Multi-protocol adaptive secret-related network penetration defense system

Abstract

The invention discloses a multi-protocol adaptive secret-related network penetration defense system, and relates to the technical field of network security defense. Comprising a data access module, a multi-protocol defense module and an access authorization module. The data access module collects and standardizes heterogeneous security data in the network; the multi-protocol defense module comprises an outer-layer osmotic analysis unit, a middle-layer osmotic analysis unit and an inner-layer osmotic analysis unit, performs layered detection and risk analysis on a boundary protocol behavior, an internal transverse movement and permission improvement behavior and a core asset high-permission operation and sensitive data access behavior, and performs dynamic multi-path verification on a host access behavior; the access authorization module generates and executes control instructions such as network blocking, authority adjustment or session termination according to alarm and risk data output by each unit; according to the method, full-link detection, dynamic credible verification and intelligent linkage response of cross-protocol and staged penetration attacks are realized, and the active defense capability and the security situation self-adaption level of a secret-related network are improved.

Description

Technical Field

[0001] This invention relates to the field of network security defense technology, specifically to a multi-protocol-adaptive classified network penetration defense system. Background Technology

[0002] In classified network environments, network attack methods are becoming increasingly complex and diverse. Attackers often use multiple network protocols to carry out cross-layer and phased penetration attacks, such as external scanning, vulnerability exploitation, lateral movement, privilege escalation, and theft of sensitive data.

[0003] Traditional network security defense systems are mostly based on single-point or single-protocol detection, making it difficult to effectively identify and correlate combined attacks that cross protocols and network partitions. In addition, existing systems often have slow response times and static, fixed defense strategies, failing to dynamically adjust verification and blocking mechanisms according to real-time threat situations. This results in detection blind spots and insufficient response when facing new penetration techniques.

[0004] Therefore, there is an urgent need for a classified network defense system that can adapt to multi-protocol environments, realize layered penetration behavior analysis, and support dynamic multi-path verification and intelligent response, so as to improve the overall network security protection capabilities. Summary of the Invention

[0005] The purpose of this invention is to solve the problems of poor protocol compatibility, weak attack chain correlation analysis capability, and static and rigid response mechanism in existing classified network defense systems, and to propose a multi-protocol adaptable classified network penetration defense system.

[0006] The objective of this invention can be achieved through the following technical solution: a multi-protocol adaptable classified network penetration defense system, comprising a data access module, a multi-protocol defense module, and an access authorization module; The data access module collects heterogeneous security data in classified networks in real time, and performs data cleaning, time synchronization, preliminary protocol identification and session reassembly processing on the collected data to generate a standardized security event stream containing protocol type, timestamp and session identifier. The multi-protocol defense module receives standardized security event streams and performs penetration analysis on network communication behavior based on a layered defense model, generating network boundary layer alarm information, internal behavior anomaly alarm data, and core asset security alarm information. The access authorization module receives network boundary layer alarm information, internal behavior anomaly alarm data, and core asset security alarm information, and generates corresponding network access control instructions according to the preset security policies, and sends them to the corresponding network devices and host agents for execution.

[0007] As a preferred embodiment of the present invention, the multi-protocol defense module includes: an outer penetration unit, a middle penetration unit, and an inner penetration unit; The outer penetration unit analyzes the behavior of external communication protocols and outputs external penetration alarm values ​​and boundary vulnerability values. Based on the external penetration alarm values ​​and boundary vulnerability values, a linear weighted calculation is performed to obtain the comprehensive risk value of the network boundary layer. The comprehensive risk value is compared with the preset boundary alarm threshold to generate alarm information for the network boundary layer. The mid-level penetration unit identifies and correlates lateral movement between hosts, privilege escalation, and abnormal access behavior in the internal network, and outputs internal behavior anomaly alarm data. The inner penetration unit monitors and analyzes the high-privilege operation sequences and sensitive data access paths of core assets, and outputs core asset security alarm information and data leakage risk values.

