Attack event portrait analysis and recognition device and method based on knowledge graph

Abstract

The invention discloses an attack event portrait analysis and recognition device and method based on a knowledge graph, and the device comprises an analysis and recognition device which is internally provided with a result display module, an analysis and recognition module, an unknown attribute analysis module, a safety response module, and a portrait construction module. According to the method, network security ontology knowledge which is relatively mature in research at present is utilized to construct a network defense knowledge graph with relatively comprehensive knowledge coverage, discrete threats, vulnerability and asset knowledge are integrated into a highly-associated knowledge system, complete knowledge support is provided for attack prediction, and the attack prediction efficiency is improved. According to the method, a path sorting algorithm with high prediction precision and high prediction result interpretability is selected, a relation path between an attacker entity and a target equipment entity is extracted as a feature, the attack is predicted more comprehensively, the influence of vulnerability unknown and expert knowledge one-sidedness is effectively overcome, the prediction accuracy is improved, and the prediction efficiency is improved. And support is provided for the interpretability of the prediction result.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a knowledge graph-based attack event profiling analysis and identification device and method. Background Technology

[0002] In today's network attack and defense system, zero-day vulnerabilities refer to a general term for system vulnerabilities that have not been discovered by security vendors but can be exploited by hacker groups. When used to launch zero-day attacks, their unknown nature to defenders creates a severe information asymmetry, making it difficult for defenders to implement effective detection due to a lack of detailed vulnerability information. This allows attackers to increase the stealth and success rate of their attacks. Currently, zero-day attacks are frequently used to infiltrate highly protected information systems and achieve covert and continuous attacks. Therefore, overcoming the difficulty in detecting zero-day attacks due to their unknown nature has become a major challenge in the current network security field.

[0003] Currently, analysis and identification devices utilize knowledge graph technology to visualize and model entities in attack events, such as attackers, attack targets, attack methods, and their relationships, and discover abnormal behavior patterns by analyzing the correlations between entities.

[0004] However, traditional analysis and identification devices have the following drawbacks: Traditional analysis and identification devices can only analyze and identify attacks from a single angle or direction, resulting in unconvincing and inaccurate results. Summary of the Invention

[0005] The purpose of this invention is to provide an attack event profiling analysis and identification device and method based on knowledge graphs, so as to solve the problem that the traditional analysis and identification devices mentioned in the background art can only analyze and identify from a single angle or a single direction of the attack event, and the analysis and identification results are not convincing and have low accuracy.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an attack event profiling analysis and identification device based on knowledge graphs, comprising an analysis and identification device, wherein the analysis and identification device is provided with a result display module, an analysis and identification module, an unknown attribute analysis module, a security response module and a profiling construction module; The result display module displays the overall results of this attack event; The analysis and identification module analyzes and identifies attack events based on knowledge graphs; The unknown attribute analysis module analyzes the path of attack events and classifies attack events; The security response module provides real-time responses to this attack event. The profile building module constructs an attacker profile.

[0007] As a preferred embodiment of the present invention, the analysis and identification module includes a knowledge source submodule, a knowledge extraction submodule, a knowledge fusion submodule, a network defense knowledge graph submodule, and a knowledge storage submodule. The knowledge source submodule is connected to the knowledge extraction submodule, the knowledge extraction submodule is connected to the knowledge fusion submodule, the knowledge fusion submodule is connected to the network defense knowledge graph submodule, and the network defense knowledge graph submodule is connected to the knowledge storage submodule. The knowledge source submodule divides the attack event data into structured and unstructured data. The knowledge extraction submodule performs ontology extraction, entity recognition, and relation extraction respectively; The knowledge fusion submodule performs ontology integration and entity alignment respectively; The network defense knowledge graph submodule's pattern layer defines attack pattern classes, vulnerability classes, and the relationship type exploit with the two as the domain and value range, respectively. The data layer uses this pattern to model data knowledge, representing the exploitation of vulnerabilities by the code injection attack pattern. The knowledge storage submodule includes a graph database to store the attack.

