Cyberspace mapping threat detection method and system

Abstract

The application discloses a network space mapping threat detection method and system, and belongs to the technical field of network security.The application obtains a behavior snapshot of a same behavior subject, extracts a multi-dimensional feature vector from spatial distribution features, time distribution features, protocol interaction features and load response features, learns a model to predict a feature vector of a next time step according to a plurality of feature vectors in a latest time window, compares errors between the predicted feature vector and an actual feature vector to screen out abnormal features, evaluates an attack intention according to the abnormal features, further evaluates an attack intention comprehensive threat coefficient, and finally evaluates a threat risk coefficient by combining the abnormal features and the attack intention comprehensive threat coefficient, so as to improve the accuracy of attack intention evaluation by the multi-dimensional features and improve the evaluation accuracy of the threat risk coefficient by combining the abnormal features and the attack intention comprehensive threat coefficient.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting cyberspace mapping threats. Background Technology

[0002] Cyberspace mapping threat detection refers to using cyberspace mapping technology to obtain information on the distribution, service status, and ports of network assets, constructing an accurate cyberspace map, and then assessing the security risks of exposed assets on the Internet and potential malicious attacks.

[0003] Chinese invention patent application number CN202510825036.1 discloses a method and system for detecting cyberspace mapping threats with causal correlation privacy protection. By using causal correlation modeling and dynamic privacy protection, it can improve the threat detection capability in complex network environments while ensuring data security. However, when facing threat activities that are highly concealed, slow-paced, and have dynamically changing behavior patterns, there are technical problems such as difficulty in identifying their potential attack intentions through static rules or single-dimensional traffic assessment and inaccurate threat risk prediction. Summary of the Invention

[0004] To address the technical problems existing in the prior art, this invention provides a method for detecting cyberspace mapping threats, comprising the following steps:

[0005] Obtain all network data packets of key nodes in the network space, and generate session metadata records after parsing all network data packets;

[0006] Set a dynamic time window, and within the same time window, aggregate the session metadata records initiated by the same subject to form a behavior session stream. Slice the behavior session stream according to a preset time interval to obtain a series of behavior snapshots sorted by time.

[0007] For each behavior snapshot, multidimensional feature extraction is performed to construct a feature vector for each behavior snapshot. The multidimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction.

[0008] The pre-trained deep learning model outputs the predicted feature vector for the next time step based on multiple feature vectors of the actor in the current latest time window.

[0009] For each type of actual feature in the actual feature vector of the subject at the next time step, the error value is calculated between each type of predicted feature in the corresponding predicted feature vector. If the error value is greater than the preset threshold, the corresponding actual feature is regarded as an abnormal feature.

[0010] The attack intent is assessed based on the abnormal characteristics. The comprehensive threat coefficient of the attack intent is evaluated based on the attack intent assessment results. The threat risk coefficient is evaluated by combining the abnormal characteristics and the comprehensive threat coefficient of the attack intent.

[0011] Furthermore, the process of generating session metadata records after parsing all network data packets includes parsing the L2 to L4 layers of the OSI model to obtain quintuple information and parsing the L7 layer to obtain application layer payload information.

[0012] Furthermore, the five-tuple information includes source IP, destination IP, source port, destination port, and transport layer protocol.

[0013] Furthermore, the spatial distribution feature extraction includes: analyzing the target IP entropy and target port entropy in the current behavior snapshot;

[0014] The extraction of time distribution features includes: analyzing the mean and variance of request times in the current behavior snapshot;

[0015] The extraction of protocol interaction features includes: analyzing the proportion of pure SYN packets, the proportion of SYN-ACK responses followed by RST packets, and the proportion of complete handshakes without interaction in the current behavior snapshot;

[0016] The load response feature extraction includes: analyzing the response consistency value in the current behavior snapshot.

[0017] Furthermore, the analysis method for the target IP entropy is as follows:

[0018] Obtain all target IP addresses accessed in the current behavior snapshot and record them as the first IP address. Calculate the frequency p1 of each first IP address appearing in the behavior snapshot. Calculate the target IP entropy based on each frequency p1 using the information entropy formula.

[0019] The target port entropy is calculated as follows:

[0020] Obtain all target ports accessed in the current behavior snapshot and calculate the frequency p2 of each target port appearing in the behavior snapshot. Calculate the target port entropy based on each frequency p2 using the information entropy formula.