[0008] In a preferred embodiment of the present invention, the behavior of the external communication protocol is analyzed, and the specific process is as follows: Standardized security event streams are filtered by protocol to obtain a set of boundary protocol events; For each event in the set, extract its protocol behavior feature vector; Within the sliding time window, feature vectors from the same source address are aggregated to calculate the scanning behavior intensity function; Construct a state transition sequence for protocol interaction. When the sequence deviates from the normal protocol model, calculate the vulnerability exploitation offset and combine it with the vulnerability feature matching degree to obtain the vulnerability exploitation risk value. A time-series cumulative analysis of boundary attack behavior is performed, and the intensity of the attack behavior is calculated using an exponential decay function; The scanning intensity, vulnerability exploitation risk value, and attack intensity are normalized and weighted to obtain the comprehensive external penetration risk value. The comprehensive risk value of external penetration is mapped to discrete external penetration alarm values, and the dynamic boundary vulnerability value is calculated by combining the protection capability parameters of the boundary protection equipment.

[0009] As a preferred embodiment of the present invention, the specific process of outputting core asset security alarm information and data leakage risk value is as follows: By defining an internal host set and a controlled resource set, a host access intensity matrix for resources is constructed within a time window; A normal access structure baseline matrix is ​​established based on the access matrix of historical time windows; the offset matrix between the current access matrix and the baseline matrix is ​​calculated, and the structural offset strength is calculated; the access row entropy value corresponding to each host is calculated, and when the increment of the row entropy value relative to the baseline entropy value exceeds the first threshold, it is determined that there is lateral movement behavior, and its risk value is calculated; a permission weight is assigned to each resource, and the permission weighted access strength of the host is calculated. When the increment of the strength relative to the baseline exceeds the second threshold, it is determined that there is permission escalation behavior, and its risk value is calculated; the sparsity of the access matrix and its offset relative to the baseline are calculated. When the offset exceeds the third threshold, it is determined that there is abnormal access behavior, and its risk value is calculated. Based on the risk values ​​of lateral movement, privilege escalation, and abnormal access, an internal abnormal behavior vector is formed and corresponding alarm data is output.

[0010] As a preferred embodiment of the present invention, the specific process of outputting core asset security alarm information and data leakage risk value is as follows: By using the core asset set and its corresponding set of high-privilege operation types, the operation behavior on the assets is serialized and modeled within a time window; Construct a normal operation semantic transition probability model for each core asset based on historical reliable data; and calculate the offset of the current operation sequence relative to the semantic model; High-risk operations are identified, including high-privilege operations performed during prohibited periods, operations that bypass auditing mechanisms, and operations that modify security policies in batches. A high-risk operation superposition coefficient is calculated. The core asset security risk value is calculated as a function of the semantic offset of the operation and the high-risk operation superposition coefficient. Define the sensitive data set and its theoretical minimum reachable path length, calculate the actual access path length, and calculate the reachability offset; combine the data sensitivity level coefficient, access frequency, and reachability offset to calculate the data leakage risk value.

[0011] In a preferred embodiment of the present invention, the multi-protocol defense module dynamically verifies host access behavior, and the specific steps are as follows: According to the non-fixed selection rules, one protocol is selected from the defense protocol library of the outer layer penetration unit, the middle layer penetration unit and the inner layer penetration unit respectively, and combined to generate a penetration defense protocol path. Based on the generated penetration defense protocol path, the communication behavior data and intermediate analysis results generated by the host during the historical access process are analyzed again to obtain the path analysis pass determination result. If the analysis passes, the similarity between the current penetration defense protocol path and the set of historically verified penetration defense protocol paths will be calculated to obtain the path consistency determination result. The system statistically analyzes the number of paths that are both valid and consistent. When this number reaches a preset access determination threshold, the host is deemed to have passed access verification.

