Attack and defense relation graph generation method and device, equipment, storage medium and program product

Abstract

The invention relates to an attack and defense relation graph generation method and device, equipment, a storage medium and a program product. Acquiring attack and defense related data of the target network system, and performing feature extraction on the attack and defense related data to obtain a feature set; the attack and defense related data comprises network flow data, log data, calling data and defense response data; determining an attack behavior feature set and a defense behavior feature set based on the feature set, and determining an attack stage feature set, a defense stage feature set, an attack tactical feature set and a defense tactical feature set based on the attack behavior feature set and the defense behavior feature set; and generating an attack and defense relation graph based on the attack behavior feature set, the defense behavior feature set, the attack stage feature set, the defense stage feature set, the attack tactical feature set and the defense tactical feature set, wherein the attack and defense relation graph is used for predicting an attack and defense situation and evaluating a defense strategy. By adopting the method, the interaction relationship and the interaction logic between the attack and the defense can be represented.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating an attack and defense relationship graph. Background Technology

[0002] A cyberattack refers to an attack launched by an attacker who uses network system vulnerabilities, malicious code, or illegal operations to illegally intrude into, steal, damage, or interfere with a target network system. Its core purpose is to affect the confidentiality, integrity, or availability of the network system.

[0003] In existing technologies, most network security protection methods only focus on detecting attack behaviors and do not characterize the interaction relationship and logic between attack and defense, making it impossible to determine the offensive and defensive posture and evaluate defense strategies. Therefore, there is an urgent need for a method that can characterize the interaction relationship and logic between attack and defense. Summary of the Invention

[0004] Based on this, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating an attack-defense relationship graph that can characterize the interaction relationship and interaction logic between attack and defense, in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for generating an attack-defense relationship graph, including:

[0006] Acquire attack and defense related data of the target network system, and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data and defense response data;

[0007] Based on the feature set, determine the attack behavior feature set and the defense behavior feature set, and based on the attack behavior feature set and the defense behavior feature set, determine the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set;

[0008] An attack-defense relationship graph is generated based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set. The attack-defense relationship graph is used to predict the attack and defense situation and evaluate defense strategies.

[0009] In one embodiment, the feature set includes multiple feature vectors; determining the attack behavior feature set and the defense behavior feature set based on the feature set includes: performing encoding mapping processing on the multiple feature vectors to obtain standardized behavior representations of the multiple feature vectors; and clustering the multiple feature vectors based on the standardized behavior representations of the multiple feature vectors to obtain the attack behavior feature set and the defense behavior feature set.

[0010] In one embodiment, determining an attack phase feature set, a defense phase feature set, an attack tactic feature set, and a defense tactic feature set based on an attack behavior feature set and a defense behavior feature set includes: determining an attack phase feature set and a defense phase feature set based on the attack behavior feature set and the defense behavior feature set; and determining an attack tactic feature set and a defense tactic feature set based on the attack phase feature set and the defense phase feature set.

[0011] In one embodiment, determining an attack phase feature set and a defense phase feature set based on an attack behavior feature set and a defense behavior feature set includes: selecting a first feature vector from the attack behavior feature set that matches the semantics of a preset attack phase, and selecting a second feature vector from the defense behavior feature set that matches the semantics of a preset defense phase; aggregating the first feature vectors to obtain feature vectors for each attack phase, and aggregating the second feature vectors to obtain feature vectors for each defense phase; determining an attack phase feature set based on the feature vectors of each attack phase, and determining a defense phase feature set based on the feature vectors of each defense phase.

[0012] In one embodiment, determining an attack tactic feature set and a defense tactic feature set based on an attack phase feature set and a defense phase feature set includes: selecting a third feature vector from the attack phase feature set that matches a preset attack tactic semantics, and selecting a fourth feature vector from the defense phase feature set that matches a preset defense tactic semantics; mapping the third feature vectors to obtain feature vectors for each attack tactic, and mapping the fourth feature vectors to obtain feature vectors for each defense tactic; determining an attack tactic feature set based on the feature vectors of each attack tactic, and determining a defense tactic feature set based on the feature vectors of each defense tactic.

[0013] In one embodiment, an attack-defense relationship graph is generated based on an attack behavior feature set, a defense behavior feature set, an attack phase feature set, a defense phase feature set, an attack tactic feature set, and a defense tactic feature set. This includes: constructing graph nodes based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set; constructing directed edges of the graph based on the associations between the attack behavior feature set and the attack phase feature set, the associations between the attack phase feature set and the attack tactic feature set, the associations between the defense behavior feature set and the defense phase feature set, and the associations between the defense phase feature set and the defense tactic feature set; and generating the attack-defense relationship graph based on the graph nodes and the directed edges of the graph.

[0014] Secondly, this application also provides an attack-defense relationship graph generation device, comprising:

[0015] The acquisition module is used to acquire attack and defense related data of the target network system and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data and defense response data;

[0016] The determination module is used to determine the attack behavior feature set and the defense behavior feature set based on the feature set, and to determine the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set based on the attack behavior feature set and the defense behavior feature set;

[0017] The execution module is used to generate an attack-defense relationship graph based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set. The attack-defense relationship graph is used to predict the attack-defense situation and evaluate defense strategies.