[0021] Furthermore, the analysis method for the mean of request times and the variance of request times is as follows:

[0022] The timestamp sequence is obtained by acquiring the timestamp of the request initiated by the subject in the current behavior snapshot. The time interval between two adjacent timestamps is calculated to obtain the time interval sequence. The mean of the request time is calculated based on the values ​​in the time interval sequence. The variance of the request time is obtained by using the variance formula based on the mean of the request time.

[0023] Furthermore, the analysis method for the proportion of pure SYN packets is as follows:

[0024] Retrieve SYN packets that did not receive a SYN-ACK response in the current behavior snapshot, and record them as non-response SYN packets. Calculate the ratio of the number of non-response SYN packets in the current behavior snapshot to the total number of SYN packets in the current behavior snapshot as the pure SYN packet ratio.

[0025] The analysis method for the proportion of SYN-ACK responses followed by RST packets is as follows:

[0026] Get the number of RST packets sent after receiving the SYN-ACK response in the current behavior snapshot, and use the ratio of the number of RST packets to the total number of SYN packets in the current behavior snapshot as the proportion of RST packets following SYN-ACK.

[0027] The analysis method for the proportion of complete handshakes without interaction is as follows:

[0028] Get the number of connections that have completed the TCP three-way handshake L1 and the number of connections that have completed the TCP three-way handshake but have no application layer data in the current behavior snapshot. Use the ratio of the number of connections L2 to the number of connections L1 as the proportion of complete handshakes without interaction.

[0029] Furthermore, the analysis method for the response consistency value is as follows:

[0030] In the current behavior snapshot, for the same target IP address, obtain the banner information of each response in the current behavior snapshot, group the same banner information into one category, analyze the frequency of occurrence of each category of banner information, and then calculate the response consistency value for the target IP address in the current behavior snapshot using the information entropy formula; in the same way, obtain the response consistency value for other target IP addresses or target ports in the current behavior snapshot.

[0031] Furthermore, the attack intent assessment based on abnormal characteristics specifically includes:

[0032] Obtain a pre-built attack intent knowledge base, which records various attack intents and multiple combinations of first abnormal features corresponding to each attack intent, as well as the error value range conditions of each first abnormal feature in each combination of first abnormal features when corresponding to the attack intent.

[0033] The current abnormal feature type combination is matched with the first abnormal feature type combination to filter out the first attack intent, and the matched first abnormal feature type combination is used as the second abnormal feature type combination. The matching condition is: if the type range of the current abnormal feature type combination includes the type range of the first abnormal feature type combination or the type range is the same, then it is matched.

[0034] The second attack intent is selected from the first attack intent by matching the error values ​​of each current abnormal feature with the error value range of each first abnormal feature in the combination of second abnormal feature types when corresponding to the first attack intent.

[0035] The present invention also provides a cyberspace mapping threat detection system, which applies the cyberspace mapping threat detection method as described in any of the above claims, including:

[0036] The acquisition module acquires the full network data packets of key nodes in the network space, and generates session metadata records after parsing the full network data packets;

[0037] The slicing module sets a dynamic time window. Within the same time window, it aggregates the session metadata records initiated by the same subject to form a behavior session stream. The behavior session stream is then sliced ​​according to a preset time interval to obtain a series of behavior snapshots sorted by time.

[0038] The feature extraction module performs multi-dimensional feature extraction on each behavior snapshot to construct a feature vector for each behavior snapshot. The multi-dimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction.

[0039] The prediction module uses a pre-trained deep learning model to output the predicted feature vector for the next time step based on multiple feature vectors of the actor within the current latest time window.

[0040] The judgment module calculates the error value between each type of actual feature in the actual feature vector of the subject at the next time step and each type of predicted feature in the corresponding predicted feature vector. If the error value is greater than the preset threshold, the corresponding actual feature is regarded as an abnormal feature.

[0041] The assessment module evaluates attack intent based on abnormal characteristics, assesses the overall threat coefficient of attack intent based on the attack intent assessment results, and assesses the threat risk coefficient by combining the abnormal characteristics and the overall threat coefficient of attack intent.