[0012] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention uses three-level penetration analysis units—outer, middle, and inner layers—to conduct specialized detection of boundary protocols, internal lateral behaviors, and core asset operations, respectively. It combines protocol feature extraction, behavior modeling, and semantic analysis to achieve full-link penetration identification from the outside to the inside and from behavior to intent.

[0013] 2. This invention forms a verification path by combining multiple penetration defense protocols through non-fixed selection rules, analyzes host access behavior multiple times, and combines historical path consistency comparison to achieve dynamic, multi-factor access verification, effectively preventing spoofing and bypass attacks.

[0014] 3. This invention automatically converts the analysis results into control commands such as network blocking, permission adjustment, and session termination through the access authorization module, thereby achieving rapid closed-loop handling of attack behaviors and supporting policy log recording, which improves the system's auditability and policy traceability.

[0015] 4. This invention, through functions such as behavior modeling based on sliding time windows, exponential decay threat assessment, and dynamic weight adjustment, adapts to different network environments and threat evolution, and has strong situational awareness and adaptive defense capabilities. Attached Figure Description

[0016] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0017] Figure 1 This is a schematic diagram of the principle of the present invention. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be understood that the terms “comprising” and “including” used in this disclosure and claims indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0020] It should also be understood that the terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0021] Please see Figure 1 As shown, a multi-protocol-adaptive classified network penetration defense system includes: a data access module, a multi-protocol defense module, and an access authorization module; the multi-protocol defense module further includes an outer penetration unit, a middle penetration unit, and an inner penetration unit, and each unit contains several penetration defense protocols; The data access module performs unified collection and preprocessing management of security data during the operation of classified networks. The collected data includes: raw data packets of the entire network traffic of network switching nodes, security probe log data deployed in key locations, and heterogeneous security log data such as system logs, access logs, and security audit logs generated by key servers.

[0022] The collected data undergoes data cleaning, time synchronization, preliminary protocol identification, and session reassembly processing to generate a standardized security event stream containing protocol type, communication timestamp, and session identifier.

[0023] The multi-protocol defense module acquires standardized security event flows to perform layered penetration defense analysis on network communication behavior. The multi-protocol defense module includes an outer-layer penetration unit, a middle-layer penetration unit, and an inner-layer penetration unit.

[0024] The outer penetration unit analyzes the external communication protocols involved in the network boundary layer, focusing on detecting external scanning behavior, vulnerability exploitation behavior, and boundary attack behavior. Based on the analysis results, it outputs external penetration alarm values ​​and boundary vulnerability values ​​reflecting the boundary security situation, thus obtaining alarm information for the network boundary layer.

[0025] The mid-level penetration unit performs behavioral analysis on internal network communication protocols, identifies and correlates lateral movement, privilege escalation, and abnormal access behaviors between internal hosts, and outputs internal behavioral anomaly alarm data.

[0026] The inner penetration unit monitors and analyzes high-privilege operations and sensitive data access behaviors related to core servers, databases, and critical application systems, identifies abnormal access patterns and high-risk operations, and outputs core asset security alarm information and data leakage risk values ​​that reflect the degree of data leakage risk.

[0027] Based on the analysis process of outer, middle, and inner penetration units, multi-path verification analysis is performed on host access behavior, including: Following a non-fixed selection rule, corresponding penetration defense protocols are selected from the outer, middle, and inner penetration units respectively, and combined to generate a penetration defense protocol path. Based on this path, the communication behavior data and analysis results generated by the host during the previous access verification process are re-analyzed. If the re-analysis passes, the currently generated penetration defense protocol path is correlated with historically verified penetration defense protocol paths to verify the consistency of analysis results under different paths. Based on the correlation analysis results, a comprehensive determination is made as to whether the host has passed access verification.

[0028] The access authorization module is connected to the outer penetration unit, the middle penetration unit, and the inner penetration unit. It receives the results from each penetration analysis unit and converts the results into control operations for network devices, identity authentication systems, or host agents, such as blocking the network of the attack source, adjusting access permissions, or terminating abnormal sessions.

