A data processing method and system for network security monitoring

Abstract

The application relates to the technical field of network security, and discloses a data processing method and system for network security monitoring.The method comprises the following steps: acquiring network entity connection relationship data and historical attack event data; constructing graph structure data and obtaining an initial representation vector by embedding the graph structure data in a preset graph neural network; weighting the initial representation vector according to a network entity importance index to obtain a quantization matrix; extracting risk nodes from the quantization matrix, and obtaining potential transmission paths by random walk when the number of the risk nodes exceeds a preset number threshold; processing the potential transmission paths in segments to confirm a risk core mode; marking a propagation chain set based on the risk core mode; extracting node risk values from the propagation chain set and preprocessing the node risk values to obtain a risk state vector, inputting the risk state vector into a preset time sequence prediction model to obtain a predicted diffusion distribution probability; determining an enhanced monitoring target based on a preset probability threshold and the predicted probability; and obtaining a monitoring enhancement scheme after solving a target function.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring technology, and in particular to a data processing method and system for network security monitoring. Background Technology

[0002] Currently, in the field of network security monitoring technology, security platforms need to analyze information security status and output alarm information based on data such as communication connection relationships, access behavior and historical attack events between network entities.

[0003] In existing technologies, risk analysis is mostly achieved through rule matching, feature database comparison, or alarm correlation, primarily focusing on detecting and handling single-point events or abnormal behavior of individual network entities. However, in complex network topologies, risks may propagate through multiple hops along the connections between network entities, and the propagation path can dynamically adjust with changes in access relationships, business call chains, and risk aggregation states.

[0004] Therefore, existing technologies struggle to effectively predict the potential propagation paths and diffusion trends of risks among network entities in complex network interconnections. Summary of the Invention

[0005] This invention provides a data processing method and system for network security monitoring, so as to effectively predict the direction of risk spread.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a data processing method for network security monitoring, comprising:

[0007] Extract connection relationship data of network entities and historical attack event data from the network environment;

[0008] Graph structure data is constructed based on the connection relationship data of the network entities and the historical attack event data, and a preset graph neural network is used to embed the graph structure data to obtain an initial representation vector;

[0009] Obtain the importance index of the network entity, and adjust the initial representation vector according to the importance index of the network entity to obtain the quantization matrix;

[0010] A set of risk nodes is extracted from the quantization matrix. If the number of risk nodes exceeds a preset threshold, a random walk algorithm is used to process the set of risk nodes to obtain potential transmission paths.

[0011] Calculate segment similarity for the potential transmission path, and cluster and group the potential transmission path according to the segment similarity to confirm the consistency of the topological structure, thereby obtaining the risk core pattern of the potential transmission path;

[0012] Based on the connectivity strength of nodes in the core risk model, paths with connectivity strength lower than a preset connectivity strength threshold are marked as weak link paths, thus obtaining a set of propagation chains.

[0013] The risk values ​​of nodes are extracted from the propagation chain set and preprocessed to obtain a risk state vector. The risk state vector is then processed based on a preset time series prediction model to obtain the predicted diffusion distribution probability.

[0014] Based on the preset probability threshold and the predicted diffusion distribution probability, the enhanced monitoring target is identified, the monitoring resource constraints are obtained, and an objective function is constructed according to the enhanced monitoring target. The optimal configuration parameters are obtained by solving the objective function. A monitoring enhancement scheme is generated according to the optimal configuration parameters, and the configuration parameters of the monitoring resources are globally optimized to obtain the monitoring enhancement scheme.

[0015] Secondly, the present invention provides a data processing system for network security monitoring, comprising:

[0016] The data acquisition module is used to extract connection relationship data of network entities and historical attack event data from the network environment;

[0017] The risk characterization module is used to construct graph structure data based on the connection relationship data and the historical attack event data, and to embed the graph structure data into a preset graph neural network to obtain an initial representation vector.

[0018] The business weighting module is used to obtain the importance index of network entities, and to adjust the initial representation vector according to the importance index to obtain the quantification matrix of risk distribution status.

[0019] The path generation module is used to extract a set of risk nodes from the quantization matrix. If the number of risk nodes exceeds a preset threshold, a random walk algorithm is used to process the set of risk nodes to obtain potential transmission paths.

[0020] The pattern recognition module is used to calculate the segment similarity of the potential transmission path, cluster and group the potential transmission path according to the segment similarity and confirm the consistency of the topological structure to obtain the risk core pattern of the potential transmission path;

[0021] The chain output module is used to mark paths with connectivity strength lower than a preset connectivity strength threshold as weak link paths based on the connectivity strength of nodes in the risk core mode, thereby obtaining a set of propagation chains.

[0022] The time-series extrapolation module is used to extract node risk values ​​from the propagation chain set and preprocess them to obtain a risk state vector. Based on a preset time-series prediction model, the risk state vector is processed to obtain the predicted diffusion distribution probability.

[0023] The scheme generation module is used to identify enhanced monitoring targets based on preset probability thresholds and the predicted diffusion distribution probability, obtain monitoring resource constraints, construct an objective function based on the enhanced monitoring targets, solve the objective function to obtain optimal configuration parameters, and generate a monitoring enhancement scheme based on the optimal configuration parameters.

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] (1) This invention constructs graph structure data by combining network entity connection relationship data and historical attack event data, and uses graph neural network to embed the graph structure data to represent it, thereby depicting the topological association and attack impact relationship between network entities in a unified representation space. This solves the problem that existing technologies have difficulty in effectively predicting the potential propagation path and diffusion trend of risks under complex network connection relationships.

[0026] (2) The present invention obtains the importance index of network entities and adjusts the initial representation vector according to the importance index of network entities to obtain a quantification matrix, so that the risk quantification result can reflect the difference in the criticality of different network entities in network operation and their impact on risk propagation. This solves the problem that the existing technology is difficult to effectively predict the potential propagation path and diffusion trend of risk under complex network connection relationships.

[0027] (3) This invention simulates the risk propagation process using a random walk algorithm, extracts and clusters potential propagation paths to obtain the core risk pattern, and combines it with time series deduction to obtain the predicted diffusion distribution probability; thereby achieving structured output of risk propagation analysis results, and adaptively determining the network areas or network entity sets that need enhanced monitoring, globally optimizing the monitoring resource configuration parameters, and outputting an executable monitoring enhancement configuration scheme to improve the accuracy and timeliness of risk node set extraction and propagation analysis triggering. Attached Figure Description

[0028] Figure 1 This is a schematic flowchart of a data processing method for network security monitoring provided in the first embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram of a data processing system structure for network security monitoring provided in the second embodiment of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] Reference Figure 1 The first embodiment of the present invention provides a data processing method for network security monitoring, comprising the following steps:

[0032] S11, extract connection relationship data of network entities and historical attack event data from the network environment;

[0033] S12, construct graph structure data based on the connection relationship data and the historical attack event data, and use a preset graph neural network to embed the graph structure data to obtain an initial representation vector;

[0034] S13, obtain the importance index of the network entity, and adjust the initial representation vector according to the importance index to obtain the quantization matrix of the risk distribution state;

[0035] S14, extract the risk node set from the quantization matrix. If the number of risk nodes exceeds a preset threshold, use a random walk algorithm to process the risk node set to obtain potential transmission paths.

[0036] S15, calculate the segment similarity of the potential transmission path, and cluster and group the potential transmission path according to the segment similarity and confirm the consistency of the topological structure to obtain the risk core pattern of the potential transmission path;

[0037] S16, Based on the connectivity strength of nodes in the core risk mode, paths with connectivity strength lower than a preset connectivity strength threshold are marked as weak link paths to obtain a propagation chain set.