[0042] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0043] This invention obtains behavioral snapshots of the same subject and extracts multi-dimensional features, including spatial distribution features, temporal distribution features, protocol interaction features, and payload response features, to construct feature vectors. A learning model then uses these feature vectors within the latest time window to output a predicted feature vector for the next time step. This predicted feature vector is compared with the actual feature vector to identify anomalous features. Attack intent is assessed based on these anomalous features, leading to an evaluation of the comprehensive threat coefficient. Finally, the threat risk coefficient is evaluated by combining the anomalous features and the comprehensive threat coefficient. This approach improves the accuracy of attack intent assessment through multi-dimensional features and enhances the accuracy of threat risk coefficient evaluation by combining anomalous features and the comprehensive threat coefficient.

[0044] The attack intent is assessed by performing a first match based on combinations of abnormal feature types, and then performing a second match based on the error value of the abnormal features. This improves the accuracy of the attack intent assessment.

[0045] By combining the idea of ​​assessing multiple possible attack intentions, after obtaining the attack intention assessment results, the overall threat coefficient is obtained by combining the preset threat coefficients of each attack intention. Then, the threat risk coefficient is further assessed by combining abnormal characteristics, thereby improving the accuracy of the threat risk coefficient assessment. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart of a cyberspace mapping threat detection method according to the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0050] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0051] Furthermore, the use of terms such as "first" and "second" in this invention is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" and "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but only on the basis of being achievable by those skilled in the art. When the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed by this invention.

[0052] Example 1

[0053] See Figure 1 As shown, the present invention provides a method for detecting cyberspace mapping threats, which specifically includes the following steps:

[0054] S1. Obtain the full network data packets of key nodes in the network space, and generate session metadata records after parsing the full network data packets;

[0055] S2. Set a dynamic time window. Within the same time window, aggregate the session metadata records initiated by the same subject to form a behavior session stream. Slice the behavior session stream according to a preset time interval to obtain a series of behavior snapshots sorted by time.

[0056] S3. Perform multi-dimensional feature extraction on each behavior snapshot to construct the feature vector of each behavior snapshot. The multi-dimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction.

[0057] S4. Using a pre-trained deep learning model, output the predicted feature vector for the next time step based on multiple feature vectors of the actor in the current latest time window.

[0058] S5. For each type of actual feature in the actual feature vector of the subject at the next time step, calculate the error value between each type of predicted feature in the corresponding predicted feature vector. If the error value is greater than the preset threshold, the corresponding actual feature is regarded as an abnormal feature.

[0059] S6. Assess attack intent based on abnormal characteristics, evaluate the comprehensive threat coefficient of attack intent based on the attack intent assessment results, and evaluate the threat risk coefficient by combining abnormal characteristics and comprehensive threat coefficient of attack intent.

[0060] Step S1: Obtain the full network data packets of key nodes in the network space, and generate session metadata records after parsing the full network data packets.

[0061] The key nodes include, but are not limited to, core servers, core switches, server zone boundaries, key routers, internet data centers, and hubs connecting different subnets. Full network data packets refer to the complete set of data packets obtained in real-time by capturing network traffic through mirroring or bypassing methods.

[0062] The process of parsing all network data packets to generate session metadata records includes parsing the L2 to L4 layers of the OSI model to obtain quintuple information and parsing the L7 layer to obtain application layer payload information.

[0063] The OSI (Open Systems Interconnection) reference model consists of layers L1 to L7, which are, in order, the physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer. L1, the physical layer, is responsible only for transmitting "bit streams" (0s and 1s) and does not contain any logical information about network communication. The L5 session layer is primarily responsible for "establishing, managing, and terminating sessions." The session management functions of the session layer (such as establishing connections and maintaining sessions) are already handled in the TCP / UDP protocol of the transport layer (L4). The L6 presentation layer is mainly responsible for "data syntax conversion and data transmission." However, the threat detection in this solution focuses more on the content and patterns of network communication, rather than the details of physical signals and session establishment, or the specific format of the data. Therefore, this embodiment only parses layers L2 to L4 and L7 to generate session metadata records.

[0064] The quintuple information includes source IP, destination IP, source port, destination port, and transport layer protocol.

[0065] In addition to the five-tuple information and application layer payload information, the session metadata record also includes timestamp records, packet direction, and TCP interaction status.

