Dynamic security protection method and system based on behavior workflow and kalman filter

Abstract

The application discloses a dynamic security protection method and system based on behavior workflow and Kalman filtering, and relates to the technical field of network security management and control.The application comprises the following steps: collecting multi-source heterogeneous original logs and performing standardized processing to obtain a standardized event stream; mapping the standardized event stream into an attack stage sequence, constructing and incrementally updating an attack semantic graph, and extracting attack progress observation values; establishing a state space model including attack progress and attack speed based on Kalman filtering, performing attack state estimation and trend prediction, and obtaining attack progress estimation and attack speed estimation; calculating threat urgency, and adjusting a two-way mandatory access control strategy based on the threat urgency classification. A dynamic security protection system capable of realizing real-time perception of attack process evolution, dynamic adjustment of access control strategy, high interpretability and strong adaptability is constructed, and deep coupling of attack semantic understanding, attack state estimation and access control strategy adjustment at the system level is realized.

Description

Technical Field

[0001] This invention belongs to the field of network security management technology, and in particular relates to a dynamic security protection method and system based on behavioral workflow and Kalman filtering. Background Technology

[0002] Cybersecurity is a key technical means to ensure the stable operation of information systems. It aims to monitor and analyze internal and external network behavior to promptly detect and block malicious attacks, such as network intrusions, malware propagation, and advanced persistent threats (APTs). Traditional security methods primarily rely on rule-based intrusion detection systems (IDS), signature-based firewall policies, and static access control list (ACL)-based permission management mechanisms.

[0003] However, existing security protection systems are essentially passive defense mechanisms, and their limitations are becoming increasingly apparent when dealing with current multi-stage, high-level cyberattacks, specifically in the following three aspects: First, there's the static and lagging nature of protection strategies. Existing access control mechanisms, such as Mandatory Access Control (MAC) and Role-Based Access Control (RBAC), generally employ predefined static policies. These policies remain unchanged long after system deployment, lacking the ability to dynamically adjust based on real-time threats. Multi-stage attacks launched by attackers (such as APT attacks) often last for weeks or even months, gradually penetrating the system. During this process, static policies cannot perceive the progress of the attack: in the early stages of the attack, the system fails to tighten access permissions for suspicious entities in a timely manner, allowing attackers to complete reconnaissance and penetration at low cost; in the later stages of the attack, when attackers have gained high privileges, rigid policies cannot effectively curb their lateral movement and privilege escalation. This passive response defense model essentially provides attackers with ample time to complete the entire attack chain, ensuring that security protection always lags behind the attackers' pace.

[0004] Second, there is a semantic gap in attack behavior observation and threat assessment. Existing intrusion detection systems (IDS) and situational awareness systems mainly rely on low-level network characteristics (such as traffic statistics, frequency of individual events, and simple rule matching) for threat determination. These methods face a serious "semantic gap" problem: the attacker's multi-stage behavior (such as port scanning in the reconnaissance stage, vulnerability exploitation in the initial intrusion stage, remote execution in the lateral movement stage, system calls in the privilege escalation stage, and data leakage in the goal achievement stage) appears as scattered, isolated, and seemingly unrelated event streams at the raw log level. Existing technologies cannot correlate these low-level events into a complete attack workflow with causal relationships, let alone accurately infer the current attack stage of the attacker. The direct consequence is that threat assessment lags far behind the actual progress of the attack. Protection systems often trigger alerts only after the attack has caused substantial damage (such as data leakage or system encryption), missing the best opportunity to intervene in the early stages of the attack.

[0005] Third, access control mechanisms suffer from unidirectionality and a lack of dynamic closed-loop mechanisms. Traditional mandatory access control often employs a unidirectional constraint model from subject to object (such as the "read-from-below-write" Biba model or the Bell-LaPadula model). This unidirectional design struggles to cope with the complex scenarios of modern attacks, especially when attackers use a low-integrity subject or a low-security object as a springboard for reverse penetration and lateral movement. Unidirectional strategies often fail to effectively block these indirect attack paths. More critically, existing defense systems generally lack a dynamic closed-loop feedback mechanism of "detection-assessment-response." There is a lack of real-time linkage between threat assessment results and access control policy enforcement points. Even if users can perceive the attack posture through independent security analysis tools, they cannot automatically and in real-time translate these quantified attack status estimates into specific policy adjustment instructions (such as temporarily raising the integrity level of a subject or lowering its security level). This leaves security protection stuck in a passive response situation of "manual intervention after alarms," ​​unable to achieve adaptive and proactive defense.

[0006] In summary, existing security protection systems suffer from inherent limitations in responding to multi-stage, dynamically evolving cyberattacks, including static and rigid strategies, delayed threat assessment, and one-way control mechanisms—representing passive defense. There is an urgent need to construct a proactive security protection mechanism capable of dynamically sensing the attack process and adjusting protection strategies in real time. To address the problems in the existing technologies, this invention proposes a dynamic security protection method and system based on behavioral workflow and Kalman filtering. Summary of the Invention

[0007] The purpose of this invention is to provide a dynamic security protection method and system based on behavioral workflow and Kalman filtering. Starting from semantic modeling of attack behavior, it constructs an attack semantic graph based on behavioral workflow, mapping raw log events into quantifiable attack stage observations. A dynamic system model of the attack process is established through Kalman filtering, integrating historical predictions and current observations to achieve optimal state estimation of attack progress and speed. Based on the state estimation results, the threat urgency is dynamically quantified, driving the hierarchical adaptive adjustment of the bidirectional mandatory access control policy, forming a closed-loop proactive defense system of "detection-evaluation-response." This solves the inherent limitations of existing cyberspace security protection systems in dealing with multi-stage, dynamically evolving cyberattacks, such as static and rigid policies, delayed threat assessment, and unidirectional control mechanisms, which are inherent to passive defense.

