An intelligent internet asset network security risk detection system

Abstract

The application relates to an intelligent Internet asset network security risk detection system, which improves threat response efficiency through a 'detection-analysis-defense-optimization' closed loop architecture, adopts a multi-protocol crawler and a flow mirror technology to realize real-time acquisition of asset metadata and flow, realizes adaptive detection based on a dynamic concurrency algorithm, guarantees transmission stability by combining double queue buffering and token bucket technology, quantifies attack path risk transmission probability based on an SSL certificate trust degree formula and a dynamic Bayesian network, generates a strategy through Q-learning reinforcement learning, a reward function of the strategy balances risk reduction and defense cost, and the strategy effectiveness is verified based on a Docker container to build a digital twin environment, Bayesian network parameters and a Q matrix are synchronously iterated to drive dynamic evolution of the defense strategy, and a visual interface is provided. The whole system has continuous optimization capability in a dynamic environment, and effectively improves the security defense level of a complex network.

Description

Technical Field

[0001] This invention relates to the field of internet asset cybersecurity risk detection technology, specifically to an intelligent internet asset cybersecurity risk detection system. Background Technology

[0002] As cyberattacks become increasingly covert and intelligent, traditional security systems face severe challenges in dynamic asset discovery, real-time threat response, and defense strategy optimization. Existing technologies generally suffer from problems such as limited asset detection dimensions, reliance on static rule bases for risk analysis, and a disconnect between defense strategies and attack evolution. These issues make it difficult to cope with complex scenarios such as the ubiquity of IoT devices and the surge in encrypted traffic, leading to security vulnerabilities such as incomplete identification of asset exposure surfaces and delayed APT attack detection.

[0003] The existing system has significant shortcomings: asset detection lacks multi-protocol support, cannot dynamically identify cloud environments and edge nodes, the threat detection engine struggles to model cross-stage attack behaviors, response to zero-day exploits has high latency, defense decisions rely on manually preset strategies, lack a dynamic balance between attack costs and defense costs, and the verification mechanism uses offline simulation, making it impossible to achieve minute-level strategy iteration. Therefore, it is necessary to build a closed-loop defense system that integrates dynamic asset mapping, attack path reasoning, reinforcement learning decision-making, and digital twin verification to achieve continuous evolution of security capabilities. Summary of the Invention

[0004] In order to solve the technical problems mentioned in the background art, the purpose of this invention is to provide an intelligent Internet asset network security risk detection system.

[0005] Therefore, the technical solution adopted by the present invention is as follows:

[0006] M1, the data acquisition and transmission module, includes a multi-protocol crawler unit, a traffic mirroring and monitoring unit, and a buffer unit.

[0007] The multi-protocol crawler unit collects metadata of the target network assets via HTTP / HTTPS / CoAP / SSDP protocols.

[0008] The traffic mirroring monitoring unit collects raw traffic packet data at the core node of the network where the target network asset is located.

[0009] The raw traffic packet data and metadata are shaped and transmitted asynchronously through a buffer unit;

[0010] M2, Risk Analysis Module, includes an SSL Certificate Chain Analysis Unit and a Dynamic Bayesian Network Unit. The SSL Certificate Chain Analysis Unit verifies the credibility of the target Internet device certificate and generates a risk label. The Dynamic Bayesian Network Unit integrates the traffic characteristics of metadata and raw traffic packet data to construct an attack path topology and quantifies the attack path topology as a risk transmission probability.

[0011] M3, the defense control module, includes a Q-learning decision unit and a digital twin simulation unit. The Q-learning decision unit generates a defense strategy based on the risk transmission probability, and the digital twin simulation unit tests the defense strategy in a Docker container environment and feeds back the test results.

[0012] M4, the closed-loop optimization module, receives the test results from the digital twin simulation unit, uses the test results to update the edge weights of the conditional probability table of the dynamic Bayesian network, and simultaneously optimizes the Q-value matrix of Q-learning.

[0013] M5, the display module, is used to dynamically display the attack path topology and risk propagation probability, display the execution status of the defense strategy generated by the Q-learning decision unit in real time, and synchronously display the edge weights of the conditional probability table of the dynamic Bayesian network and the convergence curve of the Q-value matrix of Q-learning.

[0014] Furthermore, the multi-protocol crawler unit includes a detection and acquisition subunit, a dynamic concurrency control subunit, and a data deduplication and verification subunit.

[0015] The detection and acquisition subunit obtains the response messages of the target network assets by executing detection requests in parallel using HTTP / HTTPS / CoAP / SSDP protocols. It then extracts the metadata of the network assets by parsing the Server header field and service identifier in the response messages.

[0016] The dynamic concurrency control subunit dynamically adjusts the concurrency of crawler threads based on the response latency of the network assets. The formula for calculating the concurrency is as follows:

[0017]

[0018] in, The maximum concurrency threshold, As the baseline response time, This is the current real-time round-trip time. This is the initial concurrency level.

