Network intrusion path detection method, system and device, medium and program product

Abstract

The embodiment of the invention provides a network intrusion path detection method, system and device, a medium and a program product, and relates to the technical field of network security. The method is applied to a first intelligent agent layer, and the first intelligent agent layer is connected with a second intelligent agent layer, a third intelligent agent layer and a fourth intelligent agent layer. The method comprises the following steps: generating an attack graph through a second agent layer according to network security data; wherein the network security data comprises one or more of network flow data, system log data, terminal behavior data and external threat intelligence data; determining one or more candidate intrusion paths and risk description information of the one or more candidate intrusion paths according to the attack graph through a third agent layer; and screening a target intrusion path from the one or more candidate intrusion paths through a fourth agent layer according to the risk description information of the one or more candidate intrusion paths. According to the embodiment of the invention, the network intrusion path can be accurately detected.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a network intrusion path detection method, system, device, medium, and program product. Background Technology

[0002] With the increasing diversification and complexity of cyberattacks, especially the rise of Advanced Persistent Threats (APTs) and multi-step attacks, traditional security defense technologies, such as intrusion detection systems and firewalls, often only provide passive, single-point protection and are ill-equipped to deal with interconnected attacks across hosts and networks. Attackers frequently exploit the interconnectedness of vulnerabilities in the network, gradually penetrating through a series of atomic attack steps to ultimately reach critical assets. This complex intrusion path poses a severe challenge to network security; therefore, accurate detection and modeling of intrusion paths have become crucial for improving proactive network defense capabilities. Summary of the Invention

[0003] The purpose of this application is to provide a network intrusion path detection method, system, device, medium, and program product to achieve the technical effect of accurately detecting network intrusion paths.

[0004] In a first aspect, embodiments of this application provide a network intrusion path detection method, applied to a first intelligent agent layer, wherein the first intelligent agent layer is connected to a second intelligent agent layer, a third intelligent agent layer, and a fourth intelligent agent layer respectively; the method includes: Through the second intelligent agent layer, an attack graph is generated based on network security data; wherein, the network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data; Through the third intelligent agent layer, based on the attack graph, one or more candidate intrusion paths are determined, along with risk description information for the one or more candidate intrusion paths. The fourth intelligent agent layer filters the target intrusion path from the one or more candidate intrusion paths based on the risk description information of the one or more candidate intrusion paths.

[0005] In the above implementation process, by pre-designing a four-layer intelligent agent architecture consisting of a first intelligent agent layer, a second intelligent agent layer, a third intelligent agent layer, and a fourth intelligent agent layer, and by utilizing the first intelligent agent layer in collaboration with the other multiple intelligent agent layers to detect target intrusion paths based on network security data, it is possible to accurately detect network intrusion paths.

[0006] Furthermore, the second intelligent agent layer includes an entity recognition intelligent agent, an anomaly detection intelligent agent, and a graph generation intelligent agent; The step of generating an attack graph based on network security data through the second intelligent agent layer includes: The entity recognition intelligent agent extracts network behavior features of one or more entities from the network security data; wherein, the network behavior features include operational features for characterizing network behavior operational attributes, and temporal features for characterizing network behavior temporal attributes. The anomaly detection agent determines, for each of the one or more entities, whether the entity's network behavior deviates from a pre-established network behavior baseline based on the entity's network behavior characteristics. The attack graph is generated by generating an agent from the graph, using the target entity as a node, and adding connecting edges to the node where the target entity is located based on the association relationship between the one or more entities; wherein the network behavior of the target entity deviates from the network behavior baseline.

[0007] In the above implementation process, a second agent layer is pre-set, including an entity recognition agent, an anomaly detection agent, and a graph generation agent. The entity recognition agent extracts the network behavior features of one or more entities from network security data. The anomaly detection agent determines whether the network behavior of each entity deviates from the network behavior baseline based on the network behavior features of each entity. The graph generation agent uses the target entities whose network behavior deviates from the network behavior baseline as nodes and adds connecting edges to the nodes where the target entities are located based on the association between one or more entities to generate an attack graph. This can coordinate multiple sub-agents within the second agent layer to accurately identify the inherent associations between various target entities under attack in network security data, ensuring that the attack graph is accurate and reliable.

[0008] Furthermore, the third intelligent agent layer includes a path search intelligent agent, a risk assessment intelligent agent, and a path prediction intelligent agent; The step of determining one or more candidate intrusion paths based on the attack graph, and the risk description information of the one or more candidate intrusion paths, includes: The path search agent performs path search on the attack graph to obtain one or more candidate intrusion paths. The risk assessment agent evaluates the comprehensive risk score of each of the one or more candidate intrusion paths. The comprehensive risk score is related to one or more factors, including threat intensity, attack pattern, probability of attack success, urgency of attack time, value of physical assets, and business loss. The path prediction agent predicts the later evolution information of the candidate intrusion path; wherein, the later evolution information includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path; The risk description information for determining the candidate intrusion path includes the comprehensive risk score and subsequent evolution information of the candidate intrusion path.

[0009] In the above implementation process, a third agent layer is pre-designed, including a path search agent, a risk assessment agent, and a path prediction agent. The path search agent searches for one or more candidate intrusion paths on the attack graph. The risk assessment agent evaluates the comprehensive risk score of each candidate intrusion path. The path prediction agent predicts the later evolution information of the candidate intrusion paths. The risk description information of the candidate intrusion paths is determined, including the comprehensive risk score and later evolution information of the candidate intrusion paths. This can comprehensively describe the risk assessment basis of the candidate intrusion paths by considering the current risk level and future evolution trend of the candidate intrusion paths, thereby more accurately detecting network intrusion paths.

[0010] Further, the step of performing path search on the attack graph to obtain one or more candidate intrusion paths includes: The attack graph is converted into a depth feature map; Based on a predefined path search strategy, a path search is performed on the deep feature map to obtain multiple preliminary intrusion paths; wherein, the path search strategy includes one or more of the following: shortest threat path search strategy, maximum impact path search strategy, most covert path search strategy, and fastest propagation path search strategy. Determine the comprehensive risk score of each of the multiple preliminary intrusion paths; The preset number of intrusion paths with the highest comprehensive risk scores are determined as one or more candidate intrusion paths.

[0011] In the above implementation process, by utilizing the path search agent within the second agent layer, the attack graph is transformed into a deep feature map. Based on a predefined path search strategy, path search is performed on the deep feature map to obtain multiple preliminary intrusion paths. The preset number of preliminary intrusion paths with the highest comprehensive risk scores are determined as one or more candidate intrusion paths. This approach takes into account system processing performance and prioritizes the search of several candidate intrusion paths with the highest comprehensive risk scores, which is beneficial to further improve the accuracy of network intrusion path detection.