[0008] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: As the first aspect provided by this invention, this invention is a dynamic security protection method based on behavioral workflow and Kalman filtering, comprising the following steps: Collect heterogeneous raw logs from multiple sources and perform standardization processing to obtain a standardized event stream sorted by time. The heterogeneous raw logs from multiple sources include host operating system logs, network device logs, application server logs, authentication logs, and cloud platform audit logs. The standardization processing includes: filling missing fields, converting time formats to Unix timestamps, unifying IP addresses to string formats, removing invalid and error logs, and removing duplicate events. Based on the definition and mapping rules of attack phases, the standardized event flow is mapped into the sequence of attack phases, and an attack semantic graph including phase transition relationships is constructed and incrementally updated. Attack progress observations are extracted from the attack semantic graph. The attack process is modeled as a linear dynamic system. A state-space model including attack progress and attack speed is established based on Kalman filtering. Attack state estimation and trend prediction are performed through prediction and update steps to obtain attack progress estimation and attack speed estimation. The threat urgency is calculated based on the attack status estimation results, and the bidirectional mandatory access control policy is adjusted according to the threat urgency level to complete dynamic security protection.

[0009] Furthermore, the standardized event stream includes: timestamp, source IP address, source port number, destination IP address, destination port number, user identifier, operation type, operation object, and operation result field.

[0010] Furthermore, the attack phases are defined based on the network kill chain model and the MITRE ATT&CK framework. The attack phases include the reconnaissance phase, the initial intrusion phase, the command and control phase, the lateral movement phase, the privilege escalation phase, and the attack target achievement phase. Standardized events are mapped to subsets or empty sets of attack phases through a predefined mapping rule base. One standardized event is mapped to one or more attack phases. Each rule in the mapping rule base is based on the logical combination of standardized event fields and outputs the corresponding attack phase.

[0011] Furthermore, the attack semantic graph is a directed heterogeneous graph. The node set of the attack semantic graph includes attack phase nodes, entity nodes, and event nodes. The edge set of the attack semantic graph includes phase transition edges, event-phase association edges, and entity-event association edges. The weight of the phase transition edge is the phase transition frequency from one attack phase node to another, supporting incremental updates based on new events. The attack progress observation value is the index normalized value of the latest associated attack phase of the entity, with a value range of [0, 1]. The attack progress observation value is updated only when the attack behavior occurs.

[0012] Furthermore, the state-space model includes a system state transition model and an observation model; the system state transition model adopts a constant-rate model, which describes the recursive relationship between attack progress and attack speed through a state transition matrix; the observation model adopts a linear observation model, which establishes a mapping relationship between attack progress observations and attack progress through an observation matrix.

[0013] Furthermore, the state vector of the Kalman filter is composed of attack progress and attack speed, and the Kalman filter performs state estimation through prediction and update steps: The prediction step utilizes a system state transition model to make a priori prediction of the current state based on the posterior estimate of the previous time step. After obtaining the attack progress observation value at the current moment, the update step calculates the Kalman gain, uses the observation information to correct the prior prediction, and obtains the posterior state estimate; and performs multi-step forward prediction based on the current state estimate to obtain the attack progress prediction value for multiple future time steps.

[0014] Furthermore, the threat urgency is obtained by weighted fusion of the current attack progress estimate and the maximum value of the multi-step predicted attack progress, and confidence is corrected by combining the uncertainty of state estimation; an attack speed flag is generated based on the attack speed estimate, and an active defense state is triggered when the attack speed estimate exceeds a preset threshold.

[0015] Furthermore, the bidirectional mandatory access control strategy includes forward access constraints and reverse access constraints, and achieves access control by configuring security levels and integrity levels for subjects and objects. The bidirectional mandatory access control strategy is divided into normal state, alarm state, and active defense state. The graded adjustment adopts a delayed degradation mechanism to achieve gradual policy rollback. Degrading from active defense state to alarm state requires that the threat urgency is lower than the second threshold and the attack speed flag is false for a first preset time. Degrading from alarm state to normal state requires that the threat urgency is lower than the first threshold for a second preset time. When the threat urgency is lower than the first threshold, it is a normal state, and the initial security labels of subjects and objects are maintained. When the threat urgency is between the first threshold and the second threshold, it is an alarm state, where the security level of high-risk subjects is temporarily reduced and the integrity level is increased, and enhanced protection is enabled for sensitive objects. When the threat urgency reaches or exceeds the second threshold or the attack speed flag is true, it is an active defense state, where the least privilege isolation is implemented for high-risk subjects, and reverse isolation is implemented for suspected controlled objects.

[0016] As a second aspect of the present invention, the present invention provides a dynamic security protection system based on behavioral workflow and Kalman filtering, the system being used to implement the method described in the first aspect, the system comprising: Attack semantic graph construction subsystem: It is used to collect raw logs and perform standardization processing, construct attack semantic graphs and extract attack progress observations; Attack State Estimation Subsystem: It is used for state estimation and trend prediction of attack progress and attack speed based on Kalman filtering; Dynamic access control subsystem: It is used to calculate threat urgency and adjust the two-way mandatory access control policy in a hierarchical manner; System management subsystem: It is used for system configuration, operation monitoring and human-computer interaction.

[0017] Furthermore, the attack semantic graph construction subsystem includes a data acquisition module, an event standardization module, and an attack semantic graph construction module; the attack state estimation subsystem includes a state space modeling module, a Kalman filter estimation module, and a model storage and loading module; the dynamic access control subsystem includes a threat urgency calculation module, a two-way mandatory access control policy execution module, and a policy storage and auditing module; and the system management subsystem includes a system management module and a human-computer interaction module.