[0018] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any of the embodiments of the first aspect above.

[0019] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the embodiments of the first aspect above.

[0020] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any of the embodiments of the first aspect above.

[0021] The aforementioned method, apparatus, computer equipment, computer-readable storage medium, and computer program product for generating attack-defense relationship graphs first acquire attack-defense related data of the target network system and extract features from this data to obtain a feature set. The attack-defense related data includes network traffic data, log data, call data, and defense response data. Then, based on the feature set, attack behavior feature set and defense behavior feature set are determined, and based on these feature sets, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set are determined. Finally, an attack-defense relationship graph is generated based on these feature sets. This graph is used to predict the attack-defense situation and evaluate defense strategies. The attack-defense relationship graph generation method provided in this application can generate an attack-defense relationship graph from the attack-defense related data of the target network system. The graph can characterize the interaction relationship and logic between attack and defense, and thus, the attack-defense situation can be determined and defense strategies evaluated based on the graph. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the attack-defense relationship graph generation method in one embodiment;

[0024] Figure 2 This is a flowchart illustrating a method for determining an attack behavior feature set and a defense behavior feature set in one embodiment.

[0025] Figure 3 This is a flowchart illustrating a method for determining the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set in one embodiment.

[0026] Figure 4 This is a flowchart illustrating a method for determining the attack phase feature set and the defense phase feature set in one embodiment.

[0027] Figure 5 This is a flowchart illustrating a method for determining an attack tactical feature set and a defense tactical feature set in one embodiment.

[0028] Figure 6This is a flowchart illustrating a method for generating an attack-defense relationship graph in one embodiment;

[0029] Figure 7 This is a flowchart illustrating the attack-defense relationship graph generation method in another embodiment;

[0030] Figure 8 This is a structural block diagram of an attack-defense relationship graph generation device in one embodiment;

[0031] Figure 9 This is an internal structural diagram of a computer device in one embodiment;

[0032] Figure 10 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0034] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0035] A cyberattack refers to an attack launched by an attacker who uses network system vulnerabilities, malicious code, or illegal operations to illegally intrude into, steal, damage, or interfere with a target network system. Its core purpose is to affect the confidentiality, integrity, or availability of the network system.

[0036] In existing technologies, most network security protection methods only focus on detecting attack behaviors and do not characterize the interaction relationship and logic between attack and defense, making it impossible to determine the offensive and defensive posture and evaluate defense strategies. Therefore, there is an urgent need for a method that can characterize the interaction relationship and logic between attack and defense.

[0037] In view of this, this application provides a method for generating an attack-defense relationship graph. First, attack-defense related data of the target network system is acquired, and features are extracted from this data to obtain a feature set. The attack-defense related data includes network traffic data, log data, call data, and defense response data. Then, attack behavior feature sets and defense behavior feature sets are determined based on the feature sets. Furthermore, attack phase feature sets, defense phase feature sets, attack tactic feature sets, and defense tactic feature sets are determined based on these feature sets. Finally, an attack-defense relationship graph is generated based on these feature sets. This graph is used to predict the attack-defense situation and evaluate defense strategies. The attack-defense relationship graph generation method provided in this application can generate an attack-defense relationship graph from the attack-defense related data of the target network system. The graph can represent the interaction relationships and logic between attack and defense, and thus, the attack-defense situation can be determined and defense strategies evaluated based on the graph.

[0038] The attack and defense relationship graph generation method provided in this application embodiment can be executed by a computer device, which can be a terminal or a server.

[0039] In one exemplary embodiment, such as Figure 1 As shown, a method for generating an attack-defense relationship graph is provided, which includes the following steps:

[0040] Step 101: Obtain attack and defense related data of the target network system, and extract features from the attack and defense related data to obtain a feature set.

[0041] The attack and defense related data includes network traffic data, log data, call data, and defense response data. For example, network traffic data includes packet header information and part of the payload. Call data, also known as target network system call data, can be used to reflect the system call sequence of host-level processes, including call type and call parameters.

[0042] In some exemplary embodiments, the computer device can acquire attack and defense related data of the target network system.

[0043] Specifically, computer devices can acquire network traffic data from switches, routers, and traffic acquisition probes in the target network system. They can also acquire log data from the operating system, applications, and databases of the target network system. Furthermore, they can obtain call data from the operating system kernel, process monitoring modules, and system call interceptors of the target network system. Finally, they can obtain defense response data from blocking and alarm records in the firewalls, IDS / IPS devices, or security policy enforcement modules of the target network system.

[0044] For example, attack and defense related data can be represented as D. ,in, Let j represent the j-th type of data source, which is network traffic data, log data, call data, or defense response data; p is the total number of data sources. As mentioned above, attack and defense related data includes network traffic data, log data, call data, and defense response data, so p is 4.

