construction processing on multi-dimensional attack features to generate an attack relationship graph. The attack relationship graph is used to associate multiple attack behavior features of each attacker and / or associate multiple attack behavior features of multiple attackers.

[0027] Graph Neural Networks (GNNs) are used to model complex entity relationships. For example, GNNs construct a structured attack relationship graph by treating attackers and various attack behavior characteristics (such as attack paths, tool fingerprints, and request timing features) as nodes in the graph, and logical connections within these attack behavior characteristics (such as temporal proximity, behavioral similarity, target overlap, and protocol consistency) as edges. This attack relationship graph connects discrete attack behavior characteristics and the attack behavior characteristics of discrete attackers. For instance, it connects attack tools at different attack stages to form attack tool chains, facilitating the identification of potential connections between attackers and the potential relationships between attack behaviors. This provides valuable data support for attack attribution and defense strategies.

[0028] Step 130: Perform graph analysis on the attack relationship graph to generate attacker profiles. Attacker profiles are used to measure the attack levels of multiple attackers.

[0029] Specifically, in step 130 above, the attack relationship graph is analyzed to generate an attacker profile, including: obtaining a preset threat intelligence database containing multiple malicious attack identifiers; identifying at least one attack identifier level based on the preset threat intelligence database and the attack relationship graph; performing graph analysis on the attack relationship graph to obtain at least one attack pattern and at least one attack intent; and generating an attacker profile based on at least one attack identifier level, at least one attack pattern, and at least one attack intent; wherein the attack identifier level, attack pattern, and attack intent correspond one-to-one with the attack identifier, and the attack identifier is the attacker's unique identifier.

[0030] The system includes a pre-defined threat intelligence database containing attack identifiers indicating the severity of attacks. These identifiers identify attackers who have conducted or repeatedly conducted highly damaging attacks. The attack identifier level corresponding to a malicious attack identifier is the malicious attack level. If an attack identifier in the attack relationship graph is stored in the pre-defined threat intelligence database, it is considered to be at the malicious attack level. Attack identifiers not stored in the pre-defined threat intelligence database are considered to be at the normal attack level. Attack patterns identify the scale of the attack, including group attacks and solo attacks. Group attacks indicate that multiple attack identifiers are puppet identifiers controlled by the same attack group; for example, APT groups and botnet attacks are group attacks. Solo attacks indicate that the attack identifier belongs to a single attacker; for example, script tool attacks are solo attacks. Attack intent indicates the attacker's main purpose in launching the network attack, which can include data theft, service disruption, scanning, and probing.

[0031] For example, if the attack relationship graph includes multiple attack identifiers, that is, if there are multiple attackers, then there are multiple attack identifier levels, multiple attack modes, and multiple attack intentions. That is, each attack identifier corresponds to an attack identifier level, an attack mode, and an attack intention. In addition, the attack modes, attack intentions, and attack identifier levels corresponding to multiple attack identifiers can be the same or different.

[0032] Furthermore, based on at least one attack identifier level, at least one attack mode, and at least one attack intent, an attacker profile is generated, including: for each attack identifier, if the attack identifier level corresponding to the attack identifier is a malicious attack level, and the attack mode corresponding to the attack identifier is a group attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a lethal attack; if the attack identifier level corresponding to the attack identifier is a normal attack level, and the attack mode corresponding to the attack identifier is a lone attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a medium attack level; if the attack intent corresponding to the attack identifier is scanning and probing, then the attack level corresponding to the attack identifier is a lightweight attack level; an attacker profile is formed based on each attack identifier and the attack level corresponding to the attack identifier.

[0033] Attack level refers to the degree of harm an attacker causes to a system when launching a network attack, also known as attack intensity. Malicious attacks cause the greatest harm, followed by medium attacks, with lightweight attacks causing the least. Data theft and service disruption are both high-risk attacks, potentially leading to sensitive information leaks, system paralysis, and business interruptions, posing a significant threat to system asset security and operational stability. Therefore, attacks with the intent to steal data or disrupt services have a higher attack level than lightweight attacks. Scanning and probing often involve collecting information about the target system's ports, services, or vulnerabilities. This is a reconnaissance phase in the early stages of an attack; while it poses a potential threat, it has not yet caused substantial damage to the system. Therefore, scanning and probing are considered low-risk attacks, corresponding to a lightweight attack level.