[0018] The present invention has the following beneficial effects: This invention starts with semantic modeling of attack behavior, constructing an attack semantic graph based on behavioral workflows, mapping raw log events into quantifiable attack stage observations; establishing a dynamic system model of the attack process through Kalman filtering, and integrating historical predictions with current observations to achieve optimal state estimation of attack progress and speed; dynamically quantifying threat urgency based on state estimation results, driving hierarchical adaptive adjustment of bidirectional mandatory access control policies, forming a closed-loop proactive defense system of "detection-evaluation-response". Ultimately, it constructs a dynamic security protection system capable of real-time perception of attack process evolution, dynamic adjustment of access control policies, and possessing high interpretability and strong adaptability, achieving deep coupling of attack semantic understanding, attack state estimation, and access control policy adjustment at the system level.

[0019] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the dynamic security protection method based on behavioral workflow and Kalman filtering according to the present invention; Figure 2 This is a flowchart illustrating the construction process of the attack semantic graph based on behavioral workflow in this invention. Figure 3 This is a flowchart of the attack state estimation based on Kalman filtering in this invention; Figure 4 This is a flowchart of the bidirectional mandatory access control based on state estimation of the present invention; Figure 5 This is a functional block diagram of the dynamic security protection system based on behavioral workflow and Kalman filtering according to the present invention; Figure 6 This is a system framework diagram of the dynamic security protection system based on behavioral workflow and Kalman filtering according to the present invention. Detailed Implementation

[0022] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0023] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0024] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0025] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0026] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0027] Example 1: Please see Figure 1 As shown, as the first embodiment provided by the present invention, the present invention is a dynamic security protection method based on behavioral workflow and Kalman filtering, including the following steps: The system collects heterogeneous raw logs from multiple sources and performs standardization processing to obtain a standardized event stream sorted by time. The heterogeneous raw logs include host operating system logs, network device logs, application server logs, authentication logs, and cloud platform audit logs. The standardization processing includes: preprocessing the collected raw logs; filling missing fields in the standardized events with default values; converting different time formats to Unix timestamps and unifying IP addresses to string format; removing obviously invalid or incorrectly formatted log records; and removing completely duplicate event records. Based on the definition and mapping rules of attack phases, the standardized event flow is mapped into the sequence of attack phases, and an attack semantic graph including phase transition relationships is constructed and incrementally updated. Attack progress observations are extracted from the attack semantic graph. The attack process is modeled as a linear dynamic system. A state-space model including attack progress and attack speed is established based on Kalman filtering. Attack state estimation and trend prediction are performed through prediction and update steps to obtain attack progress estimation and attack speed estimation. The threat urgency is calculated based on the attack status estimation results, and the bidirectional mandatory access control policy is adjusted according to the threat urgency level to complete dynamic security protection.

[0028] As an embodiment of the present invention, preferably, the standardized event stream includes: timestamp, source IP address, source port number, destination IP address, destination port number, user identifier, operation type, operation object, and operation result field.

[0029] As an embodiment of the present invention, preferably, the state vector of the Kalman filter is composed of attack progress and attack speed, and the Kalman filter performs state estimation through prediction and update steps: The prediction step utilizes a system state transition model to make a priori prediction of the current state based on the posterior estimate of the previous time step. After obtaining the attack progress observation value at the current moment, the update step calculates the Kalman gain, uses the observation information to correct the prior prediction, and obtains the posterior state estimate; and performs multi-step forward prediction based on the current state estimate to obtain the attack progress prediction value for multiple future time steps.

[0030] Example 2: Please see Figures 1-4 As shown in the illustration, this invention provides a dynamic security protection method based on behavioral workflow and Kalman filtering. Based on embodiment one, to eliminate format differences in multi-source heterogeneous logs, a unified standardized event format is defined. Each original log entry, after parsing, cleaning, and field mapping, is converted into a standardized event e. The standardized event e is structured as follows: e=timestamp; src_ip; src_port; dst_ip; dst_port; user; action;object; result; Wherein, timestamp represents the timestamp; src_ip represents the source IP address; src_port represents the source port number; dst_ip represents the destination IP address; dst_port represents the destination port number; user represents the user identifier performing the operation; action represents the operation type, including login, file access, process creation, network connection, privilege escalation, etc.; object represents the operation object, including file path, process ID, database table name, etc.; result represents the operation result, with values ​​including success, failure, rejection, etc. All collected raw logs are converted into standardized event streams. The timestamps are sorted in ascending order and used as input for attack behavior workflow modeling.

[0031] As an embodiment of the present invention, preferably, the attack phases are defined based on the Cyber ​​Kill Chain model and the MITRE ATT&CK framework. The attack phases include the reconnaissance phase, the initial intrusion phase, the command and control phase, the lateral movement phase, the privilege escalation phase, and the attack target achievement phase. Standardized events are mapped to subsets or empty sets of attack phases through a predefined mapping rule base. One standardized event is mapped to one or more attack phases. Each rule in the mapping rule base is based on the logical combination of standardized event fields and outputs the corresponding attack phase.

[0032] As an embodiment of the present invention, preferably, the attack phase set is defined as follows: ; in, This is the reconnaissance phase, which involves attackers gathering information about the target, such as port scanning, service probing, and information gathering. This is the initial access phase, meaning that the attacker gains initial access to the system, such as through vulnerability exploitation, phishing attacks, or brute-force attacks on weak passwords. The Command and Control (C2) phase indicates that the attacker has established a remote control channel, such as a reverse shell or C2 communication. This is the Lateral Movement phase, indicating that the attacker is spreading laterally within the internal network, such as through remote execution or internal network scanning. This is the Privilege Escalation phase, which indicates that the attacker gains higher privileges, such as sudo privilege escalation or kernel vulnerability exploitation. The Objective Achievement stage refers to the attacker's ultimate goal, including data theft, data tampering, ransomware encryption, and service disruption.

