A risk intelligent decision optimization method based on safety knowledge graph reasoning

Abstract

This invention relates to the field of network and information security technology, specifically to a risk intelligent decision optimization method based on security knowledge graph reasoning. First, multi-source security data is collected to construct a hierarchical security knowledge graph integrating behavioral and tactical relationships. Then, real-time security event sequences are mapped to initial behavioral relationships, and horizontal association expansion and vertical tactical abstraction are performed within the graph to generate causal attack paths with influence weights. Finally, the causal attack paths are input into a path simulator, and under defense resource constraints, the optimal adversarial decision sequence is solved based on Markov decision processes and reinforcement learning, driving automated response execution. This invention achieves visualized and quantitative evaluation of attack chains and global optimization configuration of defense strategies, improving proactive defense capabilities under limited security resources.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and in particular to a risk intelligent decision optimization method based on security knowledge graph reasoning. Background Technology

[0002] With the continuous expansion of enterprise information systems and the rapid development of infrastructures such as cloud computing, mobile internet, and the Internet of Things, production operations heavily rely on various network assets distributed across data centers, cloud platforms, and edge nodes, leading to a dramatic expansion of the attack surface. Attackers utilize publicly available security vulnerabilities and automated attack tools to scan vulnerable assets in bulk. Simultaneously, they employ advanced persistent attacks (APAs) through a combination of tactics such as multi-stage infiltration, lateral movement, and privilege escalation. This results in complex causal relationships and tactical evolution among single host logs, network traffic records, security device alert logs, and external threat intelligence data. To address this, the industry is gradually introducing security information and incident management platforms, security orchestration and automated response platforms, and knowledge-based threat intelligence services to centrally aggregate and match multi-source security data using rules, attempting to reconstruct attack processes, identify high-risk assets, and guide response and handling.

[0003] In existing technologies, on the one hand, multi-source security data often exists in the form of flat logs or isolated alerts, lacking a hierarchical security knowledge graph that abstracts observable atomic security events into behavioral relationships and then aggregates multi-atomic events into tactical relationships based on attack tactical patterns. It also lacks a mechanism capable of simultaneously expressing causal relationships, temporal relationships, attack stages, and core asset dependencies within a unified graph structure. This results in attack path reasoning typically remaining at a coarse-grained level based on time sorting or simple association rules, making it difficult to accurately construct the causal attack path from initial intrusion to damage to critical assets. On the other hand, even if some solutions introduce graph-based attack path analysis, they often... Limited to static topology search, it lacks a graph mapping mechanism for real-time security event sequences, the ability to quantify the influence weight of nodes in the attack path based on multi-dimensional criteria such as asset value and vulnerability severity, and the ability to input causal attack paths into a path simulator, combine atomic defense action libraries and defense resource constraints, and iteratively solve the optimal adversarial decision sequence under the framework of Markov decision process and reinforcement learning to model attack and defense adversarial confrontation. It cannot simultaneously weigh attack losses, defense costs and business impact under limited security resource constraints, resulting in defense strategies still mainly relying on manual experience configuration, and response actions are scattered, passive, and lack global optimality and interpretability. Summary of the Invention

[0004] This invention provides a risk intelligent decision optimization method based on security knowledge graph reasoning.

[0005] A risk intelligent decision optimization method based on security knowledge graph reasoning includes the following steps:

[0006] S1: Collect multi-source security data and extract entities and their relationships; divide the relationships into behavioral-level relationships and tactical-level relationships; wherein, behavioral-level relationships represent specific atomic security events that can be directly observed or recorded, and tactical-level relationships represent combination patterns of multiple behavioral-level relationships that are logically aggregated to achieve specific attack phase objectives; store entities, behavioral-level relationships and tactical-level relationships in association to form a hierarchical security knowledge graph;

[0007] S2: Receive the currently occurring security event sequence, map the security event sequence to a set of initial behavioral-level relationships in the hierarchical security knowledge graph; starting from the initial behavioral-level relationships, expand horizontally along the behavioral-level relationships in the hierarchical security knowledge graph, and abstract and converge vertically along the tactical-level relationships to generate a causal attack path from the initial event to the preset attack target; the causal attack path consists of sequentially linked behavioral-level relationship nodes and tactical-level relationship nodes; configure an influence weight value for each relationship node in the causal attack path;

[0008] S3: Input the causal attack path and the influence weight values ​​of each node into the path simulator; the path simulator simulates the attacker's advance along the path and the defender's blocking action, and iteratively calculates and deduces the optimal adversarial decision sequence that can minimize the overall threat level of the path under the constraint of defense resources; the adversarial decision sequence is a set of a series of defense actions and their execution sequence; execute the adversarial decision sequence.