[0034] In addition, the method also includes continuously updating a preset profile library based on attacker profiles, the preset profile library being used for...

[0035] Step 140: Generate a defense strategy based on the attacker profile and execute the defense strategy. The defense strategy is used to defend against attacks from multiple attackers.

[0036] Specifically, in step 140 above, generating a defense strategy based on the attacker profile includes: for each attacker described in the attacker profile, if the attack level is a light attack, the individual defense strategy for the attacker is an edge node rate limiting strategy; if the attack level is a medium attack, the individual defense strategy for the attacker is a cloud scrubbing center traffic diversion strategy; if the attack level is a critical attack, the individual defense strategy for the attacker is a carrier black hole blocking strategy; and the individual defense strategies for each attacker are combined into a defense strategy.

[0037] Individual defense strategies are defense strategies targeting specific attackers, while defense strategies refer to defense strategies against each attacker currently attacking the system. Each defense strategy must include at least one individual defense strategy. Edge node rate limiting strategies are measures to limit the rate of data traffic at the network edge (such as the end closest to the user or device). This strategy is mainly used to control the use of network resources, ensuring that critical applications and services receive sufficient bandwidth under high traffic conditions. Rate limiting can be achieved by setting a maximum transmission rate, thereby preventing some users or applications from excessively consuming bandwidth and affecting the normal use of other users. Cloud scrubbing center traffic redirection strategies refer to redirecting traffic to cloud-based security services for filtering and scrubbing using specific methods to identify and remove malicious traffic (such as CC attacks (Challenge Collapsar Attack, Distributed Denial-of-Service attack)), and then forwarding the clean traffic to the target server. This method can effectively defend against network attacks without affecting normal business operations. Traffic redirection is usually achieved by changing DNS resolution results or BGP (Border Gateway Protocol) route announcements to direct traffic to the scrubbing center for processing. Carrier black hole blocking strategy refers to an emergency measure to deal with large-scale network attacks, especially terabit-per-second (TB-level) DDoS attacks. When an IP address becomes the target of an attack, in order to prevent attack traffic from overwhelming the network, all traffic destined for that IP address is redirected to a "black hole" (i.e., a virtual bottomless pit). This means that both normal access requests and attack traffic will be dropped. Although this will temporarily make the target website or service unreachable, it can protect other parts of the network from being affected.

[0038] In addition, for low-frequency probing attacks and other lightweight attacks, defense can be carried out by triggering log alerts; for medium-level or critical attacks such as the highly covert penetration behavior of APT groups, defense can be carried out by deep traffic scrubbing or session blocking.

[0039] Therefore, by intelligently sensing the attack level, different levels of defense strategies are automatically matched to achieve a resilient protection system, from edge node rate limiting strategies to cloud-based traffic diversion strategies and operator black hole blocking strategies. Compared with traditional single-threshold defense solutions, this resilient protection system has the advantages of dynamic sensing, hierarchical response, and resource coordination. It can flexibly schedule defense strategies according to the attack level, effectively responding to attacks of different attack levels while maximizing business availability and user experience, and significantly improving the overall resilience of the system against attacks.

[0040] In some examples, after executing the defense strategy, the method also includes: real-time monitoring of defense strategy feedback information and defense resource consumption information; adjusting the defense strategy based on the defense strategy feedback information and defense resource consumption information to obtain an updated defense strategy.

[0041] The defense strategy feedback information refers to the information collected from each defense layer executing the defense strategy regarding the effectiveness of the strategy and real-time attack characteristics. This feedback information includes, but is not limited to, information such as the concurrency of attack requests, abnormal protocol characteristics, attack interception success rate, and attack duration after the defense strategy is executed. Defense resource consumption information refers to the collected resource consumption data from each defense layer executing the defense strategy. This information includes, but is not limited to, information such as CPU utilization, network bandwidth usage, and memory usage at each defense layer after the defense strategy is executed.