[0066] S2. Set a dynamic time window. Within the same time window, aggregate the session metadata records initiated by the same subject to form a behavior session stream. Slice the behavior session stream according to a preset time interval to obtain a series of behavior snapshots sorted by time:

[0067] In some embodiments, the length T of the time window is dynamically adjusted according to the request frequency of the corresponding subject:

[0068] First, obtain the average request frequency λ1 of the corresponding behavior subject through historical data. Then, set a time window baseline length Tbase for the corresponding behavior subject based on the average request frequency. At the same time, obtain the real-time request frequency λ2 of the behavior subject within the preset time.

[0069] If |λ2-λ1|≤λy, then T=Tbase;

[0070] If |λ2-λ1|>λy and λ2>λ1, then If we find that T < Tmin, then T = Tmin;

[0071] If |λ2-λ1|>λy and λ2<λ1, then If we find that T > Tmax, then T = Tmax;

[0072] Where λy is the preset frequency difference threshold, λH is the maximum boundary value, λH=λ1+λy, λL is the minimum boundary value, λL=λ1-λy, Tmin is the minimum window length, Tmin=Tbase×(1-ky), Tmax is the maximum window length, Tmax=Tbase×(1+ky), and ky is the preset adjustment coefficient, with a value range of (0,1).

[0073] S3. Perform multi-dimensional feature extraction on each behavior snapshot to construct a feature vector for each behavior snapshot. The multi-dimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction.

[0074] The spatial distribution feature extraction includes: analyzing the target IP entropy and target port entropy in the current behavior snapshot;

[0075] Entropy measures uncertainty or randomness. In scanning, attackers, in order to maximize the discovery of new assets, often distribute their target IP addresses or ports with high dispersion and low repetition, which leads to a significant increase in entropy.

[0076] The extraction of time distribution features includes: analyzing the mean and variance of request times in the current behavior snapshot;

[0077] The extraction of protocol interaction features includes: analyzing the proportion of pure SYN packets, the proportion of SYN-ACK followed by RST packets, and the proportion of complete handshakes without interaction in the current behavior snapshot;

[0078] In TCP connections, sending only SYN packets (without completing the three-way handshake) is the most basic port scanning technique. A high proportion of pure SYN packets indicates that the attacker may only care about whether the port is open, and does not intend to establish a real connection for communication. This is very likely to reflect their reconnaissance intention rather than their communication intention. The proportion of SYN-ACK followed by RST packets can reflect that the scanner's intention may be to confirm the port status while avoiding establishing too many half-open connections to avoid being identified.

[0079] The load response feature extraction includes: analyzing the response consistency value in the current behavior snapshot.

[0080] The method for analyzing the target IP entropy is as follows:

[0081] Obtain all target IP addresses accessed in the current behavior snapshot and record them as the first IP address. Calculate the frequency p1 of each first IP address appearing in the behavior snapshot. Calculate the target IP entropy based on each frequency p1 using the information entropy formula.

[0082] The method for analyzing the target port entropy is as follows:

[0083] Obtain all target ports accessed in the current behavior snapshot and calculate the frequency p2 of each target port appearing in the behavior snapshot. Calculate the target port entropy based on each frequency p2 using the information entropy formula.

[0084] The analysis method for the mean of the request time and the variance of the request time is as follows:

[0085] The timestamp sequence is obtained by acquiring the timestamp of the request initiated by the subject in the current behavior snapshot. The time interval between two adjacent timestamps is calculated to obtain the time interval sequence. The mean of the request time is calculated based on the values ​​in the time interval sequence. The variance of the request time is obtained by using the variance formula based on the mean of the request time.

[0086] The pure SYN packet ratio refers to the proportion of connections that only send SYN packets (connection requests) but do not receive a SYN-ACK response out of the total number of connections. SYN (Synchronize Sequence Numbers) is a handshake signal used when establishing a TCP / IP connection.

[0087] The analysis method for the proportion of pure SYN packets is as follows:

[0088] Retrieve SYN packets that did not receive a SYN-ACK response in the current behavior snapshot, and record them as non-response SYN packets. Calculate the ratio of the number of non-response SYN packets in the current behavior snapshot to the total number of SYN packets in the current behavior snapshot as the pure SYN packet ratio.