[0008] As a preferred technical solution of the present invention, the unknown attribute analysis module includes a path feature calculation submodule, an attack classifier, and an attack path prediction submodule; The path feature calculation submodule uses a random walk method to calculate path features for any relational path rp: , Given a starting entity S Target entity d Then the path feature h s，rp (d) The calculation is as follows: when rp = Φ, ; The attack classifier uses a LogisticRegression model to construct a binary classifier to perform link prediction. The calculation formula is as follows: , in, , where n is the path weight, representing the degree of influence of the corresponding path on whether the relationship under test is valid; The attack path prediction submodule is calculated using the following formula: .

[0009] As a preferred technical solution of the present invention, the profile construction module includes a log data submodule, a profile analysis submodule, and an attacker profile submodule; The log data submodule provides WAF alarm logs, NTA alarm logs, RASP alarm logs, network traffic logs, and intelligence data; The profiling analysis submodule performs source feature analysis, attacker identification, attack relationship graph analysis, and attack chain analysis. The attacker profiling submodule profiles the attacker's identity, skill level, attack methods, trends, and paths.

[0010] As a preferred technical solution of the present invention, the result display module includes an attack region submodule, an attack source submodule, an attack method submodule, an attack target submodule, an attack result submodule, and an attack path submodule. The Attack Region submodule displays the region where the attack is taking place; The attack source submodule displays the attacked domain name and the attacked email address; The attack methods submodule displays XSS attacks or phishing website attacks; The attack target submodule displays the attack target; The attack results submodule displays whether the attack was successful. The attack path submodule displays information about web systems or email systems.

[0011] The present invention discloses a method for using an attack event profiling and identification device based on a knowledge graph, comprising the following steps: Step 1: Knowledge Graph Generation: The analysis and identification module utilizes the Neo4jdesktop 1.3.8 graph database, based on the knowledge patterns defined by the network security ontology, to model data layer knowledge and generate a network defense knowledge graph. Step 2: Create a profile: The profile building module uses homogeneous identification and clustering to build an accurate attacker profile knowledge base. Based on the attacker profile knowledge base, the attacker's intentions, attack trends, and activity patterns are analyzed, and targeted defense measures are dynamically formulated. Step 3, Sample Training: The security response module uses data from simulated attackers targeting target systems in different training scenarios as a basis. Relying on the knowledge graph, it takes the successfully attacked devices as target entities, and the unknown attribute analysis module calculates path features. Step 4: Real-time display: The results display module displays relevant data about this attack event in real time.

[0012] As a preferred technical solution of the present invention, the generation of the network defense knowledge graph in step one specifically involves three knowledge modules: threats, assets, and vulnerabilities. These modules are constructed with simulated hacker organizations, experimental environment equipment, and vulnerabilities existing in different scenarios as the core to build corresponding entities. Entity relationships and attribute knowledge are extracted from the CAPEC, NVD, and CNNVD public databases. In terms of threat knowledge, the attacker entity is named "CTF001" and is set to have the primary attack intent of stealing information from the file server. For other system equipment, the intent is to create attack "stepping stones".

[0013] As a preferred technical solution of the present invention, the calculation of path features in step three specifically involves constructing attack positive samples {(Hi, y=1)}, using the devices that failed to attack and were not selected as attack targets as target entities, and constructing attack negative samples {(Hj, y=0)}, using the model in the Python 3.5 environment.

[0014] As a preferred technical solution of the present invention, the relevant data in step four specifically includes the attack region, attack source, attack method, attack target, attack result, and attack path.