[0029] The analysis focuses on the external communication protocols involved in the network boundary layer, specifically: By performing protocol-level filtering on the standardized security event flow, a boundary protocol event set is obtained: E b ={e1, e2, ..., e n}; for any event e in the boundary protocol event set i Let i = 1, 2, ..., n, where n is the total number of events; construct its protocol behavior feature vector: F i = <f req f resp f port f freq f err >;where: f req The number of requests to the same source address per unit of time; f resp This represents the proportion of abnormal responses; f port f represents the destination port dispersion; freq f is the rate of change of the requested time interval. err This represents the frequency of occurrence of protocol error or anomaly fields. Data in the protocol behavior feature vector is extracted using a traffic parsing engine and aggregated based on a sliding time window to form a quantifiable and evaluable sequence of scanning behaviors.

[0030] In the current sliding time window ΔT k Within, where k represents the index of the sliding time window, k=1, 2, ..., t=1, 2, ..., k; feature vectors from the same source address are aggregated to form a scan behavior sequence: Among them, IP sThis refers to identifying the source IP address of the initiator of the scanning activity in network traffic logs and calculating the scanning behavior strength function. : , where λ1, λ2, and λ3 are characteristic contribution coefficients; These represent the destination port dispersion, request time interval change rate, and protocol error characteristic value corresponding to the i-th protocol event, respectively.

[0031] Based on the communication behavior that allows for exploitation of vulnerabilities, the protocol interaction process is divided into states, and a protocol state transition sequence is constructed: StateSeq={s1→s2→⋯→s m}; m represents the total number of protocol states experienced during a single protocol interaction; When the state transition path deviates from the normal protocol model, calculate the exploit offset. : Where j is the protocol state transition index, used to represent the j-th state transition in the state transition sequence, j∈m; Further combining vulnerability signature matching, the vulnerability exploitation risk value is obtained within the k-th sliding time window. : ;in, As a logical function, it compares the features extracted from event e with all feature rules in the vulnerability database V, and extracts the event feature vector F from event e. e F e =(f1, f2, ..., f q Where: q is the total number of dimensions of the event features; f r Let r be the feature component of the r-th event, where r = 1, 2, ..., q; each feature component is converted into a numerical form through discrete encoding, interval mapping, or normalization.

[0032] For each vulnerability feature rule v in vulnerability database V g Using the same feature dimensions and encoding methods as the event features, a corresponding vulnerability feature vector is constructed: Where g is the vulnerability feature rule index, g=1, 2, ..., s; y g，r For vulnerability rule v g The feature value in the r-th feature dimension; Calculate the event feature vector Fe and the vulnerability feature vector Fv g Difference values ​​across each feature dimension: Where Δg,r represents the event e and the vulnerability rule v g The degree of difference on the r-th feature dimension.

[0033] The weighted sum of the differences across all dimensions yields the overall difference value: , where: Dg For event e and vulnerability rule v g The overall difference value; ω r represents the weight coefficient for the r-th feature dimension; the weights can be obtained through historical sample statistics or expert experience.

[0034] The comprehensive difference value D g Converted into a matching score using a probability mapping function: ,in: For event e and vulnerability rule v g The matching score.

[0035] We perform time-series cumulative analysis on boundary attack behaviors such as abnormal connections and flooding requests, and preserve the impact of historical behaviors through an exponential decay function. , where: A t δ represents the intensity of the attack detected within the t-th time window; t is the time window number, indicating the time sequence after discretization; δ is the time decay factor, with a value between (0, 1), set to 0.8 to 0.95, to reflect the persistence of the attack.

[0036] The attack intensity A t The calculation is performed by comprehensively considering the normalized number of attack events, attack type weights, and target importance. , where: N t N represents the number of attack events detected within the t-th time window; max W is a preset maximum attack event threshold used to normalize the number of attack events. t Assigning attack type weights based on the pre-defined mapping of attack behaviors, with different attack types corresponding to different weight values; I t A preset target importance coefficient is used to characterize the importance of the attacked target in the network system.