[0089] The analysis method for the proportion of SYN-ACK followed by RST packets is as follows:

[0090] Get the number of RST packets sent after receiving the SYN-ACK response in the current behavior snapshot, and use the ratio of the number of RST packets to the total number of SYN packets in the current behavior snapshot as the proportion of RST packets following SYN-ACK.

[0091] The analysis method for the proportion of complete handshakes without interaction is as follows:

[0092] Get the number of connections that have completed the TCP three-way handshake L1 and the number of connections that have completed the TCP three-way handshake but have no application layer data in the current behavior snapshot. Use the ratio of the number of connections L2 to the number of connections L1 as the proportion of complete handshakes without interaction.

[0093] The method for analyzing the response consistency value is as follows:

[0094] In the current behavior snapshot, for the same target IP address, obtain the banner information of each response in the current behavior snapshot, group the same banner information into one category, analyze the frequency of occurrence of each category of banner information, and then calculate the response consistency value for the target IP address in the current behavior snapshot using the information entropy formula; in the same way, obtain the response consistency value for other target IP addresses or target ports in the current behavior snapshot.

[0095] S4. Using a pre-trained deep learning model, output the predicted feature vector for the next time step based on multiple feature vectors of the agent within the current latest time window:

[0096] The deep learning model uses a long short-term memory network model, which is trained using the historical normal feature vector sequence of the behavioral subject as training samples, and outputs the predicted feature vector of the behavioral subject for the next time step.

[0097] When training a model for a specific subject, it first obtains the subject's identity identifier. After each training prediction, the corresponding actual historical feature vector is used as a feedback signal to adjust the model parameters. After training, the corresponding model parameters and identity identifier are stored in a preset library. When using the model on a specific subject, the model obtains the subject's identity identifier and matches it with the identity identifier in the preset library. Then, it calls the corresponding model parameters, takes the feature vector sequence composed of multiple feature vectors of the subject in the current latest time window as input, and outputs the predicted feature vector for the next time step.

[0098] S6. Assess attack intent based on abnormal characteristics, evaluate the overall threat coefficient of attack intent based on the assessment results, and combine the abnormal characteristics and the overall threat coefficient of attack intent to assess the threat risk coefficient:

[0099] The attack intent assessment based on abnormal characteristics specifically includes:

[0100] Obtain a pre-built attack intent knowledge base, which records various attack intents and multiple combinations of first abnormal features corresponding to each attack intent, as well as the error value range conditions of each first abnormal feature in each combination of first abnormal features when corresponding to the attack intent.

[0101] The current abnormal feature type combination is matched with the first abnormal feature type combination to filter out the first attack intent, and the matched first abnormal feature type combination is used as the second abnormal feature type combination. The matching condition is: if the type range of the current abnormal feature type combination includes the type range of the first abnormal feature type combination or the type range is the same, then it is matched.

[0102] For example: the first abnormal feature combination corresponding to attack intent A is: 1. abnormal feature a+b, 2. abnormal feature a; the first abnormal feature combination corresponding to attack intent B is: 1. abnormal feature a+b, 2. abnormal feature c; the first abnormal feature combination corresponding to attack intent C is: abnormal feature c; the current abnormal feature combination is abnormal feature a+b, which includes abnormal feature a, so it matches the first abnormal feature combination of abnormal feature a+b and abnormal feature a of attack intent A, and matches the first abnormal feature combination of abnormal feature a+b of attack intent B. Therefore, attack intent A and attack intent B are considered as the first attack intent.

[0103] The second attack intent is selected from the first attack intent by matching the error values ​​of each current abnormal feature with the error value range of each first abnormal feature in the combination of second abnormal feature types when corresponding to the first attack intent.

[0104] For example, based on the previous example, the first abnormal feature combination 1, abnormal feature a+b, and 2, abnormal feature a of attack intent A, as well as the first abnormal feature combination 1, abnormal feature a+b of attack intent B, can all be used as the second abnormal feature combination. Assume that for the second abnormal feature combination 1, abnormal feature a+b of attack intent A, a and b correspond to the first and second error value conditions, respectively. For the second abnormal feature combination 2, abnormal feature a of attack intent A, a corresponds to the third error value condition. For the second abnormal feature combination 1, abnormal feature a+b of attack intent B, a and b correspond to the first and fourth error value conditions, respectively. If the current abnormal feature a satisfies the first error value condition but not the third error value condition, and the current abnormal feature b satisfies the second error value condition but not the fourth error value condition, then it can only match the second abnormal feature combination 1, abnormal feature a+b of attack intent A, thus attack intent A can be used as the second attack intent.