[0019] The data deduplication and verification subunit uses a Bloom filter to perform real-time deduplication of the metadata and verifies the integrity of the metadata using CRC32.

[0020] Furthermore, the traffic mirroring monitoring unit includes a zero-copy packet capture engine subunit and a sliding time window statistics subunit.

[0021] The zero-copy packet capture engine subunit bypasses the kernel protocol stack and directly captures raw traffic packets using the libpcap library.

[0022] The sliding time window statistics subunit uses a time window Calculate the average size of the original data packets periodically. Original data packet size variance and the burst index of the original traffic package The burst index of the original traffic packets is calculated using an exponentially weighted moving average formula:

[0023]

[0024] in, The smoothing coefficient is T, the window length is T, and Packet_Count(t) is the total number of raw traffic packets captured in the current window.

[0025] Furthermore, the buffer unit includes a dual-queue design subunit, a token bucket traffic shaping subunit, a breakpoint resume mechanism subunit, and a data compression and encryption subunit.

[0026] The dual-queue design consists of a metadata queue and a raw traffic packet queue. The metadata queue stores metadata, with each record containing IP address, port, protocol type, and service version. The raw traffic packet queue stores raw traffic packet data, including protocol headers and payload data, with a maximum limit of 1500 bytes per packet.

[0027] The token bucket flow shaping subunit dynamically adjusts the token generation rate. The calculation formula is:

[0028]

[0029] in, packets per second is the base rate. For CPU utilization, CPU safety threshold, , For traffic burst threshold,

[0030] Token bucket maximum capacity The calculation formula is:

[0031]

[0032] in, Tokens are the base capacity. This is the variance adjustment coefficient.

[0033] The token bucket flow shaping subunit is based on the average size of the original flow packets. Limit the maximum size of the original traffic packet corresponding to a single token, if the... If the length is >1200 bytes, then the maximum raw data packet that a single token can transmit is 1500 bytes. If the length is ≤1200 bytes, then the maximum original data packet that a single token is allowed to transmit is: +300 bytes, the asynchronous transmission means that each original data packet requires one token to be transmitted. When there are no tokens in the token bucket, the original data packet will be cached in the original data packet queue.

[0034] When the target network asset experiences a network outage, the breakpoint resume subunit persistently stores the untransmitted metadata queue and the original traffic packet queue to the local disk. Once the target network asset's network is restored, the metadata queue is transmitted first, followed by the original traffic packet queue.

[0035] The data compression and encryption subunit uses the LZ4 algorithm to compress the original traffic packet data of the target network asset, uses the GZIP algorithm to compress the metadata of the target network asset, and encrypts the transmission channel through the TLS 1.3 protocol.

[0036] Furthermore, the SSL certificate chain analysis unit includes a certificate chain parsing subunit, a trust scoring subunit, and a risk label generation subunit.

[0037] The certificate chain parsing subunit verifies the validity of the chained signature of the root certificate, intermediate certificates, and terminal certificates, and detects the certificate revocation status and extracts the signature algorithm type of the terminal certificate.

[0038] The trust rating subunit calculates the trust level of the certificate using the following formula. :

[0039]

[0040] in, Assess the authority of root certificates. The remaining validity period of the certificate is in days. Weights for the probability of certificate revocation ,

[0041] The risk label generation subunit is based on The value and the extracted signature algorithm type are marked with a risk label, if If the value is less than 0.5 or the signature algorithm is SHA-1, it is marked as a high-risk certificate, and the mark is sent back to the metadata of the data acquisition and transmission module in real time.

[0042] Furthermore, the dynamic Bayesian network unit includes an attack path topology construction subunit, a conditional probability table subunit, and a risk propagation probability update subunit.

[0043] The attack path topology construction subunit extracts unique identifiers of network assets by parsing metadata and raw traffic packet data. It then models network assets that meet preset asset conditions as time-series nodes and constructs a predicted attack path topology based on the dependencies between nodes.

[0044] The preset asset conditions include asset exposure conditions, protocol risk characteristic conditions, traffic anomaly conditions, certificate trust conditions, and dynamic Bayesian network association conditions.

[0045] The asset exposure condition refers to the fact that the response messages of the network asset's HTTP / HTTPS / CoAP / SSDP protocol contain a resolvable Server header field or service identifier.

[0046] The aforementioned protocol risk characteristic condition refers to the fact that the protocol used by the network asset has known vulnerabilities or weak security configurations, which are obtained by parsing raw traffic packet data.

[0047] The abnormal traffic conditions refer to the average packet size. >1200 bytes, packet size variance Traffic Surge Index Greater than the traffic burst threshold,

[0048] The certificate trust level condition refers to certificates marked as high-risk certificates.