[0037] The scanning intensity, vulnerability exploitation risk value, and attack intensity mentioned above are normalized. Then, a comprehensive external penetration risk function is constructed. : ω1, ω2, and ω3 are the weight coefficients of the three types of penetration indicators, with values ​​ranging from [0, 1], and satisfying ω1 + ω2 + ω3 = 1. These coefficients are dynamically adjusted based on the actual network environment, threat intelligence, or expert experience to reflect the relative importance of different threat types. These are the three types of penetration indicators after normalization. Map the overall risk value to an external penetration warning value: The numerical level is used to directly drive the selection of the response strategy. θ1 and θ2 are both alarm classification thresholds; the alarm classification thresholds obtained based on the historical risk value distribution are used to classify the risk level of the detection results.

[0038] Based on the generated alarm values, combined with the boundary protection capability parameter C def Calculate boundary vulnerability values .

[0039] The boundary protection capability parameter C mentioned above def In existing technologies, perimeter protection devices such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and security gateways already have the following functions: detecting and classifying attack events; monitoring device operating status in real time; and logging and statistically analyzing attack blocking results.

[0040] This invention constructs a boundary protection capability parameter C based on the capability parameters, status parameters, and protection result data already provided by existing boundary protection equipment. def The alarm results are dynamically adjusted.

[0041] The comprehensive risk value R of the network boundary layer is obtained by linear weighting calculation based on external penetration warning values ​​and boundary vulnerability values. edge The comprehensive risk value R edge The alarm information for the network boundary layer is generated by comparing it with a preset boundary alarm threshold. Where: θ p1 θ p2 and θ p2 These are the threshold values ​​for boundary risk classification; L1, L2, and L3 correspond to low-risk alarms, medium-risk alarms, and high-risk alarms, respectively.

[0042] Identify and correlate lateral movement, privilege escalation, and abnormal access behaviors between internal hosts, specifically: Internal communication behavior is abstracted into access relationships, defined as follows: Internal host set: H={H 11 H 21 H n1}; Internal controlled resource set (hosts, services, shares, interfaces): R = {R 11 R 21 , ..., R m1}; within the current sliding time window ΔT k Internally, it counts the number of times a host accesses a resource and constructs an access matrix. : ;where a i1j1 Indicates host H i1 In ΔTk Internal resources R j1 Access intensity.

[0043] Based on multiple historical sliding time windows {ΔT1, ..., ΔT k−1 The access matrix is ​​normalized and its mean is calculated to obtain the baseline matrix of the normal access structure. : ;in This is the normalized access matrix, used to eliminate the impact of traffic fluctuations. t1 is an integer used to identify different historical time windows; and t1 = 1, 2, ..., k.

[0044] In the current time window ΔT k Calculate the access structure offset matrix : ; and further calculate the structural offset strength. : ; Furthermore, a typical feature of lateral movement access architecture is that the types of resources accessed by a single host suddenly increase; In response, the middle-layer penetration unit calculates the access row entropy value for each host. : ;in For host H i For resource R j The probability of access.

[0045] like If the host exhibits lateral movement behavior, its risk value is defined as follows: : . The threshold for determining lateral movement.

[0046] Analyze the abnormal increase in access weight of high-privilege resource columns: Assign a privilege weight W to each resource column. j1 Calculate the weighted access strength of permissions When the host's privilege weighting strength meets the requirements ( If a threshold for privilege escalation is set, then privilege escalation is determined to have occurred, and the privilege escalation risk value is set accordingly. Defined as: ; Furthermore, the sparsity variation of the access matrix is ​​calculated. ; Calculate sparsity offset ; when If the threshold is exceeded, abnormal access behavior is determined, and its risk value is: ; The risk values ​​for lateral movement, privilege escalation, and abnormal access are combined to form an internal abnormal behavior vector: ; The internal abnormal behavior vector is output as a structured representation of the internal penetration behavior; data with lateral movement risk value, privilege escalation risk value and abnormal access risk value exceeding the corresponding threshold are marked to generate internal behavior abnormality alarm data; and the alarm results are aligned with the external alarm results in time sequence to form a complete penetration judgment logic from external entry to internal expansion.