[0105] The overall threat coefficient Z of the attack intent is evaluated based on the attack intent assessment results, specifically as follows:

[0106] ;

[0107] N represents the number of secondary attack intentions. is the preset threat coefficient for the i-th second attack intent.

[0108] The pre-built attack intent knowledge base contains preset threat coefficients for each attack intent.

[0109] The threat risk coefficient is assessed by combining anomaly characteristics and attack intent to form a comprehensive threat coefficient, specifically as follows:

[0110] ;

[0111] F represents the threat risk coefficient, k1, k2, and k3 are the first, second, and third preset weights, respectively, RMSE is the root mean square error calculated based on the number of anomalous features and the error value, and n is the number of anomalous features. Let be the error value of the i-th abnormal feature. is the preset influence coefficient for the i-th abnormal feature.

[0112] In some embodiments, the method further includes retrieving corresponding preset defense strategies from a pre-built defense strategy library based on the attack intent assessment results and threat risk coefficients; the parameter values ​​of the strategy parameters of each preset defense strategy are matched with a corresponding preset threat risk coefficient range.

[0113] The pre-built defense strategy library retrieves the corresponding preset defense strategies: the preset defense strategies to be executed are selected based on the attack intent assessment results, the preset threat risk coefficient range corresponding to each preset defense strategy to be executed is queried based on the threat risk coefficient, the parameter values ​​of the corresponding strategy parameters are retrieved based on the preset threat risk coefficient range, and then the corresponding preset defense strategy to be executed is executed.

[0114] For example, if the attack intent assessment result is "port scanning" and the threat risk coefficient is 0.8, the template of the preset defense policy corresponding to "port scanning" in the defense policy library is: limit access to a maximum of M different ports within 60 seconds, where M is the policy parameter of the policy. When building the defense policy library, different threat risk coefficient ranges are set to correspond to different M values. Query the M value corresponding to the threat risk coefficient range that the threat risk coefficient of 0.8 falls into and apply the M value to execute the preset defense policy.

[0115] It should be noted that the above examples are for the purpose of simply and clearly explaining this solution and do not represent actual application.

[0116] Example 2

[0117] This invention also provides a cyberspace mapping threat detection system, which applies the cyberspace mapping threat detection method described in Embodiment 1, specifically including:

[0118] The acquisition module acquires the full network data packets of key nodes in the network space, and generates session metadata records after parsing the full network data packets;

[0119] The slicing module sets a dynamic time window. Within the same time window, it aggregates the session metadata records initiated by the same subject to form a behavior session stream. The behavior session stream is then sliced ​​according to a preset time interval to obtain a series of behavior snapshots sorted by time.

[0120] The feature extraction module performs multi-dimensional feature extraction on each behavior snapshot to construct a feature vector for each behavior snapshot. The multi-dimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction.

[0121] The prediction module uses a pre-trained deep learning model to output the predicted feature vector for the next time step based on multiple feature vectors of the actor within the current latest time window.

[0122] The judgment module calculates the error value between each type of actual feature in the actual feature vector of the subject at the next time step and each type of predicted feature in the corresponding predicted feature vector. If the error value is greater than the preset threshold, the corresponding actual feature is regarded as an abnormal feature.

[0123] The assessment module evaluates the threat risk coefficient based on abnormal characteristics.

[0124] Example 3

[0125] The present invention also provides an electronic device, including: a processor, a transmitting device, an input device, an output device, and a memory. The processor may be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory may be implemented using a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM), and is used to store computer program code. The computer program code includes computer instructions. When the processor executes the computer instructions, the electronic device executes a method as described in any of the above possible implementation methods.

[0126] Example 4

[0127] The present invention also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor of an electronic device, cause the processor to perform a method as described in any of the above possible implementations.