[0009] Optionally, S1 includes:

[0010] S11: Collect multi-source security data from network traffic sensors, terminal detection response logs, and security intelligence platforms, and clean and standardize the multi-source security data to form standardized multi-source security data;

[0011] S12: Based on the standardized multi-source security data, using entity recognition model and relation extraction model, extract entities that represent network assets, attack tools, and security vulnerabilities, as well as the association relationships that connect the entities and represent causal or temporal relationships between events.

[0012] S13: Based on the predefined atomic event list and tactical framework mapping rules, the association is divided into behavioral-level relationships and tactical-level relationships, wherein the behavioral-level relationships are marked as specific event types in the atomic event list, and the tactical-level relationships are marked as specific tactical stages in the tactical framework mapping rules;

[0013] S14: The entities, behavioral-level relationships, and tactical-level relationships, as well as their subordinate and aggregation relationships, are associated and stored according to a graph structure to form the hierarchical security knowledge graph.

[0014] Optionally, the multi-source security data includes full network traffic data, host system logs, security device alarm logs, and external threat intelligence data; the cleaning and standardization preprocessing includes field parsing, timestamp unification, data deduplication, and outlier removal of the multi-source security data.

[0015] Optionally, the entity recognition model is a named entity recognition model based on a pre-trained language model, used to identify and extract the entities from the standardized multi-source security data; the relation extraction model is a relation extraction model based on dependency parsing and sequence labeling, used to extract the association relationships from the standardized multi-source security data.

[0016] Optionally, S2 includes:

[0017] S21: Receive the currently continuously generated security event sequence, parse the security event sequence, and extract the key feature information in the security event sequence. The key feature information includes the source entity, the target entity, the event action type, and the occurrence timestamp.

[0018] S22: For each independent event in the security event sequence, match its key feature information with the entity and relation attributes in the hierarchical security knowledge graph, and map it to one or more corresponding behavioral-level relations in the hierarchical security knowledge graph to form a set of initial behavioral-level relations;

[0019] S23: Using the initial behavioral-level relationship as the starting node set, a path exploration algorithm is executed in the hierarchical security knowledge graph. The path exploration algorithm first expands the relationship horizontally along the behavioral-level relationship to find the next behavioral-level relationship that has a direct causal or temporal connection with the current node. At the same time, it checks whether the explored continuous behavioral-level relationships meet the definition conditions of any tactical-level relationship. If they do, it performs vertical abstraction and aggregation along the tactical-level relationship to generate a tactical-level relationship node as the aggregation node of the current path. It continues to explore subsequent possible behavioral-level relationships or tactical-level relationships from this tactical-level relationship node until the preset attack target entity node is reached or the path length reaches a threshold, thereby generating a set of causal attack paths from the initial event to the preset attack target.

[0020] S24: Select all causal attack paths that can reach the preset attack target from the set of causal attack paths, and configure an influence weight value for each behavioral-level relation node and tactical-level relation node in each selected causal attack path according to a predefined weight calculation model to complete the quantification of the causal attack path.

[0021] Optionally, in step S21, the parsing of the security event sequence is performed in real time using a streaming processing engine, which matches and extracts features from continuous raw log streams based on predefined event patterns.

[0022] Optionally, in step S22, mapping an event to a corresponding behavioral-level relationship in the hierarchical security knowledge graph is achieved by calculating the semantic similarity between the key feature information of the event and the existing behavioral-level relationship attributes in the graph. If the similarity exceeds a preset threshold, the mapping is considered successful.

[0023] Optionally, S3 includes:

[0024] S31: Based on the causal attack path and the influence weight values ​​of each node, initialize the path simulator, wherein each behavioral-level relation node and tactical-level relation node in the causal attack path is mapped to an attack state node in the path simulator, and each attack state node is assigned its corresponding influence weight value. At the same time, define the atomic defense action library and defense resource constraints available to the defender in the path simulator, and set a loss function with the objective of minimizing the sum of the final loss caused by the attacker and the defense cost.