[0042] Specifically, the defense strategy is adjusted based on the defense strategy feedback information and defense resource consumption information to obtain an updated defense strategy, including: if the defense strategy feedback information contains new multi-dimensional attack features, the defense strategy is adjusted based on the new multi-dimensional attack features to obtain a first updated defense strategy; if the defense resource consumption information does not conform to the preset defense resource consumption information, the defense strategy with an attack level higher than the attack level corresponding to the defense strategy is used as the second updated defense strategy; and the updated defense strategy is composed of the first updated defense strategy and the second updated defense strategy.

[0043] Among them, new multi-dimensional attack features refer to attack features that are different from multi-dimensional attack features in the real-time attack features in the feedback information of defense strategies.

[0044] Furthermore, the defense strategy is adjusted based on the new multi-dimensional attack features to obtain the first updated defense strategy, which includes: performing graph construction processing on the new multi-dimensional attack features based on graph neural networks to generate a new attack relationship graph. The new attack relationship graph is used to associate multiple attack behavior features of each attacker and / or associate multiple attack behavior features of multiple attackers; performing graph analysis on the new attack relationship graph to generate a new attacker profile. The new attacker profile is used to measure the attack level of multiple attackers; and generating the first updated defense strategy based on the new attacker profile. The first updated defense strategy is used to defend against attacks from multiple attackers. It should be noted that the method for analyzing and processing the new multi-dimensional attack features is the same as the method for analyzing and processing multi-dimensional attack features. For detailed processing procedures for the new multi-dimensional attack features, please refer to the processing procedures for multi-dimensional attack features in this solution, which will not be elaborated further here.

[0045] The first updated defense strategy can be designed to address attacks of a level equal to or higher than the defense strategy's capabilities, or attacks of a level lower than the defense strategy's capabilities. Specifically, if the defense strategy is an edge node rate limiting strategy, and the multi-dimensional attack feature analysis reveals a new attacker profile of medium or critical attack level, then the first updated defense strategy will be either a cloud-based traffic redirection strategy or a carrier black hole blocking strategy. If the multi-dimensional attack feature analysis reveals a new attacker profile of lightweight attack level, then the first updated defense strategy will be an edge node rate limiting strategy; if the multi-dimensional attack feature analysis reveals a new attacker profile of no attack level, then the first updated defense strategy will be no defense. Here, "no attack level" indicates that the current system is not under network attack.

[0046] Specifically, if the feedback information from the defense strategy contains information that does not meet the preset defense effect, a third updated defense strategy is generated. This third updated defense strategy is a defense strategy with an attack level higher than the attack level corresponding to the original defense strategy, and it is incorporated into the updated defense strategy. For example, if the defense strategy is an edge node rate limiting strategy, and the request concurrency in the feedback information exceeds the preset request concurrency, or there are abnormal protocol characteristics, or the attack duration after executing the defense strategy exceeds the preset attack duration, then a cloud-based traffic diversion strategy or a carrier black hole blocking strategy with an attack level higher than that of the edge node rate limiting strategy is generated; this cloud-based traffic diversion strategy or carrier black hole blocking strategy is then used as the third updated defense strategy.

[0047] For example, such as Figure 2 Based on the attack level obtained from the analysis of multi-dimensional attack characteristics, a corresponding defense strategy is selected. If the attack level is a lightweight attack, an edge node rate limiting strategy is used; if the attack level is a medium attack, a cloud-based traffic diversion strategy is used; if the attack level is a critical attack, a carrier black hole blocking strategy is used, and a defense strategy is generated. The SDN controller monitors the feedback information and resource consumption information of the executed defense strategy in real time, and adjusts the defense strategy based on the feedback information and resource consumption information.