[0033] As an embodiment of the present invention, preferably, in order to achieve the mapping from standardized events to the attack phase, the mapping function is defined as follows: ; in, Represents the set of attack phases The power set, i.e. The set of all subsets, the output of which can be a non-empty subset, represents the normalized event. Associated with one or more attack phases; or an empty set, representing a normalized event. This is a normal event, not matching any attack phase, and is based on a predefined mapping rule base. Each rule uses a logical combination of event fields as conditions to output the corresponding attack stage. Each mapping rule... The form is: ; Here, the condition is a logical combination of event fields, and the mapping rule is as follows: ; ; ; Based on the above mapping rule base This implements mapping for all attack phases. For complex events, a single event can trigger multiple rules, thus mapping to multiple phases.

[0034] As an embodiment of the present invention, preferably, for each attacking entity (such as source IP "src_ip" or user "user"), according to the standardized event flow, the events associated with it are sorted by time and converted into an attack phase sequence through a mapping function. Let the standardized event sequence associated with an entity be... The timestamp satisfies The corresponding attack phase sequence is defined as follows: ; in To construct the subsequent attack semantic graph, a stage transition counting matrix T is further constructed based on the attack stage sequence: ; in, For indicator functions, Indicates from stage among all entities Transition to Stage The total number of times.

[0035] As an embodiment of the present invention, preferably, the attack semantic graph is a directed heterogeneous graph, and the attack semantic graph is defined as follows: , where the set of nodes Sum of edges The definition is as follows: The node set of the attack semantic graph includes attack phase nodes. , indicating the attack phase Each stage corresponds to one node; entity node This includes IP nodes, user nodes, host nodes, file nodes, etc., representing network entities or resources involved in the attack; event nodes. , indicating a standardized event ; Attack semantic graph edge set phase transition edge This indicates that the attack started from the stage. Transition to Stage Edge weight Record the transition frequency, and the initial weight value is equal to the element value of the stage transition count matrix, i.e. Event-phase related edges , indicating an event Mapping to the attack phase Entity-Event Association Edge This indicates that the entity generated the event. .

[0036] As an embodiment of the present invention, preferably, the attack semantic graph is constructed based on the definition of the node set and the edge set, for each newly arrived standardized event. Perform incremental updates. First, create event nodes. Extract entity fields from the event and create new entity nodes. And add entity-event association edges. Then call the mapping function. Get Event Corresponding attack phase subset For each Create new attack phase nodes And add event-phase associated edges. Finally, regarding the event For related entities, obtain the most recently associated subset of attack phases. (Based on the latest event-phase association of this entity), if If it exists, add or update the phase transition edge. , represented as .

[0037] As an embodiment of the present invention, preferably, normal events output an empty set under the mapping function, and no event-stage association edges are generated.

[0038] As an embodiment of the present invention, preferably, the attack progress observation value is the index normalized value of the latest associated attack stage of the entity, with a value range of [0, 1]. The attack progress observation value is only updated when the attack occurs. Specifically, at the current timestamp t, for each entity, the current attack state observation value of the entity is extracted from the attack semantic graph, and the current attack stage is defined. The most recent attack phase associated with this entity is represented by the most recent event time, as follows:

[0039] To quantify the attack progress, the attack phase index is normalized to the [0,1] interval, and the current attack state observation value is defined. for: ; in, Current attack phase In the ordered attack phase, the set Index in This observation represents the total number of attack phases. By effectively filtering out interference from normal events through the attack semantic graph, the observations are updated only when the attack actually occurs, providing continuous and standardized input for subsequent Kalman filtering and supporting the optimal estimation and prediction of the attack state.

[0040] Example 3: Please see Figures 1-4 As shown in the illustration, this invention provides a dynamic security protection method based on behavioral workflow and Kalman filtering. Based on embodiments one and two, the attack process is modeled as a dynamic system using Kalman filtering-based attack state estimation. Kalman filtering (KF) is used to estimate the attack progress and speed, providing state input for subsequent dynamic access control and defining an attack state vector. , representing the attack state vector It belongs to a two-dimensional real number space and is used to describe the current state of the attack process: ; in, This represents the actual attack progress, which is not directly obtainable by the system. Its value is a normalized attack stage index. The attack phase index refers to the numerical value of the attack progress, which is also a state variable. The set of ordered attack phases in the current attack phase. Index in Indicates the total number of attack phases; This represents the attack speed, i.e., the rate of change of attack progress per unit of time, expressed as attack progress divided by time steps. (Observation value) For the attack progress observation extracted from the attack semantic graph at time t, a normalized value is defined, also as the index of the current attack phase. Observation value Compared to the actual attack progress They have the same numerical range and physical meaning, which makes them easy for filtering algorithms to process.

[0041] As an embodiment of the present invention, preferably, the state-space model includes a system state transition model and an observation model; the system state transition model describes the recursive relationship between attack progress and attack speed through a state transition matrix; the system state transition model uses a constant-rate model to effectively approximate the attack process, assuming that the attack speed remains constant within a short time interval, and describes the change of attack progress over time: ; in, Here is the state transition matrix. The time interval between two adjacent observation time steps; This is process noise, used to describe attack speed fluctuations and model uncertainties. for The covariance matrix of is denoted as a diagonal matrix and expressed as: ; in, For the attack progress noise variance, The noise variance represents the attack speed. The system state transition model abstracts the attack process into a dynamic system state recursion relationship, describing the attack progress through a constant-rate model. and attack speed The coupling between them, i.e. , ; The observation model employs a linear observation model, establishing a mapping relationship between attack progress observations and attack progress through an observation matrix. The observation model describes the relationship between observations and states. (The last sentence appears to be incomplete and possibly refers to a separate topic: attack progress observations.) Directly corresponding to the state The observation function is of linear form: ; in, This is the observation matrix, indicating that the observed values ​​directly reflect the attack progress. Observational noise is used to describe the errors (such as stage detection delays, mapping errors, etc.) when extracting observations based on attack semantic graphs. To observe the noise variance.