[0045] For the j-th type of data source It can contain its contents One original data sample, ,in, This represents the original feature dimension of this type of data, such as the number of bytes in network traffic packets or the number of fields in log entries for log data.

[0046] Furthermore, in an optional embodiment of this application, after obtaining the attack and defense related data of the target network system, each type of data in the attack and defense related data can be cleaned to remove redundancy, missing values ​​and outliers.

[0047] Specifically, let's assume the cleaning function is... Then each type of data after cleaning can be represented as The processed attack and defense related data can be represented as .

[0048] Furthermore, in an optional embodiment of this application, since the collection frequency and timestamp format of different data sources are inconsistent, it is necessary to perform unified time alignment processing on various types of data in attack and defense related data.

[0049] Specifically, assuming the original timestamp is The mapping function is Then, each type of data after alignment can be represented as All data is mapped to a unified global timeline, which ensures that behaviors from different sources can be compared and fused on the same time dimension.

[0050] Furthermore, computer equipment can extract features from attack and defense related data to obtain a feature set.

[0051] Specifically, for each type of cleaned and aligned data, computer equipment can extract its core features related to offensive and defensive behaviors. Assume the feature extraction function is... ,but ;in, The extracted feature dimensions.

[0052] For example, for network traffic data, computer devices can extract packet length distribution, communication frequency, and protocol characteristics; for log data, computer devices can extract access event types, failure counts, and user identifiers; for call data, computer devices can extract call sequence patterns and call frequency; and for defense response data, computer devices can extract blocking rule numbers and alarm categories.

[0053] The initial feature set can be represented as Furthermore, in an optional embodiment of this application, since the numerical ranges of different features differ, it is necessary to map the feature vectors in the feature set to a unified vector space. .

[0054] Specifically, assume the normalization function is ,but ;

[0055] The processed feature set can be represented as .

[0056] Step 102: Determine the attack behavior feature set and the defense behavior feature set based on the feature set, and determine the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set based on the attack behavior feature set and the defense behavior feature set.

[0057] Optionally, the attack behavior feature set refers to a subset of features that can characterize various attack behaviors in the target network system. The defense behavior feature set refers to a subset of features that can characterize various defense behaviors in the target network system.

[0058] The attack phase feature set refers to a subset of features categorized and summarized according to the time sequence or process stages of attack implementation. It can be used to characterize the core behavioral characteristics of different attack phases. The defense phase feature set refers to a subset of features categorized and summarized according to the time sequence or process stages of defense implementation. It can be used to characterize the core behavioral characteristics of different defense phases.

[0059] The attack tactical feature set refers to a subset of features categorized and summarized according to the types of attack tactics employed, and can be used to characterize the typical behavioral characteristics of various attack tactics. The defense tactical feature set refers to a subset of features categorized and summarized according to the types of defense tactics employed, and can be used to characterize the typical behavioral characteristics of various defense tactics.

[0060] In some exemplary embodiments, a computer device may determine an attack behavior feature set and a defense behavior feature set based on a feature set.

[0061] Specifically, computer devices can input feature sets into a pre-trained feature analysis model to obtain attack behavior feature sets and defense behavior feature sets output by the feature analysis model.

[0062] Furthermore, after determining the attack behavior feature set and the defense behavior feature set based on the feature set, the computer device can determine the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set based on the attack behavior feature set and the defense behavior feature set.

[0063] Specifically, computer equipment can input attack behavior feature sets and defense behavior feature sets into a pre-trained feature analysis model to obtain attack phase feature sets, defense phase feature sets, attack tactical feature sets, and defense tactical feature sets output by the feature analysis model.

[0064] Step 103: Generate an attack-defense relationship graph based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set.

[0065] Among them, the attack-defense relationship graph is used to predict the attack-defense situation and evaluate defense strategies.

[0066] In some exemplary embodiments, after determining the attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set based on the attack behavior feature set and defense behavior feature set, the computer device can generate an attack-defense relationship map based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set.

[0067] Specifically, computer equipment can input attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set into a pre-trained attack-defense relationship graph generation model to obtain the attack-defense relationship graph output by the attack-defense relationship graph generation model.

[0068] The aforementioned method for generating an attack-defense relationship graph first acquires attack-defense related data of the target network system and extracts features from this data to obtain a feature set. This attack-defense related data includes network traffic data, log data, call data, and defense response data. Then, based on the feature set, attack behavior feature set and defense behavior feature set are determined. Furthermore, based on these feature sets, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set are determined. Finally, an attack-defense relationship graph is generated based on these feature sets. This graph is used to predict the attack-defense situation and evaluate defense strategies. The attack-defense relationship graph generation method provided in this application can generate an attack-defense relationship graph from the attack-defense related data of the target network system. This graph can characterize the interaction relationships and logic between attack and defense, and thus, the attack-defense situation can be determined and defense strategies evaluated based on the graph.

[0069] In one exemplary embodiment, such as Figure 2 As shown, the feature set includes multiple feature vectors; determining the attack behavior feature set and the defense behavior feature set based on the feature set includes the following steps:

[0070] Step 201: Encode and map multiple feature vectors to obtain a standardized behavioral representation of the multiple feature vectors.