[0048] Therefore, the system continuously collects information on defense resource consumption (such as CPU utilization, memory usage, and bandwidth load) and defense strategy feedback (such as attack interception effectiveness, false positive rate, and abnormal behavior logs) at each defense level to dynamically assess the current protection status. Based on this real-time data, the intelligent decision engine can dynamically optimize the selection and scheduling of defense strategies: for example, when the cloud-based cleaning center's resource load is detected to be too high, the system can trigger a carrier-grade black hole blocking strategy in advance to prevent service interruption due to overload of cleaning nodes; when new attack behavior characteristics are identified in the defense strategy feedback information, the system automatically starts extracting and modeling new multi-dimensional attack characteristics and generates the first updated defense strategy, enabling the defense strategy to adaptively adjust based on the system's real-time status. This constructs a closed-loop defense system of "monitoring—analysis—decision-response—feedback," realizing dynamic defense driven by real-time data, significantly improving the timeliness and accuracy of defense strategy adjustments, and enhancing the overall defense efficiency of the system.

[0049] In some examples, the method also includes: setting up attack decoy information that simulates the weaknesses of the business system; attracting attackers to attack the business system based on the attack decoy information; obtaining the attacker's standard multi-dimensional attack characteristics, attack identifiers, and attack timelines, wherein the description format of the standard multi-dimensional attack characteristics conforms to the standardized description format of threat intelligence; generating an attack report based on the standard multi-dimensional attack characteristics, attack identifiers, and attack timelines, and storing the attack report using blockchain evidence storage technology.

[0050] Multi-dimensional attack characteristics refer to the real-time collection of attacker behavior characteristics, including attack paths, attack tools, and attack methods. Attack methods refer to the technical methods and tactical strategies employed by attackers to carry out attacks, such as port scanning, SQL injection, XSS cross-site scripting, CSRF cross-site request forgery, credential brute-force attacks, session hijacking, and privilege escalation. Blockchain evidence storage technology utilizes the distributed, immutable, and traceable characteristics of blockchain to store standard multi-dimensional attack characteristics, attack identifiers, and attack timelines on the blockchain using hash digests, timestamps, and encrypted storage, thereby achieving data authenticity, integrity, and verifiability. The standardized description format can be STIX format.

[0051] Specifically, the system deploys a containerized high-interaction honeypot cluster to simulate real vulnerabilities and weaknesses in various business systems. Based on these real vulnerabilities and weaknesses, attack bait information is generated, which also includes fake business interfaces to attract attackers to attack business systems based on these fake business interfaces. This induces attackers to expose their attack tools and techniques, resulting in standard multi-dimensional attack characteristics.

[0052] For example, such as Figure 3As shown, by generating attack bait information simulating real vulnerabilities and weaknesses of various business systems in the deployed containerized honeypot, multi-dimensional attack characteristics, attack timelines, and attack identifiers of attackers are recorded. The multi-dimensional attack characteristics are then standardized to obtain standard multi-dimensional attack characteristics. Based on blockchain technology, the standard multi-dimensional attack characteristics, attack timelines, and attack identifiers are stored on the blockchain.

[0053] Furthermore, when standard multi-dimensional attack features are obtained, they can be analyzed based on an adaptive interaction mechanism, and the attack decoy information can be dynamically adjusted to effectively and continuously attract attackers to perform attack interactions, thus facilitating the acquisition of more comprehensive standard multi-dimensional attack features.

[0054] Furthermore, the multi-dimensional attack features collected in real time are formatted using the Structured Threat Information Expression (STIX) standard to obtain standard multi-dimensional attack features.

[0055] Therefore, by setting up attack decoy information simulating weaknesses in business systems and actively attracting attackers into a controlled environment based on this decoy, the capture and analysis of real attack behaviors can be effectively achieved. During this process, the system can accurately acquire the attacker's standard multi-dimensional attack characteristics (such as attack paths, tool fingerprints, TTPs tactical behaviors, etc.), attack identifiers (such as source IP, MAC address, malicious domain name), and a complete attack timeline. The multi-dimensional characteristics are expressed in a structured manner using standardized threat intelligence description formats such as STIX, ensuring data compatibility and shareability. Based on the above information, a structured attack report is generated, and the report's hash value is solidified on the blockchain using blockchain notarization technology, ensuring its authenticity, integrity, and timeliness are tamper-proof. This mechanism not only achieves proactive discovery and in-depth tracing of advanced threats but also provides highly reliable and verifiable data support for cross-organizational threat intelligence sharing, attack attribution analysis, and judicial evidence collection, significantly improving the initiative, automation, and legal effectiveness of network defense and greatly enhancing the efficiency of tracking and evidence collection.