[0012] Furthermore, the fourth intelligent agent layer includes a decision-making and execution intelligent agent; The step of filtering a target intrusion path from one or more candidate intrusion paths based on the risk description information of the one or more candidate intrusion paths includes: The decision-making agent performs the following operations: For each of the one or more candidate intrusion paths, the overall expected loss of the candidate intrusion path is determined based on the later evolution information of the candidate intrusion path. If the overall risk score of the candidate intrusion path is greater than the risk score threshold and the overall expected loss of the candidate intrusion path is greater than the expected loss threshold, then the candidate intrusion path is determined to be the target intrusion path. Otherwise, it is determined that the candidate intrusion path is not the target intrusion path; The risk description information of the candidate intrusion path includes the comprehensive risk score and subsequent evolution information of the candidate intrusion path.

[0013] In the above implementation process, by pre-designing a fourth agent layer including a decision-making agent, the decision-making agent determines the overall expected loss of each candidate intrusion path among one or more candidate intrusion paths based on the later evolution information of the candidate intrusion path. If the comprehensive risk score of the candidate intrusion path is greater than the risk score threshold and the overall expected loss of the candidate intrusion path is greater than the expected loss threshold, then the candidate intrusion path is determined to be the target intrusion path; otherwise, the candidate intrusion path is determined not to be the target intrusion path. The decision-making agent can use the fusion of the comprehensive risk score and later evolution information of the candidate intrusion path to make a decision and accurately determine the target intrusion path.

[0014] Furthermore, the later evolution information of the candidate intrusion path includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path; The step of determining the overall expected loss of the candidate intrusion path based on its later evolution information includes: Based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path, the total expected loss of the candidate intrusion path is calculated; wherein, the expected loss of the path is determined based on the probability of the path occurring, the attack loss along the path, and the probability of successful defense against the path.

[0015] In the above implementation process, by utilizing the decision execution agent in the fourth agent layer based on the later evolution information of the candidate intrusion path, the expected loss of the path is determined according to the occurrence probability of the path, the attack loss along the path, and the success probability of defense against the path. The expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path are obtained. Based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path, the overall expected loss of the candidate intrusion path is statistically calculated. The decision execution agent can accurately determine the overall expected loss of the candidate intrusion path based on the comprehensive later evolution information of the candidate intrusion path.

[0016] Furthermore, the method also includes: The fourth agent layer triggers the defense response corresponding to the target intrusion path.

[0017] In the above implementation process, by utilizing the fourth intelligent agent layer, after the target intrusion path is selected, the corresponding defense response of the target intrusion path is triggered, which can ensure timely defense against attacks and improve network security.

[0018] Furthermore, the second intelligent agent layer includes a monitoring intelligent agent, and the fourth intelligent agent layer includes a learning intelligent agent; the method further includes: The monitoring agent monitors the operational data of the target agent layer. The target agent layer is optimized based on the operational data through the learning agent. The target agent layer includes one or more of the first agent layer, the second agent layer, the third agent layer, and the fourth agent layer.

[0019] In the above implementation process, by adding a monitoring agent in the second agent layer and a learning agent in the fourth agent layer, the monitoring agent monitors the operation data of one or more target agent layers in the first, second, third, and fourth agent layers, and the learning agent optimizes the target agent layer based on the operation data. This enables timely optimization of the target agent layers in the entire system, ensuring more accurate detection of network intrusion paths in the future.

[0020] Secondly, embodiments of this application provide a network intrusion path detection system, including a first intelligent agent layer, a second intelligent agent layer, a third intelligent agent layer, and a fourth intelligent agent layer; the first intelligent agent layer is connected to the second intelligent agent layer, the third intelligent agent layer, and the fourth intelligent agent layer respectively; The first intelligent agent layer is used for: Through the second intelligent agent layer, an attack graph is generated based on network security data; wherein, the network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data; Through the third intelligent agent layer, based on the attack graph, one or more candidate intrusion paths are determined, along with risk description information for the one or more candidate intrusion paths. The fourth intelligent agent layer filters the target intrusion path from the one or more candidate intrusion paths based on the risk description information of the one or more candidate intrusion paths.

[0021] Thirdly, embodiments of this application provide an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method described above.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the method described above.

[0023] Fifthly, embodiments of this application provide a computer program product, the computer program product including instructions, which, when executed by a computer, cause the computer to perform the method described above. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating a network intrusion path detection method provided in the first embodiment of this application; Figure 2 This is a schematic diagram of the structure of a network intrusion path detection system exemplified in the first embodiment of this application; Figure 3 A schematic diagram of a network intrusion path detection system provided in the second embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. Detailed Implementation

[0026] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0027] It should be noted that in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance. Furthermore, the step numbers in the text are only for the convenience of explaining the embodiments of this application and are not intended to limit the order in which the steps are performed.

[0028] With the increasing diversification and complexity of cyberattacks, especially the rise of Advanced Persistent Threats (APTs) and multi-step attacks, traditional security defense technologies, such as intrusion detection systems and firewalls, often only provide passive, single-point protection and are ill-equipped to deal with interconnected attacks across hosts and networks. Attackers frequently exploit the interconnectedness of vulnerabilities in the network, gradually penetrating through a series of atomic attack steps to ultimately reach critical assets. This complex intrusion path poses a severe challenge to network security; therefore, accurate detection and modeling of intrusion paths have become crucial for improving proactive network defense capabilities.

[0029] Therefore, this application provides a network intrusion path detection method. By pre-designing a four-layer intelligent agent architecture consisting of a first intelligent agent layer, a second intelligent agent layer, a third intelligent agent layer, and a fourth intelligent agent layer, and utilizing the first intelligent agent layer in coordination with the other multiple intelligent agent layers to detect the target intrusion path based on network security data, the method can accurately detect network intrusion paths.

[0030] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a network intrusion path detection method provided in the first embodiment of this application. The first embodiment of this application provides a network intrusion path detection method applied to a first agent layer, which is connected to a second agent layer, a third agent layer, and a fourth agent layer; the method includes steps S101-S103: S101. Through the second intelligent agent layer, an attack graph is generated based on network security data; wherein, network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data.

[0031] As an example, a network intrusion path detection system is established by pre-training a large network security model to construct a first agent layer, a second agent layer, a third agent layer, and a fourth agent layer, and then connecting the first agent layer with the second agent layer, the third agent layer, and the fourth agent layer respectively.

[0032] In practical applications, a network intrusion path detection system can be obtained by constructing a four-layer intelligent agent architecture consisting of a first intelligent agent layer, a second intelligent agent layer, a third intelligent agent layer, and a fourth intelligent agent layer using a large network security domain model obtained through training the pipeline.

[0033] In a network intrusion path detection system, the first agent layer is the core of the entire system, mainly playing a unified and coordinating role, responsible for interconnection and communication between multiple agent layers, task scheduling, resource allocation, conflict resolution, and result aggregation.

[0034] The first intelligent agent layer triggers the second intelligent agent layer to perform the following operations: collect network security data in real time from one or more data sources, including one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data, and generate an attack graph based on the currently collected network security data.

[0035] It should be noted that attack graphs are used to describe the relationships between various entities that have been attacked in network security data.

[0036] S102. Through the third intelligent agent layer, based on the attack graph, determine one or more candidate intrusion paths, as well as risk description information for one or more candidate intrusion paths.