[0038] S17. Extract node risk values ​​from the propagation chain set and preprocess them to obtain a risk state vector. Process the risk state vector based on a preset time series prediction model to obtain the predicted diffusion distribution probability.

[0039] S18. Based on the preset probability threshold and the predicted diffusion distribution probability, confirm the enhanced monitoring target, obtain the monitoring resource constraints, construct an objective function according to the enhanced monitoring target, solve the objective function to obtain the optimal configuration parameters, and generate a monitoring enhancement scheme according to the optimal configuration parameters.

[0040] In step S11, it is necessary to extract connection relationship data of network entities and historical attack event data from the network environment. It should be noted that network entities refer to identifiable and manageable physical or logical resources in cyberspace.

[0041] Specifically, the connection relationship data includes the topological connections and logical communication links between network entities. In this embodiment, network entity connection relationships are obtained through traffic mirroring analysis technology or SNMP protocol scanning. For example, it is found that there is a communication connection between the core database server and the web application server based on TCP port 3306, and a connection between the web application server and the perimeter protection device based on HTTP port 80.

[0042] Historical attack event data refers to security alerts, vulnerability exploitation records, and malicious behavior audit logs recorded in the network environment. This data is extracted from the databases of the Security Operations Center (SOC) or Intrusion Detection System (IDS). For example, records showing a web application server experiencing five SQL injection attempts in the past 30 days, and historical events showing an edge terminal being detected as infected with a Trojan program in the past 30 days, are extracted.

[0043] In step S12, graph structure data is constructed based on the connection relationship data and the historical attack event data, and a preset graph neural network is used to embed the graph structure data to obtain an initial representation vector, including:

[0044] Based on the connection relationship data, a network topology adjacency matrix is ​​constructed, and attack features are extracted from the historical attack event data to construct a node attribute matrix.

[0045] By fusing the network topology adjacency matrix with the node attribute matrix, graph structure data is obtained;

[0046] A preset graph neural network is used to perform feature aggregation processing on the graph structure data to obtain a network dimension vector;

[0047] The distribution of the network dimension vector is analyzed, the attack impact probability is calculated, and the attack impact probability is organized to obtain the initial representation vector.

[0048] It should be noted that the adjacency matrix of the network topology represents the physical or logical connection status between different network entities, and the size of the matrix is ​​determined according to the number of entities. Simultaneously, threat level, attack frequency, and the number of historical vulnerabilities are extracted from historical attack event data. The threat level comes from the severity field in the historical attack event records and is divided into low, medium, high, and severe. When the field itself is a numerical level, the level value is directly taken; when the field is a text category, a preset mapping table is used to map the low, medium, high, and severe categories to level values ​​of 1, 2, 3, and 4 respectively.

[0049] Attack frequency is obtained by counting the total number of attack events within a preset statistical window and dividing by the window duration. The statistical window is a pre-configured parameter of the system and can be set to a fixed duration according to real-time requirements. The number of historical vulnerabilities comes from the vulnerability records of the network entity within the vulnerability statistical time range, where the vulnerability statistical time range is a pre-configured parameter that can be set by the platform as needed. The number of historical vulnerabilities is obtained by deduplicating vulnerability entries. The dimensional features are subjected to min-max normalization and scaled to the 0-1 range.

[0050] One-hot encoding is used to process category features such as entity type, and these features are then concatenated with the normalized numerical features to construct a node attribute matrix. By fusing the network topology adjacency matrix with the node attribute matrix, graph structure data containing topological dependencies and security vulnerability distribution characteristics is obtained.

[0051] It's worth noting that the pre-defined graph neural network (GCN) is the core tool for performing high-dimensional feature extraction and node relationship modeling. The GCN employs a three-layer graph convolutional network structure. The number of neurons in the input layer matches the feature dimension of the node attribute matrix; the hidden layer has a feature dimension of 128 and uses ReLU as the activation function; the output layer contains one neuron, using Sigmoid as the activation function to output the attack impact probability between 0 and 1. The GCN aggregates the features of neighboring nodes through multi-layer graph convolution operations, obtaining a network dimension vector representing the deep association features of nodes. The number of convolution kernels is set to 128, and their size is dynamically determined based on the normalized adjacency matrix of the graph structure. The weight propagation mechanism means that during the convolution operation, the feature representation of the central node is determined by the weighted sum of its own features and the features of its neighboring nodes after transformation by a learnable weight matrix. The weight matrix uses the Xavier initialization method, with the bias term initialized to zero.

[0052] The model training employs a cross-entropy loss function, with supervision labels provided by confirmed attack nodes or alarm annotations from historical attack event data. The Adam optimizer is used for iterative training at a learning rate of 0.001 until the model converges. The system utilizes the output layer to perform linear transformations and nonlinear mappings on the network dimension vectors output from the hidden layers to calculate the attack impact probability of each node.

[0053] In step S13, the importance index of network entities is obtained, and the initial representation vector is weighted and adjusted according to the importance index to obtain a quantization matrix of risk distribution status, including:

[0054] Obtain classification information and business relationships of network entities from the network security platform;

[0055] Information importance weights are generated based on the classification information, and propagation association weights are determined based on the business association relationships.

[0056] Real-time operational data is obtained from a network security platform. A dynamic change factor is constructed based on the real-time operational data. The information importance weight and the propagation association weight are adjusted based on the dynamic change factor. The adjusted weight is then obtained after processing.

[0057] The initial representation vector is weighted and adjusted according to the adjusted weights to obtain the quantization matrix of the risk distribution state.

[0058] It should be noted that classification information can characterize the type of network entity; business relationships are used to characterize the dependency, invocation, and access relationships between different network entities. Specifically, network entities can be categorized and layered, with baseline weights set for different categories based on dimensions such as confidentiality, integrity, and availability. For confidentiality, the hierarchical identifiers of the data carried by the network entity can be read, such as public, internal, sensitive, and confidential, and mapped to (0.25, 0.5, 0.75, 1.0) respectively. Integrity indicators can be extracted from the network entity's relationship configuration, such as whether it is on a critical control link, whether integrity verification is enabled, and the number of recent high-risk changes, and these indicators are mapped to a score between 0 and 1. Availability targets or RTO thresholds can be obtained from the business system's SLA configuration and converted into a score between 0 and 1. After obtaining the quantitative results of the three dimensions, a weighted summation is performed to form a set of network entity importance weights. Within the current monitoring period, the maximum and minimum values ​​of the baseline importance weights of all entities in the network are calculated, and the baseline importance weight of each entity is scaled to the 0-1 range according to this range, thus obtaining the information importance weight.

[0059] It is worth noting that the propagation association weight reflects the ease with which a risk can penetrate to neighboring nodes through business interaction paths after a node has been attacked. In this embodiment, determining the propagation association weight first requires extracting the topology connection parameters from the business relationship, which are obtained by parsing the business relationship data in the network security platform. Business relationships exist in the form of "source entity - target entity" call, access records, or dependency configurations. The platform extracts the edges and directions between network entities based on this relationship, forming an interaction topology. From this, topology connection parameters such as the node's neighbor set and the number of connections can be obtained. The degree centrality of the target node is then calculated. In the business relationships, all records where the source entity identifier equals the target node identifier are retrieved, and the target entity identifier is extracted to form an outgoing neighbor set. Similarly, all records where the target entity identifier equals the target node identifier are retrieved, and the source entity identifier is extracted to form an incoming neighbor set. The outgoing and incoming neighbor sets are then joined and deduplicated to obtain the neighbor node set. The number of elements in the neighbor node set is counted to obtain the degree centrality. Subsequently, the business traffic intensity between this node and other nodes is obtained. This is calculated by retrieving all records where the source entity identifier equals the target node identifier, obtaining the session byte count for each record, and summing them to obtain the total node session byte count within the monitoring period. Dividing the total node session byte count by the window length of the monitoring period yields the business traffic intensity.