[0042] As an embodiment of the present invention, preferably, the Kalman filter achieves optimal estimation of the actual attack state by fusing prior predictions from the system state transition model and information corrections from observations through two steps: prediction and update. The present invention models the attack process as a linear dynamic system, where both the state transition model and the observation model are linear, satisfying the applicability conditions of the Kalman filter. Therefore, the standard Kalman filter is used for attack state estimation. The initial state estimate of the Kalman filter is as follows: This indicates that the initial attack progress is 0, and no attack phase has been detected; the initial attack speed is 0, and there is no attack progression trend; the covariance matrix is ​​initialized. Initial attack progress variance Set to a larger value, such as This reflects the uncertainty of the initial state; the variance of the initial attack speed. It is set to be on the same order of magnitude as the process noise.

[0043] set up For a moment The posterior state estimate, which incorporates the up-to-date state... The optimal estimate after considering all observation information at any given time; To estimate the corresponding covariance matrix, representing the uncertainty of the estimation result, the Kalman filter recursively calculates the state estimate at time t through the following two steps: (1) Prediction Step: The prediction step utilizes the state transition model to make a prior prediction of the current state based on the posterior estimate of the previous time step, while simultaneously updating the uncertainty of the estimate: ; ; in, For prior state estimation, it means a prediction of the current attack state based solely on historical information; The prior estimate covariance matrix reflects the uncertainty of the prediction results; F is the state transition matrix, and Q is the process noise covariance matrix; (2) Update steps: When the observation value at time t is obtained Then, an update step is performed to correct the prior estimate using observation information, resulting in the posterior estimate: First, calculate the Kalman gain. The weight of the observation in the correction process is determined by both the uncertainty of the prior estimate and the observation noise. ; in, Let R be the observation matrix, and R be the observation noise variance. Updated state estimate: ; Update the covariance matrix: ; in, for Identity matrix.

[0044] Through iterative prediction and update steps, the Kalman filter outputs a posterior state estimate at each time t. ,in This indicates an estimate of the attack progress. This represents the attack speed estimate, which combines the best estimate from historical predictions and current observations, and outputs the estimated covariance matrix. This reflects the uncertainty of the estimation results. The recursive process does not require storing historical observation sequences; it only needs to maintain the current state estimate and covariance matrix. Based on the current state estimate, the Kalman filter can perform N forward predictions to assess the changing trends of future attack progress. ; in, The Nth power of the state transition matrix represents the predicted attack progress. Represented as: ; This forecast reflects the extent to which the attack process may advance after the next N steps, assuming the attack speed remains at the current estimate.

[0045] Example 4: Please see Figures 1-4 As shown, as an embodiment of the present invention, the present invention is a dynamic security protection method based on behavioral workflow and Kalman filtering. Based on embodiments one to three, as an embodiment of the present invention, preferably, the threat urgency is calculated based on the attack state estimation result output by the Kalman filter, and the bidirectional mandatory access control policy is dynamically adjusted. Threat urgency It is used to quantify the threat level posed by the current attack to the system, comprehensively reflect the current attack progress and future attack trends, and provide a quantitative basis for adjusting access control policies.

[0046] As an embodiment of the present invention, preferably, the threat urgency is obtained by weighted fusion of the current attack progress estimate and the maximum value of the multi-step predicted attack progress, and the threat urgency is defined as the current attack progress estimate. Multi-step prediction of attack progress The weighted fusion yields: ; in, For time t, it is the posterior estimate of the attack progress, reflecting the extent to which the current attack has progressed; This is an N-step prediction of the attack progress based on the current state, reflecting future attack trends; M is the maximum number of prediction steps, set according to actual protection needs (e.g., ...). ); For the preset weights, satisfy ; The operation takes the maximum value from multiple predictions to ensure sensitivity to near-term potential risks. This definition ensures that even with the current attack progress... It has not yet entered a critical stage. If it is predicted in future steps that it may rapidly advance to a high-risk stage, the urgency of the threat will still increase, thereby triggering adjustments to access control policies.

[0047] As an embodiment of the present invention, preferably, the estimated covariance matrix of the Kalman filter output is... This reflects the uncertainty of the estimation results. When the estimation uncertainty is high (such as in the early stages of an attack), the strategy adjustment should be more conservative to avoid over-response due to misjudgment. Define a confidence correction factor: ; in, The standard deviation of the attack progress estimate. As a reference uncertainty threshold, when uncertainty increases, Reduce the aggressiveness of access control policy adjustments, ultimately lowering the urgency of the effective threat. Revised to: ; In addition to threat urgency, attack speed estimation is introduced. As an auxiliary indicator, when the attack speed exceeds a preset threshold At this time, it indicates that the attack is advancing rapidly, and the attack speed flag is defined: ; in, This flag is used as an indicator function and is used as an additional trigger condition for access control policy adjustments.

[0048] As an embodiment of the present invention, preferably, bidirectional mandatory access control implements access constraints in two directions: from subject to object (forward) and from object to subject (reverse), achieving stricter access control than traditional unidirectional access control. Simultaneously, the policy level is dynamically adjusted according to the urgency of the threat; access control is achieved by configuring security and integrity levels for subjects and objects; the bidirectional mandatory access control policy consists of security labels and access rules in both directions. (Define the subject set.) (such as users, processes), sets of objects (Such as files, databases, system resources), in the system, each entity and object All were given a security label, main label Includes security level (e.g., public, internal, confidential) and integrity levels (e.g., low integrity, high integrity); object labeling It also includes confidentiality and integrity levels. The initial value of the tag is based on the asset importance and user role settings. When dynamically adjusted, the permission is contracted by overriding temporary tags.

[0049] As an embodiment of the present invention, preferably, the forward access rule is the main body. For the object Access requests are permitted if and only if the security level conditions are met. (The security level of the subject matter is no lower than that of the confidentiality level of the object matter, and the "no further reading" principle is followed) and the integrity condition is met. (The integrity level of the subject is not higher than that of the object, and the principle of "not writing" is followed.)