[0047] Monitoring and analysis are conducted on high-privilege operations and sensitive data access behaviors related to core servers, databases, and application systems, specifically as follows: Define the core assets and construct the core asset set: A = {A1, A2, ..., A...} z A p}, where p is the total number of core assets; and each core asset corresponds to at least one set of high-privilege operation types: O(A z )={o1, o2, ..., o y , ..., o q}; In the current sliding time window ΔT k Internally, serialization modeling is performed on operational behaviors on core assets to form operational sequences. b represents the length of the operation sequence observed within the current time window (i.e., the number of operations); Based on historical reliable operating cycles, for each core asset A z Constructing a normal operation semantic transfer model: .

[0048] Within the current time window, calculate the offset of the actual operation sequence relative to the semantic baseline. Where y is the index variable of the sequence position, used to traverse adjacent operation pairs in the operation sequence; High-risk operation indicators include the following: high-privilege operations during prohibited time periods; operations that bypass auditing or disable logging; and bulk modifications to security policies or access control rules. Define a high-risk operation flag function: I risk (o y Given that )∈{0,1}, calculate the high-risk operation superposition coefficient: Among them, o y This represents the y-th operation detected within the current time window; I risk (o y )=1 indicates that the operation is marked as a high-risk operation, an operation that bypasses auditing or disables logging, or a batch modification of security policies or access control rules; risk (oy )=0 indicates that the operation is a normal operation.

[0049] Sensitive data objects are hierarchically defined, and a sensitive data set is constructed: D = {D1, D2, ..., D...} h D s For each sensitive data object, define its theoretical minimum reachable path length L. min In other words, under legitimate business scenarios, the minimum number of operation steps required to access the data from ordinary access.

[0050] Calculate the actual access path length L within the current time window. act and define reachability offset. When L act <L min If this occurs, it indicates the existence of an abnormal access path that bypasses control. The data leakage risk value is obtained by jointly calculating the frequency of sensitive data access, reachability offset, and data sensitivity level. , where: S h For sensitive data object D h Sensitivity level coefficient; F h (k) The frequency of access to the corresponding data within the current window.

[0051] Calculate the core asset security risk value based on the semantic offset of high-privilege operations and the superposition coefficient of high-risk operations. ; When the risk value When the threshold is exceeded, a core asset security alarm message is generated.

[0052] Based on the analysis outputs of the outer, middle, and inner penetration units, multi-path verification analysis is performed on the host access behavior. The specific process is as follows: Following a non-fixed selection rule, corresponding penetration defense protocols are selected from the outer, middle, and inner penetration units respectively, and combined to generate a penetration defense protocol path: P= <e x1 (o2) e y1 (m2) e z1 (2) >,e x1 (o2) ∈Eouter, e y1 (m2) ∈Emiddle,e z1 (i2) ∈Einner; P j1 The penetration defense protocol path generated for the j1st step; e x1 (o2)∈Eouter: The x1th defense protocol selected from the outer penetration unit protocol set Eouter; e y1 (m2) ∈Emiddle: The y1th defense protocol selected from the middle-layer penetration unit protocol set Emiddle; e z1 (i2) ∈Einner: The z1th defense protocol selected from the inner layer penetration unit protocol set Einner; where o2 is the identifier of the corresponding penetration defense protocol selected from the outer layer penetration unit, m2 is the identifier of the corresponding penetration defense protocol selected from the middle layer penetration unit, and i2 is the identifier of the corresponding penetration defense protocol selected from the inner layer penetration unit.

