Traceability analysis system and method based on knowledge graph deduction

Abstract

The invention discloses a traceability analysis system and method based on knowledge graph deduction. Comprising a log acquisition and preprocessing module, an attack behavior feature extraction module, a defense capability mapping module, a knowledge graph construction module, an event association analysis module, a knowledge reasoning and deduction module, an attack path visualization module and a defense strategy decision support module. According to the invention, by integrating log data, attack behavior characteristics, defense capability information and a knowledge graph technology, comprehensive traceability analysis of network attacks is realized, and the intelligent level of network security protection is improved. Specifically, the multi-source log data can be automatically collected and preprocessed, and the data quality is ensured; the method is based on ATTamp; cK and D3FEND frameworks are adopted, attack behavior characteristics are accurately extracted, defense capability mapping is established, and a solid foundation is provided for subsequent analysis.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a source tracing analysis system and method based on knowledge graph deduction. Background Technology

[0002] With the rapid development of network technology, network attack methods are becoming increasingly complex and diversified, and new attack methods such as advanced persistent threats (APTs) pose a serious threat to network security. Traditional network security attribution analysis methods often rely on manual analysis and simple log correlation, which suffers from low attribution efficiency, poor accuracy, and an inability to intuitively display attack paths. Knowledge graph-based attribution analysis offers a new approach to solving the aforementioned problems. Knowledge graphs can integrate massive amounts of cybersecurity data and construct relationships between entities, providing strong support for attribution analysis. However, existing knowledge graph-based attribution analysis systems and methods still have shortcomings in terms of the completeness of module composition, the detail of module principles, and the refinement of methodological steps, making it difficult to meet the needs of attribution analysis in complex network environments. Summary of the Invention

[0003] The purpose of this invention is to provide a source tracing analysis system and method based on knowledge graph deduction to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a source tracing analysis system based on knowledge graph inference, comprising a log collection and preprocessing module, an attack behavior feature extraction module, a defense capability mapping module, a knowledge graph construction module, an event association analysis module, a knowledge reasoning and inference module, an attack path visualization module, and a defense strategy decision support module; The log collection and preprocessing module is used to collect various log data in the network environment and preprocess them to provide a high-quality data foundation for subsequent analysis. The attack behavior feature extraction module is based on the ATT&CK framework and extracts attack behavior features from preprocessed log data. The defense capability mapping module, in conjunction with the D3FEND framework, establishes a mapping relationship between defense capabilities and attack behaviors; The knowledge graph construction module integrates the output results of the attack behavior feature extraction module and the defense capability mapping module to construct a full-scenario network security situation awareness knowledge graph. The event correlation analysis module, based on the constructed knowledge graph, performs correlation analysis on security events in the network, explores potential connections between events, and identifies attack chains. The knowledge reasoning and deduction module utilizes knowledge reasoning technology, based on knowledge graphs and event correlation analysis results, to deduce the entire attack process and achieve attack tracing; it adopts a combination of rule-based reasoning and machine learning-based reasoning. The attack path visualization module presents the attack paths derived from knowledge reasoning to users in an intuitive and clear way, making it easier for users to understand the attack process and situation; a force-directed layout algorithm is used to lay out and arrange the attack paths. The defense strategy decision support module provides users with targeted defense strategy suggestions based on attack tracing results and defense capability information in the knowledge graph. First, it analyzes the attack techniques and vulnerabilities involved in the attack path, and then queries the mapping relationship in the defense capability mapping module to obtain the corresponding defense measures.

[0005] Preferably, the log collection and preprocessing module collects logs including but not limited to server logs, network device logs (such as routers and switches), terminal device logs, application logs, and security device logs (such as firewalls and intrusion detection systems); it adopts a distributed collection architecture, deploying a dedicated log collection agent program on each device to achieve real-time collection of log data; at the same time, it supports multiple log formats, such as Syslog, Windows Event Log, JSON format logs, etc. The preprocessing process includes log cleaning, log standardization, and log anonymization. Log cleaning removes invalid data (such as malformed logs and duplicate logs) using a threshold-based outlier removal algorithm. The mean of the log data is set to... The standard deviation is When a certain log data satisfy When an outlier occurs, it is identified as an anomaly and removed; log standardization converts logs of different formats into a unified structured format and defines unified fields, such as timestamp, event type, source IP address, destination IP address, event description, etc.; log desensitization processes sensitive information in logs (such as user accounts, passwords, ID card numbers, etc.) by using replacement and encryption methods to ensure data security.