[0060] The propagation correlation weight is obtained by weighting and summing the degree centrality and traffic intensity. It is worth noting that the first and second weight coefficients add up to 1. The first and second weight coefficients are determined through offline calibration. In the offline calibration phase, attack chain sequences are extracted from historical attack event data. These sequences consist of network entity identifiers ordered by time. Positive sample nodes are generated for intermediate nodes in the attack chain sequences. The features of positive sample nodes are the degree centrality score and traffic intensity score of the intermediate node within the monitoring period aligned with the attack event timestamp. The positive sample label is 1. A candidate negative sample node set is constructed from network entity identifiers that have never appeared in any attack chain sequence within the same monitoring period. Nodes with the same number as positive samples are randomly selected from the candidate negative sample node set to generate negative sample nodes. The negative sample label is 0. In this embodiment, the sample nodes are time-divided according to the start timestamp of the monitoring period to obtain a training set and a validation set.

[0061] In this embodiment, a candidate set is defined for the first weight coefficient, covering values ​​from 0 to 1 and containing multiple discrete candidate values. The second weight coefficient is obtained by subtracting the first weight coefficient from 1. For each candidate first weight coefficient, the degree centrality score is multiplied by the candidate first weight coefficient, and the traffic intensity score is multiplied by the candidate second weight coefficient. The two multiplication results are then added together to obtain the propagation correlation weight score. The area under the ROC curve (AUC) corresponding to the propagation correlation weight score is calculated on the validation set, and the AUC is averaged using cross-validation. The candidate first weight coefficient with the largest average AUC is selected as the first weight coefficient, and the second weight coefficient is obtained by subtracting the first weight coefficient from 1.

[0062] Furthermore, real-time operational data refers to indicators that reflect the immediate load and activity status of network entities within the current monitoring period, including but not limited to CPU utilization, memory usage, real-time connection count, and bandwidth usage.

[0063] The dynamic change factor is a moderating variable used to characterize the impact of node operating load on the sensitivity of security risks. The dynamic change factor is obtained by mapping the membership degree of at least one core indicator in the real-time operating data. The core indicators are preferably a combination of bandwidth utilization and CPU utilization, memory utilization, and real-time connection number and bandwidth utilization. When a combination indicator is used, the CPU utilization, memory utilization, real-time connection number and bandwidth utilization are respectively input into a preset membership function to obtain the corresponding adjustment coefficients, and the adjustment coefficients are weighted and summarized to obtain the dynamic change factor. For example, using a piecewise linear membership function as the preset membership function, the dynamic change factor is set to 1.0 when the bandwidth utilization rate is between 0% and 30%; when the bandwidth utilization rate is between 30% and 70%, the dynamic change factor changes in a piecewise linear manner between 1.0 and 1.4; when the bandwidth utilization rate is between 70% and 90%, the dynamic change factor is set to 1.4; when the bandwidth utilization rate is between 90% and 95%, the dynamic change factor changes in a piecewise linear manner between 1.4 and 1.8; and when the bandwidth utilization rate is between 95% and 100%, the dynamic change factor is set to 1.8.

[0064] It should be noted that the interval boundaries in the piecewise linear membership function are determined through offline calibration. During the offline calibration phase, this embodiment extracts real-time operational data from multiple monitoring periods from historical operational logs and extracts attack event records from historical attack event data. The real-time operational data samples and attack event records are aligned according to network entity identifiers and the start timestamp of the monitoring period to obtain labeled samples. A label value of 1 for a labeled sample indicates that an attack event occurred in that monitoring period, while a label value of 0 indicates that no attack event occurred in that monitoring period.

[0065] Real-time running data is divided according to candidate thresholds, which are selected from different values ​​of the real-time running data. Four thresholds are enumerated from the candidate thresholds to divide the 0% to 100% range into five adjacent intervals. For each set of thresholds, the percentage of samples with a label of 1 within each of the five intervals is calculated. The sum of the squared differences between the label of each interval and the percentage of labels in that interval is calculated as the interval error. The five interval errors are added together to obtain the total error of the set of thresholds. The four thresholds with the smallest total error are selected as the interval boundaries. The interval boundaries are 30%, 70%, 90%, and 95%, and the segmentation points of the piecewise linear membership function are determined accordingly.

[0066] It should be noted that the baseline weight is obtained by multiplying the information importance weight by the dissemination correlation weight, and the adjusted weight is obtained by multiplying the dynamic change factor by the baseline weight. The dynamic change factor is then used as a scaling operator to perform a composite operation with the baseline weight. In this way, static business attributes are coupled with dynamic operational status, outputting an adjusted weight that reflects real-time risk tolerance.

[0067] It is worth noting that the initial representation vector (containing the original attack impact probability of each network entity) is multiplied element-wise with the generated adjusted weights to obtain the weight-corrected risk vector. The quantization matrix of the risk distribution state is obtained by arranging the weight-corrected risk scores of each node according to the spatial topological index.

[0068] In step S14, the risk node set is extracted from the quantization matrix. If the number of risk nodes in the risk node set exceeds a preset threshold, a random walk algorithm is used to process the risk node set to obtain potential transmission paths, including:

[0069] Traverse the elements of the quantization matrix, extract the elements that exceed the preset safety baseline, and combine them into a risk node set;

[0070] If the number of risk nodes exceeds a preset threshold, the state transition probability is determined based on the connection relationship data, and a random walk algorithm is used to process the risk node set in combination with the state transition probability to generate a walk trajectory. Target paths that meet a preset confidence level are extracted from the walk trajectory to form the potential transmission path.

[0071] It should be noted that the preset security baseline selects data from normal business cycles as the baseline sample set during the offline phase. A normal business cycle is defined as the monitoring cycle in which the mean and standard deviation of the risk values ​​of all network nodes are statistically analyzed over historical monitoring cycles. Monitoring cycles in which none of these statistical values ​​exceed the 95th percentile of their historical values ​​are considered normal business cycles, and the baseline sample set is constructed accordingly. The mean and twice the standard deviation are then added to obtain the preset security baseline. When the risk value of any network entity in the current monitoring cycle is higher than the preset security baseline, the network entity is determined to meet the risk node condition. Furthermore, the combination method of the risk node set refers to the process of aggregating the identifiers of network entities that meet the risk node condition. In this embodiment, the quantification matrix of risk distribution is traversed. For each matrix element with a risk value higher than the preset security baseline, the network entity identifier corresponding to that matrix element is extracted and appended to a unified container to form the risk node set.

[0072] It should be noted that the preset quantity threshold is used to determine whether the current network risk has the potential for large-scale spread and to trigger in-depth simulation analysis. Its length can be determined according to the scale of the network topology and the carrying capacity of computing resources.

[0073] State transition probability is an indicator that measures the likelihood of risk penetrating from the current node to neighboring nodes. By extracting connection strength data between network entities (such as service traffic frequency and protocol trust level), normalized sub-scores are generated for service traffic frequency and protocol trust level, respectively. Multiple normalized sub-scores are then aggregated to obtain the edge connection strength score. For service traffic frequency, this embodiment extracts historical samples from normal service cycles during the offline phase, calculates the lower and higher quantile boundary values ​​of the service traffic frequency, which are the 5% and 95th percentile values ​​of the historical samples of the service traffic frequency, respectively. These lower and higher quantile boundary values ​​are used as pruning boundaries. When the service traffic frequency of the current monitoring period is less than the lower quantile boundary value, the lower quantile boundary value is used; when it is greater than the higher quantile boundary value, the higher quantile boundary value is used. This embodiment performs min-max normalization on the pruned service traffic frequency to obtain service traffic sub-scores between 0 and 1. For protocol trust levels, this embodiment pre-establishes a mapping table from protocol trust levels to numerical values. The input of the mapping table is the protocol trust level enumeration value, and the output is a trust sub-score between 0 and 1. The trust sub-score monotonically increases with the protocol trust level.