[0128] The beneficial effects of this invention are as follows:

[0129] This invention obtains behavioral snapshots of the same subject and extracts multi-dimensional features, including spatial distribution features, temporal distribution features, protocol interaction features, and payload response features, to construct feature vectors. A learning model then uses these feature vectors within the latest time window to output a predicted feature vector for the next time step. This predicted feature vector is compared with the actual feature vector to identify anomalous features. Attack intent is assessed based on these anomalous features, leading to an evaluation of the comprehensive threat coefficient. Finally, the threat risk coefficient is evaluated by combining the anomalous features and the comprehensive threat coefficient. This approach improves the accuracy of attack intent assessment through multi-dimensional features and enhances the accuracy of threat risk coefficient evaluation by combining anomalous features and the comprehensive threat coefficient.

[0130] The attack intent is assessed by performing a first match based on combinations of abnormal feature types, and then performing a second match based on the error value of the abnormal features. This improves the accuracy of the attack intent assessment.

[0131] By combining the idea of ​​assessing multiple possible attack intentions, after obtaining the attack intention assessment results, the overall threat coefficient is obtained by combining the preset threat coefficients of each attack intention. Then, the threat risk coefficient is further assessed by combining abnormal characteristics, thereby improving the accuracy of the threat risk coefficient assessment.

[0132] In the description of this specification, the references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0133] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0134] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting cyberspace mapping threats, characterized in that, Includes the following steps: Obtain all network data packets of key nodes in the network space, and generate session metadata records after parsing all network data packets; Set a dynamic time window, and within the same time window, aggregate the session metadata records initiated by the same subject to form a behavior session stream. Slice the behavior session stream according to a preset time interval to obtain a series of behavior snapshots sorted by time. For each behavior snapshot, multidimensional feature extraction is performed to construct a feature vector for each behavior snapshot. The multidimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction. The pre-trained deep learning model outputs the predicted feature vector for the next time step based on multiple feature vectors of the actor in the current latest time window. For each type of actual feature in the actual feature vector of the subject at the next time step, the error value is calculated between each type of predicted feature in the corresponding predicted feature vector. If the error value is greater than the preset threshold, the corresponding actual feature is regarded as an abnormal feature. The attack intent is assessed based on the abnormal characteristics. The comprehensive threat coefficient of the attack intent is evaluated based on the attack intent assessment results. The threat risk coefficient is evaluated by combining the abnormal characteristics and the comprehensive threat coefficient of the attack intent. The spatial distribution feature extraction includes: analyzing the target IP entropy and target port entropy in the current behavior snapshot; The extraction of time distribution features includes: analyzing the mean and variance of request times in the current behavior snapshot; The extraction of protocol interaction features includes: analyzing the proportion of pure SYN packets, the proportion of SYN-ACK responses followed by RST packets, and the proportion of complete handshakes without interaction in the current behavior snapshot; The load response feature extraction includes: analyzing the response consistency value in the current behavior snapshot.

2. The cyberspace mapping threat detection method according to claim 1, characterized in that, The process of parsing all network data packets to generate session metadata records includes parsing the L2 to L4 layers of the OSI model to obtain quintuple information and parsing the L7 layer to obtain application layer payload information.

3. The cyberspace mapping threat detection method according to claim 2, characterized in that, The quintuple information includes source IP, destination IP, source port, destination port, and transport layer protocol.

4. The cyberspace mapping threat detection method according to claim 1, characterized in that, The method for analyzing the target IP entropy is as follows: Obtain all target IP addresses accessed in the current behavior snapshot and record them as the first IP address. Calculate the frequency p1 of each first IP address appearing in the behavior snapshot. Calculate the target IP entropy based on each frequency p1 using the information entropy formula. The target port entropy is calculated as follows: Obtain all target ports accessed in the current behavior snapshot and calculate the frequency p2 of each target port appearing in the behavior snapshot. Calculate the target port entropy based on each frequency p2 using the information entropy formula.

5. The cyberspace mapping threat detection method according to claim 1, characterized in that, The analysis method for the mean of the request time and the variance of the request time is as follows: The timestamp sequence is obtained by acquiring the timestamp of the request initiated by the subject in the current behavior snapshot. The time interval between two adjacent timestamps is calculated to obtain the time interval sequence. The mean of the request time is calculated based on the values ​​in the time interval sequence. The variance of the request time is obtained by using the variance formula based on the mean of the request time.