[0050] As an embodiment of the present invention, preferably, the reverse access rule is the object. For the subject Access requests are permitted if and only if the security level conditions are met. (The security level of the object is no higher than that of the subject, to prevent low-security-level objects from leaking information to high-security-level subjects) and the integrity condition is met. (The integrity level of the object should not be lower than that of the integrity level of the subject, to prevent low-integrity objects from contaminating high-integrity subjects).

[0051] As an embodiment of the present invention, preferably, based on the urgency of the threat... and attack speed flag ,definition The lower limit for triggering an alarm state. To establish a lower limit for triggering proactive defense, three progressively increasing policy levels are set, and graded responses are achieved by dynamically adjusting the security labels of the subject and object: (1) Normal state, triggering condition: In this state, the system considers the current attack threat to be low and has not yet entered a critical phase; all entities... and object Maintain its initial security label: In this state, no intervention is made in normal business operations to ensure the continuity of system operation; (2) Alarm status, triggering conditions: When the threat urgency reaches the alarm threshold, the system determines that the attack has reached a level requiring attention. The system identifies a set of high-risk entities associated with the attacking entity. (Such as attacked user accounts, entities corresponding to suspicious source IPs), temporarily adjust their security labels, including lowering the security level of high-risk entities. ,in This sets a temporary upper limit for security, preventing high-risk entities from accessing highly confidential objects; it also raises the integrity level for high-risk entities. This prevents it from being written to high-integrity objects. Simultaneously, it protects the set of sensitive objects. Enhanced protection is enabled for (e.g., authentication databases, audit logs, security configuration files) by temporarily increasing their security level or decreasing their integrity level, restricting forward and reverse access paths. In alert status, the system adds real-time alerts for abnormal access behavior, aiming to proactively contain attacks before they spread.

[0052] (3) Active defense state, triggering condition: or When the threat urgency reaches the active defense threshold, or the attack speed exceeds the preset threshold, When an attack progresses rapidly, the system determines that the attack has entered a high-risk phase and takes proactive defense measures. The system implements least privilege isolation for high-risk entities, including reducing their security level to the lowest possible level. This restricts access to objects to the lowest level of confidentiality; it also raises the integrity level of high-risk entities to the highest level. This prevents it from writing to any high-integrity object. If necessary, network isolation or process suspension is implemented on high-risk entities to block their communication with external systems. Simultaneously, suspected controlled object sets are also monitored. Implement reverse isolation for compromised services or infected processes by temporarily upgrading their security level or downgrading their integrity level, and strictly restrict them from making reverse access requests to any entity.

[0053] As an embodiment of the present invention, preferably, to prevent frequent policy switching due to fluctuations in threat urgency at threshold boundaries, a hysteresis mechanism is introduced to define policy degradation conditions: To downgrade from active defense mode to alarm mode, the following conditions must be met. and continued time; To downgrade from an alarm state to a normal state, the following conditions must be met. continued time; in and To maintain a time threshold, policy rollback is only implemented after the attack has subsided. When the degradation conditions are met, the system first clears temporary label overlays and restores the initial security labels of subjects and objects. The recovery process is gradual, restoring labels for non-critical subjects and objects first, followed by labels for critical assets, to avoid introducing security risks through a one-time recovery. For subjects or objects isolated in proactive defense mode, the system removes network isolation or process suspension after confirming the threat has subsided, restoring their normal communication and operational status. After policy recovery, the system synchronizes the current policy level to all access control enforcement points and records policy change logs for security auditing and post-incident analysis.

[0054] Example 5: Please see Figures 5-6 As shown, as an embodiment of the present invention, the present invention is a dynamic security protection system based on behavioral workflow and Kalman filtering. The system is used to implement the methods described in embodiments one to four. The system mainly consists of four subsystems: an attack semantic graph construction subsystem, an attack state estimation subsystem, a dynamic access control subsystem, and a system management subsystem, including: The attack semantic graph construction subsystem is responsible for collecting and preprocessing raw log data, constructing an attack semantic graph based on behavioral workflows, and extracting attack progress observations. The attack state estimation subsystem, the core subsystem, establishes a dynamic system model of the attack process based on Kalman filtering, integrating historical predictions and current observations to achieve optimal state estimation of attack progress and speed. The dynamic access control subsystem quantifies threat urgency based on state estimation results, driving hierarchical adaptive adjustments to bidirectional mandatory access control policies. The system management and control subsystem is responsible for system management and control, and provides a human-computer interaction interface to display the system's security posture. The overall architecture of this system adopts a layered design, from bottom to top: data access layer, computing engine layer, response decision layer, and management and maintenance layer. The functional modules of each subsystem are as follows: Figure 5 As shown, the system framework is as follows: Figure 6 As shown.

[0055] As an embodiment of the present invention, preferably, the attack semantic graph construction subsystem is located at the data access layer and is responsible for collecting raw log data, performing standardization processing, constructing the attack semantic graph, and extracting attack progress observations to provide structured input for subsequent attack state estimation. Specifically, it includes the following modules: Data Acquisition Module: By deploying a lightweight data acquisition agent or integrating with an existing log management platform, this module collects raw data in real time, including host operating system logs, network device logs, application server logs, authentication logs, and cloud platform audit logs. The module supports multiple data access protocols and features data buffering and compression transmission mechanisms to ensure data integrity and low latency. Event Standardization Module: This module receives raw log data streams from the data acquisition module via a streaming processing framework and sequentially performs data cleaning, format standardization, and field mapping. It converts multi-source heterogeneous logs into a unified standardized event format, including core fields such as timestamp, source IP, source port, destination IP, destination port, user identifier, operation type, operation object, and operation result. The module fills in missing fields with default values, removes invalid or incorrectly formatted records, eliminates completely duplicate event records, and outputs a standardized event stream sorted by timestamp. The attack semantic graph construction module receives a standardized event stream and constructs and dynamically updates the attack semantic graph based on a predefined set of attack phases and a mapping rule base. The graph is organized as a directed heterogeneous graph, containing attack phase nodes, entity nodes (IP, user, host, file, etc.), and event nodes, as well as phase transition edges, event-phase association edges, and entity-event association edges. The module supports incremental updates to the graph. For each newly arrived standardized event, it creates a corresponding node and association edge, and updates the weights of the phase transition edges based on the latest attack phase associated with the entity. Simultaneously, the module extracts current attack progress observations from the graph, normalizing the latest associated attack phase index to the [0,1] interval to provide continuous and standardized observation input for Kalman filtering.