[0025] S32: In the initialized path simulator, the causal attack path is used as the deduction baseline to simulate the process of the attacker gradually advancing from the initial node to the target node. At each attack state node, according to the defense resource constraints, one or more defense actions that the defender can select from the atomic defense action library are enumerated. The expected loss change after the attacker changes the attack path or the attack state node is blocked due to the defense action is calculated. Through multiple rounds of iterative deduction, multiple candidate adversarial decision sequences containing different combinations of defense actions and execution sequences and their corresponding expected loss evaluation values ​​are generated.

[0026] S33: From the plurality of candidate adversarial decision sequences, select the candidate adversarial decision sequence with the smallest expected loss assessment value, determine it as the optimal adversarial decision sequence, and schedule the corresponding security resources and drive the automated response tool to execute the optimal adversarial decision sequence according to the defensive actions and their execution sequence specified in the optimal adversarial decision sequence.

[0027] Optionally, the atomic defense action library includes blocking network connections, isolating hosts, resetting user sessions, revoking access credentials, applying virtual patches, enabling enhanced logging, and switching network topology paths.

[0028] Optionally, the defense resource constraints include the upper limit of the number of defense actions that can be executed simultaneously, the time cost required to execute a specific defense action, and the budget for computing and human resources consumed in executing the defense action.

[0029] The beneficial effects of this invention are:

[0030] 1. This invention constructs a hierarchical security knowledge graph that simultaneously includes behavioral and tactical relationships. It extracts all network traffic data, host system logs, security device alarm logs, and external threat intelligence data into a unified graph structure. Combining an atomic event list and tactical framework mapping rules based on the MITRE ATT&CK framework, it precipitates atomic security events as behavioral relationships and attack phases involving multiple events as tactical relationships. This transforms previously scattered and heterogeneous security data into a sustainably evolving hierarchical security knowledge graph. This graph can express the causal relationships, temporal relationships, and tactical phase evolution of attack chains within a unified semantic space, solving the problem in existing technologies where security logs are presented only as flat lists or isolated alarms, making it difficult to support subsequent systematic analysis.

[0031] 2. This invention introduces a graph mapping and causal attack path generation mechanism for real-time security event sequences. It utilizes a streaming engine to parse security event sequences in real time, extracting key features such as source entities, target entities, event action types, timestamps and protocols, file hash values, process command-line parameters, and threat intelligence identifiers. Based on semantic similarity, events are dynamically mapped to behavioral relationships or incrementally created relationships in a hierarchical security knowledge graph. Furthermore, through improved depth-first search and matching of tactical pattern rule bases, a causal attack path from initial intrusion to core assets is generated. An analytic hierarchy process (AHP) model is used to configure influence weight values ​​for path nodes, achieving automatic reconstruction from a "discrete alarm list" to a "quantifiable causal attack path." This solves the problems of existing technologies struggling to reconstruct multi-hop attack chains and objectively compare the importance of different attack paths.

[0032] 3. This invention introduces an attack-defense adversarial decision optimization mechanism based on a path simulator. It maps behavioral and tactical relationship nodes in causal attack paths to attack state nodes in a Markov decision process. Influence weights characterize the severity of different states. Based on an atomic defense action library and defense resource constraints, it constructs a loss function that integrates attack loss, defense cost, and business impact penalties. Using reinforcement learning algorithms such as value iteration or policy iteration, and considering the adversarial nature of attacker bypass and alternative paths, it iteratively solves for the optimal adversarial decision sequence that minimizes expected loss. This sequence is then automatically executed in conjunction with the firewall management system, endpoint detection and response platform, and security orchestration and automated response platform. Compared to existing solutions that rely on manual experience to configure static policies, this invention can automatically provide an optimal defense scheme that integrates actions and execution timing under limited security resource constraints, improving the efficiency of defense resource utilization and the ability to respond to advanced persistent attacks. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram of the S2 process in an embodiment of the present invention. Detailed Implementation

[0036] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should also be noted that, to make the embodiments more comprehensive, the following embodiments are the best and preferred embodiments, and those skilled in the art can use other alternative methods to implement some well-known technologies; moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0037] It should be noted that the use of terms such as "an embodiment," "an embodiment," "an exemplary embodiment," and "some embodiments" in the specification indicates that the described embodiment may include a specific feature, structure, or characteristic, but not every embodiment necessarily includes that specific feature, structure, or characteristic. Furthermore, when a specific feature, structure, or characteristic is described in connection with an embodiment, implementing such a feature, structure, or characteristic in conjunction with other embodiments (whether explicitly described or not) should be within the knowledge of those skilled in the art.