[0071] Step 202: Based on the standardized behavior representation of multiple feature vectors, cluster the multiple feature vectors to obtain the attack behavior feature set and the defense behavior feature set.

[0072] In some exemplary embodiments, a computer device may perform encoding mapping processing on multiple feature vectors to obtain standardized behavioral representations of the multiple feature vectors, and cluster the multiple feature vectors based on the standardized behavioral representations of the multiple feature vectors to obtain attack behavior feature sets and defense behavior feature sets.

[0073] Specifically, computer devices can mathematically define the basic units of offensive and defensive actions.

[0074] Assume the set of attack behavior features is The set of defensive behaviors is ;in, A feature vector representing an attack behavior unit. The feature vector of a defensive action unit, set With sets This constitutes the behavioral unit library of the target network system.

[0075] In order to achieve the extraction from feature set Encoding functions were defined based on the attack behavior feature set and the defense behavior feature set. , ;in, This represents the input feature vector. This represents the standardized behavior after encoding. Dimensions of the higher-order semantic space.

[0076] The encoding function can be implemented using matrix transformations, that is... ;in, For the mapping matrix, This is a bias term.

[0077] Since similar attack or defense behaviors should exhibit similar distributions in higher-order spaces, computer devices can use clustering methods to group similar samples into the same behavioral characteristics. Assuming the clustering function is... ,but Where c is the category label, C is the total number of categories, and each category corresponds to a behavioral feature.

[0078] For the set of attack behavior characteristics ;in, Let be the set of attack samples of the i-th class after clustering.

[0079] For the set of defensive behavior features ;in, Let be the set of defense samples of the j-th class after clustering.

[0080] Furthermore, in an optional embodiment of this application, in order to give the behavioral feature set clear semantics, the behavioral feature set can be labeled by combining expert knowledge and rule base.

[0081] Assume the semantic annotation function is ,but ;in, For semantic labels, for example, the set of attack behavior features can be labeled as scanning, penetration, and lateral movement, while the set of defense behavior features can be labeled as blocking, isolation, and recovery.

[0082] In one exemplary embodiment, such as Figure 3 As shown, based on the attack behavior feature set and the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactical feature set, and the defense tactical feature set are determined, including the following steps:

[0083] Step 301: Based on the attack behavior feature set and the defense behavior feature set, determine the attack phase feature set and the defense phase feature set.

[0084] In some exemplary embodiments, a computer device may determine an attack phase feature set and a defense phase feature set based on an attack behavior feature set and a defense behavior feature set.

[0085] Specifically, computer equipment can input attack behavior feature sets and defense behavior feature sets into a pre-trained feature analysis model to obtain attack phase feature sets and defense phase feature sets output by the feature analysis model.

[0086] Step 302: Based on the attack phase feature set and the defense phase feature set, determine the attack tactical feature set and the defense tactical feature set.

[0087] In some exemplary embodiments, after determining the attack phase feature set and the defense phase feature set based on the attack behavior feature set and the defense behavior feature set, the computer device can determine the attack tactic feature set and the defense tactic feature set based on the attack phase feature set and the defense phase feature set.

[0088] Specifically, computer equipment can input attack phase feature sets and defense phase feature sets into a pre-trained feature analysis model to obtain attack tactical feature sets and defense tactical feature sets output by the feature analysis model.

[0089] In one exemplary embodiment, such as Figure 4 As shown, based on the attack behavior feature set and the defense behavior feature set, the attack phase feature set and the defense phase feature set are determined, including the following steps:

[0090] Step 401: Select a first feature vector that matches the semantics of the preset attack stage from the attack behavior feature set, and select a second feature vector that matches the semantics of the preset defense stage from the defense behavior feature set.

[0091] Step 402: Aggregate the first feature vector to obtain the feature vectors of each attack stage, and aggregate the second feature vector to obtain the feature vectors of each defense stage.

[0092] Step 403: Determine the feature set of the attack stage based on the feature vectors of each attack stage, and determine the feature set of the defense stage based on the feature vectors of each defense stage.

[0093] In some exemplary embodiments, a computer device may select a first feature vector from an attack behavior feature set that semantically matches a preset attack phase, and select a second feature vector from a defense behavior feature set that semantically matches a preset defense phase.

[0094] Furthermore, after obtaining the first feature vector and the second feature vector, the computer device can perform aggregation processing on the first feature vector to obtain feature vectors for each attack stage, and perform aggregation processing on the second feature vector to obtain feature vectors for each defense stage.

[0095] Furthermore, after obtaining the feature vectors of each attack stage and the feature vectors of each defense stage, the computer device can determine the feature set of the attack stage based on the feature vectors of each attack stage, and determine the feature set of the defense stage based on the feature vectors of each defense stage.

[0096] Specifically, assuming the attack phase feature set is as follows: ,in, The vector representation of the i-th attack phase, where r is the total number of phases, such as reconnaissance, penetration, lateral movement, persistence, etc.