[0056] For example, to gain a clearer understanding of this solution, please refer to [link / reference]. Figure 4 The system acquires multi-dimensional attack features, performs graph construction on these features to generate an attack relationship graph, generates an attacker profile based on the attack relationship graph and a pre-set threat intelligence database, assesses the attack level based on the attacker profile, and obtains a defense strategy corresponding to the attack level.

[0057] In summary, this solution acquires multi-dimensional attack features, including various attack behaviors targeting multiple attackers. It then uses a graph neural network to construct an attack relationship graph, which is used to associate various attack behaviors of each attacker and / or multiple attackers. The attack relationship graph is analyzed to generate attacker profiles, which are used to assess the attack severity of multiple attackers. Finally, defense strategies are generated and executed based on these attacker profiles to defend against attacks from multiple attackers. By collecting multi-dimensional behavioral features from network traffic (such as request frequency, tool fingerprints, and attack paths), and dynamically constructing an attack relationship graph using a graph neural network to generate fine-grained attacker profiles, this solution achieves accurate association and attack severity assessment of multiple attackers and their complex attack behaviors. Compared to traditional defense models that rely on static rules and fixed thresholds, this solution possesses adaptive learning capabilities, effectively identifying new variant attacks, low-frequency slow attacks, and the covert attack behaviors of Advanced Persistent Threat (APT) organizations, significantly improving the accuracy of network attack identification and response time. By comprehensively analyzing multi-dimensional attack characteristics, the system avoids false positives and false negatives caused by single threshold judgment, significantly reduces the false positive rate, and achieves a defense upgrade from "passive rule matching" to "proactive intelligent cognition," thereby enhancing the intelligent, refined, and adaptive protection capabilities of the overall network security defense system.

[0058] Example 2: Another embodiment of this application relates to a network attack defense device based on multi-dimensional intelligent analysis. The implementation details of this embodiment's network attack defense device based on multi-dimensional intelligent analysis are described below. The following implementation details are provided for ease of understanding and are not essential for implementing this solution. A schematic diagram of the network attack defense device 50 based on multi-dimensional intelligent analysis in this embodiment can be seen as follows: Figure 5 As shown, it includes an acquisition unit 501, a processing unit 502, and a generation unit 503.

[0059] The acquisition unit 501 is used to acquire multi-dimensional attack features, which include multiple attack behavior features targeting multiple attackers.

[0060] The processing unit 502 is used to perform graph construction processing on the multi-dimensional attack features based on the graph neural network to generate an attack relationship graph. The attack relationship graph is used to associate multiple attack behavior features of each attacker and / or associate multiple attack behavior features of multiple attackers.

[0061] The generation unit 503 is used to perform graph analysis on the attack relationship graph and generate an attacker profile, which is used to measure the attack level of the multiple attackers.

[0062] The generation unit 503 is further configured to generate a defense strategy based on the attacker profile and execute the defense strategy, which is used to defend against attacks from the multiple attackers.

[0063] In some examples, when the generation unit 503 performs graph analysis on the attack relationship graph to generate an attacker profile, it is specifically used to: acquire a preset threat intelligence database containing multiple malicious attack identifiers; identify at least one attack identifier level based on the preset threat intelligence database and the attack relationship graph; perform graph analysis on the attack relationship graph to obtain at least one attack pattern and at least one attack intent; and generate an attacker profile based on at least one attack identifier level, at least one attack pattern, and at least one attack intent; wherein the attack identifier level, the attack pattern, and the attack intent correspond one-to-one with the attack identifier, and the attack identifier is the attacker's unique identifier.