[0049] The association condition of the dynamic Bayesian network refers to the edge weights of the associated attack path topology. and edge activation state ,

[0050] The conditional probability table calculation subunit is based on the score from the Common Vulnerability Scoring System (CVSS) and the average packet size of the original traffic packets. Package size variance Traffic Surge Index Weighted calculation of edge weights ,

[0051] The risk propagation probability update subunit calculates the risk state probability of each node in real time using a forward-backward algorithm based on the edge weights and edge activation states of the attack path topology. And update the risk propagation probability of the attack path.

[0052] The edge activation state is used to determine in real time whether an attack path edge is in an active attack state. When the edge activation state value is 0, it means that there is no sign of this attack path edge being attacked. When the edge activation state value is 1, it means that this attack path edge is being used to attack other attack path edges.

[0053] Furthermore, the Q-learning decision unit includes a state definition subunit, an action set subunit, a reward function subunit, a Q-value matrix update subunit, and a defense strategy generation subunit.

[0054] The state definition subunit incorporates the risk propagation probability, SSL certificate trust score, and average packet size of the original traffic packets. Package size variance Traffic Surge Index Transform into risk states that Q-learning can handle :

[0055] ,

[0056] The action set subunit is a collection of defensive actions. :

[0057] Blocking IPs, limiting port rates, and isolating internet assets.

[0058] The reward function subunit calculates the defensive action using the following formula. exist Instant rewards in status :

[0059]

[0060] in, This represents the difference in the probability of risk transmission to key assets before and after the execution of defensive actions. The nonlinear penalty term for the sum of edge weights is used to suppress defensive actions. Over-defense For defensive actions The blocked attack path edge, Reduce the weight of risk. As a weight for action cost, These are the weighting coefficients.

[0061] The Q-value matrix update sub-unit is iteratively optimized using the following formula.

[0062]

[0063] Among them, learning rate Discount factor , To perform the action The new state after that, For the new state The following candidate actions,

[0064] The defense strategy generation module is based on the updated Q-value matrix, through... Operation selection Maximize the action ,Right now

[0065]

[0066] The optimal defense strategy for the current state.

[0067] Furthermore, the digital twin simulation environment construction subunit, parallel strategy testing subunit, and optimal strategy selection subunit,

[0068] The digital twin simulation environment construction subunit, based on metadata and raw traffic packet data, simulates network device topology using Mininet and injects historical attack data and real-time traffic characteristics of raw traffic packets to generate a simulation test environment. These traffic characteristics include the average packet size of the raw traffic packets. Package size variance Traffic Surge Index ,

[0069] The parallel strategy testing subunit synchronously deploys the Q-learning defense strategy in a Docker container cluster and records the actual effect indicators of the defense actions obtained by executing the defense strategy. The actual effect indicators of the defense actions include false alarm rate, response latency, and resource overhead.

[0070] Furthermore, the dynamic Bayesian network parameter update unit adjusts the edge weights of the conditional probability table based on the metadata and original traffic packets fed back by the digital twin simulation unit. The Q-learning optimization unit updates the Q-value matrix of the action pair through the actual effect index of the defense action of the defense strategy. The action pair refers to the action pair in the risk state. Defensive actions to be performed .

[0071] Compared with the prior art, the advantages of the present invention are as follows:

[0072] 1. Multi-dimensional Dynamic Perception and Intelligent Decision-Making Capabilities: This invention supports HTTP / HTTPS / CoAP / SSDP protocol detection through a multi-protocol crawler unit, combined with a zero-copy packet capture engine to collect encrypted traffic in real time, and uses a dynamic Bayesian network to construct attack path topology and quantify risk propagation probability. Through dynamic concurrency algorithms and sliding window statistical technology, the system can accurately identify the exposure surfaces of IoT devices, edge nodes, and cloud services, significantly improving asset discovery coverage. Combined with the SSL certificate trust scoring formula, the false positive rate is significantly reduced, and threat detection latency is compressed to the millisecond level.

[0073] 2. Adaptive Defense Strategy Evolution Mechanism: Based on the Q-learning reinforcement learning framework and the Docker digital twin environment, a dynamic defense chain of "risk analysis - strategy generation - simulation verification - closed-loop optimization" is constructed. By balancing risk reduction and defense costs through the reward function, the strategy iteration cycle is shortened from several hours to minutes, and the accuracy of defense actions is significantly improved.