[0056] As an embodiment of the present invention, preferably, the attack state estimation subsystem is located at the computation engine layer and is responsible for establishing a dynamic system model of the attack process based on Kalman filtering. It integrates the attack semantic graph observations with the prior predictions of the system state transition model to achieve optimal estimation and trend prediction of the attack state. Specifically, it includes the following modules: The state-space modeling module defines the attack state vector, including two dimensions: attack progress and attack speed, and constructs the state transition model and observation model. The state transition model adopts a constant-rate model, describing the recursive relationship between attack progress and attack speed through the state transition matrix; the observation model is linear, establishing the mapping relationship between observed values ​​and attack progress through the observation matrix. This module is responsible for initializing the state estimation vector and covariance matrix, and maintaining hyperparameters such as the process noise covariance matrix and observation noise variance. The Kalman filter estimation module implements the Kalman filter prediction and update recursive algorithm. The prediction step utilizes a state transition model to make a prior prediction of the current state based on the posterior estimate from the previous time step, and updates the estimated covariance matrix. The update step, after obtaining the current attack progress observation, calculates the Kalman gain, corrects the prior estimate using the observation information, and outputs the posterior state estimate and covariance matrix. The module supports multi-step forward prediction, calculating attack progress predictions for multiple future time steps based on the current state estimate, providing attack trend information for threat urgency quantification. The model storage and loading module, implemented based on a model repository, is responsible for the storage, version management, and dynamic loading of Kalman filter model parameters (state transition matrix, observation matrix, noise covariance matrix, etc.). The module supports hot loading and rollback mechanisms to ensure the stability of the online estimation service. It also provides model performance monitoring functions, recording key indicators such as estimation error and computation latency.

[0057] As an embodiment of the present invention, preferably, the dynamic access control subsystem, located at the response decision layer, is responsible for quantifying the threat urgency based on the attack state estimation results and driving the hierarchical adaptive adjustment of the bidirectional mandatory access control policy. Specifically, it includes the following modules: Threat urgency calculation module: Receives the posterior estimate of attack progress, multi-step predicted attack progress, and estimated covariance matrix from the attack status estimation subsystem. It calculates the threat urgency by weighting the current attack progress with future attack trends, and adjusts the confidence level of the threat urgency using estimation uncertainty, outputting the effective threat urgency. Simultaneously, it generates an attack speed flag based on the attack speed estimate, serving as an additional trigger condition for strategy adjustments. The two-way mandatory access control policy enforcement module maintains security labels for subjects (users, processes) and objects (files, databases, system resources) based on a two-way mandatory access control model, including security and integrity levels. The module dynamically adjusts the policy level based on threat urgency and attack speed flags. In normal operation, it maintains the initial labels; in alert status, it temporarily lowers the security level and raises the integrity level for high-risk subjects, and enables enhanced protection for sensitive objects; in proactive defense status, it implements least privilege isolation for high-risk subjects and reverse isolation for suspected controlled objects. The module supports a gradual policy recovery and delayed degradation mechanism to prevent frequent policy switching. The policy storage and auditing module is responsible for storing the configuration information of two-way mandatory access control policies, including the initial security labels of subjects and objects, temporary label overriding rules, policy-level trigger thresholds, and retention time parameters. The module records policy adjustment logs, including the trigger time, policy levels before and after the adjustment, affected subjects and objects, and reasons for the adjustment, for use in security auditing and post-event analysis.

[0058] As an embodiment of the present invention, preferably, the system management subsystem: located at the management and maintenance layer, it provides functions such as system configuration and human-computer interaction, realizing global system management, visual display, and human-computer collaborative interaction. Specifically, it includes the following modules: System Management Module: Provides a web-based management interface for system administrators to perform global configurations, including data source management, attack phase set definition, mapping rule base configuration, Kalman filter hyperparameter settings, and access control policy threshold configuration. Simultaneously, this module collects and displays the real-time operating status of each subsystem, including key indicators such as data throughput, estimation error, policy adjustment frequency, and number of alarm events, enabling global system control. Human-Computer Interaction Module: Provides a web management interface and a real-time security situation dashboard, displaying attack status estimation results, threat urgency change curves, policy adjustment records, and alarm events in list and detail page formats. Operations and maintenance personnel can use the interface to manually confirm policy adjustments, mark false positives / false negatives, and input handling opinions, achieving a dynamic security protection and handling process through human-machine collaboration.

[0059] This invention presents a dynamic security protection method and system based on behavioral workflow and Kalman filtering. It employs a behavioral workflow-based attack semantic graph construction, which facilitates the semantic abstraction and structured expression of attack behaviors. By defining a standardized set of attack stages, this invention establishes a semantic mapping rule base from raw log events to attack stages, constructing a directed heterogeneous graph containing attack stage nodes, entity nodes, and event nodes. This mechanism overcomes the limitations of existing intrusion detection systems that rely on low-level network features and lack semantic expression of attack behaviors. It can associate scattered, seemingly unrelated event sequences into a complete attack workflow, effectively supporting real-time perception and semantic understanding of the attack process, and providing a structured input foundation for subsequent threat assessment.