[0097] The construction of the attack phase feature set is achieved by aggregating the feature vectors corresponding to attack behaviors belonging to the same phase. Assume the phase aggregation function is... ,but ;in, Representation and Stage The corresponding set of behavioral tags ensures that all semantically related attack behaviors are unified into the corresponding stage.

[0098] The feature set of the defense phase is ,in, The vector representation of the j-th attack stage, such as detection, blocking, recovery, etc., is the same as the aggregation process of the attack stage feature set.

[0099] In one exemplary embodiment, such as Figure 5 As shown, based on the attack phase feature set and the defense phase feature set, the attack tactical feature set and the defense tactical feature set are determined, including the following steps:

[0100] Step 501: Select the third feature vector that matches the preset attack tactic semantics from the attack phase feature set, and select the fourth feature vector that matches the preset defense tactic semantics from the defense phase feature set.

[0101] Step 502: Map the third feature vector to obtain the feature vectors of each attack tactic, and map the fourth feature vector to obtain the feature vectors of each defense tactic.

[0102] Step 503: Determine the attack tactic feature set based on the feature vectors of each attack tactic, and determine the defense tactic feature set based on the feature vectors of each defense tactic.

[0103] In some exemplary embodiments, the computer device may select a third feature vector from the attack phase feature set that matches the semantics of a preset attack tactic, and select a fourth feature vector from the defense phase feature set that matches the semantics of a preset defense tactic.

[0104] Furthermore, after obtaining the third and fourth feature vectors, the computer device can perform mapping processing on the third feature vector to obtain the feature vectors of each attack tactic, and perform mapping processing on the fourth feature vector to obtain the feature vectors of each defense tactic.

[0105] Furthermore, after obtaining the feature vectors of each attack tactic and each defense tactic, the computer device can determine the attack tactic feature set based on the feature vectors of each attack tactic, and determine the defense tactic feature set based on the feature vectors of each defense tactic.

[0106] Specifically, the set of attack tactical characteristics can be represented as The set of defensive tactical features can be represented as ;in, This can represent tactics employed by attackers, such as resource theft, service disruption, and privilege escalation. It can represent the defender's tactics such as defense in depth, minimizing the attack surface, and rapid recovery.

[0107] The calculation method can be expressed as follows: , ,in, This is a mapping function used to map stage vectors in the stage feature set to the tactical feature set.

[0108] In summary, to achieve traceability, a hierarchical mapping relationship is defined from the behavioral feature set to the stage feature set, and then to the tactical feature set. Let the hierarchical mapping function be... Then there is This hierarchical mapping function ensures that each behavioral feature can ultimately be traced back to a tactical feature, solving the problem of lack of a global perspective in traditional technologies.

[0109] In an optional embodiment of this application, a constraint matrix between the attack and defense phases is defined to characterize the logical relationship of the attack and defense interaction. Let the feature set of the attack phase be... The feature set of the defense phase is Then the relation matrix can be represented as ;in, Indicates the attack phase With the defensive phase There are interactive relationships; for example, lateral movement corresponds to a blocking strategy. This indicates that the two are not directly related. This matrix can provide a rigorous mathematical foundation for the subsequent construction of an attack-defense relationship graph.

[0110] In one exemplary embodiment, such as Figure 6 As shown, an attack-defense relationship graph is generated based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set. This includes the following steps:

[0111] Step 601: Construct graph nodes based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set;

[0112] Step 602: Based on the association between the attack behavior feature set and the attack phase feature set, the association between the attack phase feature set and the attack tactic feature set, the association between the defense behavior feature set and the defense phase feature set, and the association between the defense phase feature set and the defense tactic feature set, construct directed edges of the graph;

[0113] Step 603: Generate an attack and defense relationship graph based on graph nodes and directed edges.

[0114] In some exemplary embodiments, a computer device may construct graph nodes based on a set of attack behavior features, a set of defense behavior features, a set of attack phase features, a set of defense phase features, a set of attack tactics features, and a set of defense tactics features.

[0115] Furthermore, computer devices can construct directed edges in a graph based on the association between the attack behavior feature set and the attack phase feature set, the association between the attack phase feature set and the attack tactic feature set, the association between the defense behavior feature set and the defense phase feature set, and the association between the defense phase feature set and the defense tactic feature set.

[0116] Furthermore, after obtaining the graph nodes and directed edges, the computer device can generate an attack and defense relationship graph based on the graph nodes and directed edges.

[0117] Specifically, the attack-defense relationship graph is a directed weighted graph, which can be represented as follows: Among them, the set of nodes It includes a set of attack behavior features, a set of defense behavior features, a set of attack phase features, a set of defense phase features, a set of attack tactical features, and a set of defense tactical features, along with an edge set. The weight matrix represents the causal or dependency relationship between nodes. , Indicates from node To the node The strength of the association. For example, when attack phase characteristics Trigger defense phase At that time, there exists an edge And its weight It is determined by empirical rules or statistical learning methods.