[0074] 3. End-to-End Collaborative Protection and Visualized Management: Employing dual-queue buffering and token bucket traffic shaping ensures stable data transmission; dynamically displaying risk propagation paths through a 3D force-directed graph supports manual tuning of Bayesian network edge weights and Q-learning parameters, achieving a minute-level closed loop of "risk identification - policy execution - effect verification." This shortens the average threat response time, improves the efficiency of handling complex attack scenarios, and reduces the false positive rate. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a schematic diagram of the system workflow of the present invention;

[0077] Figure 2 This is a schematic diagram of the core process of the data acquisition and transmission module of the present invention;

[0078] Figure 3 This is a schematic diagram of the core process of the defense control module of the present invention; Detailed Implementation

[0079] To achieve the above objectives, the present invention provides an intelligent internet asset network security risk detection system, comprising:

[0080] M1, the data acquisition and transmission module, includes a multi-protocol crawler unit, a traffic mirroring and monitoring unit, and a buffer unit. The multi-protocol crawler unit collects metadata of the target network asset via HTTP / HTTPS / CoAP / SSDP protocols. The traffic mirroring and monitoring unit collects raw traffic packet data at the core node of the network where the target network asset is located. The raw traffic packet data and metadata are processed by the buffer unit for traffic shaping and asynchronous transmission.

[0081] The multi-protocol crawler unit probes and collects metadata via HTTP / HTTPS / CoAP / SSDP protocols. This includes a probe and collection subunit, a dynamic concurrency control subunit, and a data deduplication and verification subunit, ensuring comprehensive and accurate detection and extraction of metadata from network assets.

[0082] The detection and acquisition subunit constructs GET / HEAD requests via HTTP / HTTPS protocols to probe web services, parses the Server field and page content characteristics (such as title and keywords) in the response header, and extracts service type (such as Nginx, Apache) and version information. The CoAP protocol sends resource discovery requests via UDP (such as GET / .well-known / core) to parse the resource path of IoT devices (such as / sensors / temperature) and device identifiers (such as device UUID). The SSDP protocol broadcasts M-SEARCH messages to the local area network, receives responses from smart devices (such as UPnP devices), and parses the device description URL and device type (such as smart TV, camera).

[0083] The dynamic concurrency control subunit dynamically adjusts the concurrency of crawler threads based on the response latency of the network assets. The formula for calculating the concurrency is as follows:

[0084]

[0085] in, The maximum concurrency threshold, As the baseline response time, This is the current real-time round-trip time. This is the initial concurrency level.

[0086] The data deduplication and verification subunit configures the bit array size to 1GB using a Bloom filter, uses 7 hash functions (such as MurmurHash3) to deduplicatize the metadata (IP + port + protocol), and generates a checksum (such as 0x7D0B1A3E) using CRC32 checksum. Data packets that fail the checksum are discarded.

[0087] The traffic mirroring monitoring unit collects raw traffic packets through mirror ports at core network nodes, including a zero-copy packet capture engine subunit and a sliding time window statistics subunit.

[0088] The zero-copy packet capture engine subunit bypasses the kernel protocol stack by using the libpcap library to directly capture raw traffic packets, and sets the buffer size to 128MB to reduce CPU interrupt frequency.

[0089] The sliding time window statistics subunit calculates the following characteristics with a window period of 60 seconds:

[0090] Average size of raw data packets During the time window Average size of all raw data packets within (default 60 seconds):

[0091]

[0092] in, For the first Size of each data packet (in bytes), For window Total number of data packets within,

[0093] Original packet size variance This measures the dispersion of the window's inner frame size.

[0094]

[0095] The burst index of the original traffic packet is determined by detecting the burstiness of the original traffic packet using an exponentially weighted moving average (EWMA). The formula is as follows:

[0096]

[0097] in, For smoothing coefficients, For window length, In the time window The total number of raw traffic packets captured internally.

[0098] The buffer unit implements asynchronous transmission of metadata and traffic data through a dual-queue mechanism, avoiding I / O blocking. By dynamically adjusting the transmission rate, it prevents network congestion or packet loss caused by data surges. It includes a dual-queue design subunit, a token bucket traffic shaping subunit, a breakpoint resume mechanism subunit, and a data compression and encryption subunit.

[0099] The dual-queue design subunit stores network asset metadata in JSON format (such as device IP, service version, and protocol type) in a metadata queue, and raw traffic packet queue stores raw traffic packets in PCAP format (including timestamps, protocol headers, and payloads). The maximum size of a single packet is limited to 1500 bytes to avoid MTU fragmentation.

[0100] The token bucket flow shaping subunit dynamically adjusts the token generation rate. The calculation formula is:

[0101]

[0102] in, packets per second is the base rate. For CPU utilization, CPU safety threshold, The slope of the Sigmoid function. For traffic burst threshold,

[0103] Token bucket maximum capacity The calculation formula is:

[0104]

[0105] in, Tokens are the base capacity. This is the variance adjustment coefficient.

[0106] The token bucket flow shaping subunit is based on Limit the maximum size of the data packet corresponding to a single token. If the size is greater than 1200 bytes, then the maximum allowed packet size for a single token is 1500 bytes. If the size is ≤1200 bytes, then the maximum allowed packet size for a single token is [value missing]. +300 bytes: Each raw data packet requires one token to be transmitted. When there are no tokens in the token bucket, the raw data packet will be cached in the raw data packet queue.