6. The cyberspace mapping threat detection method according to claim 1, characterized in that, The analysis method for the proportion of pure SYN packets is as follows: Retrieve SYN packets that did not receive a SYN-ACK response in the current behavior snapshot, and record them as non-response SYN packets. Calculate the ratio of the number of non-response SYN packets in the current behavior snapshot to the total number of SYN packets in the current behavior snapshot as the pure SYN packet ratio. The analysis method for the proportion of SYN-ACK responses followed by RST packets is as follows: Get the number of RST packets sent after receiving the SYN-ACK response in the current behavior snapshot, and use the ratio of the number of RST packets to the total number of SYN packets in the current behavior snapshot as the proportion of RST packets following SYN-ACK. The analysis method for the proportion of complete handshakes without interaction is as follows: Get the number of connections that have completed the TCP three-way handshake L1 and the number of connections that have completed the TCP three-way handshake but have no application layer data in the current behavior snapshot. Use the ratio of the number of connections L2 to the number of connections L1 as the proportion of complete handshakes without interaction.

7. The cyberspace mapping threat detection method according to claim 1, characterized in that, The method for analyzing the response consistency value is as follows: In the current behavior snapshot, for the same target IP address, obtain the banner information of each response in the current behavior snapshot, group the same banner information into one category, analyze the frequency of occurrence of each category of banner information, and then calculate the response consistency value for the target IP address in the current behavior snapshot using the information entropy formula. In the same way, obtain the response consistency values ​​for other target IP addresses or target ports in the current behavior snapshot.

8. The cyberspace mapping threat detection method according to claim 1, characterized in that, The attack intent assessment based on abnormal characteristics specifically includes: Obtain a pre-built attack intent knowledge base, which records various attack intents and multiple combinations of first abnormal features corresponding to each attack intent, as well as the error value range conditions of each first abnormal feature in each combination of first abnormal features when corresponding to the attack intent. The current abnormal feature type combination is matched with the first abnormal feature type combination to filter out the first attack intent, and the matched first abnormal feature type combination is used as the second abnormal feature type combination. The matching condition is: if the type range of the current abnormal feature type combination includes the type range of the first abnormal feature type combination or the type range is the same, then it is matched. The second attack intent is selected from the first attack intent by matching the error values ​​of each current abnormal feature with the error value range of each first abnormal feature in the combination of second abnormal feature types when corresponding to the first attack intent.

9. A cyberspace mapping threat detection system, employing the cyberspace mapping threat detection method as described in any one of claims 1 to 8, characterized in that, include: The acquisition module acquires the full network data packets of key nodes in the network space, and generates session metadata records after parsing the full network data packets; The slicing module sets a dynamic time window. Within the same time window, it aggregates the session metadata records initiated by the same subject to form a behavior session stream. The behavior session stream is then sliced ​​according to a preset time interval to obtain a series of behavior snapshots sorted by time. The feature extraction module performs multi-dimensional feature extraction on each behavior snapshot to construct a feature vector for each behavior snapshot. The multi-dimensional feature extraction includes spatial distribution feature extraction, temporal distribution feature extraction, protocol interaction feature extraction, and load response feature extraction. The prediction module uses a pre-trained deep learning model to output the predicted feature vector for the next time step based on multiple feature vectors of the actor within the current latest time window. The judgment module calculates the error value between each type of actual feature in the actual feature vector of the subject at the next time step and each type of predicted feature in the corresponding predicted feature vector. If the error value is greater than the preset threshold, the corresponding actual feature is regarded as an abnormal feature. The assessment module evaluates attack intent based on abnormal characteristics, assesses the overall threat coefficient of attack intent based on the attack intent assessment results, and assesses the threat risk coefficient by combining the abnormal characteristics and the overall threat coefficient of attack intent. The spatial distribution feature extraction includes: analyzing the target IP entropy and target port entropy in the current behavior snapshot; The extraction of time distribution features includes: analyzing the mean and variance of request times in the current behavior snapshot; The extraction of protocol interaction features includes: analyzing the proportion of pure SYN packets, the proportion of SYN-ACK responses followed by RST packets, and the proportion of complete handshakes without interaction in the current behavior snapshot; The load response feature extraction includes: analyzing the response consistency value in the current behavior snapshot.

Images