[0038] Generally, terms can be understood at least partly from their use in context. For example, depending at least partly on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in a singular sense, or a combination of features, structures, or characteristics in a plural sense. Additionally, the term "based on" can be understood not necessarily to convey an exclusive set of factors, but rather, alternatively, depending at least partly on the context, to allow for the presence of other factors that are not necessarily explicitly described.

[0039] like Figures 1-2 As shown, a risk intelligent decision optimization method based on security knowledge graph reasoning includes the following steps:

[0040] S1: Collect multi-source security data and extract entities and their relationships; divide these relationships into behavioral-level relationships and tactical-level relationships; behavioral-level relationships represent specific atomic security events that can be directly observed or recorded, while tactical-level relationships represent combinations of multiple behavioral-level relationships logically aggregated to achieve specific attack phase objectives; associate and store entities, behavioral-level relationships, and tactical-level relationships to form a hierarchical security knowledge graph. The specific steps are as follows:

[0041] S11: Collect multi-source security data from network traffic sensors, endpoint detection response logs, and security intelligence platforms, and perform cleaning and standardization preprocessing on the multi-source security data to form standardized multi-source security data, specifically:

[0042] First, network traffic sensors are deployed on network boundary devices and core switching devices to continuously collect full network traffic data via port mirroring. During collection, each piece of full network traffic data is encapsulated into a record structure according to a preset format. The record structure includes at least a timestamp field, a source IP address field, a destination IP address field, a source port field, a destination port field, a transport protocol field, a session identifier field, and a transmitted byte field. This record is then written to a buffer for temporary storage of the raw full network traffic data.

[0043] Secondly, a log collection agent is installed on each host system. The agent receives the host system log output, parses the time field, user identifier field, process identifier field, file path field, event level field, and event description field in the original host system log, maps them into a unified key-value structure, and writes the mapping result into the host system log collection channel, thereby forming a host system log data stream.

[0044] Furthermore, the security management platform centrally collects security device alarm logs generated by firewalls, intrusion detection systems, intrusion prevention systems, and bastion hosts deployed in the network. Following a preset log parsing template, the security management platform extracts the device identifier field, alarm time field, alarm level field, alarm type field, source asset identifier field, target asset identifier field, and associated session identifier field from each original security device alarm log, and stores the extraction results in the security device alarm log data stream.

[0045] Meanwhile, external threat intelligence data is periodically retrieved through the standard interface provided by the security intelligence platform. The threat intelligence source, threat identifier, attack tool name, relevant security vulnerability number, and threat confidence level fields are parsed out to form an external threat intelligence data stream.

[0046] Subsequently, the aforementioned network traffic data, host system logs, security device alarm logs, and external threat intelligence data underwent unified cleaning and standardization preprocessing. This cleaning and standardization preprocessing included: performing field parsing, mapping the original field names in data records from different sources to a unified set of field names, which at least included a timestamp field, source entity identifier field, target entity identifier field, event type field, asset identifier field, user identifier field, and description information field; performing unified timestamp processing, converting all record timestamps to a unified time standard and representing them in a unified format, and filling in missing time fields with the record's arrival time at the receiving end; performing data deduplication, using a combination of timestamp, source entity identifier, target entity identifier, event type, and asset identifier as the deduplication key, retaining only one duplicate record with the exact same deduplication key; and performing outlier removal, identifying records with IP addresses outside the legal address range, port numbers outside the legal port range, timestamps exceeding the reasonable offset range of the current time, and event types outside the allowed enumeration set based on pre-configured rules, marking these records as outliers and removing them from the data stream.

[0047] After completing the above processing, the data set after field parsing, timestamp unification, data deduplication, and outlier removal will be defined as standardized multi-source secure data and stored in a standardized data storage area that can be directly accessed by the subsequent entity recognition and relationship extraction modules.

[0048] S12: Based on standardized multi-source security data, using entity recognition and relation extraction models, extract entities representing network assets, attack tools, and security vulnerabilities, as well as the relationships connecting entities that represent causal or temporal connections between events, specifically:

[0049] First, an entity recognition model is constructed, which is a named entity recognition model based on a pre-trained language model. This model takes a text sequence (concatenated from descriptive and structured fields in standardized multi-source security data) as input. An embedding layer converts the text sequence into a vector representation, and a multi-layer coding network generates context-sensitive feature representations. Finally, the output layer provides an entity label for each labeled position. The entity label set includes at least network asset labels, attack tool labels, security vulnerability labels, and non-entity labels.