[0037] As an example, after the first agent layer generates the attack graph in the second agent layer, it triggers the third agent layer to perform the following operations: based on the attack graph, determine one or more candidate intrusion paths, and for each of the one or more candidate intrusion paths, determine the risk description information of the candidate intrusion path, thereby obtaining the risk description information of one or more candidate intrusion paths.

[0038] It should be noted that the risk description information of the candidate intrusion path is used to describe the basis for risk assessment of the candidate intrusion path, such as one or more of the following: threat intensity, attack mode, probability of attack success, urgency of attack time, value of physical assets, and business loss.

[0039] S103. Through the fourth intelligent agent layer, the target intrusion path is selected from one or more candidate intrusion paths based on the risk description information of one or more candidate intrusion paths.

[0040] As an example, after the first agent layer obtains one or more candidate intrusion paths and their risk description information from the third agent layer, it triggers the fourth agent layer to perform the following operations: for each candidate intrusion path among the one or more candidate intrusion paths, it determines whether the candidate intrusion path is a target intrusion path based on the risk description information of the candidate intrusion path, thereby filtering the target intrusion path from the one or more candidate intrusion paths.

[0041] It is understandable that there may be only one or multiple intrusion paths to the target.

[0042] This application embodiment uses a four-layer intelligent agent architecture—a first intelligent agent layer, a second intelligent agent layer, a third intelligent agent layer, and a fourth intelligent agent layer—designed in advance. By utilizing the first intelligent agent layer in collaboration with the other multiple intelligent agent layers, it can accurately detect network intrusion paths based on network security data.

[0043] In an optional embodiment, the second intelligent agent layer includes an entity recognition intelligent agent, an anomaly detection intelligent agent, and a graph generation intelligent agent. The step of generating an attack graph based on network security data using the second intelligent agent layer includes: extracting network behavior features of one or more entities from the network security data using the entity recognition intelligent agent; wherein the network behavior features include operational features characterizing the operational attributes of network behavior and temporal features characterizing the temporal attributes of network behavior; determining, for each of the one or more entities, whether the entity's network behavior deviates from a pre-established network behavior baseline based on the entity's network behavior features using the anomaly detection intelligent agent; and generating an attack graph using the graph generation intelligent agent, with the target entity as a node, adding connecting edges to the node containing the target entity based on the association relationships between one or more entities; wherein the target entity's network behavior deviates from the network behavior baseline.

[0044] As an example, the pre-designed second agent layer includes an entity recognition agent, an anomaly detection agent, and a graph generation agent.

[0045] After being triggered by the first intelligent agent layer, the second intelligent agent layer extracts network behavior features of one or more entities from network security data. The network behavior features include operational features used to characterize the operational attributes of network behavior, and temporal features used to characterize the temporal attributes of network behavior.

[0046] In practical applications, entity recognition agents can preprocess network security data before extracting network behavior features of one or more entities from network security data. This preprocessing includes data cleaning and data normalization.

[0047] For example, the entity recognition intelligent agent first cleans and normalizes the network security data to obtain preprocessed network security data. Then, it extracts multiple entities such as IP addresses, domain names, user accounts, and process information from the preprocessed network security data. Finally, for each of the multiple entities, it uses a large model to enhance the semantic understanding of the entity, extracts the network behavior features of the entity, and converts the network behavior features of the entity into vector representations.

[0048] An anomaly detection agent, for each of one or more entities, determines whether the entity's network behavior deviates from a pre-established network behavior baseline based on the entity's network behavior characteristics.

[0049] It should be noted that the network behavior baseline serves as a benchmark for distinguishing between normal and abnormal network behavior. It is typically established and dynamically optimized based on historical normal network behavior data. For example, normal network behavior data from the past month is first collected. This data is then broken down into operational characteristics (such as IP connection frequency, process launch count, and user login duration) and time-series characteristics (such as daily backup traffic at fixed times and weekly business traffic growth). The mean and standard deviation of the operational characteristics and the mean and standard deviation of the time-series characteristics within this normal network behavior data are then calculated to characterize the network behavior baseline.

[0050] In practical applications, an anomaly detection agent can choose from a variety of anomaly detection algorithms, including but not limited to statistical anomaly detection algorithms, isolated forest algorithms, ARIMA time series analysis algorithms, and autoencoder reconstruction error detection algorithms. Each anomaly detection algorithm is used to determine the anomaly score of the entity based on its network behavior characteristics. Based on the multiple anomaly scores of the entity, a comprehensive anomaly score is calculated. If the comprehensive anomaly score of the entity is greater than the anomaly score threshold, it is determined that the network behavior of the entity deviates from the network behavior baseline; otherwise, it is determined that the network behavior of the entity does not deviate from the network behavior baseline.

[0051] After the anomaly detection agent completes anomaly detection on one or more entities, the graph generation agent can identify the entities whose network behavior deviates from the network behavior baseline, i.e., the target entities. Using the target entities as nodes, the agent adds connecting edges to the nodes where the target entities are located based on the relationships between the polyline entities, thus generating an attack graph.

[0052] In practical applications, graph generation agents can initialize the node set of an attack graph, add target entities as nodes to the node set, add connecting edges to the target entities based on the relationships between the entities, calculate the similarity between the two entities connected by the connecting edge as the weight of the connecting edge, and apply time decay to adjust the weight.

[0053] This application embodiment pre-sets a second agent layer including an entity recognition agent, an anomaly detection agent, and a graph generation agent. The entity recognition agent extracts network behavior features of one or more entities from network security data. The anomaly detection agent determines whether the network behavior of each entity deviates from the network behavior baseline based on the network behavior features. The graph generation agent uses the target entities whose network behavior deviates from the network behavior baseline as nodes and adds connecting edges to the nodes where the target entities are located based on the association relationships between one or more entities to generate an attack graph. This can coordinate multiple sub-agents within the second agent layer to accurately identify the inherent relationships between various target entities under attack in network security data, ensuring the accuracy and reliability of the attack graph.

[0054] In an optional embodiment, the third intelligent agent layer includes a path search agent, a risk assessment agent, and a path prediction agent. The step of determining one or more candidate intrusion paths and their risk description information based on the attack graph includes: using the path search agent to perform path search on the attack graph to obtain one or more candidate intrusion paths; using the risk assessment agent to evaluate the comprehensive risk score of each candidate intrusion path; wherein the comprehensive risk score is related to one or more factors among threat intensity, attack pattern, attack success probability, attack time urgency, entity asset value, and business loss; using the path prediction agent to predict the subsequent evolution information of the candidate intrusion paths; wherein the subsequent evolution information includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path; and determining the risk description information of the candidate intrusion paths includes the comprehensive risk score and subsequent evolution information of the candidate intrusion paths.

[0055] As an example, the pre-designed third agent layer includes a path search agent, a risk assessment agent, and a path prediction agent.

[0056] After being triggered by the first agent layer, the third agent layer performs path search on the attack graph and obtains one or more candidate intrusion paths.