[0074] This embodiment calculates the arithmetic mean of the service traffic sub-score and the trust sub-score to obtain the edge connection strength score. It then performs min-max normalization on the edge connection strength scores corresponding to all adjacent nodes pointed to by the same source network entity to obtain the state transition probability. The edge connection strength scores on all outgoing edges of the current node are summed, and the edge connection strength score of each outgoing edge is divided by the summation result to obtain the state transition probability from the current node to the corresponding adjacent node. A higher connection strength probability value indicates a greater state transition probability. The random walk algorithm uses each risk node in the set as a starting seed point and iteratively jumps through the network topology graph according to the state transition probability to simulate the attacker's lateral movement within the network. Generating the walk trajectory involves recording the jump sequence of each node during the random walk process and organizing it into path data containing temporal characteristics.

[0075] It is worth noting that extracting target paths that meet the preset confidence level means performing frequency statistics on the full trajectory sequence generated by the random walk, calculating the proportion of the frequency of each path sequence to the total number of simulations, and selecting sequences whose proportion is greater than or equal to the preset confidence threshold as path segments. The preset confidence threshold is calibrated and determined in the offline stage based on the replay results of the attack link verified in the historical attack event data.

[0076] Specifically, the node sequences that meet the confidence requirements are connected in order of jump sequence. The topological validity is confirmed by verifying the physical link connectivity between nodes. The comprehensive confidence score and generation time information corresponding to the path are attached. Through the aggregation and objectification of the above data, a potential transmission path is formed.

[0077] In step S15, calculating segment similarity for the potential transmission path, clustering and grouping the potential transmission path based on the segment similarity, and confirming topological consistency to obtain the risk core pattern of the potential transmission path includes:

[0078] Each potential transmission path is represented as a sequence of network entity identifiers arranged in chronological order;

[0079] A sliding window is used to extract a subsequence of a preset length from each potential network entity identifier sequence as a path segment, resulting in a set of path segments;

[0080] Extract fragment features from path segments. Fragment features include node type sequence, edge connection strength sequence, and node risk value sequence.

[0081] Calculate the sequence similarity of the node type sequence, edge connection strength sequence, and node risk value sequence respectively, and then calculate the average to obtain the segment similarity.

[0082] Density clustering is used to group the path segment set to obtain the grouped segment set;

[0083] For each set of grouped segments, construct the set of directed edges for the segments within the group and generate a topological graph;

[0084] Based on the topology diagram, the consistency of the topology is determined to identify the core risk patterns of potential transmission paths. Among them, the topology diagram corresponding to the set of group segments with isomorphic mapping is used as the core risk pattern; the set of group segments without isomorphic mapping is not included in the set of core risk patterns.

[0085] It should be noted that each potential transmission path is represented as a sequence of network entity identifiers arranged in chronological order, and then two parameters, the sliding window length and the step size, are set. For example, the window length is derived from historical attack event data during the offline calibration phase, and the step size is set to 1, resulting in a reproducible truncation method for adjacent segment coverage. The sliding window gradually shifts to the right from the first element of each network entity identifier sequence, moving one element to the right each time, truncating a fixed-length subsequence as a path segment, thus obtaining a set of path segments. For each path segment, segment features are extracted, including three categories: node type sequence, edge connection strength sequence, and node risk value sequence.

[0086] In this embodiment, the similarity of the three types of sequences is calculated separately and then fused when calculating the segment similarity. The node type sequence similarity uses edit distance normalized similarity; the edge connection strength sequence similarity is calculated by aligning two edge connection strength sequences according to their positions in the segment, performing min-max normalization on the edge connection strength values ​​at each position using the minimum and maximum values ​​obtained from offline calibration, calculating the absolute value of the difference between the corresponding positions after normalization, and averaging the results to obtain the average difference value. The result of subtracting the average difference value is taken as the edge connection strength sequence similarity; the calculation process for node risk value sequence similarity is the same as that for edge connection strength sequence similarity, the difference being that the input sequence is a node risk value sequence, and the normalized minimum and maximum values ​​are obtained by statistically analyzing the elements of the quantization matrix during the offline calibration stage. Finally, the segment similarity is calculated by averaging the three sequence similarities, and this is taken as the segment similarity of the path segment.

[0087] Furthermore, the similarity between each pair of path segments is calculated from the path segment set. This embodiment uses density-based clustering to group the path segment set into grouped segment sets. During density clustering, the segment similarity is first converted to a distance value, which is one minus the segment similarity. Let the total number of segments in the path segment set be the sample size, and set the minimum sample size to the integer part of the natural logarithm of the sample size. The neighborhood radius is determined using the k-distance curve inflection point method, where k is the minimum sample size minus 1. For each path segment, the distance to its k-th nearest neighbor is calculated, and the segments are sorted in ascending order to obtain the k-distance curve. The distance increment between adjacent sorted points is then calculated. In this embodiment, the distance to the k-th nearest neighbor corresponding to the sorted point with the largest distance increment is used as the neighborhood radius, resulting in a reproducible neighborhood radius determination rule.

[0088] For each group of segments, this embodiment constructs a set of directed edges for the segments within the group and generates a topology graph. A graph isomorphism determination process is used to ensure topology consistency. Node isomorphism constraints include consistent node type, consistent edge direction, and consistent edge position order within the path segments. Consistent edge position order within the path segments means that the i-th hop edge of two path segments corresponds only to the i-th hop edge of another path segment, without reordering the edge connection strength values. For the numerical attribute of edge connection strength, a tolerance threshold is set, and the absolute value of the normalized connection strength difference between two corresponding edges not exceeding this threshold is used as one of the isomorphism constraints. The edge connection strength tolerance threshold is determined by offline calibration. During the offline calibration phase, repeated communication records between the same source node and destination node are selected within the normal business cycle. The absolute value of the normalized connection strength difference of the same directed edge in different monitoring cycles is statistically analyzed, and the high quantile of this absolute value is used as the edge connection strength tolerance threshold. Graph isomorphism determination uses the VF2 matching process to output whether isomorphic mapping exists. The topological structure graph corresponding to the set of grouped segments with isomorphic mappings is used as the core risk pattern; the set of grouped segments without isomorphic mappings is not included in the set of core risk patterns.

[0089] In step S16, based on the connectivity strength of nodes in the risk core pattern, paths with connectivity strength lower than a preset connectivity strength threshold are marked as weak links, resulting in a propagation chain set, including:

[0090] Based on the risk core pattern, nodes are extracted, a local topology is constructed according to the nodes, and the connection relationship data is statistically analyzed within a preset statistical time window to obtain the node interaction frequency. The risk value of the node is extracted from the quantization matrix, and the link weight of the local topology is determined according to the node interaction frequency and the risk value.

[0091] Based on the link weights, the connectivity strength of the paths in the local topology is calculated, and paths with connectivity strength lower than the preset connectivity strength threshold are identified as weak link candidate paths.

[0092] The blocking cost of the weak link candidate paths is evaluated, and the weak link candidate paths whose blocking cost meets the preset blocking cost threshold are determined as the propagation chain set.

[0093] In one implementation, each connection record in the connection relationship data includes at least the source entity identifier, the destination entity identifier, the record timestamp, and the session identifier. When the connection relationship data also includes the source port, the destination port, the protocol type, the number of session bytes, and the session duration, this embodiment retains these fields and participates in the subsequent blocking cost assessment.