[0118] Furthermore, to represent the attacker's multi-stage actions, a path search algorithm is used in... Constructing an attack chain, the attack chain can be represented as... ; where each behavioral unit in the chain For a given time series node, the edge weight This represents the inter-stage transition probability. The chain weight is... Its value can be used to measure the credibility and strength of an attack path.

[0119] In an optional embodiment of this application, in order to reflect the dynamic response of the defender, a defense strategy sequence is defined as follows: ; among them, each Corresponding to the characteristics of defensive behavior, edge weights represent the temporal order and relevance of strategy execution.

[0120] attack chain With the defense chain The matching relationship is determined by the interaction function. definition, Its output is a matching score, which can be used to measure the extent to which a defense strategy covers a specific attack path.

[0121] In an optional embodiment of this application, after generating the attack-defense relationship graph, the future attack-defense situation can be predicted. Specifically, a Markov chain-based reasoning mechanism is introduced into the attack-defense relationship graph. Let the set of attack states be... The transition probability matrix is ,but Among them, the state transition is determined by the edge weights in the graph. Decision. This is made by calculating the state distribution. This allows us to predict the attacker's most likely next action. Similarly, the defender's state transition matrix... It can be used to simulate defensive maneuvers.

[0122] In an optional embodiment of this application, after generating the attack-defense relationship graph, the defense effect can be evaluated by defining an attack-defense effectiveness function. Specifically, let the attack chain weight be... Defense coverage score is Then the efficiency function can be defined as The lower the effectiveness value, the better the defense coverage; conversely, the higher the effectiveness value, the more vulnerabilities exist, and the defense strategy needs to be optimized.

[0123] In one exemplary embodiment, such as Figure 7 As shown, another method for generating attack-defense relationship graphs is provided, which includes the following steps:

[0124] Step 701: Obtain attack and defense related data of the target network system, and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data and defense response data; the feature set includes multiple feature vectors;

[0125] Step 702: Encode and map multiple feature vectors to obtain standardized behavioral representations of multiple feature vectors; cluster and divide multiple feature vectors based on standardized behavioral representations of multiple feature vectors to obtain attack behavior feature sets and defense behavior feature sets.

[0126] Step 703: Select a first feature vector that matches the semantics of a preset attack stage from the attack behavior feature set, and select a second feature vector that matches the semantics of a preset defense stage from the defense behavior feature set; perform aggregation processing on the first feature vector to obtain feature vectors for each attack stage, and perform aggregation processing on the second feature vector to obtain feature vectors for each defense stage; determine the attack stage feature set based on the feature vectors of each attack stage, and determine the defense stage feature set based on the feature vectors of each defense stage.

[0127] Step 704: Select third feature vectors that match the semantics of preset attack tactics from the attack phase feature set, and select fourth feature vectors that match the semantics of preset defense tactics from the defense phase feature set; perform mapping processing on the third feature vectors to obtain feature vectors for each attack tactic, and perform mapping processing on the fourth feature vectors to obtain feature vectors for each defense tactic; determine the attack tactic feature set based on the feature vectors of each attack tactic, and determine the defense tactic feature set based on the feature vectors of each defense tactic.

[0128] Step 705: Construct graph nodes based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set; construct directed edges of the graph based on the associations between the attack behavior feature set and the attack phase feature set, the associations between the attack phase feature set and the attack tactic feature set, the associations between the defense behavior feature set and the defense phase feature set, and the associations between the defense phase feature set and the defense tactic feature set; generate an attack-defense relationship graph based on the graph nodes and the directed edges of the graph, which is used to predict the attack-defense situation and evaluate defense strategies.

[0129] The attack and defense relationship graph generation method provided in this application first maps heterogeneous data from multiple sources such as network traffic, system logs, system calls, and defense responses to a unified feature space. This solves the problem that existing technologies have difficulty integrating different data types, significantly improves data utilization, and makes the representation of attack and defense behaviors more comprehensive and accurate.

[0130] By using encoding and clustering methods, the original features are transformed into attack and defense behavior features with clear semantics, forming a reusable set of behavior features. This breaks through the limitation of traditional systems that can only rely on rule bases or feature matching to identify attacks, significantly improving the ability to identify unknown and variant attacks, while also enhancing the system's ability to abstract defense actions.

[0131] By gradually abstracting low-level behavioral characteristics into stage characteristics and tactical characteristics, this application achieves a multi-level and multi-dimensional characterization of the attack and defense process. Traditional technologies can often only identify single-point events, while this application can reveal the attacker's overall strategy and the defender's global logic, greatly improving the depth and breadth of network security situation awareness.

[0132] By utilizing directed weighted graphs and Markov chain reasoning mechanisms, a dynamic interaction model between attackers and defenders is constructed. This enables not only the description of attacks that have already occurred but also the prediction of the attacker's next move, and the quantitative evaluation and optimization of defense strategies. It effectively solves the problem that traditional technologies can only provide static alerts and lack inferential capabilities.