[0057] In practical applications, the path search agent performs three analysis tasks in parallel during path search: 1. Parallel branch A, the pattern matching agent, loads known attack patterns from the attack pattern library, generates an observation graph based on the abnormal entities affected by the path in the attack graph, calculates the similarity between the observation graph and the attack graph of the known attack patterns, performs subgraph isomorphism detection, maps it to the MITRE ATT&CK framework, and identifies the attack patterns of the path; 2. Parallel branch B, the impact surface assessment agent, initializes the impact propagation queue, adds infected nodes that have already been infected in the attack graph to the impact propagation queue, traverses the path in breadth-first order, calculates the infection probability of each node, quantifies business losses, and generates an impact propagation heatmap; 3. Parallel branch C, the risk assessment agent, calculates the threat intensity of the path, assesses the entity asset value of each node, calculates the probability of attack success, calculates the urgency of the attack time, and, combined with previous attack patterns and business losses, assesses the comprehensive risk score of the path, specifically by weighted fusion of scores from various dimensions.

[0058] Understandably, the third agent layer may also include pattern matching agents and impact surface evaluation agents.

[0059] Previously, the risk assessment agent had assessed the overall risk score of each candidate intrusion path from one or more candidate intrusion paths based on one or more factors, including threat intensity, attack pattern, probability of attack success, urgency of attack time, value of physical assets, and business loss.

[0060] The path prediction agent predicts the later evolution information of the candidate intrusion path, wherein the later evolution information includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path.

[0061] In practical applications, path prediction agents can use algorithms based on a fusion of deep reinforcement learning and causal reasoning to perform path prediction. The specific process is as follows: 1. The attack path prediction is modeled as a partially observable Markov decision process (POMDP). The state space includes the complete topology of the current attack graph, the set of nodes compromised by the attacker and their degree of control, the real-time defense status of each node, network traffic statistics and anomaly indicators, the long short-term memory representation of historical attack sequences, and the dynamic updates of external threat intelligence. 2. Define the fine-grained action space that attackers may take, not limited to: lateral movement (including multiple protocols such as SMB, SSH, RDP, WMI, etc.), privilege escalation (including kernel vulnerability exploitation, credential theft, token spoofing, etc.), persistence (including registry modification, service creation, scheduled tasks, etc.), defense evasion (including process injection, log clearing, timestamp tampering, etc.), data outflow (including DNS tunneling, HTTPS encrypted channels, etc.), and lateral propagation (including worm-like spread, targeted phishing, etc.). 3. Policy learning is performed using algorithms not limited to Proximal Policy Optimization (PPO) and Direct Preference Optimization (DPO). Double Q networks and target networks are used to alleviate the overestimation problem. Entropy regularization is introduced, and then Prioritized Experience Replay is used to improve learning efficiency. 4. Introduce causal graphs to model the causal relationships between attack behaviors, use counterfactual reasoning to evaluate the effectiveness of different strategies, and identify key attack nodes and causal paths through do-calculus; 5. Monte Carlo Tree Search (MCTS) is used to search and predict possible future attack sequences through four stages: selection, expansion, simulation, and backtracking. Then, machine learning algorithms, including but not limited to linear models and ensemble learning, are used to predict uncertainties and provide confidence intervals and credibility scores for each predicted path. 6. Employ Model-Agnostic Meta-Learning (MAML) or Prototypical Networks to achieve few-shot learning capabilities, enabling agents to quickly adapt based on a small number of novel attack samples.

[0062] Finally, the path prediction agent outputs the attack evolution tree for the next N steps, including: the K subsequent intrusion paths with the highest probability of occurrence (including probability distribution and confidence interval), the key decision points and branch probabilities of each path, the attack timeline prediction (including expected arrival time and attack window), the attack success probability and expected loss of each node, the causal explanation chain, uncertainty assessment and credibility score, and other later evolution information.

[0063] By utilizing path prediction agents to predict the later evolution information of a candidate intrusion path, the future evolution trend of the attack can be taken into account, and network intrusion paths can be detected more accurately.

[0064] At this point, the risk description information for the candidate intrusion path is determined, including the comprehensive risk score of the candidate intrusion path and its subsequent evolution information.

[0065] This application embodiment pre-designs a third agent layer comprising a path search agent, a risk assessment agent, and a path prediction agent. The path search agent searches for one or more candidate intrusion paths on the attack graph. The risk assessment agent evaluates the comprehensive risk score of each candidate intrusion path. The path prediction agent predicts the later evolution information of the candidate intrusion paths. The risk description information of the candidate intrusion paths is determined, including the comprehensive risk score and later evolution information of the candidate intrusion paths. This approach can comprehensively describe the risk assessment basis of candidate intrusion paths by considering their current risk level and future evolution trend, thereby more accurately detecting network intrusion paths.

[0066] In an optional embodiment, the step of performing path search on the attack graph to obtain one or more candidate intrusion paths includes: converting the attack graph into a deep feature map; performing path search on the deep feature map based on a predefined path search strategy to obtain multiple preliminary intrusion paths; wherein the path search strategy includes one or more of the following: shortest threat path search strategy, maximum impact path search strategy, most covert path search strategy, and fastest propagation path search strategy; determining the comprehensive risk score of each preliminary intrusion path among the multiple preliminary intrusion paths; and determining a preset number of preliminary intrusion paths with the highest comprehensive risk scores as one or more candidate intrusion paths.

[0067] As an example, the path-searching agent can use a multi-strategy collaborative search algorithm based on graph neural network enhancement for path search, in which the attack graph is first transformed into a deep feature graph.

[0068] In practical applications, path search agents can use graph attention networks (GAT) or graph convolutional networks (GCN) to perform deep representation learning on attack graphs. The embedding vector of each node aggregates the structural and semantic information of k-hop neighbors, and a contrastive learning mechanism is used to enhance the node discriminability in order to transform the attack graph into a deep feature map.

[0069] The path-searching agent employs a reinforcement learning-driven multi-hop reasoning mechanism to learn to explore paths in 1-N hops on a deep feature map. The decision for each hop is based on the joint representation of the current state, historical paths, and the node where the target entity is located. The exploration strategy is optimized using a policy gradient method.

[0070] The path search agent introduces a multi-head self-attention mechanism to dynamically calculate the association strength between nodes. The attention weight is determined based on three dimensions: node feature similarity, temporal proximity, and threat propagation probability. Specifically, the attention weight can be obtained by weighted fusion.

[0071] The path search agent trains a path generator and a path discriminator using a generative adversarial network (GAN). The generator learns to construct paths that bypass traditional detection methods, while the discriminator learns to identify real attack path patterns.

[0072] The path search agent uses a context-based dynamic weight adjustment mechanism. The weight calculation integrates multi-dimensional factors such as real-time threat intelligence, attacker behavior patterns, dynamic asset value, and network topology changes, and uses meta-learning to adapt to new attack patterns.

[0073] The path search agent executes multiple search strategies in parallel, such as the shortest threat path search strategy, the maximum impact path search strategy, the most covert path search strategy, and the fastest propagation path search strategy. The results of multiple strategies are fused using Bayesian model averaging (BMA) or Stacking ensemble methods.