[0094] It should be noted that, based on the link set of the local topology, a "link session arrival time series" is constructed. The difference between two adjacent session arrival timestamps for each link is used to obtain an "arrival time interval set." This set of arrival time intervals is sorted in ascending order, and the arrival time interval at the third-to-last position after sorting is taken as the candidate time window length for that link. The third-to-last position is determined using the nearest rank method. Candidate time window lengths are obtained for all links in the local topology, and the median of these candidate time window lengths is taken as the preset statistical time window length. This window length is recalculated as the connection relationship data is updated.

[0095] It is worth noting that a sliding statistical analysis is performed on the connection relationship data using a preset statistical time window as the statistical unit. The sliding step size is determined by the timestamp precision of the connection relationship data. The minimum time resolution of the recorded timestamps in the connection relationship data is statistically analyzed, and this minimum time resolution is used as the sliding step size. When the recorded timestamp precision is 1 second, the sliding step size is 1 second. For any link in the local topology, this embodiment counts the number of connection records for that link within the preset statistical time window. Dividing this number of connection records by the window length of the preset statistical time window yields the link interaction frequency for that link. This embodiment obtains the link interaction frequency for all links in the local topology.

[0096] It should be noted that the link interaction frequency is processed by minimum-maximum normalization within the local topology link set to obtain the normalized interaction frequency; the node risk value of the local node set is processed by minimum-maximum normalization to obtain the normalized risk value. When the maximum and minimum values ​​of the interaction frequency within the local topology are the same, this embodiment sets the normalized interaction frequency to 0.5; when the maximum and minimum values ​​of the risk value within the local node set are the same, this embodiment sets the normalized risk value to 0.5.

[0097] In one implementation, for any link in the local topology, the arithmetic mean of the normalized risk values ​​of the nodes at both ends of the link is taken to obtain the mean endpoint risk of the link; the mean endpoint risk is multiplied by the normalized interaction frequency to obtain the link weight of the link, so that the link weight reflects both the interaction frequency and the risk value.

[0098] It should be noted that the connectivity strength of any path in the local topology is calculated based on link weights. In this embodiment, the minimum link weight of all links traversed by the path is taken. For any path in the local topology, the set of links traversed by that path is extracted, and the link weight corresponding to each link in the set is read sequentially to obtain the link weight sequence of that path. In this embodiment, the link weight with the smallest value in the link weight sequence is selected as the connectivity strength of that path, so that the path connectivity strength reflects the weak links in the path.

[0099] The preset connectivity strength threshold is determined based on historical attack event data. The network entity sequences involved in the attack events are extracted from the historical attack event data, and directed connection pairs formed by adjacent network entities are mapped as positive sample paths. Paths with the same length as the positive sample paths but not appearing in the network entity sequences involved in the attack events are randomly sampled in the local topology to form negative sample paths. The connectivity strength of the positive and negative sample paths is calculated separately, and the candidate threshold set is derived from the connectivity strength values ​​of the sample paths. In this embodiment, the connectivity strength of all positive and negative sample paths is calculated separately, and all connectivity strength values ​​are merged, deduplicated, and sorted in ascending order.

[0100] This embodiment generates candidate thresholds using the median value of two adjacent different connectivity strength values, and uses the lowest and highest ranked connectivity strength values ​​as boundary values ​​for the candidate threshold set. For any candidate threshold, this embodiment classifies paths with connectivity strength below the candidate threshold as weak links and paths with connectivity strength not lower than the candidate threshold as non-weak links. This embodiment counts the number of weak links identified in positive sample paths and divides it by the total number of positive sample paths to obtain the true positive rate; it also counts the number of weak links identified in negative sample paths and divides it by the total number of negative sample paths to obtain the false positive rate. The difference between the true positive rate and the false positive rate is calculated for each candidate threshold. This embodiment selects the candidate threshold that maximizes the difference between the true positive rate and the false positive rate as the preset connectivity strength threshold; when there are ties in the difference, this embodiment selects the candidate threshold with the smaller value as the preset connectivity strength threshold. This threshold is recalculated as historical attack event data is updated. Paths with connectivity strength below the preset connectivity strength threshold are identified as weak link candidate paths.

[0101] It should be noted that a blocking action set is constructed for each weak link candidate path. This set includes port blocking actions, access control policy tightening actions, and session mirroring actions. The number of service sessions and the number of service failures are counted for each weak link candidate path within a preset statistical time window. In this embodiment, the service failure rate is obtained by dividing the number of service failures by the number of service sessions. When the number of service sessions is 0, the service failure rate is set to 0. This embodiment calculates the average response latency of the path within the preset statistical time window and extracts the baseline average response latency from the historical baseline data corresponding to the path within the normal business cycle. The difference between the two is taken, and the absolute value is used to obtain the change in average response latency. This embodiment uses the historical samples corresponding to the path within the normal business cycle as the normalized sample set. The minimum and maximum values ​​for the number of service sessions, the service failure rate, and the change in average response latency are determined as the upper and lower bounds for normalization. Min-max normalization is then performed on the three indicators within the current statistical time window to obtain three normalized indicators. The normalization upper and lower bounds are preferably taken from the 5th and 95th percentile values ​​of historical samples to reduce the impact of extreme values ​​on the normalization results. The arithmetic mean of the three normalization indicators is taken to obtain the business impact. The arithmetic mean is an equally weighted average, with each of the three indicators having a weight of 1 / 3. Based on the security platform policy issuance records, the number of policy changes and rollbacks are counted to calculate the implementation occupancy. Within a preset statistical time window, the number of policy changes corresponding to blocking actions and the number of rollbacks corresponding to blocking actions are counted. In this embodiment, the number of policy changes and rollbacks are added together to obtain the action occupancy count, and the action occupancy count is normalized by minimum-maximum normalization to obtain the implementation occupancy.

[0102] It should be noted that the minimum and maximum values ​​of the business impact will be calculated for all blocking actions in the current assessment, and the business impact will be normalized to the minimum and maximum values. Similarly, the minimum and maximum values ​​of the implementation occupancy will be calculated for all blocking actions in the current assessment, and the implementation occupancy will be normalized to the minimum and maximum values. When the maximum and minimum values ​​of the business impact are the same, the normalization result of the business impact will be uniformly set to 0.5. When the maximum and minimum values ​​of the implementation occupancy are the same, this embodiment will uniformly set the normalization result of the implementation occupancy to 0.5. The arithmetic mean of the normalized business impact and the normalized implementation occupancy will be used as the blocking cost. The preset blocking cost threshold will be determined through offline playback assessment. Historical handling records will be jointly extracted from the security platform's handling work order database and policy issuance records. Historical handling records will at least include the handling action identifier, handling action type, policy issuance timestamp, rollback timestamp, and business monitoring indicators before and after the handling.

[0103] This embodiment uses all historical processing records that meet the field integrity condition before the offline calibration time point as the sample set. When the blocking action corresponding to a certain historical processing record has no rollback record within the preset observation period, and the business failure rate within the preset observation period does not exceed the preset deviation threshold of the historical baseline failure rate, and the change in average response latency does not exceed the preset deviation threshold of the historical baseline latency, this embodiment marks the historical processing record as having an acceptable blocking cost with a label of 1; otherwise, it is marked as 0. The preset deviation threshold can be taken as the 95th percentile value of the deviation amount in the normal business cycle.

[0104] In step S17, the step of extracting node risk values ​​from the propagation chain set and preprocessing them to obtain a risk state vector, and then processing the risk state vector based on a preset time-series prediction model to obtain the predicted diffusion distribution probability, includes:

[0105] Extract a node set based on the propagation chain set, determine the node index based on the node set, extract the node risk value corresponding to the node set based on the quantization matrix, normalize the node risk value, and fill it into vector elements according to the node index to construct the risk state vector at the initial moment.