[0006] Preferably, the attack behavior feature extraction module first constructs an attack behavior feature library. This feature library is based on attack techniques in the ATT&CK framework and stores feature indicators corresponding to each attack technique, such as specific port access, abnormal process creation, and specific command execution. Then, it analyzes the log data line by line, matching the events in the logs with the feature indicators in the feature library. For successfully matched events, it extracts the corresponding attack stage, attack technique, attack source, and attack target feature information, and represents it in the form of a feature vector, denoted as . ,in Indicates the first The values ​​of each characteristic indicator.

[0007] Preferably, the defense capability mapping module first constructs a defense capability library, storing information on defense technologies, defense measures, and defense equipment within the D3FEND framework; then, it establishes a mapping relationship between attack technologies and defense measures through semantic similarity calculation; the semantic similarity calculation employs a cosine similarity algorithm for attack technology feature vectors. and defensive measure feature vector Their similarity The calculation formula is:

[0008] in, and They are vectors and The One component; when If the attack exceeds the set threshold, it is considered that there is a mapping relationship between the attack technique and the defense measures, and this mapping relationship is stored in the mapping relationship library.

[0009] Preferably, the knowledge graph in the knowledge graph construction module includes two parts: entities and relationships. Entities include attack entities (such as attack techniques, attack sources, attack targets, etc.), defense entities (such as defense measures, defense equipment, etc.), and log entities (such as log events, devices, etc.). Relationships include the progressive relationship between attacks, the adversarial relationship between attacks and defenses, and the association relationship between logs and attacks. First, define the ontology model of the knowledge graph, determining the types of entities, their attributes, and the types of relationships between them. Then, extract attack entities and their attributes from attack behavior characteristic information, defense entities and their attributes from defense capability mapping relationships, and log entities and their attributes from log data. Next, establish connections between entities based on their relationships; for example, associate attack sources with attack techniques, attack techniques with corresponding defense measures, and log events with attack techniques. Finally, use a graph database to store the constructed knowledge graph for subsequent querying, analysis, and reasoning.

[0010] Preferably, the event association analysis module uses the Apriori algorithm to mine association rules between events; Let the event set be Transaction set Each transaction yes A subset; association rules are of the form of The implication, in which ,and Support This refers to a transaction set that simultaneously contains and The proportion of transactions to the total number of transactions, i.e.:

[0011] Confidence This refers to the fact that a transaction set contains The transaction contains The ratio, that is:

[0012] By setting minimum support and minimum confidence thresholds, strong association rules that meet the conditions are selected. These rules reflect the close connection between events. Based on these association rules, scattered security events are linked together to form a preliminary outline of the attack chain.

[0013] Preferably, the rule-based reasoning in the knowledge reasoning and deduction module involves: constructing a reasoning rule base, with rules formulated based on the progressive relationship of attack stages in the ATT&CK framework and known attack patterns; for example, if a "malicious code delivery" event is detected, and a "malicious code execution" event is subsequently detected, it can be inferred that there are attack steps from "malicious code delivery" to "malicious code execution". Machine learning-based reasoning: The graph neural network (GNN) model is used to analyze the knowledge graph and predict attack paths and potential attack targets. The GNN model learns the features of nodes and edges in the knowledge graph to capture the dependencies between entities, thereby enabling reasoning.

[0014] Preferably, the force-directed layout algorithm in the attack path visualization module simulates the attraction and repulsion forces in a physical system, resulting in a uniform distribution of nodes in the graph, moderate edge lengths, and an overall aesthetically pleasing and easy-to-understand layout. Through a graphical interface, the attack source, attack target, attack technique, and attack steps are displayed in the form of nodes and edges. Different types of nodes and edges are distinguished by different colors and shapes. The system can also display the time of the attack and related log information. Users can gain a deeper understanding of the attack path through interactive operations (such as zooming, panning, and clicking on nodes to view details).