[0015] Compared with the prior art, the beneficial effects of the present invention are: Leveraging the relatively mature cybersecurity ontology knowledge currently being researched, a comprehensive network defense knowledge graph was constructed, integrating discrete threat, vulnerability, and asset knowledge into a highly interconnected knowledge system. This provides complete knowledge support for attack prediction. Based on this, the attack prediction problem was transformed into a link prediction problem. A path ranking algorithm with high prediction accuracy and strong interpretability was selected, and the relationship paths between attacker entities and target device entities were extracted as features. This resulted in a more comprehensive prediction of attacks, effectively overcoming the influence of vulnerability unknowns and the one-sidedness of expert knowledge, improving prediction accuracy, and providing support for the interpretability of prediction results. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the architecture of the analysis and identification device of the present invention; Figure 2 This is a schematic diagram of the architecture of the analysis and identification module of the present invention; Figure 3 This is a schematic diagram of the architecture of the unknown attribute analysis module of the present invention; Figure 4 This is a schematic diagram of the architecture of the image construction module of the present invention; Figure 5 This is a schematic diagram of the architecture of the result display module of the present invention; Figure 6 This is a flowchart of the present invention. Detailed Implementation

[0017] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1-6 The present invention provides an attack event profile analysis and identification device based on knowledge graph, including an analysis and identification device, which includes a result display module, an analysis and identification module, an unknown attribute analysis module, a security response module and a profile construction module. The results display module provides an overall result for this attack event. The analysis and identification module analyzes and identifies attack events based on knowledge graphs; The unknown attribute analysis module analyzes the path of attack events and classifies attack events; The security response module provides real-time responses to this attack incident. The profile building module constructs attacker profiles.

[0019] The analysis and identification module includes a knowledge source submodule, a knowledge extraction submodule, a knowledge fusion submodule, a network defense knowledge graph submodule, and a knowledge storage submodule. The knowledge source submodule is connected to the knowledge extraction submodule, the knowledge extraction submodule is connected to the knowledge fusion submodule, the knowledge fusion submodule is connected to the network defense knowledge graph submodule, and the network defense knowledge graph submodule is connected to the knowledge storage submodule. The knowledge source submodule divides the attack event data into structured and unstructured data. The knowledge extraction submodule performs ontology extraction, entity recognition, and relation extraction respectively; The knowledge fusion submodule performs ontology integration and entity alignment respectively; The network defense knowledge graph submodule's pattern layer defines attack pattern classes, vulnerability classes, and the relationship type exploit with the two as their domain and value range, respectively. The data layer uses this pattern to model data knowledge, representing the exploitation of vulnerabilities by the code injection attack pattern. The knowledge storage submodule includes a graph database to store the attack.

[0020] The unknown attribute analysis module includes a path feature calculation submodule, an attack classifier, and an attack path prediction submodule; The path feature calculation submodule uses a random walk method to calculate path features for any relational path rp: , Given a starting entity S Target entity d Then the path feature h s，rp (d) The calculation is as follows: when rp = Φ, ; The attack classifier uses a LogisticRegression model to construct a binary classifier for link prediction. The calculation formula is as follows: , in, , where n is the path weight, representing the degree of influence of the corresponding path on whether the relationship under test is valid; The calculation formula for the attack path prediction submodule is as follows: .

[0021] The profile building module includes a log data submodule, a profile analysis submodule, and an attacker profile submodule; The log data submodule provides WAF alarm logs, NTA alarm logs, RASP alarm logs, network traffic logs, and intelligence data; The profiling analysis submodule performs source feature analysis, attacker identification, attack relationship graph analysis, and attack chain analysis. The attacker profiling submodule profiles attackers based on their identity, skill level, attack methods, trends, and attack paths.

[0022] The results display module includes sub-modules for attack region, attack source, attack method, attack target, attack result, and attack path. The Attack Region submodule displays the region where the attack is taking place; The attack source submodule displays the attacked domain name and the attacked email address; The attack methods submodule displays XSS attacks or phishing website attacks; The attack target submodule displays the attack target; The attack results submodule displays whether the attack was successful. The attack path submodule displays information about web systems or email systems.