[0106] Based on the risk state vector and the connection relationship between nodes in the propagation chain set, the state changes of adjacent nodes are determined and integrated to obtain the node state sequence;

[0107] The node state sequence is input into a preset time-series prediction model, which outputs the predicted diffusion distribution probability.

[0108] It should be noted that deduplication is performed on all nodes appearing in the propagation chain set to obtain the node set. A global node index table is generated based on the entire network entity list in the network environment, and a unique and fixed node index is assigned to each network entity identifier; the global node index table remains unchanged across statistical periods. The node index table contains at least two columns: network entity identifier and node index, and there is a one-to-one correspondence between the node index and the network entity identifier. Further, the node risk value corresponding to the node set is extracted based on the quantization matrix. Each matrix element in the quantization matrix corresponds to a unique network entity identifier, and the matrix element corresponding to the network entity identifier is retrieved one by one according to the node index table to obtain the node risk value.

[0109] In one implementation, missing value handling and normalization are performed on the node risk value sequence. When missing values ​​exist in the node risk value sequence, all non-missing matrix elements within the same statistical period are extracted from the quantization matrix, the median is calculated, and this median is used to fill the missing positions. When all matrix elements within the same statistical period are missing, the entire node risk value sequence is filled with zero values. The minimum and maximum values ​​of the node risk value sequence are extracted within the node set, and min-max normalization is performed on the node risk value sequence. When the maximum and minimum values ​​are the same, this embodiment sets all normalization results to 0.5, resulting in a reproducible degradation handling rule.

[0110] It is worth noting that the length of the risk state vector is the same as the number of nodes in the node set. The first element of the vector corresponds to the network entity identifier that is first in the node index table, and the last element of the vector corresponds to the network entity identifier that is last in the node index table, thus obtaining the risk state vector.

[0111] Furthermore, the connection relationships between nodes are extracted from the propagation chain set and organized into a connection relationship table. The connection relationship table contains at least two columns: source network entity identifier and target entity identifier, and maintains the same network entity identifier encoding as the node index table. When the propagation chain set carries link weights, the link weights are synchronously recorded in the connection relationship table; when the propagation chain set does not carry link weights, this embodiment recalculates the link weights for each connection relationship in the connection relationship table.

[0112] It should be noted that the state change is calculated and the node state sequence is constructed based on the connection relationship table and the risk state vector. In this embodiment, the set of all incoming edges pointing to the target entity identifier is located in the connection relationship table. The link weights of each incoming edge are read and summed to obtain the total weight of the incoming edges. When the total weight of the incoming edges is greater than zero, the link weights of each incoming edge are divided by the total weight of the incoming edges to obtain the normalized link weight. When the total weight of the incoming edges is equal to zero, the normalized link weights of each incoming edge are set to equal values. The risk state vector element corresponding to the source network entity identifier is weighted and summed with the corresponding normalized link weight to obtain the aggregated impact value. The difference between the aggregated impact value and the risk state vector element corresponding to the target entity identifier is taken to obtain the state change value. For target entity identifiers without incoming edges, the aggregated impact value is set to zero.

[0113] The state change values ​​are filled in the node index table to form a state change vector. First, all vector elements of the risk state vector are written, and then all vector elements of the state change vector are written to obtain the node state vector. That is, the first half of the node state vector consists of risk state vector elements, and the second half consists of state change vector elements, and both parts are arranged in the order of the node index table. The node state vector is repeatedly generated and arranged according to the statistical period timestamp in multiple consecutive statistical periods to obtain the node state sequence.

[0114] It should be noted that the preset temporal prediction model is set as a combination of a recurrent neural network and a temporal convolutional network. The input is a sequence of node states, and the output is the node risk value, arranged in the order of the node index table. The combined structure includes a recurrent neural network module and a temporal convolutional network module connected in sequence. The recurrent neural network module is used to encode the temporal features of the node state sequence and output the hidden state sequence. The temporal convolutional network module receives the hidden state sequence and performs multi-scale one-dimensional convolution extraction to obtain the node risk prediction sequence. The training samples are obtained by slicing historical statistical periods. The supervision label is the node risk value sequence in the quantization matrix of the future statistical period that matches the node index. The training set, validation set, and test set are divided by the timestamp of the statistical period. The earliest 70% of the statistical period samples are used as the training set, the next 15% of the statistical period samples are used as the validation set, and the latest 15% of the statistical period samples are used as the test set. The model hyperparameters are determined by cross-validation and grid search, with the minimum prediction error on the validation set as the selection criterion.

[0115] Furthermore, the predicted node risk values ​​are converted into predicted diffusion distribution probabilities. For any future statistical period, negative predicted node risk values ​​are truncated to zero and the sum of non-negative predicted node risk values ​​is calculated. When the sum is greater than zero, the non-negative predicted node risk value of each node is divided by the sum to obtain the predicted diffusion distribution probability for that future statistical period. When the sum of non-negative predicted node risk values ​​is equal to zero, backtracking normalization is performed to obtain the predicted diffusion distribution probability. The risk state vector of the statistical period closest to the future statistical period is located from the node state sequence and used as the backtrack risk vector. When the sum of the vector elements of the backtrack risk vector is greater than zero, this embodiment divides each vector element of the backtrack risk vector by the sum of the vector elements of the backtrack risk vector to obtain the predicted diffusion distribution probability of the future statistical period. When the sum of the vector elements of the backtrack risk vector is still equal to zero, this embodiment uses the risk state vector at the initial moment as the backtrack risk vector and performs backtrack normalization processing. When the sum of the vector elements of the predicted node risk value sequence and the backtrack risk vectors at all levels are equal to zero, this embodiment sets the predicted diffusion distribution probability of each node to the reciprocal of the number of nodes in the node set as a conservative default output.

[0116] In step S18, the process of confirming the enhanced monitoring target based on a preset probability threshold and the predicted diffusion distribution probability, obtaining monitoring resource constraints, constructing an objective function based on the enhanced monitoring target, solving the objective function to obtain optimal configuration parameters, and generating a monitoring enhancement scheme based on the optimal configuration parameters includes:

[0117] Based on the predicted diffusion distribution probability, the risk priority of network areas or network entities is determined, and a candidate set of monitoring to be enhanced is generated.

[0118] Network regions or network entities whose predicted diffusion distribution probability exceeds a preset probability threshold are selected from the candidate set as enhanced monitoring targets;

[0119] The monitoring resource constraints are obtained, and the coverage of enhanced monitoring targets and the monitoring resource overhead are set as optimization objectives. An objective function for monitoring resource configuration is constructed, and the objective function is solved under the monitoring resource constraints to obtain the optimal configuration parameters. The monitoring resource constraints include bandwidth overhead, computing resource overhead, or storage resource overhead. A monitoring enhancement scheme is generated based on the optimal configuration parameters.

[0120] It should be noted that, based on the predicted diffusion distribution probability of each network region or network entity, a candidate set of entities to be enhanced for monitoring is generated by arranging them from high to low; and network regions or network entities whose predicted diffusion distribution probability exceeds a preset probability threshold are selected from the candidate set to obtain the enhanced monitoring targets.

[0121] The preset probability threshold is determined through offline calibration. The offline calibration data is obtained by associating the predicted diffusion distribution probability of historical statistical periods with the historical attack event records in the corresponding future statistical periods. Precision and recall are calculated one by one on the candidate threshold set. Positive samples in the candidate threshold set are network areas or network entities that were selected as enhanced monitoring targets in the current statistical period and have experienced historical attack events in the corresponding future statistical period. Negative samples are network areas or network entities that were selected as enhanced monitoring targets in the current statistical period and have not experienced historical attack events in the corresponding future statistical period. Precision is the number of positive samples predicted as positive divided by the total number of positive samples predicted as positive. Recall is the number of positive samples predicted as positive divided by the total number of positive samples. The F1 score is calculated from precision and recall.