[0050] Standardized multi-source security data is input into the entity recognition model line by line, and named entity recognition inference is performed on the text sequence of each record. When the model outputs a network asset tag at a certain field position, a network asset entity object is generated in the current record, with its entity identifier set as the asset identifier field and its entity type set as network asset. When the model outputs an attack tool tag, an attack tool entity object is generated, with its entity identifier set as the attack tool name field and its entity type set as attack tool. When the model outputs a security vulnerability tag, a security vulnerability entity object is generated, with its entity identifier set as the security vulnerability number field and its entity type set as security vulnerability. For multiple identical entity identifiers appearing in the same record, they are merged by searching existing entity objects to avoid generating duplicate entities in the knowledge graph.

[0051] Secondly, a relation extraction model is constructed, which is a relation extraction model based on dependency parsing and sequence labeling. Dependency parsing is performed on the text sequence of each record in the normalized multi-source security data to obtain a dependency tree structure representing the dependency relationships between words. The dependency tree structure and the original text sequence are jointly encoded and input into the relation extraction model, which then performs sequence labeling on the relationship types between entity pairs at the output end. Relation types include at least those representing causal relationships and those representing temporal relationships.

[0052] During relation extraction, for each record containing multiple entity objects, the combinations of entity pairs are enumerated, and the relation extraction model is used to determine whether there is a causal or temporal relationship between the entity pairs. When the model outputs a causal relationship, an association object is generated, with the starting entity pointing to the cause entity and the target entity pointing to the result entity, and the relationship type is set to causal. When the model outputs a temporal relationship, an association object is generated, with the starting entity pointing to the earlier entity and the target entity pointing to the later entity, and the relationship type is set to temporal.

[0053] When generating relational objects, the timestamp field of the source record is written into the time attribute of the relational object, and the output probability of the model for this relation type is written into the confidence attribute of the relational object, so as to enable fine-grained management of the relations in the graph structure later. After the above processing, an intermediate structured result is obtained, consisting of network asset entities, attack tool entities, security vulnerability entities, and the relations connecting these entities that represent causal or temporal relationships between events.

[0054] S13: Based on the predefined atomic event list and tactical framework mapping rules, the relationships are divided into behavioral-level relationships and tactical-level relationships. Behavioral-level relationships are marked as specific event types in the atomic event list, while tactical-level relationships are marked as specific tactical stages in the tactical framework mapping rules. Specifically:

[0055] First, a list of atomic events is pre-defined in the configuration center. This list is a predefined list enumerating all observable atomic security events. Each event type in the list includes an event name, a trigger condition expression, a set of required fields, and an event level attribute. Event types include network connection establishment, network connection termination, access to a specific port, successful user login, failed user login, file creation, file modification, file deletion, process startup, process injection, and registry key modification. Each event type corresponds to a set of explicit field matching rules used to determine whether the event has occurred from related objects and their associated entity objects.

[0056] Then, pre-defined tactical framework mapping rules are established, based on the MITRE ATT&CK framework. These rules map multiple atomic security events to a single tactical phase, configuring each phase with a tactical-level relationship identifier, a set of atomic event types that can constitute that phase, and time windows and associated constraints. Tactical phases include initial access, execution, persistence, privilege escalation, evasion defense, credential access, discovery, lateral movement, collection, command and control, and data exfiltration. Each tactical phase is uniquely described through an atomic event combination pattern.

[0057] For each associated object obtained in S12, a behavior-level relationship matching process is first executed. This process compares the entity type, event type fields, and time attributes involved in the associated object with the event types in the atomic event list. When the triggering condition expression of an atomic event is satisfied on the record corresponding to the current associated object, a behavior-level relationship is generated. The relationship type of this behavior-level relationship is then marked as the specific event type in the corresponding atomic event list, and a reference association is established between the behavior-level relationship and the entity object participating in that event.