[0023] The present invention discloses a method for using an attack event profiling and identification device based on a knowledge graph, comprising the following steps: Step 1: Knowledge Graph Generation: The analysis and identification module utilizes the Neo4jdesktop 1.3.8 graph database, based on the knowledge patterns defined by the network security ontology, to model data layer knowledge and generate a network defense knowledge graph. Step 2: Create a profile: The profile building module uses homogeneous identification and clustering to build an accurate attacker profile knowledge base. Based on the attacker profile knowledge base, the attacker's intentions, attack trends, and activity patterns are analyzed, and targeted defense measures are dynamically formulated. Step 3, Sample Training: The security response module uses data from simulated attackers targeting target systems in different training scenarios as a basis. Relying on the knowledge graph, it takes the successfully attacked devices as target entities, and the unknown attribute analysis module calculates path features. Step 4: Real-time display: The results display module displays relevant data about this attack event in real time.

[0024] Step one generates a network defense knowledge graph, specifically consisting of three knowledge modules: threats, assets, and vulnerabilities. These modules are constructed with simulated hacker organizations, experimental environment equipment, and vulnerabilities in different scenarios as the core. Entity relationships and attribute knowledge are extracted from public databases such as CAPEC, NVD, and CNNVD. In terms of threat knowledge, the attacker entity is named "CTF001," and its primary attack intent is to steal information from the file server. For other system devices, its intent is to create attack "stepping stones."

[0025] In step three, the path feature calculation specifically involves constructing a positive attack sample {(Hi, y=1)}, using the devices that failed to attack or were not selected as attack targets as target entities, and constructing a negative attack sample {(Hj, y=0)}. The model is then used in the Python 3.5 environment.

[0026] The relevant data in step four specifically includes the attack region, attack source, attack method, attack target, attack result, and attack path.

[0027] In this invention, the analysis and identification module utilizes the Neo4jdesktop 1.3.8 graph database, based on the knowledge patterns defined by the network security ontology, to model data layer knowledge and generate a network defense knowledge graph. The three knowledge modules—threat, assets, and vulnerabilities—construct corresponding entities based on simulated hacker organizations, experimental environment equipment, and vulnerabilities existing in different scenarios, respectively. They extract entity relationships and attribute knowledge from public databases such as CAPEC, NVD, and CNNVD. Regarding threat knowledge, the attacker entity is named "CTF001," with its primary attack intent being to steal information from file servers, and its intent to create attack "stepping stones" for other system devices. The profile construction module... Homology identification and clustering are used to build an accurate attacker profile knowledge base. Based on this knowledge base, attacker intent, attack trends, and activity patterns are analyzed, and targeted defense measures are dynamically formulated. The security response module is based on attack data simulating different training scenarios of target systems. Relying on knowledge graphs, it uses successfully attacked devices as target entities, and the unknown attribute analysis module calculates path features. Positive attack samples {(Hi, y=1)} are constructed, and negative attack samples {(Hj, y=0)} are constructed using devices that failed to be attacked or were not selected as attack targets. The model is used in the Python 3.5 environment. The results display module displays relevant data of this attack event in real time.

[0028] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A knowledge graph-based attack event profiling and identification device, comprising an analysis and identification device, characterized in that: The analysis and identification device includes a result display module, an analysis and identification module, an unknown attribute analysis module, a security response module, and a profile construction module. The result display module displays the overall results of this attack event; The analysis and identification module analyzes and identifies attack events based on knowledge graphs; The unknown attribute analysis module analyzes the path of attack events and classifies attack events; The security response module provides real-time responses to this attack event. The profile building module constructs an attacker profile.

2. The attack event profiling and identification device based on knowledge graphs according to claim 1, characterized in that: The analysis and identification module includes a knowledge source submodule, a knowledge extraction submodule, a knowledge fusion submodule, a network defense knowledge graph submodule, and a knowledge storage submodule. The knowledge source submodule is connected to the knowledge extraction submodule, the knowledge extraction submodule is connected to the knowledge fusion submodule, the knowledge fusion submodule is connected to the network defense knowledge graph submodule, and the network defense knowledge graph submodule is connected to the knowledge storage submodule. The knowledge source submodule divides the attack event data into structured and unstructured data. The knowledge extraction submodule performs ontology extraction, entity recognition, and relation extraction respectively; The knowledge fusion submodule performs ontology integration and entity alignment respectively; The network defense knowledge graph submodule's pattern layer defines attack pattern classes, vulnerability classes, and the relationship type exploit with the two as the domain and value range, respectively. The data layer uses this pattern to model data knowledge, representing the exploitation of vulnerabilities by the code injection attack pattern. The knowledge storage submodule includes a graph database to store the attack.