[0133] By visually representing the attack and defense chain, the relationships between stages, and tactical intentions, security managers can intuitively understand the causal relationships between complex attack paths and defensive measures, significantly lowering the threshold for security analysis while improving the speed and accuracy of emergency response.

[0134] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0135] Based on the same inventive concept, this application also provides an attack-defense relationship graph generation device for implementing the attack-defense relationship graph generation method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more attack-defense relationship graph generation device embodiments provided below can be found in the limitations of the attack-defense relationship graph generation method described above, and will not be repeated here.

[0136] In one exemplary embodiment, such as Figure 8 As shown, an attack-defense relationship graph generation device 800 is provided, including: an acquisition module 801, a determination module 802, and an execution module 803, wherein:

[0137] The acquisition module 801 is used to acquire attack and defense related data of the target network system and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data and defense response data;

[0138] The determination module 802 is used to determine the attack behavior feature set and the defense behavior feature set based on the feature set, and to determine the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set based on the attack behavior feature set and the defense behavior feature set;

[0139] The execution module 803 is used to generate an attack-defense relationship graph based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set. The attack-defense relationship graph is used to predict the attack-defense situation and evaluate the defense strategy.

[0140] In one embodiment, the feature set includes multiple feature vectors; the determination module 802 is specifically used to perform encoding mapping processing on the multiple feature vectors to obtain standardized behavioral representations of the multiple feature vectors; and to cluster the multiple feature vectors based on the standardized behavioral representations of the multiple feature vectors to obtain an attack behavior feature set and a defense behavior feature set.

[0141] In one embodiment, the determining module 802 is specifically used to determine the attack phase feature set and the defense phase feature set based on the attack behavior feature set and the defense behavior feature set; and to determine the attack tactical feature set and the defense tactical feature set based on the attack phase feature set and the defense phase feature set.

[0142] In one embodiment, the determining module 802 is specifically used to filter a first feature vector that semantically matches a preset attack stage from the attack behavior feature set, and to filter a second feature vector that semantically matches a preset defense stage from the defense behavior feature set; to perform aggregation processing on the first feature vector to obtain feature vectors for each attack stage, and to perform aggregation processing on the second feature vector to obtain feature vectors for each defense stage; to determine an attack stage feature set based on the feature vectors for each attack stage, and to determine a defense stage feature set based on the feature vectors for each defense stage.

[0143] In one embodiment, the determining module 802 is specifically used to filter third feature vectors that match the semantics of preset attack tactics from the attack phase feature set, and to filter fourth feature vectors that match the semantics of preset defense tactics from the defense phase feature set; to perform mapping processing on the third feature vectors to obtain feature vectors of each attack tactic, and to perform mapping processing on the fourth feature vectors to obtain feature vectors of each defense tactic; to determine the attack tactic feature set based on the feature vectors of each attack tactic, and to determine the defense tactic feature set based on the feature vectors of each defense tactic.

[0144] In one embodiment, the execution module 803 is specifically used to construct graph nodes based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set; construct directed edges of the graph based on the association between the attack behavior feature set and the attack phase feature set, the association between the attack phase feature set and the attack tactic feature set, the association between the defense behavior feature set and the defense phase feature set, and the association between the defense phase feature set and the defense tactic feature set; and generate an attack-defense relationship graph based on the graph nodes and the directed edges of the graph.

[0145] Each module in the aforementioned attack-defense relationship graph generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0146] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network. When executed by the processor, the computer program implements a method for generating an attack-defense relationship graph.

[0147] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a method for generating an attack-defense relationship graph.

[0148] Those skilled in the art will understand that Figure 9 and Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0149] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0150] Acquire attack and defense related data of the target network system, and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data and defense response data;

[0151] Based on the feature set, determine the attack behavior feature set and the defense behavior feature set, and based on the attack behavior feature set and the defense behavior feature set, determine the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set;

[0152] An attack-defense relationship graph is generated based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set. The attack-defense relationship graph is used to predict the attack and defense situation and evaluate defense strategies.

[0153] In one embodiment, when the processor executes the computer program, it further performs the following steps: encoding and mapping multiple feature vectors to obtain standardized behavioral representations of the multiple feature vectors; and clustering the multiple feature vectors based on the standardized behavioral representations of the multiple feature vectors to obtain an attack behavior feature set and a defense behavior feature set.

[0154] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining an attack phase feature set and a defense phase feature set based on an attack behavior feature set and a defense behavior feature set; and determining an attack tactical feature set and a defense tactical feature set based on the attack phase feature set and the defense phase feature set.

[0155] In one embodiment, when the processor executes the computer program, it further performs the following steps: filtering a first feature vector from the attack behavior feature set that semantically matches a preset attack stage, and filtering a second feature vector from the defense behavior feature set that semantically matches a preset defense stage; aggregating the first feature vector to obtain feature vectors for each attack stage, and aggregating the second feature vector to obtain feature vectors for each defense stage; determining an attack stage feature set based on the feature vectors for each attack stage, and determining a defense stage feature set based on the feature vectors for each defense stage.