[0053] Based on the penetration defense protocol path, the communication behavior data Hcomm generated by the host during the previous access verification process and the analysis results (scanning behavior strength function) are analyzed. Vulnerability Exploitation Risk Value The attack intensity (At) is analyzed again, and the path analysis is calculated using a decision function. : When the analysis passes again, the currently generated penetration defense protocol path will be compared with the set P of historically verified penetration defense protocol paths. hist ={P1 (hist) P2 (hist) , ..., P l (hist) Perform association analysis and calculate path consistency: Where C(P) is the consistency measure between path P and the historical path set; P k (hist) This is the kth historically verified penetration defense protocol path; Sim(P) j1 P k (hist) ) represents path P and historical path P k (hist) The similarity function; The number of historically verified paths is given, and k1 is the index of each verified path; Consistent(P j1 θ is a Boolean decision indicating whether path P is consistent with historical paths (1 indicates consistency, 0 indicates inconsistency). cons The consistency threshold is set by policy or security requirements.

[0054] Verify the consistency of analysis results under different penetration defense protocol paths, and based on the correlation analysis results, comprehensively determine whether the host passes the access verification: HostAccess represents the host access determination result, including pass and rejection; N passθ represents the number of paths that are both valid and consistent; Pass(P) is the path pass determination value; Consistent(P) is the path consistency determination value; θ acc Access thresholds are set based on security policies or risk levels.

[0055] The access authorization module is connected to the outer penetration unit, the middle penetration unit, and the inner penetration unit, and is used to receive network boundary layer alarm information, internal behavior anomaly alarm data, and core asset security alarm information generated by each penetration analysis unit.

[0056] Based on the received alarm information, the access authorization module parses the alarm type, alarm level and associated objects, and generates corresponding control decisions accordingly.

[0057] The control decisions include at least one of the following or a combination thereof: network blocking decisions for attack sources; decisions to adjust access permissions for hosts or users; and decisions to terminate sessions for abnormal connections.

[0058] Based on the control decision, the access authorization module transforms the alarm information into control operations targeting network devices, identity authentication systems, or host agents, and sends the control operations to the corresponding devices for execution, so as to achieve network blocking of the attack source, adjustment of access permissions, or termination of abnormal sessions.

[0059] While issuing control operations, the access authorization module generates corresponding policy execution logs. The policy execution logs include at least: alarm information source identifier; alarm type and alarm level that triggered the control operation; type of control operation executed; target object of the control operation; execution time and result of the control operation.

[0060] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A multi-protocol-adaptive classified network penetration defense system, comprising a data access module, a multi-protocol defense module, and an access authorization module, characterized in that: The data access module collects heterogeneous security data in classified networks in real time, and performs cleaning, time synchronization, preliminary protocol identification and session reassembly processing on the heterogeneous security data to generate a standardized security event stream containing protocol type, timestamp and session identifier. The multi-protocol defense module receives standardized security event streams and performs penetration analysis on network communication behavior based on a layered defense model, generating network boundary layer alarm information, internal behavior anomaly alarm data, and core asset security alarm information. The access authorization module receives network boundary layer alarm information, internal behavior anomaly alarm data, and core asset security alarm information, and generates corresponding network access control instructions according to the preset security policies, and sends them to the corresponding network devices and host agents for execution.

2. The multi-protocol adaptable classified network penetration defense system according to claim 1, characterized in that, The multi-protocol defense module includes: an outer penetration unit, a middle penetration unit, and an inner penetration unit; The outer penetration unit analyzes the behavior of external communication protocols and outputs external penetration alarm values ​​and boundary vulnerability values; it performs linear weighted calculations based on the external penetration alarm values ​​and boundary vulnerability values ​​to obtain the comprehensive risk value of the network boundary layer; it compares the comprehensive risk value with the preset boundary alarm threshold to generate alarm information for the network boundary layer. The mid-level penetration unit identifies and correlates lateral movement between hosts, privilege escalation, and abnormal access behavior in the internal network, and outputs internal behavior anomaly alarm data. The inner penetration unit monitors and analyzes the high-privilege operation sequences and sensitive data access paths of core assets, and outputs core asset security alarm information and data leakage risk values.