[0064] In some examples, when generating an attacker profile based on at least one attack identifier level, at least one attack pattern, and at least one attack intent, the generation unit 503 is specifically configured to: for each attack identifier, if the attack identifier level corresponding to the attack identifier is a malicious attack level, and the attack pattern corresponding to the attack identifier is a group attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a lethal attack; if the attack identifier level corresponding to the attack identifier is a normal attack level, and the attack pattern corresponding to the attack identifier is a solo attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a medium attack level; if the attack intent corresponding to the attack identifier is scanning and probing, then the attack level corresponding to the attack identifier is a lightweight attack level; and form an attacker profile based on each attack identifier and the attack level corresponding to the attack identifier.

[0065] In some examples, when the generation unit 503 generates a defense strategy based on the attacker profile, it specifically performs the following: for each attacker described in the attacker profile, if the attack level is a light attack, the individual defense strategy for the attacker is an edge node rate limiting strategy; if the attack level is a medium attack, the individual defense strategy for the attacker is a cloud scrubbing center traffic diversion strategy; if the attack level is a lethal attack, the individual defense strategy for the attacker is a carrier black hole blocking strategy; and combines the individual defense strategies for each attacker into a defense strategy.

[0066] In some examples, after executing the defense strategy, the device is also used to: monitor defense strategy feedback information and defense resource consumption information in real time; adjust the defense strategy based on the defense strategy feedback information and the defense resource consumption information to obtain an updated defense strategy.

[0067] In some examples, when the device is used to adjust the defense strategy based on the defense strategy feedback information and the defense resource consumption information to obtain an updated defense strategy, it is specifically used to: if the defense strategy feedback information contains new multi-dimensional attack features, then adjust the defense strategy based on the new multi-dimensional attack features to obtain a first updated defense strategy; if the defense resource consumption information does not conform to preset defense resource consumption information, then use a defense strategy with an attack level higher than the attack level corresponding to the defense strategy as a second updated defense strategy; and form an updated defense strategy based on the first updated defense strategy and the second updated defense strategy.

[0068] In some examples, the acquisition unit 501 is further configured to: set attack decoy information simulating the weaknesses of a business system; attract an attacker to attack the business system based on the attack decoy information; acquire the attacker's standard multi-dimensional attack characteristics, attack identifiers, and attack timelines, wherein the description format of the standard multi-dimensional attack characteristics conforms to the standardized description format of threat intelligence; generate an attack report based on the standard multi-dimensional attack characteristics, the attack identifiers, and the attack timelines, and store the attack report using blockchain evidence storage technology.

[0069] It is worth mentioning that all units involved in this embodiment are logical units. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed in this application; however, this does not mean that other units are absent in this embodiment.

[0070] Example 3: Another embodiment of this application relates to an electronic device, such as... Figure 6 As shown, it includes: at least one processor 901; and a memory 902 communicatively connected to the at least one processor 901; wherein the memory 902 stores instructions executable by the at least one processor 901, the instructions being executed by the at least one processor 901 to enable the at least one processor 901 to execute the network attack defense method based on multi-dimensional intelligent analysis in the above embodiments.

[0071] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0072] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0073] Example 4: Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0074] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A network attack defense method based on multi-dimensional intelligent analysis, characterized in that, include: Acquire multi-dimensional attack features, which include multiple attack behavior features targeting multiple attackers; The multi-dimensional attack features are processed by graph neural network to generate an attack relationship graph. The attack relationship graph is used to associate multiple attack behavior features of each attacker and / or associate multiple attack behavior features of multiple attackers. The attack relationship graph is analyzed to generate an attacker profile, which is used to measure the attack level of the multiple attackers. A defense strategy is generated based on the attacker profile and executed. The defense strategy is used to defend against attacks from the multiple attackers.

2. The network attack defense method based on multi-dimensional intelligent analysis according to claim 1, characterized in that, The step of performing graph analysis on the attack relationship graph to generate an attacker profile includes: Obtain a preset threat intelligence database, which contains multiple malicious attack identifiers; At least one attack identification level is identified based on the preset threat intelligence database and the attack relationship graph; The attack relationship graph is analyzed to obtain at least one attack pattern and at least one attack intent. An attacker profile is generated based on at least one of the attack identification levels, at least one of the attack patterns, and at least one of the attack intentions. The attack identifier level, the attack mode, and the attack intent are all corresponding to the attack identifier, and the attack identifier is the unique identifier of the attacker.