[0156] In one embodiment, when the processor executes the computer program, it further performs the following steps: filtering a third feature vector from the attack phase feature set that matches the semantics of a preset attack tactic, and filtering a fourth feature vector from the defense phase feature set that matches the semantics of a preset defense tactic; mapping the third feature vector to obtain the feature vector of each attack tactic, and mapping the fourth feature vector to obtain the feature vector of each defense tactic; determining an attack tactic feature set based on the feature vector of each attack tactic, and determining a defense tactic feature set based on the feature vector of each defense tactic.

[0157] In one embodiment, when the processor executes the computer program, it further implements the following steps: constructing graph nodes based on the attack behavior feature set, defense behavior feature set, attack phase feature set, defense phase feature set, attack tactic feature set, and defense tactic feature set; constructing directed edges of the graph based on the associations between the attack behavior feature set and the attack phase feature set, the associations between the attack phase feature set and the attack tactic feature set, the associations between the defense behavior feature set and the defense phase feature set, and the associations between the defense phase feature set and the defense tactic feature set; and generating an attack-defense relationship graph based on the graph nodes and the directed edges of the graph.

[0158] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any embodiment.

[0159] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described in any embodiment.

[0160] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0161] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0162] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for generating an attack-defense relationship graph, characterized in that, The method includes: Acquire attack and defense related data of the target network system, and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data, and defense response data; Based on the aforementioned feature set, an attack behavior feature set and a defense behavior feature set are determined. Based on the attack behavior feature set and the defense behavior feature set, an attack phase feature set, a defense phase feature set, an attack tactic feature set, and a defense tactic feature set are determined. An attack-defense relationship graph is generated based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set. The attack-defense relationship graph is used to predict the attack-defense situation and evaluate defense strategies.

2. The method according to claim 1, characterized in that, The feature set includes multiple feature vectors; determining the attack behavior feature set and the defense behavior feature set based on the feature set includes: The plurality of feature vectors are encoded and mapped to obtain a standardized behavioral representation of the plurality of feature vectors; Based on the standardized behavioral representation of the multiple feature vectors, the multiple feature vectors are clustered to obtain the attack behavior feature set and the defense behavior feature set.

3. The method according to claim 1, characterized in that, The process of determining the attack phase feature set, defense phase feature set, attack tactical feature set, and defense tactical feature set based on the attack behavior feature set and the defense behavior feature set includes: Based on the attack behavior feature set and the defense behavior feature set, the attack phase feature set and the defense phase feature set are determined; Based on the attack phase feature set and the defense phase feature set, the attack tactic feature set and the defense tactic feature set are determined.

4. The method according to claim 3, characterized in that, The step of determining the attack phase feature set and the defense phase feature set based on the attack behavior feature set and the defense behavior feature set includes: Select a first feature vector that semantically matches a preset attack stage from the set of attack behavior features, and select a second feature vector that semantically matches a preset defense stage from the set of defense behavior features; The first feature vector is aggregated to obtain feature vectors for each attack stage, and the second feature vector is aggregated to obtain feature vectors for each defense stage. The attack phase feature set is determined based on the feature vectors of each attack phase, and the defense phase feature set is determined based on the feature vectors of each defense phase.

5. The method according to claim 3, characterized in that, The step of determining the attack tactical feature set and the defense tactical feature set based on the attack phase feature set and the defense phase feature set includes: A third feature vector matching the preset attack tactic semantics is selected from the attack phase feature set, and a fourth feature vector matching the preset defense tactic semantics is selected from the defense phase feature set. The third feature vector is mapped to obtain the feature vectors of each attack tactic, and the fourth feature vector is mapped to obtain the feature vectors of each defense tactic. The attack tactic feature set is determined based on the feature vectors of each attack tactic, and the defense tactic feature set is determined based on the feature vectors of each defense tactic.

6. The method according to any one of claims 1 to 5, characterized in that, The process of generating an attack-defense relationship graph based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set includes: Graph nodes are constructed based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set; Based on the association between the attack behavior feature set and the attack phase feature set, the association between the attack phase feature set and the attack tactic feature set, the association between the defense behavior feature set and the defense phase feature set, and the association between the defense phase feature set and the defense tactic feature set, directed edges of the graph are constructed. The attack and defense relationship graph is generated based on the graph nodes and the directed edges of the graph.

7. A device for generating an attack-defense relationship graph, characterized in that, The device includes: The acquisition module is used to acquire attack and defense related data of the target network system and extract features from the attack and defense related data to obtain a feature set; the attack and defense related data includes network traffic data, log data, call data and defense response data; The determination module is used to determine an attack behavior feature set and a defense behavior feature set based on the feature set, and to determine an attack phase feature set, a defense phase feature set, an attack tactic feature set, and a defense tactic feature set based on the attack behavior feature set and the defense behavior feature set; The execution module is used to generate an attack-defense relationship graph based on the attack behavior feature set, the defense behavior feature set, the attack phase feature set, the defense phase feature set, the attack tactic feature set, and the defense tactic feature set. The attack-defense relationship graph is used to predict the attack-defense situation and evaluate the defense strategy.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images