3. The attack event profiling and identification device based on knowledge graphs according to claim 1, characterized in that: The unknown attribute analysis module includes a path feature calculation submodule, an attack classifier, and an attack path prediction submodule. The path feature calculation submodule uses a random walk method to calculate path features for any relational path rp: ， Given a starting entity S Target entity d Then the path feature h s，rp (d) The calculation is as follows: when rp = Φ, ； The attack classifier uses a LogisticRegression model to construct a binary classifier to perform link prediction. The calculation formula is as follows: ， in, , where n is the path weight, representing the degree of influence of the corresponding path on whether the relationship under test is valid; The attack path prediction submodule is calculated using the following formula: 。 4. The attack event profiling and identification device based on knowledge graphs according to claim 1, characterized in that: The profile building module includes a log data submodule, a profile analysis submodule, and an attacker profile submodule; The log data submodule provides WAF alarm logs, NTA alarm logs, RASP alarm logs, network traffic logs, and intelligence data; The profiling analysis submodule performs source feature analysis, attacker identification, attack relationship graph analysis, and attack chain analysis. The attacker profiling submodule profiles the attacker's identity, skill level, attack methods, trends, and paths.

5. The attack event profiling and identification device based on knowledge graphs according to claim 1, characterized in that: The results display module includes an attack region submodule, an attack source submodule, an attack method submodule, an attack target submodule, an attack result submodule, and an attack path submodule. The Attack Region submodule displays the region where the attack is taking place; The attack source submodule displays the attacked domain name and the attacked email address; The attack methods submodule displays XSS attacks or phishing website attacks; The attack target submodule displays the attack target; The attack results submodule displays whether the attack was successful. The attack path submodule displays information about web systems or email systems.

6. The method of using the knowledge graph-based attack event profiling and identification device according to claim 1, characterized in that, Includes the following steps: Step 1: Knowledge Graph Generation: The analysis and identification module utilizes the Neo4jdesktop 1.3.8 graph database, based on the knowledge patterns defined by the network security ontology, to model data layer knowledge and generate a network defense knowledge graph. Step 2: Create a profile: The profile building module uses homogeneous identification and clustering to build an accurate attacker profile knowledge base. Based on the attacker profile knowledge base, the attacker's intentions, attack trends, and activity patterns are analyzed, and targeted defense measures are dynamically formulated. Step 3, Sample Training: The security response module uses data from simulated attackers targeting target systems in different training scenarios as a basis. Relying on the knowledge graph, it takes the successfully attacked devices as target entities, and the unknown attribute analysis module calculates path features. Step 4: Real-time display: The results display module displays relevant data about this attack event in real time.

7. The method of using the knowledge graph-based attack event profiling and identification device according to claim 6, characterized in that: In step one, the network defense knowledge graph is generated by three knowledge modules: threats, assets, and vulnerabilities. These modules are constructed with simulated hacker organizations, experimental environment equipment, and vulnerabilities in different scenarios as the core. Entity relationships and attribute knowledge are extracted from public databases such as CAPEC, NVD, and CNNVD. In terms of threat knowledge, the attacker entity is named "CTF001" and its main attack intent is to steal information from the file server. For other system devices, its intent is to create attack "stepping stones".

8. The method of using the knowledge graph-based attack event profiling and identification device according to claim 6, characterized in that: In step three, calculating the path features specifically involves constructing positive attack samples {(Hi, y=1)}, using devices that failed to attack or were not selected as attack targets as target entities, and constructing negative attack samples {(Hj, y=0)}. The model is then used in the Python 3.5 environment.

9. The method of using the knowledge graph-based attack event profiling and identification device according to claim 6, characterized in that: The relevant data in step four specifically includes the attack region, attack source, attack method, attack target, attack result, and attack path.

Images