[0015] Preferably, the defense strategy decision support module evaluates and ranks defense measures based on the actual network environment (such as network topology, device configuration, and service requirements). Evaluation indicators include defense effectiveness, implementation cost, and impact on services. The module uses the Analytic Hierarchy Process (AHP) to comprehensively score the defense measures and recommends the optimal defense strategy to the user based on the score results, such as deploying specific security devices, updating security policies, and patching system vulnerabilities. At the same time, this module can also simulate the effect of the defense strategy after its implementation and predict the probability of attacks being blocked, providing a reference for user decision-making.

[0016] An analytical method for a knowledge graph-based source tracing analysis system includes the following steps: Step 1: Log Collection and Preprocessing: Log data is collected from multiple sources such as servers, network devices, terminal devices, applications, and security devices through a log collection agent. The collected log data is preprocessed by first removing outliers using a threshold-based outlier removal algorithm, then converting logs of different formats into a unified structured format, and finally de-identifying sensitive information to obtain preprocessed log data. Step 2, Attack Behavior Feature Extraction: An attack behavior feature library is constructed based on the ATT&CK framework. The feature library contains feature indicators corresponding to various attack techniques. The preprocessed log data is analyzed line by line. The events in the logs are matched with the feature indicators in the feature library for pattern matching and semantic analysis to extract the feature information of attack stage, attack technique, attack source, and attack target, and represent it in the form of feature vectors. Step 3, Defense Capability Mapping: Construct a defense capability library using the D3FEND framework to store information on defense technologies, defense measures, and defense equipment; use the cosine similarity algorithm to calculate the semantic similarity between the feature vectors of attack technologies and the feature vectors of defense measures, establish a mapping relationship between attack technologies and defense measures, and store the mapping relationship in the mapping relationship library; Step 4: Knowledge Graph Construction: Define the ontology model of the knowledge graph, determine the entity types, attributes, and relationship types; extract attack entities and their attributes from attack behavior feature information, extract defense entities and their attributes from defense capability mapping relationships, and extract log entities and their attributes from log data; establish connections between entities based on the relationships between entities, and store the constructed knowledge graph using a graph database. Step 5: Event Correlation Analysis: The Apriori algorithm is used to perform correlation analysis on security events in the network; minimum support threshold and minimum confidence threshold are set, the support and confidence between events are calculated, strong correlation rules are screened out, and scattered security events are linked together according to the correlation rules to identify the preliminary outline of the attack chain. Step 6, Knowledge Reasoning and Deduction: Combining rule-based reasoning and machine learning-based reasoning methods, reasoning and deduction are performed based on the knowledge graph and event association analysis results; the knowledge graph is analyzed using rules in the reasoning rule base and graph neural network models to deduce the entire attack process and determine the attack source, attack path, and attack target information; Step 7, Attack Path Visualization: The attack path obtained by knowledge reasoning is laid out using a force-directed layout algorithm. The attack path is displayed to the user in the form of nodes and edges through a graphical interface. Nodes represent the attack source, attack target, and attack technology, and edges represent the relationship between them. At the same time, relevant detailed information is displayed. Step 8: Defense Strategy Decision Support: Analyze the attack techniques and vulnerabilities involved in the attack path, query the mapping database to obtain corresponding defense measures; combine the actual network environment, use the hierarchical analysis method to evaluate and rank the defense measures, recommend the optimal defense strategy to the user, and simulate the effect after the implementation of the defense strategy.

[0017] Compared with the prior art, the beneficial effects of the present invention are: This invention integrates log data, attack behavior characteristics, defense capability information, and knowledge graph technology to achieve comprehensive source tracing and analysis of network attacks, thereby improving the intelligence level of network security protection. Specifically, this invention can automatically collect and preprocess multi-source log data to ensure data quality; based on the ATT&CK and D3FEND frameworks, it accurately extracts attack behavior characteristics and establishes defense capability mappings, providing a solid foundation for subsequent analysis; by constructing a full-scenario network security situational awareness knowledge graph, it achieves correlation analysis and potential connection mining of security events in the network; by using knowledge reasoning technology to deduce the attack process, it achieves accuracy and efficiency in attack source tracing; the visualization of attack paths allows users to intuitively understand the attack process and situation, facilitating rapid response; and the defense strategy decision support module provides users with targeted defense strategy suggestions, effectively improving the pertinence and effectiveness of network security protection. Attached Figure Description

[0018] Figure 1 This is a system schematic diagram of the present invention; Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation

[0019] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0020] Please see Figure 1-2 This invention provides a source tracing and analysis system based on knowledge graph inference, including a log collection and preprocessing module, an attack behavior feature extraction module, a defense capability mapping module, a knowledge graph construction module, an event association analysis module, a knowledge reasoning and inference module, an attack path visualization module, and a defense strategy decision support module; The log collection and preprocessing module is used to collect various log data in the network environment and preprocess them to provide a high-quality data foundation for subsequent analysis. The attack behavior feature extraction module is based on the ATT&CK framework and extracts attack behavior features from preprocessed log data. The defense capability mapping module, in conjunction with the D3FEND framework, establishes a mapping relationship between defense capabilities and attack behaviors; The knowledge graph construction module integrates the outputs of the attack behavior feature extraction module and the defense capability mapping module to construct a full-scenario network security situation awareness knowledge graph. The event correlation analysis module, based on the constructed knowledge graph, performs correlation analysis on security events in the network, uncovers potential connections between events, and identifies attack chains. The knowledge reasoning and deduction module utilizes knowledge reasoning technology, based on knowledge graphs and event correlation analysis results, to deduce the entire attack process and achieve attack attribution; it adopts a combination of rule-based reasoning and machine learning-based reasoning. The attack path visualization module presents the attack paths derived from knowledge reasoning to users in an intuitive and clear way, making it easier for users to understand the attack process and situation; a force-directed layout algorithm is used to lay out and arrange the attack paths. The defense strategy decision support module provides users with targeted defense strategy suggestions based on attack attribution results and defense capability information in the knowledge graph. First, it analyzes the attack techniques and vulnerabilities involved in the attack path, and then queries the mapping relationship in the defense capability mapping module to obtain the corresponding defense measures.

[0021] The log collection and preprocessing module collects logs from various sources, including but not limited to server logs, network device logs (such as routers and switches), terminal device logs, application logs, and security device logs (such as firewalls and intrusion detection systems). It adopts a distributed collection architecture, deploying a dedicated log collection agent on various devices to achieve real-time collection of log data. It also supports multiple log formats, such as Syslog, Windows Event Log, and JSON format logs. The preprocessing process includes log cleaning, log standardization, and log anonymization. Log cleaning removes invalid data (such as malformed logs and duplicate logs) using a threshold-based outlier removal algorithm. The mean of the log data is set to... The standard deviation is When a certain log data satisfy When an outlier occurs, it is identified as an anomaly and removed; log standardization converts logs of different formats into a unified structured format and defines unified fields, such as timestamp, event type, source IP address, destination IP address, event description, etc.; log desensitization processes sensitive information in logs (such as user accounts, passwords, ID card numbers, etc.) by using replacement and encryption methods to ensure data security.

[0022] The attack behavior feature extraction module first constructs an attack behavior feature library. This library is based on attack techniques within the ATT&CK framework and stores characteristic indicators corresponding to each attack technique, such as specific port access, abnormal process creation, and specific command execution. Then, it analyzes log data line by line, matching events in the logs with the characteristic indicators in the feature library. For successfully matched events, it extracts the corresponding attack stage, attack technique, attack source, and attack target feature information, representing them as feature vectors, denoted as... ,in Indicates the first The values ​​of each characteristic indicator.

[0023] The defense capability mapping module first constructs a defense capability library to store information on defense technologies, measures, and equipment within the D3FEND framework. Then, it establishes a mapping relationship between attack technologies and defense measures through semantic similarity calculation. The semantic similarity calculation uses a cosine similarity algorithm for attack technology feature vectors. and defensive measure feature vector Their similarity The calculation formula is:

[0024] in, and They are vectors and The One component; when If the attack exceeds the set threshold, it is considered that there is a mapping relationship between the attack technique and the defense measures, and this mapping relationship is stored in the mapping relationship library.

[0025] The knowledge graph construction module consists of two parts: entities and relationships. Entities include attack entities (such as attack techniques, attack sources, attack targets, etc.), defense entities (such as defense measures, defense equipment, etc.), and log entities (such as log events, devices, etc.). Relationships include the progressive relationship between attacks, the adversarial relationship between attacks and defenses, and the association relationship between logs and attacks. First, define the ontology model of the knowledge graph, determining the types of entities, their attributes, and the types of relationships between them. Then, extract attack entities and their attributes from attack behavior characteristic information, defense entities and their attributes from defense capability mapping relationships, and log entities and their attributes from log data. Next, establish connections between entities based on their relationships; for example, associate attack sources with attack techniques, attack techniques with corresponding defense measures, and log events with attack techniques. Finally, use a graph database to store the constructed knowledge graph for subsequent querying, analysis, and reasoning.