[0107] When the target network asset experiences a network outage, the breakpoint resume subunit persistently stores the untransmitted metadata queue and the metadata and traffic queue of the original traffic packets to the local disk. When the target network asset's network is restored, the metadata queue is transmitted first, followed by the traffic queue of the original traffic packets.

[0108] The data compression and encryption subunit compresses the original traffic packets using the LZ4 algorithm (compression rate of approximately 50%), compresses the metadata using GZIP (compression rate of approximately 70%), and enables TLS 1.3 encryption on the transmission channel to prevent data from being eavesdropped on or tampered with during transmission.

[0109] M2, the risk analysis module, includes an SSL certificate chain analysis unit and a dynamic Bayesian network unit. The SSL certificate chain analysis unit verifies the trustworthiness of the device certificate and generates a risk label. The dynamic Bayesian network unit integrates network asset metadata and the traffic characteristics of the original traffic packets to construct an attack path topology and quantifies the probability of risk propagation.

[0110] The SSL certificate chain analysis unit verifies the integrity and legitimacy of the certificate chain, scores the trust level of the calculated certificates, and marks self-signed, expired, or weakly signed certificates. It includes a certificate chain parsing subunit, a trust level scoring subunit, and a risk label generation subunit.

[0111] The certificate chain parsing subunit verifies the validity of the chained signature by extracting the root certificate, intermediate certificates, and terminal certificates from the certificate chain, detecting certificate revocation status, and extracting the signature algorithm type of the terminal certificate.

[0112] Trust rating sub-unit:

[0113]

[0114] in, Assess the authority of the root certificate (e.g., Lets Encrypt = 0.9, self-signed = 0.1). The remaining validity period of the certificate (in days). Weights for certificate revocation probability (based on CRL / OCSP response) ,

[0115] Risk label generation subunit based on The value and the extracted signature algorithm type are marked with a risk label, if If the value is less than 0.5 or the signature algorithm is SHA-1, the certificate is marked as high-risk, and the mark is transmitted back to the metadata of the data acquisition and transmission module in real time.

[0116] The dynamic Bayesian network unit models network assets, vulnerabilities, and attack actions as a time-series Bayesian network, updates the network asset status in real time, and quantifies the path probability of an attacker from an initial node to a critical asset. It includes an attack path topology construction subunit, a conditional probability table subunit, and a risk propagation probability update subunit.

[0117] The attack path topology construction subunit extracts unique identifiers of network assets by parsing metadata and raw traffic packet data, models entities that meet preset asset conditions as time-series nodes, and constructs a predicted attack path topology based on the dependencies between nodes.

[0118] The preset asset conditions include asset exposure conditions, protocol risk characteristic conditions, traffic anomaly conditions, certificate trust conditions, and dynamic Bayesian network association conditions.

[0119] Asset exposure conditions refer to situations where the HTTP / HTTPS / CoAP / SSDP protocol response messages of network assets contain resolvable Server header fields or service identifiers.

[0120] Protocol risk characteristics refer to the fact that the protocol used by the network asset has known vulnerabilities or weak security configurations, which are obtained by parsing raw traffic packet data.

[0121] Traffic anomaly conditions refer to the average packet size >1200 bytes, packet size variance Traffic Surge Index Greater than the traffic burst threshold,

[0122] Certificate trust criteria refer to certificates that are marked as high-risk certificates.

[0123] The association condition of a dynamic Bayesian network refers to the edge weights of the associated attack path topology. and edge activation state ,

[0124] The conditional probability table sub-unit has edge weights determined by the average packet size of the metadata and the original traffic packets. Traffic Surge Index Joint computing:

[0125]

[0126] in, The vulnerability received a CVSS score (3.0~10.0). Traffic characteristic risk value, weight ,

[0127] The formula for calculating the risk value of traffic characteristics is:

[0128] Traffic_Risk

[0129] The risk propagation probability update subunit calculates the risk state probability of each node in real time using a forward-backward algorithm based on the edge weights and edge activation states of the attack path topology. And update the risk propagation probability of the attack path:

[0130]

[0131] in, The edge is in an active state (0 or 1). This refers to the possibility of an attacker moving from one asset (or vulnerability) to another. Connect two nodes for each edge. Edge weight,

[0132] M3, the defense control module, includes an O-learning decision-making unit and a digital twin simulation unit. The O-learning unit generates defense strategies based on risk propagation probabilities, and the digital twin simulation unit tests the effectiveness of the defense strategies in an isolated environment and provides feedback on the results.

[0133] The Q-learning decision unit maps network risk levels to defensive actions and dynamically adjusts the Q-value matrix through reinforcement learning to maximize risk reduction benefits. It includes sub-units for state definition, action set, reward function, Q-value update rules, and defense strategy generation.