3. The multi-protocol adaptable classified network penetration defense system according to claim 2, characterized in that, The analysis of external communication protocol behavior is performed as follows: Standardized security event streams are filtered by protocol to obtain a set of boundary protocol events; For each event in the set, extract its protocol behavior feature vector; Within the sliding time window, feature vectors from the same source address are aggregated to calculate the scanning behavior intensity function; Construct a state transition sequence for protocol interaction. When the sequence deviates from the normal protocol model, calculate the vulnerability exploitation offset and combine it with the vulnerability feature matching degree to obtain the vulnerability exploitation risk value. A time-series cumulative analysis of boundary attack behavior is performed, and the intensity of the attack behavior is calculated using an exponential decay function; The scanning intensity, vulnerability exploitation risk value, and attack intensity are normalized and weighted to obtain the comprehensive external penetration risk value. The comprehensive risk value of external penetration is mapped to discrete external penetration alarm values, and the dynamic boundary vulnerability value is calculated by combining the protection capability parameters of the boundary protection equipment.

4. A multi-protocol adaptable classified network penetration defense system according to claim 3, characterized in that, The specific process for outputting core asset security alert information and data leakage risk values ​​is as follows: By defining an internal host set and a controlled resource set, a host access intensity matrix for resources is constructed within a time window; Establish a baseline matrix for normal access structure based on the access matrix of historical time windows; Calculate the offset matrix between the current access matrix and the baseline matrix, and calculate the structural offset strength; Calculate the access row entropy value for each host. When the increase of the row entropy value relative to the baseline entropy value exceeds the first threshold, it is determined that there is lateral movement behavior, and its risk value is calculated. Assign a permission weight to each resource, calculate the host's permission weighted access strength, and when the increment of the permission weighted access strength relative to the baseline exceeds a second threshold, it is determined that there is permission escalation behavior, and its risk value is calculated. Calculate the sparsity of the access matrix and its offset relative to the baseline. When the offset exceeds the third threshold, it is determined that there is abnormal access behavior, and its risk value is calculated. Based on the risk values ​​of lateral movement, privilege escalation, and abnormal access, an internal abnormal behavior vector is formed and corresponding alarm data is output.

5. A multi-protocol adaptable classified network penetration defense system according to claim 4, characterized in that, The specific process for outputting core asset security alert information and data leakage risk values ​​is as follows: By using the core asset set and its corresponding set of high-privilege operation types, the operation behavior on the assets is serialized and modeled within a time window; Construct a normal operation semantic transfer probability model for each core asset based on historical reliable data; And calculate the offset of the current operation sequence relative to the semantic transition probability model; Identify high-risk operational behaviors, which include high-privilege operations performed during prohibited periods, operations that bypass auditing mechanisms, and operations that modify security policies in batches, and calculate the high-risk operation superposition coefficient; Calculate the security risk value of core assets; Define the sensitive data set and its theoretical minimum reachable path length, calculate the actual access path length, and calculate the reachability offset; The data leakage risk value is calculated by combining the data sensitivity level coefficient, access frequency, and accessibility offset.

6. A multi-protocol adaptable classified network penetration defense system according to claim 5, characterized in that, The multi-protocol defense module dynamically verifies host access behavior, and the specific steps are as follows: According to the non-fixed selection rules, one protocol is selected from the defense protocol library of the outer layer penetration unit, the middle layer penetration unit and the inner layer penetration unit respectively, and combined to generate a penetration defense protocol path. Based on the generated penetration defense protocol path, the communication behavior data and intermediate analysis results generated by the host during the historical access process are analyzed again to obtain the path analysis pass determination result. If the analysis passes, the similarity between the current penetration defense protocol path and the set of historically verified penetration defense protocol paths will be calculated to obtain the path consistency determination result. The system statistically analyzes the number of paths that are both valid and consistent. When the number of such paths reaches a preset access determination threshold, the host is deemed to have passed access verification.

Images