[0026] The event correlation analysis module uses the Apriori algorithm to discover correlation rules between events; Let the event set be Transaction set Each transaction yes A subset; association rules are of the form of The implication, in which ,and Support This refers to a transaction set that simultaneously contains and The proportion of transactions to the total number of transactions, i.e.:

[0027] Confidence This refers to the fact that a transaction set contains The transaction contains The ratio, that is:

[0028] By setting minimum support and minimum confidence thresholds, strong association rules that meet the conditions are selected. These rules reflect the close connection between events. Based on these association rules, scattered security events are linked together to form a preliminary outline of the attack chain.

[0029] Rule-based reasoning in the knowledge reasoning and deduction module: Construct a reasoning rule base. The rules are formulated based on the progressive relationship of attack stages in the ATT&CK framework and known attack patterns. For example, if a "malicious code delivery" event is detected and a "malicious code execution" event is subsequently detected, it can be inferred that there are attack steps from "malicious code delivery" to "malicious code execution". Machine learning-based reasoning: The graph neural network (GNN) model is used to analyze the knowledge graph and predict attack paths and potential attack targets. The GNN model learns the features of nodes and edges in the knowledge graph to capture the dependencies between entities, thereby enabling reasoning.

[0030] The force-directed layout algorithm in the attack path visualization module simulates the attraction and repulsion forces in a physical system, resulting in a uniform distribution of nodes and moderate edge lengths in the graph, creating an aesthetically pleasing and easy-to-understand overall layout. Through a graphical interface, attack sources, targets, techniques, and steps are displayed as nodes and edges. Different types of nodes and edges are distinguished by different colors and shapes. The module also displays the time of the attack and related log information. Users can gain a deeper understanding of the attack path through interactive operations (such as zooming, panning, and clicking on nodes to view details).

[0031] The defense strategy decision support module evaluates and ranks defense measures based on the actual network environment (such as network topology, device configuration, and service requirements). Evaluation indicators include defense effectiveness, implementation cost, and impact on services. It uses the Analytic Hierarchy Process (AHP) to comprehensively score defense measures and recommends the optimal defense strategy to the user based on the score results, such as deploying specific security devices, updating security policies, and patching system vulnerabilities. Simultaneously, this module can simulate the effects of implemented defense strategies and predict the probability of attacks being blocked, providing a reference for user decision-making.

[0032] An analytical method for a knowledge graph-based source tracing analysis system includes the following steps: Step 1: Log Collection and Preprocessing: Log data is collected from multiple sources such as servers, network devices, terminal devices, applications, and security devices through a log collection agent. The collected log data is preprocessed by first removing outliers using a threshold-based outlier removal algorithm, then converting logs of different formats into a unified structured format, and finally de-identifying sensitive information to obtain preprocessed log data. Step 2, Attack Behavior Feature Extraction: An attack behavior feature library is constructed based on the ATT&CK framework. The feature library contains feature indicators corresponding to various attack techniques. The preprocessed log data is analyzed line by line. The events in the logs are matched with the feature indicators in the feature library for pattern matching and semantic analysis to extract the feature information of attack stage, attack technique, attack source, and attack target, and represent it in the form of feature vectors. Step 3, Defense Capability Mapping: Construct a defense capability library using the D3FEND framework to store information on defense technologies, defense measures, and defense equipment; use the cosine similarity algorithm to calculate the semantic similarity between the feature vectors of attack technologies and the feature vectors of defense measures, establish a mapping relationship between attack technologies and defense measures, and store the mapping relationship in the mapping relationship library; Step 4: Knowledge Graph Construction: Define the ontology model of the knowledge graph, determine the entity types, attributes, and relationship types; extract attack entities and their attributes from attack behavior feature information, extract defense entities and their attributes from defense capability mapping relationships, and extract log entities and their attributes from log data; establish connections between entities based on the relationships between entities, and store the constructed knowledge graph using a graph database. Step 5: Event Correlation Analysis: The Apriori algorithm is used to perform correlation analysis on security events in the network; minimum support threshold and minimum confidence threshold are set, the support and confidence between events are calculated, strong correlation rules are screened out, and scattered security events are linked together according to the correlation rules to identify the preliminary outline of the attack chain. Step 6, Knowledge Reasoning and Deduction: Combining rule-based reasoning and machine learning-based reasoning methods, reasoning and deduction are performed based on the knowledge graph and event association analysis results; the knowledge graph is analyzed using rules in the reasoning rule base and graph neural network models to deduce the entire attack process and determine the attack source, attack path, and attack target information; Step 7, Attack Path Visualization: The attack path obtained by knowledge reasoning is laid out using a force-directed layout algorithm. The attack path is displayed to the user in the form of nodes and edges through a graphical interface. Nodes represent the attack source, attack target, and attack technology, and edges represent the relationship between them. At the same time, relevant detailed information is displayed. Step 8: Defense Strategy Decision Support: Analyze the attack techniques and vulnerabilities involved in the attack path, query the mapping database to obtain corresponding defense measures; combine the actual network environment, use the hierarchical analysis method to evaluate and rank the defense measures, recommend the optimal defense strategy to the user, and simulate the effect after the implementation of the defense strategy.