[0060] This invention presents a dynamic security protection method and system based on behavioral workflow and Kalman filtering. By employing Kalman filtering-based attack state estimation, it facilitates dynamic tracking and trend prediction of the attack process. The invention models the attack process as a dynamic system, defining a state space composed of attack progress and attack speed. Through a two-step recursive process of prediction and update using Kalman filtering, it integrates observations extracted from the attack semantic graph with prior predictions from the system state transition model to achieve optimal estimation of the actual attack state. This mechanism overcomes the limitations of existing threat assessment methods that rely solely on current observations and struggle to capture attack evolution trends. It can output attack progress and attack speed estimates in real time and supports multi-step forward prediction, providing quantifiable and predictable state inputs for the dynamic adjustment of access control policies.

[0061] This invention presents a dynamic security protection method and system based on behavioral workflow and Kalman filtering. Employing bidirectional mandatory access control based on state estimation, it facilitates real-time linkage and tiered response between protection strategies and attack processes. Based on the attack state estimation results output by Kalman filtering, this invention quantifies the threat urgency by integrating the current attack progress with future attack trends, driving the bidirectional mandatory access control strategy to adaptively adjust in tiers between normal, alarm, and proactive defense states. This mechanism overcomes the limitations of existing access control strategies, which are static, rigid, and lack dynamic closed-loop mechanisms. Through positive and negative bidirectional constraints and dynamic adjustment of subject and object security labels, it achieves a shift from passive response to proactive defense.

[0062] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0063] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A dynamic security protection method based on behavioral workflow and Kalman filtering, characterized in that, Includes the following steps: Collect heterogeneous raw logs from multiple sources and perform standardization processing to obtain a standardized event stream sorted by time; Based on the definition and mapping rules of attack phases, the standardized event flow is mapped into the sequence of attack phases, and an attack semantic graph including phase transition relationships is constructed and incrementally updated. Attack progress observations are extracted from the attack semantic graph. A state-space model including attack progress and attack speed is established based on Kalman filtering. Attack state estimation and trend prediction are performed through prediction and update steps to obtain attack progress estimation and attack speed estimation. The threat urgency is calculated based on the attack status estimation results, and the bidirectional mandatory access control policy is adjusted according to the threat urgency level to complete dynamic security protection.

2. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 1, characterized in that, The standardized event stream includes: timestamp, source IP address, source port number, destination IP address, destination port number, user identifier, operation type, operation object, and operation result field.

3. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 1, characterized in that, The attack phases are defined based on the network kill chain model and the MITRE ATT&CK framework. The attack phases include the reconnaissance phase, initial intrusion phase, command and control phase, lateral movement phase, privilege escalation phase, and attack target achievement phase. Standardized events are mapped to subsets or empty sets of attack phases through a predefined mapping rule base. One standardized event is mapped to one or more attack phases. Each rule in the mapping rule base is based on the logical combination of standardized event fields and outputs the corresponding attack phase.

4. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 1, characterized in that, The attack semantic graph is a directed heterogeneous graph. The node set of the attack semantic graph includes attack phase nodes, entity nodes, and event nodes. The edge set of the attack semantic graph includes phase transition edges, event-phase association edges, and entity-event association edges. The weight of the phase transition edge is the phase transition frequency from one attack phase node to another, and it supports incremental updates based on new events. The attack progress observation value is the index normalized value of the latest associated attack phase of the entity, with a value range of [0, 1]. The attack progress observation value is updated only when the attack behavior occurs.

5. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 1, characterized in that, The state-space model includes a system state transition model and an observation model. The system state transition model adopts a constant-rate model, which describes the recursive relationship between attack progress and attack speed through a state transition matrix. The observation model adopts a linear observation model, which establishes a mapping relationship between attack progress observations and attack progress through an observation matrix.

6. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 5, characterized in that, The state vector of the Kalman filter consists of attack progress and attack speed. The Kalman filter estimates the state through prediction and update steps. The prediction step utilizes a system state transition model to make a priori prediction of the current state based on the posterior estimate of the previous time step. After obtaining the attack progress observation value at the current moment, the update step calculates the Kalman gain, uses the observation information to correct the prior prediction, and obtains the posterior state estimate; and performs multi-step forward prediction based on the current state estimate to obtain the attack progress prediction value for multiple future time steps.

7. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 6, characterized in that, The threat urgency is obtained by weighted fusion of the current attack progress estimate and the maximum value of the multi-step predicted attack progress, and confidence is corrected by combining the uncertainty of state estimation; an attack speed flag is generated based on the attack speed estimate, and an active defense state is triggered when the attack speed estimate exceeds a preset threshold.

8. The dynamic security protection method based on behavioral workflow and Kalman filtering according to claim 1, characterized in that, The bidirectional mandatory access control policy includes forward access constraints and reverse access constraints. It achieves access control by configuring security levels and integrity levels for subjects and objects. The bidirectional mandatory access control policy is divided into normal state, alarm state, and active defense state. The tiered adjustment adopts a delayed degradation mechanism to achieve gradual policy rollback.

9. A dynamic security protection system based on behavioral workflow and Kalman filtering, characterized in that, The system is used to implement the method according to any one of claims 1-8, and the system comprises: Attack semantic graph construction subsystem: It is used to collect raw logs and perform standardization processing, construct attack semantic graphs and extract attack progress observations; Attack State Estimation Subsystem: It is used for state estimation and trend prediction of attack progress and attack speed based on Kalman filtering; Dynamic access control subsystem: It is used to calculate threat urgency and adjust the two-way mandatory access control policy in a hierarchical manner; System management subsystem: It is used for system configuration, operation monitoring and human-computer interaction.

10. The dynamic security protection system based on behavioral workflow and Kalman filtering according to claim 9, characterized in that, The attack semantic graph construction subsystem includes a data acquisition module, an event standardization module, and an attack semantic graph construction module; the attack state estimation subsystem includes a state space modeling module, a Kalman filter estimation module, and a model storage and loading module; the dynamic access control subsystem includes a threat urgency calculation module, a two-way mandatory access control policy execution module, and a policy storage and auditing module; the system management subsystem includes a system management module and a human-computer interaction module.

Images