[0074] As shown above, the path search agent performs path search on the deep feature map based on a predefined path search strategy, and obtains multiple preliminary intrusion paths.

[0075] The path search agent uses a path ranking model based on reinforcement learning to accurately rank multiple initial intrusion paths. The ranking model is optimized by a combination of three loss functions: Pointwise, Pairwise, and Listwise. It selects a preset number of paths with the highest comprehensive risk scores, such as K initial intrusion paths, as candidate intrusion paths.

[0076] This application embodiment utilizes a path search agent within the second agent layer to transform the attack graph into a deep feature map. Based on a predefined path search strategy, path search is performed on the deep feature map to obtain multiple preliminary intrusion paths. A preset number of preliminary intrusion paths with the highest comprehensive risk scores are determined as one or more candidate intrusion paths. This approach takes into account system processing performance and prioritizes searching for several candidate intrusion paths with the highest comprehensive risk scores, which is beneficial for further improving the accuracy of network intrusion path detection.

[0077] In an optional embodiment, the fourth agent layer includes a decision execution agent; the step of selecting a target intrusion path from one or more candidate intrusion paths based on the risk description information of one or more candidate intrusion paths includes: through the decision execution agent, performing the following operations: for each of the one or more candidate intrusion paths, determining the overall expected loss of the candidate intrusion path based on the later evolution information of the candidate intrusion path; if the comprehensive risk score of the candidate intrusion path is greater than the risk score threshold and the overall expected loss of the candidate intrusion path is greater than the expected loss threshold, then the candidate intrusion path is determined to be a target intrusion path; otherwise, the candidate intrusion path is determined not to be a target intrusion path; wherein, the risk description information of the candidate intrusion path includes the comprehensive risk score and later evolution information of the candidate intrusion path.

[0078] As an example, the pre-designed fourth agent layer includes decision-making agents.

[0079] After being triggered by the first agent layer, the fourth agent layer makes a decision-making agent for each of the one or more candidate intrusion paths. The risk description information of the candidate intrusion path includes the comprehensive risk score and the later evolution information of the candidate intrusion path. Based on the later evolution information of the candidate intrusion path, the overall expected loss of the candidate intrusion path is determined.

[0080] The overall risk score of the candidate intrusion path is compared with a pre-set risk score threshold, and the overall expected loss of the candidate intrusion path is compared with a pre-set expected loss threshold. If the overall risk score of the candidate intrusion path is greater than the risk score threshold and the overall expected loss of the candidate intrusion path is greater than the expected loss threshold, then the candidate intrusion path is considered to have a high risk and is very likely to cause a high loss. In this case, the candidate intrusion path is determined to be the target intrusion path that should be focused on. Otherwise, the candidate intrusion path is determined not to be the target intrusion path.

[0081] This application embodiment pre-designs a fourth agent layer including a decision-making execution agent. The decision-making execution agent, for each of one or more candidate intrusion paths, determines the overall expected loss of the candidate intrusion path based on its later evolution information. If the comprehensive risk score of the candidate intrusion path is greater than a risk score threshold and the overall expected loss of the candidate intrusion path is greater than an expected loss threshold, then the candidate intrusion path is determined to be the target intrusion path; otherwise, it is determined not to be the target intrusion path. This allows the decision-making execution agent to fuse the comprehensive risk score and later evolution information of the candidate intrusion path for decision-making, accurately determining the target intrusion path.

[0082] In an optional embodiment, the late-stage evolution information of the candidate intrusion path includes each subsequent intrusion path of the candidate intrusion path and the occurrence probability of each subsequent intrusion path; determining the overall expected loss of the candidate intrusion path based on the late-stage evolution information of the candidate intrusion path includes: calculating the overall expected loss of the candidate intrusion path based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path; wherein, the expected loss of the path is determined based on the occurrence probability of the path, the attack loss along the path, and the success probability of defense against the path.

[0083] As an example, the decision-making execution agent, for each of one or more candidate intrusion paths, whose risk description information includes a comprehensive risk score and post-evolution information, including subsequent intrusion paths and their occurrence probabilities, determines the attack loss along the candidate intrusion path. Based on historical response results and current defense resources, it dynamically assesses the probability of successful defense against the candidate intrusion path. Based on the occurrence probability, attack loss, and successful defense probability of the candidate intrusion path, it determines the expected loss of the candidate intrusion path. Simultaneously, for each subsequent intrusion path, the agent determines the attack loss along that subsequent intrusion path, dynamically assesses the probability of successful defense against that subsequent intrusion path based on historical response results and current defense resources, and determines the expected loss of that subsequent intrusion path based on its occurrence probability, attack loss, and successful defense probability. Thus, the expected loss for each subsequent intrusion path is obtained.

[0084] In practical applications, the expected loss of a path can be calculated using the following formula: Expected loss of a candidate intrusion path = attack loss along the candidate intrusion path × probability of occurrence of the candidate intrusion path × (1 - probability of successful defense against the candidate intrusion path), and expected loss of a subsequent intrusion path = attack loss along the subsequent intrusion path × probability of occurrence of the subsequent intrusion path × (1 - probability of successful defense against the subsequent intrusion path).

[0085] Based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path, the overall expected loss of the candidate intrusion path is calculated.

[0086] In practical applications, the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path can be summed to obtain the overall expected loss of the candidate intrusion path.

[0087] This application embodiment utilizes the decision execution agent in the fourth agent layer to determine the expected loss of a path based on the later evolution information of the candidate intrusion path, according to the probability of the path's occurrence, the attack loss along the path, and the probability of successful defense against the path. This yields the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path. Furthermore, based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path, the overall expected loss of the candidate intrusion path is statistically calculated. This allows the decision execution agent to accurately determine the overall expected loss of the candidate intrusion path based on comprehensive later evolution information of the candidate intrusion path.

[0088] In an optional embodiment, the method further includes step S104: S104. Trigger the defense response corresponding to the target intrusion path through the fourth intelligent agent layer.

[0089] As an example, after the fourth agent layer filters out the target intrusion path, it selects a defense response for the target intrusion path and triggers the defense response to effectively defend against the attack.

[0090] In practical applications, the decision-making agent in the fourth agent layer can select the defense response that minimizes the overall expected loss of the target intrusion path.

[0091] This application embodiment utilizes a fourth intelligent agent layer to trigger a defense response corresponding to the target intrusion path after filtering out the target intrusion path, which can ensure timely defense against attacks and improve network security.

[0092] In an optional embodiment, the second intelligent agent layer includes a monitoring intelligent agent, and the fourth intelligent agent layer includes a learning intelligent agent; the method further includes steps S105-S106: S105. Monitor the operational data of the target intelligent agent layer by monitoring the intelligent agent; S106. By learning the intelligent agent, optimize the target intelligent agent layer based on the operational data; The target agent layer includes one or more of the first agent layer, the second agent layer, the third agent layer, and the fourth agent layer.