[0033] Example: In practical applications, the log collection and preprocessing module collects logs through collection agents deployed on various devices, such as access control logs from firewalls and system logs from servers. The collected logs are preprocessed to remove malformed logs, and Syslog and Windows Event Log formats are uniformly converted into a structured format containing fields such as timestamps, source IPs, and destination IPs. User passwords in the logs are also encrypted.

[0034] The attack behavior feature extraction module is based on the ATT&CK framework and extracts attack features from preprocessed logs. For example, when an event of "remote login port 3389 being frequently accessed" is detected in the logs, it is matched with the "remote service session hijacking" attack technique in the feature library to extract features such as the attack stage being "lateral movement" and the attack source being the corresponding IP address.

[0035] The defense capability mapping module, combined with the D3FEND framework, calculates the semantic similarity between the "remote service session hijacking" attack technique and the defense measures. It finds that the similarity with the "remote desktop protocol encryption" defense measure is high, and establishes a mapping relationship between the two.

[0036] The knowledge graph construction module constructs a knowledge graph from entities such as attack sources, "remote service session hijacking" attack techniques, "remote desktop protocol encryption" defense measures, and related log events, and stores it in the Neo4j graph database.

[0037] The event correlation analysis module uses the Apriori algorithm to perform correlation analysis on security events. If the support and confidence of the "remote login port 3389 is frequently accessed" event and the "abnormal login of system account" event are found to be high, they are associated together to form part of the attack chain.

[0038] The knowledge reasoning and deduction module uses reasoning rules and GNN models, based on knowledge graphs and association analysis results, to deduce the attack path by which attackers move laterally through "remote service session hijacking" technology and ultimately attempt to obtain sensitive information.

[0039] The attack path visualization module uses the Fruchterman-Reingold algorithm to lay out the attack path and displays information such as the attack source, attack steps, and attack target through a graphical interface, allowing users to intuitively view the attack process.

[0040] Based on the attack path, the defense strategy decision support module found the corresponding defense measures to be "remote desktop protocol encryption" and "account password strength enhancement". Taking into account the actual network situation, the AHP method was used to evaluate these two measures, and it was recommended to prioritize the implementation of the "remote desktop protocol encryption" measure.