3. The network attack defense method based on multi-dimensional intelligent analysis according to claim 2, characterized in that, The process of generating an attacker profile based on at least one of the attack identification levels, at least one of the attack patterns, and at least one of the attack intentions includes: For each of the aforementioned attack identifiers, if the attack identifier level corresponding to the attack identifier is a malicious attack level, the attack mode corresponding to the attack identifier is a gang attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a lethal attack. If the attack identifier corresponding to the attack identifier is a normal attack level, the attack mode corresponding to the attack identifier is a single attack, and the attack intent corresponding to the attack identifier is data theft and / or service disruption, then the attack level corresponding to the attack identifier is a medium attack level. If the attack intent corresponding to the attack identifier is scanning and probing, then the attack level corresponding to the attack identifier is a lightweight attack level; An attacker profile is formed based on each attack identifier and the attack level corresponding to the attack identifier.

4. The network attack defense method based on multi-dimensional intelligent analysis according to claim 1, characterized in that, The defense strategy generated based on the attacker profile includes: For each attacker described in the attacker profile, if the attack level is a lightweight attack level, then the individual defense strategy for that attacker is an edge node rate limiting strategy. If the attack level is medium, then the individual defense strategy against the attacker is a cloud-based scrubbing center traffic diversion strategy. If the attack level is a lethal attack, then the individual defense strategy against the attacker is the operator black hole blocking strategy. The defense strategy will be composed of individual defense strategies against each attacker.

5. The network attack defense method based on multi-dimensional intelligent analysis according to claim 1, characterized in that, After implementing the defense strategy, the method further includes: Real-time monitoring of defense strategy feedback information and defense resource consumption information; The defense strategy is adjusted based on the feedback information of the defense strategy and the information on defense resource consumption to obtain an updated defense strategy.

6. The network attack defense method based on multi-dimensional intelligent analysis according to claim 5, characterized in that, The step of adjusting the defense strategy based on the defense strategy feedback information and the defense resource consumption information to obtain an updated defense strategy includes: If the defense strategy feedback information contains new multi-dimensional attack features, then the defense strategy is adjusted based on the new multi-dimensional attack features to obtain a first updated defense strategy; If the defense resource consumption information does not conform to the preset defense resource consumption information, then the defense strategy with an attack level higher than the attack level corresponding to the defense strategy will be used as the second updated defense strategy. An update defense strategy is formed based on the first update defense strategy and the second update defense strategy.

7. The network attack defense method based on multi-dimensional intelligent analysis according to any one of claims 1 to 6, characterized in that, The method further includes: Set up attack decoy information to simulate the weaknesses of the business system; The attack decoy information is used to attract attackers to attack the business system. Obtain the attacker's standard multi-dimensional attack characteristics, attack identifiers, and attack timeline. The description format of the standard multi-dimensional attack characteristics conforms to the standardized description format of threat intelligence. An attack report is generated based on the standard multi-dimensional attack characteristics, the attack identifier, and the attack timeline, and the attack report is stored using blockchain evidence storage technology.

8. A network attack defense device based on multi-dimensional intelligent analysis, characterized in that, include: The acquisition unit is used to acquire multi-dimensional attack features, which include multiple attack behavior features targeting multiple attackers. The processing unit is used to perform graph construction processing on the multi-dimensional attack features based on the graph neural network to generate an attack relationship graph, which is used to associate multiple attack behavior features of each attacker and / or associate multiple attack behavior features of multiple attackers. The generation unit is used to perform graph analysis on the attack relationship graph and generate an attacker profile, which is used to measure the attack level of the multiple attackers. The generation unit is further configured to generate a defense strategy based on the attacker profile and execute the defense strategy, which is used to defend against attacks from the multiple attackers.

9. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the network attack defense method based on multi-dimensional intelligent analysis as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the network attack defense method based on multi-dimensional intelligent analysis as described in any one of claims 1 to 7.

Images