[0134] The state definition subunit incorporates the risk propagation probability, SSL certificate trust score, and average packet size of the original traffic packets. Package size variance Traffic Surge Index Transform into risk states that Q-learning can handle :

[0135]

[0136] Among them, each state The threshold range for the corresponding node risk level is divided.

[0137] Action set sub-unit, Blocking IPs, limiting port rates, and isolating internet assets. ,

[0138] The reward function subunit calculates the defensive action using the following formula. exist Instant rewards in status :

[0139]

[0140] in, This represents the difference in the probability of risk transmission to key assets before and after the execution of defensive actions. The nonlinear penalty term for the sum of edge weights is used to suppress defensive actions. Over-defense For defensive actions The blocked attack path edge, Reduce the weight of risk. As a weight for action cost, These are the weighting coefficients.

[0141] Q-value update rule subunit:

[0142]

[0143] Among them, learning rate Discount factor , To perform the action The new state after that, For the new state The following candidate actions,

[0144] The defense strategy generation module is based on the updated Q-value matrix, through... Operation selection Maximize the action ,Right now

[0145]

[0146] As the optimal defense strategy for the current state,

[0147] The digital twin simulation unit tests the feasibility of defense strategies by mirroring a real network topology in a Docker container, quantifying the false alarm rate, response latency, and resource overhead of the strategies. It includes sub-units for building the digital twin simulation environment, parallel strategy testing, and optimal strategy selection.

[0148] The digital twin simulation environment construction subunit, based on metadata and raw traffic packet data, simulates network device topology using Mininet and injects historical attack data and real-time traffic characteristics of raw traffic packets to generate a simulation test environment. These traffic characteristics include the average packet size of the raw traffic packets. Package size variance Traffic Surge Index ,

[0149] The parallel strategy testing subunit tests three strategies simultaneously, and the evaluation metrics include:

[0150] False Alarm Rate (FPR): Number of false alarms / Total normal traffic ,

[0151] Response latency (L): End-to-end time from policy generation to execution (in milliseconds).

[0152] Resource overhead (O): CPU / memory utilization increment,

[0153] The optimal strategy is to select the sub-unit based on the comprehensive scoring formula:

[0154] Score

[0155] The strategy with the highest score is selected and fed back to the Q-learning unit.

[0156] M4, the closed-loop optimization module, includes a dynamic Bayesian network parameter update unit and a Q-learning optimization unit. It synchronously updates model parameters based on simulation feedback data to achieve adaptive optimization.

[0157] The dynamic Bayesian network parameter update unit adjusts the edge weights of the conditional probability table based on the metadata and original traffic packets fed back by the digital twin simulation unit.

[0158] Q-learning updates the Q-value of action pairs using metrics indicating the actual effectiveness of defensive actions in a defensive strategy. An action pair refers to the action in a risky state. Defensive actions to be performed .

[0159] M5, the display module, is an interactive force-directed graph built on D3.js. Nodes represent network assets (color-coded risk levels: red - high risk, orange - medium risk, green - low risk), and edges represent attack paths (the line width is proportional to the risk transmission probability W(e). When the edge of the dynamic Bayesian network is in the active state I(e)=1, it is displayed as a flashing dashed line).

[0160] The ECharts layout uses a three-column layout. The left side features a horizontal progress bar displaying the current strategy's execution progress, with green indicating completion and red indicating failure. The middle section uses a pie chart to show CPU / memory usage (data sourced from the actual effectiveness metrics of defense actions fed back by the digital twin simulation unit). Alarms are triggered when thresholds are exceeded. The right side uses virtual scrolling technology to display the 50 most recent strategy execution logs (timestamp, action type, target asset, execution result). Critical operations (such as isolating assets) are highlighted with a yellow background.

[0161] Use Plotly to draw a heatmap of the conditional probability table. The horizontal and vertical axes represent the asset node IDs, and the cell color depth represents the edge weight W(e) (color scale: blue 0 → red 1). Hovering the mouse displays the specific weight value and associated traffic characteristics (μ_size, F_burst).

[0162] The t-SNE dimensionality reduction algorithm is used to compress the high-dimensional Q-value matrix into a 2D plane. The scatter plot shows the distribution of state-action pairs (state s is coded by shape and action a is distinguished by color). The size of the point reflects the absolute value of Q(s, a). The horizontal axis of the line graph is the number of training cycles, and the vertical axis is the average Q-value. Double-clicking a scatter plot will pop up a policy details card, which displays a bar chart comparing the Q-values ​​of each action in that state and the historical reward R(s, a) record.