[0041] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A knowledge graph-based reasoning and traceability analysis system, characterized in that: It includes modules for log collection and preprocessing, attack behavior feature extraction, defense capability mapping, knowledge graph construction, event correlation analysis, knowledge reasoning and deduction, attack path visualization, and defense strategy decision support. The log collection and preprocessing module is used to collect various log data in the network environment and preprocess them to provide a high-quality data foundation for subsequent analysis. The attack behavior feature extraction module is based on the ATT&CK framework and extracts attack behavior features from preprocessed log data. The defense capability mapping module, in conjunction with the D3FEND framework, establishes a mapping relationship between defense capabilities and attack behaviors; The knowledge graph construction module integrates the output results of the attack behavior feature extraction module and the defense capability mapping module to construct a full-scenario network security situation awareness knowledge graph. The event correlation analysis module, based on the constructed knowledge graph, performs correlation analysis on security events in the network, explores potential connections between events, and identifies attack chains. The knowledge reasoning and deduction module utilizes knowledge reasoning technology, based on knowledge graphs and event correlation analysis results, to deduce the entire attack process and achieve attack tracing; it adopts a combination of rule-based reasoning and machine learning-based reasoning. The attack path visualization module presents the attack paths derived from knowledge reasoning to users in an intuitive and clear way, making it easier for users to understand the attack process and situation; a force-directed layout algorithm is used to lay out and arrange the attack paths. The defense strategy decision support module provides users with targeted defense strategy suggestions based on attack tracing results and defense capability information in the knowledge graph. First, it analyzes the attack techniques and vulnerabilities involved in the attack path, and then queries the mapping relationship in the defense capability mapping module to obtain the corresponding defense measures. 2.The knowledge graph-based reasoning system for traceability analysis according to claim 1, wherein: The log collection and preprocessing module collects logs including, but not limited to, server logs, network device logs, terminal device logs, application logs, and security device logs. A distributed data collection architecture is adopted, and a dedicated log collection agent is deployed on each device to achieve real-time collection of log data; The preprocessing process includes log cleaning, log standardization and log desensitization; the log cleaning is used for removing invalid data, adopts an outlier rejection algorithm based on a threshold, sets the mean value of log data as , the standard deviation as , when a log data satisfies , it is determined as an outlier and is rejected; the log standardization converts logs of different formats into a unified structured format and defines unified fields; the log desensitization processes sensitive information in the log in a replacement and encryption manner to ensure data security.

3. The source tracing analysis system based on knowledge graph inference according to claim 1, characterized in that: The attack behavior feature extraction module first constructs an attack behavior feature library, which is based on attack techniques in the ATT&CK framework and stores feature indicators corresponding to each attack technique, such as specific port access, abnormal process creation, and specific command execution. Then, the log data is analyzed line by line, and the events in the log are matched with the feature indicators in the feature library. For events that match successfully, the feature information of the corresponding attack stage, attack technique, attack source, and attack target is extracted and represented in the form of a feature vector, denoted as where represents the value of the th feature indicator.

4. The source tracing analysis system based on knowledge graph inference according to claim 1, characterized in that: The defense capability mapping module firstly constructs a defense capability library to store defense technologies, defense measures and defense device information in the D3FEND framework; then, a mapping relationship between attack technologies and defense measures is established through semantic similarity calculation; the cosine similarity algorithm is used for semantic similarity calculation, and the calculation formula of the similarity between an attack technology feature vector and a defense measure feature vector is ​ ; in, and They are vectors and The One component; when If the attack exceeds the set threshold, it is considered that there is a mapping relationship between the attack technique and the defense measures, and this mapping relationship is stored in the mapping relationship library. 5.The knowledge graph-based traceability analysis system of claim 1, wherein: The knowledge graph construction module includes two parts: entities and relationships. Entities include attack entities, defense entities, and log entities; relationships include progressive relationships between attacks, adversarial relationships between attacks and defenses, and association relationships between logs and attacks. First, define the ontology model of the knowledge graph, and determine the types of entities, attributes, and the types of relationships between entities; Then, attack entities and their attributes are extracted from attack behavior feature information, defense entities and their attributes are extracted from defense capability mapping relationships, and log entities and their attributes are extracted from log data. Next, connections between entities are established based on the relationships between entities. Finally, the constructed knowledge graph is stored using a graph database to facilitate subsequent querying, analysis, and reasoning. 6.The knowledge graph-based traceability analysis system of claim 1, wherein: The event association analysis module uses the Apriori algorithm to mine association rules between events; Let the event set be , the transaction set , where each transaction is a subset of ; a correlation rule is an implication of the form , where and ; the support is the proportion of transactions in the transaction set that contain both and , i.e. ; confidence refers to the proportion of transactions that contain transactions that contain simultaneously, i.e.: ; By setting minimum support threshold and minimum confidence threshold, strong association rules that meet the conditions are selected. These rules reflect the close relationship between events. Based on these association rules, scattered security events are linked together to form a preliminary outline of the attack chain.