[0122] It is worth noting that the monitoring resource constraints include bandwidth resource constraints, computing resource constraints, and storage resource constraints. Within the current statistical period, the available resource limits for each of the three types of constraints are calculated. All three limits are obtained by subtracting baseline occupancy from total capacity. Baseline occupancy is determined using the 95th percentile of the corresponding indicator in the baseline period, calculated using the nearest rank method. The product of the sample number and 0.95 is rounded up to obtain the rank, and the sample value corresponding to that rank is used. Total capacity is the upper limit of resources that the monitoring system can schedule in the current statistical period. Total bandwidth capacity is the rated available bandwidth of the mirror link; total computing capacity is the number of available CPU cores and available memory capacity of the monitoring nodes; and total storage capacity is the available capacity of the log storage partition. The baseline period is determined through offline screening. In historical statistical periods, the statistical period in which the mean and variance of the risk values ​​of all network nodes are lower than the corresponding historical thresholds and the proportion of high-risk alarms is lower than a preset proportion threshold is selected as the baseline period.

[0123] Furthermore, the optimal configuration parameters include the set of monitoring points, sampling frequency parameters, log field selection parameters, and retention period parameters. For each enhanced monitoring target, a set of candidate monitoring configuration items is generated. Each candidate monitoring configuration item contains at least one monitoring point and the sampling frequency parameters, log field selection parameters, and retention period parameters bound to that monitoring point. The coverage contribution and resource consumption are calculated for each candidate monitoring configuration item.

[0124] Coverage contribution is determined by the proportion of enhanced monitoring targets covered by this configuration item to the total number of enhanced monitoring targets. Coverage determination is based on topological reachability constructed from connectivity data. The determination criteria include the existence of a reachable path from the monitoring point to the target network entity that does not exceed a preset hop count threshold. The preset hop count threshold is determined by the 90th percentile of the attack chain length distribution in historical attack event data. The value at the 90th percentile is calculated using linear interpolation. In this embodiment, the connectivity data is constructed as an unweighted directed graph, and a breadth-first search is used to search for the path with the fewest hops from the monitoring point to the target network entity in the unweighted directed graph. If the minimum hop count is not greater than the preset hop count threshold, it is determined to be reachable. Attack chain length refers to the number of hops between adjacent hops.

[0125] Resource usage is determined by the arithmetic mean of the maximum and minimum normalized values ​​of bandwidth resource usage, computing resource usage, and storage resource usage. The minimum and maximum observed values ​​within the candidate monitoring configuration item set in the current statistical period are used. When the maximum and minimum observed values ​​are the same, the corresponding normalization result is uniformly set to 0.5.

[0126] It should be noted that a deterministic rule is used to generate a unique solution when solving the objective function. All candidate monitoring configuration items that do not meet the monitoring resource constraints are filtered out to obtain a set of feasible configuration items. From this set, the configuration item with the largest contribution to coverage is selected and added to the optimal configuration parameters. When multiple configuration items have the same contribution to coverage, the configuration item with the smallest resource consumption is selected. If the resource consumption is still the same, the configuration item with the smallest lexicographical order of the network entity identifier of the monitoring point is selected. The updated remaining resource constraints are obtained by subtracting the resource consumption of the selected configuration items from the upper limits of various available resources. The stopping condition for the repeated selection process is that no candidate monitoring configuration item simultaneously satisfies all remaining resource constraints. When no feasible configuration item satisfies the monitoring resource constraints, the optimal configuration parameters are output.

[0127] In one implementation, the monitoring enhancement scheme includes a list of enhanced monitoring targets and a monitoring point identifier, sampling frequency parameter, log field selection parameter, and retention period parameter corresponding to each enhanced monitoring target, and is output in lexicographical order of network entity identifiers.

[0128] In summary, this invention discloses a data processing method for network security monitoring. By quantitatively modeling network risks and extracting core risk patterns, constructing propagation chains and risk state vectors and outputting predicted diffusion distribution probabilities, and solving for optimal configuration parameters under constraints of bandwidth usage, computing resource usage, and storage resource usage to generate monitoring enhancement schemes, this invention solves the technical problems in existing technologies such as the difficulty in structurally characterizing risk propagation chains, the lack of reproducible predictive basis for risk diffusion trends, and the difficulty in determining and backtracking monitoring enhancement configurations under resource constraints.

[0129] Reference Figure 2 The second embodiment of the present invention provides a data processing system for network security monitoring, comprising:

[0130] The data acquisition module is used to extract connection relationship data of network entities and historical attack event data from the network environment;

[0131] The risk characterization module is used to construct graph structure data based on the connection relationship data and the historical attack event data, and to embed the graph structure data into a preset graph neural network to obtain an initial representation vector.

[0132] The business weighting module is used to obtain the importance index of network entities, and to adjust the initial representation vector according to the importance index to obtain the quantification matrix of risk distribution status.

[0133] The path generation module is used to extract a set of risk nodes from the quantization matrix. If the number of risk nodes exceeds a preset threshold, a random walk algorithm is used to process the set of risk nodes to obtain potential transmission paths.

[0134] The pattern recognition module is used to calculate the segment similarity of the potential transmission path, cluster and group the potential transmission path according to the segment similarity and confirm the consistency of the topological structure to obtain the risk core pattern of the potential transmission path;

[0135] The chain output module is used to mark paths with connectivity strength lower than a preset connectivity strength threshold as weak link paths based on the connectivity strength of nodes in the risk core mode, thereby obtaining a set of propagation chains.

[0136] The time-series extrapolation module is used to extract node risk values ​​from the propagation chain set and preprocess them to obtain a risk state vector. Based on a preset time-series prediction model, the risk state vector is processed to obtain the predicted diffusion distribution probability.

[0137] The scheme generation module is used to identify enhanced monitoring targets based on preset probability thresholds and the predicted diffusion distribution probability, obtain monitoring resource constraints, construct an objective function based on the enhanced monitoring targets, solve the objective function to obtain optimal configuration parameters, and generate a monitoring enhancement scheme based on the optimal configuration parameters.

[0138] It should be noted that the data processing system for network security monitoring provided in this embodiment of the invention is used to execute all the process steps of the data processing method for network security monitoring in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0139] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0140] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A data processing method for network security monitoring, characterized in that, include: Extract connection relationship data of network entities and historical attack event data from the network environment; Graph structure data is constructed based on the connection relationship data and the historical attack event data, and a preset graph neural network is used to embed the graph structure data to obtain an initial representation vector; Obtain the importance index of network entities, and adjust the initial representation vector according to the importance index to obtain the quantification matrix of risk distribution status; A set of risk nodes is extracted from the quantization matrix. If the number of risk nodes exceeds a preset threshold, a random walk algorithm is used to process the set of risk nodes to obtain potential transmission paths. Calculate segment similarity for the potential transmission path, and cluster and group the potential transmission path according to the segment similarity to confirm the consistency of the topological structure, thereby obtaining the risk core pattern of the potential transmission path; Based on the connectivity strength of nodes in the core risk pattern, paths with connectivity strength lower than a preset connectivity strength threshold are marked as weak link paths, thus obtaining a set of propagation chains. The risk values ​​of nodes are extracted from the propagation chain set and preprocessed to obtain a risk state vector. The risk state vector is then processed based on a preset time series prediction model to obtain the predicted diffusion distribution probability. Based on the preset probability threshold and the predicted diffusion distribution probability, the enhanced monitoring target is identified, the monitoring resource constraints are obtained, and an objective function is constructed according to the enhanced monitoring target. The optimal configuration parameters are obtained by solving the objective function, and a monitoring enhancement scheme is generated according to the optimal configuration parameters.