[0163] This invention provides an intelligent internet asset cybersecurity risk detection system, aiming to improve the detection accuracy and real-time response capability of internet asset cybersecurity risks. The system consists of multiple collaborative modules, which collect network asset data in real time through multi-protocol crawling and traffic mirroring technologies, and utilize dynamic Bayesian networks and reinforcement learning algorithms for risk modeling and defense strategy generation. The system can accurately identify attack paths, quantify risk propagation probabilities, and dynamically optimize defense actions based on real-time threats, ensuring the full lifecycle security protection of network assets.

[0164] In summary, the advantages of this invention lie in its ability to cover IoT devices, cloud services, and hidden interfaces, enabling precise asset and threat location; its ability to model attack paths through dynamic Bayesian networks, and to calculate risk propagation probabilities in real time by combining vulnerability exploitation chains and traffic anomalies; its ability to generate defense strategies through Q-learning and pre-validate them in a digital twin environment; its closed-loop feedback module continuously updating the risk model and strategy matrix to adapt to new threats such as APT attacks; and its redundant storage and multi-protocol communication to ensure the stability of data transmission and storage. This invention significantly improves the proactive defense capabilities and intelligence level of network security management, helps build an adaptive immune system, and provides reliable security guarantees for digital transformation.

[0165] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An intelligent internet asset cybersecurity risk detection system, characterized in that, include; M1, the data acquisition and transmission module, includes a multi-protocol crawler unit, a traffic mirroring and monitoring unit, and a buffer unit. The multi-protocol crawler unit collects metadata of the target network assets via HTTP / HTTPS / CoAP / SSDP protocols. The traffic mirroring monitoring unit collects raw traffic packet data at the core node of the network where the target network asset is located. The raw traffic packet data and metadata are shaped and transmitted asynchronously through a buffer unit; M2, the risk analysis module, includes an SSL certificate chain analysis unit and a dynamic Bayesian network unit. The SSL certificate chain analysis unit verifies the trustworthiness of the target Internet device certificate and generates a risk label. The SSL certificate chain analysis unit includes a certificate chain parsing subunit, a trust scoring subunit, and a risk label generation subunit. The certificate chain parsing subunit verifies the validity of the chained signature of the root certificate, intermediate certificates, and terminal certificates, and detects the certificate revocation status and extracts the signature algorithm type of the terminal certificate. The trust rating subunit calculates the trust level of the certificate using the following formula. : in, Assess the authority of root certificates. The remaining validity period of the certificate is in days. Weights for the probability of certificate revocation , The risk label generation subunit is based on The value and the extracted signature algorithm type are marked with a risk label, if If the value is less than 0.5 or the signature algorithm is SHA-1, it is marked as a high-risk certificate, and the mark is sent back to the metadata of the data acquisition and transmission module in real time. The dynamic Bayesian network unit integrates the traffic characteristics of metadata and raw traffic packet data to construct the attack path topology, and quantifies the attack path topology as the risk propagation probability. The dynamic Bayesian network unit includes an attack path topology construction subunit, a conditional probability table subunit, and a risk propagation probability update subunit. The attack path topology construction subunit extracts unique identifiers of network assets by parsing metadata and raw traffic packet data. It then models network assets that meet preset asset conditions as time-series nodes and constructs a predicted attack path topology based on the dependencies between nodes. The preset asset conditions include asset exposure conditions, protocol risk characteristic conditions, traffic anomaly conditions, certificate trust conditions, and dynamic Bayesian network association conditions. The asset exposure condition refers to the fact that the response messages of the network asset's HTTP / HTTPS / CoAP / SSDP protocol contain a resolvable Server header field or service identifier. The aforementioned protocol risk characteristic condition refers to the fact that the protocol used by the network asset has known vulnerabilities or weak security configurations, which are obtained by parsing raw traffic packet data. The abnormal traffic conditions refer to the average packet size. >1200 bytes, packet size variance Traffic Surge Index Greater than the traffic burst threshold, The certificate trust level condition refers to certificates marked as high-risk certificates. The association condition of the dynamic Bayesian network refers to the edge weights of the associated attack path topology. and edge activation state , The conditional probability table calculation subunit is based on the score from the Common Vulnerability Scoring System (CVSS) and the average packet size of the original traffic packets. Package size variance Traffic Surge Index Weighted calculation of edge weights , The risk propagation probability update subunit calculates the risk state probability of each node in real time using a forward-backward algorithm based on the edge weights and edge activation states of the attack path topology. And update the risk propagation probability of the attack path. The edge activation state is used to determine in real time whether an attack path edge is in an active attack state. When the edge activation state value is 0, it means that there is no sign of this attack path edge being attacked. When the edge activation state value is 1, it means that this attack path edge is being used to attack other attack path edges. M3, the defense control module, includes a Q-learning decision unit and a digital twin simulation unit. The Q-learning decision unit generates a defense strategy based on the risk transmission probability, and the digital twin simulation unit tests the defense strategy in a Docker container environment and feeds back the test results. The digital twin simulation unit includes a digital twin simulation environment construction subunit, a parallel strategy testing subunit, and an optimal strategy selection subunit. The digital twin simulation environment construction subunit, based on metadata and raw traffic packet data, simulates network device topology using Mininet and injects historical attack data and real-time traffic characteristics of raw traffic packets to generate a simulation test environment. These traffic characteristics include the average packet size of the raw traffic packets. Package size variance Traffic Surge Index , The parallel strategy testing subunit synchronously deploys the Q-learning defense strategy in the Docker container cluster and records the actual effect indicators of the defense actions obtained by executing the defense strategy. The actual effect indicators of the defense actions include false alarm rate, response latency and resource overhead. M4, the closed-loop optimization module, receives the test results from the digital twin simulation unit, uses the test results to update the edge weights of the conditional probability table of the dynamic Bayesian network, and simultaneously optimizes the Q-value matrix of Q-learning. M5, the display module, is used to dynamically display the attack path topology and risk propagation probability, display the execution status of the defense strategy generated by the Q-learning decision unit in real time, and synchronously display the edge weights of the conditional probability table of the dynamic Bayesian network and the convergence curve of the Q-value matrix of Q-learning.