[0093] As an example, a monitoring agent is added to the second agent layer, and a learning agent is added to the fourth agent layer.

[0094] After being triggered by the first agent layer, the second agent layer monitors the operational data of one or more target agents in the first, second, third, and fourth agent layers periodically.

[0095] In practical applications, when a monitoring agent monitors the entire system, that is, when the target agent includes the first, second, third, and fourth agent layers, the operational data of the target agent includes system operating status, detection results, response effects, false alarm feedback, and other data.

[0096] After being triggered by the first intelligent agent layer, the learning intelligent agent layer periodically obtains the operational data fed back by the monitoring intelligent agent and optimizes the target intelligent agent layer based on the operational data.

[0097] In practical applications, learning agents can label true positives and false positives on running data, update the network intrusion path detection system with new data increments, add new attack patterns to the knowledge base, update entity relationship weights, and optimize detection threshold parameters, etc.

[0098] The learning agent can autonomously decide whether to update or iterate the agent model or the entire operation process based on the data, forming a closed-loop learning mechanism. The updated agent model will be fed back to the anomaly detection agent to continuously optimize the detection capability.

[0099] For example, adaptive policy optimization of a learning agent includes: 1. The path prediction agent adopts an online reinforcement learning mechanism. It updates the policy network immediately after each real attack is detected and uses importance sampling to correct the offline data distribution bias. 2. When a new attack pattern is detected, transfer learning is used to transfer knowledge from similar attack scenarios to the new scenario, and Domain Adaptation technology is adopted to reduce the data requirements of the target domain. 3. Agents with multiple deployment nodes share model parameters through federated learning instead of sharing raw data, and use differential privacy mechanisms to protect data security.

[0100] The network intrusion path detection system periodically uses attack scenarios generated by the path prediction agent to perform automated attack simulations in a sandbox environment, verifying the accuracy of predictions and the effectiveness of defense strategies. The simulation results are fed back to the learning agent for model iteration.

[0101] This application embodiment adds a monitoring agent to the second agent layer and a learning agent to the fourth agent layer. The monitoring agent monitors the operation data of one or more target agent layers in the first, second, third, and fourth agent layers. The learning agent optimizes the target agent layers based on the operation data, which can optimize the target agent layers in the entire system in a timely manner and ensure more accurate detection of network intrusion paths in the future.

[0102] In practical applications, the fourth intelligent agent layer can also include a visualization intelligent agent. The visualization intelligent agent is used to generate a visualization map of attack paths, display entity relationships and attack chains, and output risk scoring reports, attacker attribution reports and predicted trends, etc., for easy viewing by users.

[0103] To more clearly illustrate the network intrusion path detection method provided in the first embodiment of this application, based on... Figure 2 The network intrusion path detection system shown provides an application example: 1. The environment setup is as follows: a security detection system with a graphics processing unit (GPU), vector database, graph database, time-series database, distributed message queue, and multi-agent collaborative platform; 2. A suspicious lateral movement attack occurred in the user's network environment; 3. Apply the aforementioned network intrusion path detection method: The entity recognition intelligent agent continuously collects multi-source network security data such as network traffic data, system log data, and terminal behavior data, and detects that the source IP 192.168.1.100 initiated SMB connection attempts to multiple internal network hosts; The entity recognition agent extracts key entities: source IP 192.168.1.100, target IP list (192.168.1.105-110), user account administrator, process name psexec.exe, etc., and performs semantic enhancement and feature vectorization. The anomaly detection agent calculated that the IP's connection behavior significantly deviated from the normal network behavior baseline (the connection frequency was 10 times that of the baseline). The Isolation Forest algorithm gave an anomaly score of 0.95, and the autoencoder reconstruction error exceeded the threshold by 3 times. Based on the combined results, it was determined to be abnormal network behavior. The graph-generating agent generates an attack graph based on abnormal entities: using 192.168.1.100 as the source node, it establishes connections to multiple target hosts, calculates edge weights based on temporal relationships and behavioral similarity, and applies time decay to adjust the weights of recent behaviors to be higher. The path search agent employs a multi-strategy search enhanced by GNN: a 3-layer graph attention network is used to learn node embeddings, and the 128-dimensional vector of each node incorporates information from its 3-hop neighbors; four search strategies are executed in parallel: the shortest threat path searches for 3 candidate paths, the path with the greatest impact identifies the domain controller as a key springboard node, the most covert path identifies lateral movement channels that bypass the IDS, and the fastest propagation path predicts that 12 hosts can be infected within 2 hours; a reinforcement learning ranking model is used to rank 7 initial intrusion paths, and finally outputs the 3 candidate intrusion paths with the highest comprehensive risk scores; the adversarial search module discovers that attackers may use the printer vulnerability (CVE-2021-34527 PrintNightmare) as a covert springboard, and discovers the attack path: 192.168.1.100 → 192.168.1.105 (domain controller) → 192.168.1.108 (file server) → 192.168.1.110 (database server), which has the highest threat strength of 9.2 / 10; While searching the path, the pattern matching agent identified that the attack behavior matched the T1021.002 (Lateral Movement - SMB / Windows Admin Shares) tactic in MITRE ATT&CK, with the attack phase being "Lateral Movement", and the similarity reached 0.89; The risk scoring agent calculates a comprehensive risk score: path threat strength 9.2, asset value weight (domain controller 0.9, database 0.95), attack success probability 0.75, attack time urgency 0.88, and the comprehensive risk score is 8.7 / 10, which exceeds the preset threshold of 7.0. The path prediction agent uses the SAC reinforcement learning algorithm for deep prediction: It uses Transformer to encode 60 minutes of historical attack sequences, capturing the periodic pattern of attackers probing every 15 minutes; MCTS search simulates the evolution of the attack over the next 20 steps, exploring 1247 possible attack sequences; the causal reasoning module identifies "acquiring domain controller privileges" as a key causal node for subsequent attacks, blocking this node can reduce the attack success rate by 85%; it predicts the Top-5 attack paths and their probabilities: Path 1 (probability 0.68): Domain controller privilege escalation → Database access → Data leakage → Trace erasure; Path 2 (probability 0.45): File server hijacking → Phishing email distribution → Lateral diffusion; Path 3 (probability 0.38): Printer vulnerability exploitation → Bypassing isolation → Internal network penetration; Path 4 (probability 0.32): Persistent backdoor → Long-term infiltration → Targeted data theft; Path 5 (probability 0.25): Ransomware deployment → Bulk encryption → Ransom demand; Uncertainty quantification shows that the confidence interval for path 1 is [0.63, [0.73], credibility score 0.91; predicted attack timeline: domain controller privilege escalation is expected to occur within 15 minutes, and data leakage is expected to begin within 1 hour; The decision-making and execution agent comprehensively considers current threats and predicted risks, calculates the total expected loss to be 8.5 million yuan (considering data leakage, business interruption, and reputational damage). Based on the principle of minimizing expected loss, the cost-effectiveness of five response schemes is compared, and the "immediate isolation + emergency patch + honeypot trap" combined strategy is selected. The system replayed the predicted attack path 1 in the isolated sandbox, verifying a prediction accuracy of 92%; it was found that the defense strategy was 98% effective in blocking domain controller privilege escalation, but its coverage of printer vulnerabilities was insufficient; and it automatically triggered the push of emergency patches for printer vulnerabilities and the deployment of honeypots. The learning agent used 874 time-series data points from this attack for online learning, and gradient pruning was used to prevent overfitting when updating the policy network parameters. The meta-learning module quickly adapted to the "lateral movement + privilege escalation" combination pattern based on this attack, converging with only 3 samples. The federated learning mechanism synchronized the printer vulnerability exploitation pattern learned in this attack to the other 5 deployment nodes without sharing the original data. The model accuracy improved from 87.3% before the update to 92.1%, and the false positive rate decreased from 5.2% to 2.8%. The visual agent generates an attack path map, highlighting the attack chain in red, displaying the risk score and asset value of each node, and outputting a detailed source tracing report: "A lateral movement attack was detected from 192.168.1.100, using the psexec tool and administrator credentials. The attack targets were the domain controller and core database. The attack method matches the TTP commonly used by the APT28 group. It is recommended to take immediate isolation and source tracing measures." The monitoring agent continuously tracks the response effect, confirms that the attack has been successfully blocked, updates the effectiveness evaluation data of the defense strategy, and feeds it back to the learning agent for the next round of model optimization.