7. The source tracing analysis system based on knowledge graph inference according to claim 1, characterized in that: The knowledge reasoning and deduction module includes rule-based reasoning: a reasoning rule base is constructed, and the rules are formulated based on the progressive relationship of the attack phases in the ATT&CK framework and known attack patterns; Machine learning-based reasoning: The graph neural network (GNN) model is used to analyze the knowledge graph and predict attack paths and potential attack targets. The GNN model learns the features of nodes and edges in the knowledge graph to capture the dependencies between entities, thereby enabling reasoning.

8. The source tracing analysis system based on knowledge graph inference according to claim 1, characterized in that: The attack path visualization module uses a force-directed layout algorithm to simulate the attraction and repulsion forces in a physical system, resulting in a uniform distribution of nodes and moderate edge lengths in the graph, creating an aesthetically pleasing and easy-to-understand overall layout. Through a graphical interface, the attack source, target, technique, and steps are displayed as nodes and edges, with different colors and shapes used to distinguish different types of nodes and edges. The module also displays the time of the attack and related log information, allowing users to gain a deeper understanding of the attack path through interactive operations.

9. The source tracing analysis system based on knowledge graph inference according to claim 1, characterized in that: The defense strategy decision support module evaluates and ranks defense measures based on the actual network environment. Evaluation indicators include defense effectiveness, implementation cost, and impact on business. The Analytic Hierarchy Process (AHP) is used to comprehensively score the defense measures, and the optimal defense strategy is recommended to the user based on the score results.

10. The analysis method of a source tracing analysis system based on knowledge graph inference according to any one of claims 1-9, characterized in that: Includes the following steps: Step 1: Log Collection and Preprocessing: Log data is collected from multiple sources such as servers, network devices, terminal devices, applications, and security devices through a log collection agent. The collected log data is preprocessed by first removing outliers using a threshold-based outlier removal algorithm, then converting logs of different formats into a unified structured format, and finally de-identifying sensitive information to obtain preprocessed log data. Step 2, Attack Behavior Feature Extraction: An attack behavior feature library is constructed based on the ATT&CK framework. The feature library contains feature indicators corresponding to various attack techniques. The preprocessed log data is analyzed line by line. The events in the logs are matched with the feature indicators in the feature library for pattern matching and semantic analysis to extract the feature information of attack stage, attack technique, attack source, and attack target, and represent it in the form of feature vectors. Step 3, Defense Capability Mapping: Construct a defense capability library using the D3FEND framework to store information on defense technologies, defense measures, and defense equipment; use the cosine similarity algorithm to calculate the semantic similarity between the feature vectors of attack technologies and the feature vectors of defense measures, establish a mapping relationship between attack technologies and defense measures, and store the mapping relationship in the mapping relationship library; Step 4: Knowledge Graph Construction: Define the ontology model of the knowledge graph, determine the entity types, attributes, and relationship types; extract attack entities and their attributes from attack behavior feature information, extract defense entities and their attributes from defense capability mapping relationships, and extract log entities and their attributes from log data; establish connections between entities based on the relationships between entities, and store the constructed knowledge graph using a graph database. Step 5: Event Correlation Analysis: The Apriori algorithm is used to perform correlation analysis on security events in the network; minimum support threshold and minimum confidence threshold are set, the support and confidence between events are calculated, strong correlation rules are screened out, and scattered security events are linked together according to the correlation rules to identify the preliminary outline of the attack chain. Step 6, Knowledge Reasoning and Deduction: Combining rule-based reasoning and machine learning-based reasoning methods, reasoning and deduction are performed based on the knowledge graph and event association analysis results; the knowledge graph is analyzed using rules in the reasoning rule base and graph neural network models to deduce the entire attack process and determine the attack source, attack path, and attack target information; Step 7, Attack Path Visualization: The attack path obtained by knowledge reasoning is laid out using a force-directed layout algorithm. The attack path is displayed to the user in the form of nodes and edges through a graphical interface. Nodes represent the attack source, attack target, and attack technology, and edges represent the relationship between them. At the same time, relevant detailed information is displayed. Step 8: Defense Strategy Decision Support: Analyze the attack techniques and vulnerabilities involved in the attack path, query the mapping database to obtain corresponding defense measures; combine the actual network environment, use the hierarchical analysis method to evaluate and rank the defense measures, recommend the optimal defense strategy to the user, and simulate the effect after the implementation of the defense strategy.

Images