2. The intelligent internet asset network security risk detection system according to claim 1, characterized in that, The multi-protocol crawler unit includes a detection and acquisition subunit, a dynamic concurrency control subunit, and a data deduplication and verification subunit. The detection and acquisition subunit obtains the response messages of the target network assets by executing detection requests in parallel using HTTP / HTTPS / CoAP / SSDP protocols. It then extracts the metadata of the network assets by parsing the Server header field and service identifier in the response messages. The dynamic concurrency control subunit dynamically adjusts the concurrency of crawler threads based on the response latency of the network assets. The formula for calculating the concurrency is as follows: in, The maximum concurrency threshold, As the baseline response time, This is the current real-time round-trip time. This is the initial concurrency level. The data deduplication and verification subunit uses a Bloom filter to perform real-time deduplication of the metadata and verifies the integrity of the metadata using CRC32.

3. The intelligent internet asset network security risk detection system according to claim 1, characterized in that, The traffic mirroring monitoring unit includes a zero-copy packet capture engine subunit and a sliding time window statistics subunit. The zero-copy packet capture engine subunit bypasses the kernel protocol stack and directly captures raw traffic packets using the libpcap library. The sliding time window statistics subunit uses a time window Calculate the average size of the original data packets periodically. Original data packet size variance and the burst index of the original traffic package The burst index of the original traffic packets is calculated using an exponentially weighted moving average formula: in, The smoothing coefficient is T, the window length is T, and Packet_Count(t) is the total number of raw traffic packets captured in the current window.

4. The intelligent internet asset network security risk detection system according to claim 1, characterized in that, The buffer unit includes a dual-queue design subunit, a token bucket traffic shaping subunit, a breakpoint resume mechanism subunit, and a data compression and encryption subunit. The dual-queue design consists of a metadata queue and a raw traffic packet queue. The metadata queue stores metadata, with each record containing IP address, port, protocol type, and service version. The raw traffic packet queue stores raw traffic packet data, including protocol headers and payload data, with a maximum limit of 1500 bytes per packet. The token bucket flow shaping subunit dynamically adjusts the token generation rate. The calculation formula is: in, packets per second is the base rate. For CPU utilization, CPU safety threshold, , For traffic burst threshold, Token bucket maximum capacity The calculation formula is: in, Tokens are the base capacity. This is the variance adjustment coefficient. The token bucket flow shaping subunit is based on the average size of the original flow packets. Limit the maximum size of the original traffic packet corresponding to a single token, if the... If the length is >1200 bytes, then the maximum raw data packet that a single token can transmit is 1500 bytes. If the length is ≤1200 bytes, then the maximum raw data packet that a single token is allowed to transmit is: +300 bytes, the asynchronous transmission means that each original data packet requires one token to be transmitted. When there are no tokens in the token bucket, the original data packet will be cached in the original data packet queue. When the target network asset experiences a network outage, the interrupted metadata queue and the original traffic packet queue are persistently stored on the local disk. Once the target network asset's network is restored, the metadata queue is transmitted first, followed by the original traffic packet queue. The data compression and encryption subunit uses the LZ4 algorithm to compress the original traffic packet data of the target network asset, uses the GZIP algorithm to compress the metadata of the target network asset, and encrypts the transmission channel through the TLS 1.3 protocol.

5. The intelligent internet asset network security risk detection system according to claim 1, characterized in that, The dynamic Bayesian network parameter update unit adjusts the edge weights of the conditional probability table based on the metadata and original traffic packets fed back by the digital twin simulation unit. The Q-learning optimization unit updates the Q-value matrix of the action pair through the actual effect index of the defense action of the defense strategy. The action pair refers to the action in the risk state. Defensive actions to be performed .

Images