[0104] Please refer to Figure 3 , Figure 3This is a schematic diagram of a network intrusion path detection system provided in the second embodiment of this application. The second embodiment of this application provides a network intrusion path detection system 20, including a first intelligent agent layer 201, a second intelligent agent layer 202, a third intelligent agent layer 203, and a fourth intelligent agent layer 204. The first intelligent agent layer 201 is connected to the second intelligent agent layer 202, the third intelligent agent layer 203, and the fourth intelligent agent layer 204. The first intelligent agent layer 201 is used to: generate an attack graph based on network security data through the second intelligent agent layer 202; wherein, the network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data; determine one or more candidate intrusion paths and risk description information of one or more candidate intrusion paths based on the attack graph through the third intelligent agent layer 203; and filter target intrusion paths from one or more candidate intrusion paths based on the risk description information of one or more candidate intrusion paths through the fourth intelligent agent layer 204.

[0105] In an optional embodiment, the second intelligent agent layer 202 includes an entity recognition intelligent agent, an anomaly detection intelligent agent, and a graph generation intelligent agent. The step of generating an attack graph based on network security data through the second intelligent agent layer 202 includes: extracting network behavior features of one or more entities from the network security data using the entity recognition intelligent agent; wherein the network behavior features include operational features characterizing the operational attributes of network behavior and temporal features characterizing the temporal attributes of network behavior; determining, for each of the one or more entities, whether the entity's network behavior deviates from a pre-established network behavior baseline based on the entity's network behavior features using the anomaly detection intelligent agent; and generating an attack graph by adding connecting edges to the nodes containing the target entity, using the target entity as a node, based on the association relationships between one or more entities; wherein the target entity's network behavior deviates from the network behavior baseline.

[0106] In an optional embodiment, the third intelligent agent layer 203 includes a path search agent, a risk assessment agent, and a path prediction agent. The step of determining one or more candidate intrusion paths and their risk description information based on the attack graph includes: using the path search agent to perform path search on the attack graph to obtain one or more candidate intrusion paths; using the risk assessment agent to evaluate the comprehensive risk score of each candidate intrusion path; wherein the comprehensive risk score is related to one or more factors among threat intensity, attack pattern, attack success probability, attack time urgency, entity asset value, and business loss; using the path prediction agent to predict the subsequent evolution information of the candidate intrusion paths; wherein the subsequent evolution information includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path; and determining the risk description information of the candidate intrusion paths includes the comprehensive risk score and subsequent evolution information of the candidate intrusion paths.

[0107] In an optional embodiment, the step of performing path search on the attack graph to obtain one or more candidate intrusion paths includes: converting the attack graph into a deep feature map; performing path search on the deep feature map based on a predefined path search strategy to obtain multiple preliminary intrusion paths; wherein the path search strategy includes one or more of the following: shortest threat path search strategy, maximum impact path search strategy, most covert path search strategy, and fastest propagation path search strategy; determining the comprehensive risk score of each preliminary intrusion path among the multiple preliminary intrusion paths; and determining a preset number of preliminary intrusion paths with the highest comprehensive risk scores as one or more candidate intrusion paths.

[0108] In an optional embodiment, the fourth agent layer 204 includes a decision execution agent; the step of selecting a target intrusion path from one or more candidate intrusion paths based on the risk description information of one or more candidate intrusion paths includes: through the decision execution agent, performing the following operations: for each of the one or more candidate intrusion paths, determining the overall expected loss of the candidate intrusion path based on the later evolution information of the candidate intrusion path; if the comprehensive risk score of the candidate intrusion path is greater than the risk score threshold and the overall expected loss of the candidate intrusion path is greater than the expected loss threshold, then the candidate intrusion path is determined to be a target intrusion path; otherwise, the candidate intrusion path is determined not to be a target intrusion path; wherein, the risk description information of the candidate intrusion path includes the comprehensive risk score and the later evolution information of the candidate intrusion path.

[0109] In an optional embodiment, the late-stage evolution information of the candidate intrusion path includes each subsequent intrusion path of the candidate intrusion path and the occurrence probability of each subsequent intrusion path; determining the overall expected loss of the candidate intrusion path based on the late-stage evolution information of the candidate intrusion path includes: calculating the overall expected loss of the candidate intrusion path based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path; wherein, the expected loss of the path is determined based on the occurrence probability of the path, the attack loss along the path, and the success probability of defense against the path.

[0110] In an optional embodiment, the first agent layer 201 is further configured to: trigger a defense response corresponding to the target intrusion path through the fourth agent layer 204.

[0111] In an optional embodiment, the second agent layer 202 includes a monitoring agent, and the fourth agent layer 204 includes a learning agent; the first agent layer 201 is further configured to: monitor the operating data of the target agent layer through the monitoring agent; and optimize the target agent layer based on the operating data through the learning agent; wherein the target agent layer includes one or more of the first agent layer 201, the second agent layer 202, the third agent layer 203, and the fourth agent layer 204.

[0112] The implementation process of the functions and roles of each intelligent agent layer in the above system is detailed in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0113] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in the fourth embodiment of this application. The fourth embodiment of this application provides an electronic device 30, including a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, it implements the method described in the first embodiment of this application and can achieve the same beneficial effects.

[0114] When the processor 301 reads a computer program from the memory 302 via the bus 303 and executes the computer program, it can implement any of the methods described in the first embodiment of this application.

[0115] Processor 301 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 301 may be a microprocessor.

[0116] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 301 of this disclosure embodiment can be used to execute instructions in the memory 302 to implement the method described in the first embodiment of this application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0117] The fifth embodiment of this application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the method described in the first embodiment of this application, and can achieve the same beneficial effects.