2. The data processing method for network security monitoring according to claim 1, characterized in that, The process involves constructing graph structure data based on the connection relationship data and the historical attack event data, and embedding the graph structure data using a preset graph neural network to obtain an initial representation vector, including: Based on the connection relationship data, a network topology adjacency matrix is ​​constructed, and attack features are extracted from the historical attack event data to construct a node attribute matrix. By fusing the network topology adjacency matrix with the node attribute matrix, graph structure data is obtained; A preset graph neural network is used to perform feature aggregation processing on the graph structure data to obtain a network dimension vector; The distribution of the network dimension vector is analyzed, the attack impact probability is calculated, and the attack impact probability is organized to obtain the initial representation vector.

3. The data processing method for network security monitoring according to claim 1, characterized in that, The process of obtaining importance indices for network entities and weighting and adjusting the initial representation vector based on these indices to obtain a quantification matrix of risk distribution states includes: Obtain classification information and business relationships of network entities from the network security platform as importance indicators; Information importance weights are generated based on the classification information, and propagation association weights are determined based on the business association relationships. Real-time operational data is obtained from a network security platform. A dynamic change factor is constructed based on the real-time operational data. The information importance weight and the propagation correlation weight are adjusted based on the dynamic change factor to obtain the adjusted weight. The initial representation vector is weighted and adjusted according to the adjusted weights to obtain the quantization matrix of the risk distribution state.

4. The data processing method for network security monitoring according to claim 1, characterized in that, The step of extracting a risk node set from the quantization matrix, and if the number of risk nodes in the risk node set exceeds a preset threshold, then using a random walk algorithm to process the risk node set to obtain potential transmission paths, includes: Traverse the elements of the quantization matrix, extract the elements that exceed the preset safety baseline, and combine them into a risk node set; If the number of risk nodes exceeds a preset threshold, the state transition probability is determined based on the connection relationship data. A random walk algorithm is used, combined with the state transition probabilities, to process the set of risk nodes and generate a walk trajectory; The target path that meets the preset confidence level is extracted from the walking trajectory to form the potential transmission path.

5. The data processing method for network security monitoring according to claim 1, characterized in that, The calculation of segment similarity for the potential transmission path includes: Each potential transmission path is represented as a sequence of network entity identifiers arranged in chronological order; A sliding window is used to extract a subsequence of a preset length from each potential network entity identifier sequence as a path segment, resulting in a set of path segments; Extract the fragment features of the path segment, which include a node type sequence, an edge connection strength sequence, and a node risk value sequence; Calculate the sequence similarity of the node type sequence, edge connection strength sequence, and node risk value sequence respectively, and then calculate the average to obtain the segment similarity.

6. The data processing method for network security monitoring according to claim 5, characterized in that, The step of clustering and grouping the potential transmission paths based on the fragment similarity and confirming the consistency of the topological structure to obtain the risk core pattern of the potential transmission paths includes: The path segment set is grouped using density clustering to obtain a grouped segment set; For each set of grouped segments, construct the set of directed edges for the segments within the group and generate a topological graph; Based on the topology diagram, a topology consistency determination is performed to identify the core risk patterns of the potential transmission paths; wherein, the topology diagram corresponding to the set of group segments with isomorphic mapping is used as the core risk pattern; the set of group segments without isomorphic mapping is not included in the set of core risk patterns.

7. The data processing method for network security monitoring according to claim 1, characterized in that, Based on the connectivity strength of nodes in the core risk model, paths with connectivity strength below a preset connectivity strength threshold are marked as weak links, resulting in a propagation chain set, including: Based on the risk core pattern, nodes are extracted, a local topology is constructed according to the nodes, and the connection relationship data is statistically analyzed within a preset statistical time window to obtain the node interaction frequency. The risk value of the node is extracted from the quantization matrix, and the link weight of the local topology is determined according to the node interaction frequency and the risk value. Based on the link weights, the connectivity strength of the paths in the local topology is calculated, and paths with connectivity strength lower than the preset connectivity strength threshold are identified as weak link candidate paths. The blocking cost of the weak link candidate paths is evaluated, and the weak link candidate paths whose blocking cost meets the preset blocking cost threshold are determined as the propagation chain set.

8. The data processing method for network security monitoring according to claim 1, characterized in that, The step of extracting node risk values ​​from the propagation chain set and preprocessing them to obtain a risk state vector, and then processing the risk state vector based on a preset time-series prediction model to obtain the predicted diffusion distribution probability, includes: Extract a node set based on the propagation chain set, determine the node index based on the node set, extract the node risk value corresponding to the node set based on the quantization matrix, normalize the node risk value, and fill it into vector elements according to the node index to construct the risk state vector at the initial moment. Based on the risk state vector and the connection relationship between nodes in the propagation chain set, the state changes of adjacent nodes are determined and integrated to obtain the node state sequence; The node state sequence is input into a preset time-series prediction model, which outputs the predicted diffusion distribution probability.

9. A data processing method for network security monitoring according to claim 1, characterized in that, The process of identifying enhanced monitoring targets based on a preset probability threshold and the predicted diffusion distribution probability, obtaining monitoring resource constraints, constructing an objective function based on the enhanced monitoring targets, solving the objective function to obtain optimal configuration parameters, and generating a monitoring enhancement scheme based on the optimal configuration parameters includes: Based on the predicted diffusion distribution probability, the risk priority of network areas or network entities is determined, and a candidate set of monitoring to be enhanced is generated. Network regions or network entities whose predicted diffusion distribution probability exceeds a preset probability threshold are selected from the candidate set as enhanced monitoring targets; The monitoring resource constraints are obtained, and the coverage of the monitoring targets and the monitoring resource consumption are set as optimization objectives. An objective function for monitoring resource allocation is constructed, and the optimal configuration parameters are obtained by solving the objective function under the monitoring resource constraints. The monitoring resource constraints include bandwidth consumption, computing resource consumption, or storage resource consumption. A monitoring enhancement scheme is generated based on the optimal configuration parameters.

10. A data processing system for network security monitoring, characterized in that, include: The data acquisition module is used to extract connection relationship data of network entities and historical attack event data from the network environment; The risk characterization module is used to construct graph structure data based on the connection relationship data and the historical attack event data, and to embed the graph structure data into a preset graph neural network to obtain an initial representation vector. The business weighting module is used to obtain the importance index of network entities, and to adjust the initial representation vector according to the importance index to obtain the quantification matrix of risk distribution status. The path generation module is used to extract a set of risk nodes from the quantization matrix. If the number of risk nodes exceeds a preset threshold, a random walk algorithm is used to process the set of risk nodes to obtain potential transmission paths. The pattern recognition module is used to calculate the segment similarity of the potential transmission path, cluster and group the potential transmission path according to the segment similarity and confirm the consistency of the topological structure to obtain the risk core pattern of the potential transmission path; The chain output module is used to mark paths with connectivity strength lower than a preset connectivity strength threshold as weak link paths based on the connectivity strength of nodes in the risk core mode, thereby obtaining a set of propagation chains. The time-series extrapolation module is used to extract node risk values ​​from the propagation chain set and preprocess them to obtain a risk state vector. Based on a preset time-series prediction model, the risk state vector is processed to obtain the predicted diffusion distribution probability. The scheme generation module is used to identify enhanced monitoring targets based on preset probability thresholds and the predicted diffusion distribution probability, obtain monitoring resource constraints, construct an objective function based on the enhanced monitoring targets, solve the objective function to obtain optimal configuration parameters, and generate a monitoring enhancement scheme based on the optimal configuration parameters.

Images