[0118] The third embodiment of this application provides a computer program product, which includes instructions that, when executed by a computer, cause the computer to perform the method described in the first embodiment of this application and achieve the same beneficial effects.

[0119] The methods described in the first embodiment of this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, in the form of a computer program product. A computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of this application are performed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0120] Computer programs or instructions can be stored in or transferred from one computer-readable storage medium to another. For example, a computer program or instructions can be transferred from one website, computer, server, or data center to another via wired or wireless means. A computer-readable storage medium can be any usable medium that a computer can access, or a data storage device such as a server or data center that integrates one or more usable media. Usable media can be magnetic media, such as floppy disks, hard disks, and magnetic tapes; optical media, such as digital video discs; or semiconductor media, such as solid-state drives. The computer-readable storage medium can be volatile or non-volatile, or may include both types.

[0121] In summary, this application provides a network intrusion path detection method, system, device, medium, and program product. The network intrusion path detection method is applied to a first intelligent agent layer, which is connected to a second, third, and fourth intelligent agent layer. The method includes: generating an attack graph based on network security data through the second intelligent agent layer; wherein the network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data; determining one or more candidate intrusion paths and risk description information of one or more candidate intrusion paths based on the attack graph through the third intelligent agent layer; and filtering a target intrusion path from one or more candidate intrusion paths based on the risk description information of one or more candidate intrusion paths through the fourth intelligent agent layer. This application, by pre-designing a four-layer intelligent agent architecture of the first, second, third, and fourth intelligent agent layers, utilizes the first intelligent agent layer in collaboration with the other multiple intelligent agent layers to detect target intrusion paths based on network security data, enabling accurate detection of network intrusion paths.

[0122] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0123] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0124] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0125] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting network intrusion paths, characterized in that, The method is applied to a first agent layer, which is connected to a second agent layer, a third agent layer, and a fourth agent layer, respectively; the method includes: Through the second intelligent agent layer, an attack graph is generated based on network security data; wherein, the network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data; Through the third intelligent agent layer, based on the attack graph, one or more candidate intrusion paths are determined, along with risk description information for the one or more candidate intrusion paths. The fourth intelligent agent layer filters the target intrusion path from the one or more candidate intrusion paths based on the risk description information of the one or more candidate intrusion paths.

2. The method according to claim 1, characterized in that, The second intelligent agent layer includes an entity recognition intelligent agent, an anomaly detection intelligent agent, and a graph generation intelligent agent; The step of generating an attack graph based on network security data through the second intelligent agent layer includes: The entity recognition intelligent agent extracts network behavior features of one or more entities from the network security data; wherein, the network behavior features include operational features for characterizing network behavior operational attributes, and temporal features for characterizing network behavior temporal attributes. The anomaly detection agent determines, for each of the one or more entities, whether the entity's network behavior deviates from a pre-established network behavior baseline based on the entity's network behavior characteristics. The attack graph is generated by generating an agent from the graph, using the target entity as a node, and adding connecting edges to the node where the target entity is located based on the association relationship between the one or more entities; wherein the network behavior of the target entity deviates from the network behavior baseline.

3. The method according to claim 1, characterized in that, The third agent layer includes a path search agent, a risk assessment agent, and a path prediction agent; The step of determining one or more candidate intrusion paths based on the attack graph, and the risk description information of the one or more candidate intrusion paths, includes: The path search agent performs path search on the attack graph to obtain one or more candidate intrusion paths. The risk assessment agent evaluates the comprehensive risk score of each of the one or more candidate intrusion paths. The comprehensive risk score is related to one or more factors, including threat intensity, attack pattern, probability of attack success, urgency of attack time, value of physical assets, and business loss. The path prediction agent predicts the later evolution information of the candidate intrusion path; wherein, the later evolution information includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path; The risk description information for determining the candidate intrusion path includes the comprehensive risk score and subsequent evolution information of the candidate intrusion path.

4. The method according to claim 3, characterized in that, The step of performing path search on the attack graph to obtain one or more candidate intrusion paths includes: The attack graph is converted into a depth feature map; Based on a predefined path search strategy, a path search is performed on the deep feature map to obtain multiple preliminary intrusion paths; wherein, the path search strategy includes one or more of the following: shortest threat path search strategy, maximum impact path search strategy, most covert path search strategy, and fastest propagation path search strategy. Determine the comprehensive risk score of each of the multiple preliminary intrusion paths; The preset number of intrusion paths with the highest comprehensive risk scores are determined as one or more candidate intrusion paths.

5. The method according to claim 1, characterized in that, The fourth agent layer includes decision-making and execution agents; The step of filtering a target intrusion path from one or more candidate intrusion paths based on the risk description information of the one or more candidate intrusion paths includes: The decision-making agent performs the following operations: For each of the one or more candidate intrusion paths, the overall expected loss of the candidate intrusion path is determined based on the later evolution information of the candidate intrusion path. If the overall risk score of the candidate intrusion path is greater than the risk score threshold and the overall expected loss of the candidate intrusion path is greater than the expected loss threshold, then the candidate intrusion path is determined to be the target intrusion path. Otherwise, it is determined that the candidate intrusion path is not the target intrusion path; The risk description information of the candidate intrusion path includes the comprehensive risk score and subsequent evolution information of the candidate intrusion path.

6. The method according to claim 5, characterized in that, The later evolution information of the candidate intrusion path includes each subsequent intrusion path of the candidate intrusion path and the probability of occurrence of each subsequent intrusion path; The step of determining the overall expected loss of the candidate intrusion path based on its later evolution information includes: Based on the expected loss of the candidate intrusion path and the expected loss of each subsequent intrusion path, the total expected loss of the candidate intrusion path is calculated; wherein, the expected loss of the path is determined based on the probability of the path occurring, the attack loss along the path, and the probability of successful defense against the path.

7. The method according to claim 1, characterized in that, The method further includes: The fourth agent layer triggers the defense response corresponding to the target intrusion path.

8. The method according to any one of claims 1 to 7, characterized in that, The second agent layer includes a monitoring agent, and the fourth agent layer includes a learning agent; the method further includes: The monitoring agent monitors the operational data of the target agent layer. The target agent layer is optimized based on the operational data through the learning agent. The target agent layer includes one or more of the first agent layer, the second agent layer, the third agent layer, and the fourth agent layer.

9. A network intrusion path detection system, characterized in that, It includes a first agent layer, a second agent layer, a third agent layer, and a fourth agent layer; the first agent layer is connected to the second agent layer, the third agent layer, and the fourth agent layer, respectively. The first intelligent agent layer is used for: Through the second intelligent agent layer, an attack graph is generated based on network security data; wherein, the network security data includes one or more of network traffic data, system log data, terminal behavior data, and external threat intelligence data; Through the third intelligent agent layer, based on the attack graph, one or more candidate intrusion paths are determined, along with risk description information for the one or more candidate intrusion paths. The fourth intelligent agent layer filters the target intrusion path from the one or more candidate intrusion paths based on the risk description information of the one or more candidate intrusion paths.

10. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1 to 8.

Images