[0058] After completing behavior-level relationship matching, a tactical-level relationship aggregation process is performed on the associated relationship objects that have not yet been matched as behavior-level relationships. Based on tactical framework mapping rules, the tactical-level relationship aggregation process scans multiple behavior-level relationships and unmatched associated relationship objects in chronological order within the same attack session. It aggregates the set of associations that satisfy a certain tactical stage's atomic event combination pattern and time window constraints into a single tactical-level relationship. For the aggregated tactical-level relationship, its tactical identifier is set to a specific tactical stage in the tactical framework mapping rules, and all behavior-level relationships in the aggregated set are recorded as the set of subordinate relationships of that tactical-level relationship.

[0059] During the tactical-level relationship aggregation process, an initial achievement state is calculated for each tactical-level relationship. An initial impact level is also calculated based on the number of behavioral-level relationships constituting the tactical-level relationship, the time span covered, and the sensitivity of the network assets involved. This provides a basis for subsequent prioritization of tactical-level relationships in the graph structure. After the above processing, all relationships are divided into two categories: behavioral-level relationships and tactical-level relationships, each with a clearly defined event type and tactical stage marker.

[0060] S14: Entities, behavioral-level relationships, and tactical-level relationships, as well as their subordinate and aggregation connections, are stored in a graph structure to form a hierarchical security knowledge graph, specifically:

[0061] During the storage phase, a graph database is used to implement relational storage. The graph database adopts an attribute graph model, storing entities as graph nodes and behavioral-level relationships and tactical-level relationships as edges with different attribute labels. When creating graph nodes, network asset entities are mapped to nodes with network asset node labels, attack tool entities are mapped to nodes with attack tool node labels, and security vulnerability entities are mapped to nodes with security vulnerability node labels. The node attributes store structured attribute information such as entity identifier, entity type, asset importance, attack tool family, and vulnerability severity level.

[0062] When creating an edge corresponding to a behavior-level relationship, the starting entity node and the target entity node of the behavior-level relationship are used as the two ends of the edge. The relationship label of the edge is set to the behavior-level relationship label, and the specific event type field from the atomic event list, as well as the confidence attribute and timestamp attribute calculated in the preceding steps, are recorded in the edge's attributes. The confidence attribute numerically represents the degree of credibility of the behavior-level relationship judgment result, and the timestamp attribute records the time when the event corresponding to the behavior-level relationship occurred, facilitating time-based queries and inferences in the graph database.

[0063] When creating edges corresponding to tactical-level relationships, the key entity nodes participating in the tactical-level relationship are used as endpoints. The relationship label of the edge is set to the tactical-level relationship label, and the specific tactical stage identifier in the tactical framework mapping rules is recorded in the edge's attributes. Simultaneously, the achievement status attribute and the impact level attribute are also recorded. The achievement status attribute indicates whether the tactical-level relationship has currently met the completion conditions defined in the tactical framework mapping rules, while the impact level attribute quantifies the degree of influence of the tactical-level relationship on the overall attack path.

[0064] To represent the aggregation relationships among multiple behavioral-level relations belonging to the same tactical-level relation, an aggregation structure is created for each tactical-level relation in the graph database. This aggregation structure is implemented by establishing aggregation edges between the tactical-level relation and each behavioral-level relation. Aggregation edges point from the edges or intermediate relation nodes corresponding to the behavioral-level relations to the edges or intermediate relation nodes corresponding to the tactical-level relations. The aggregation edge attributes record the role identifier and sequence number of the behavioral-level relation in that tactical phase, thus explicitly representing the subordinate relationships and aggregation order between the tactical-level relation and its subordinate behavioral-level relations in the graph structure.

[0065] After creating the nodes and edges, indexes are established for the node identifier and relation identifier fields in the graph database to improve the efficiency of subsequent queries that quickly retrieve causal attack paths based on entity identifier, event type, and tactical stage. During operation, a scheduling component periodically initiates batch processing tasks from steps S11 to S14 at preset time intervals. Simultaneously, when new multi-source security data is detected being written to the standardized data storage area, the new data is encapsulated as an incremental task and submitted to the asynchronous task queue to execute the corresponding processing flow in steps S11 to S14, thereby realizing the dynamic updating and incremental construction of the hierarchical security knowledge graph.

[0066] S2: Receive the current sequence of security events and map it to a set of initial behavioral-level relationships in a hierarchical security knowledge graph. Starting from these initial behavioral-level relationships, expand the hierarchical security knowledge graph horizontally along these relationships and vertically abstract and converge them along the tactical-level relationships to generate a causal attack path from the initial events to the preset attack target. The causal attack path consists of sequentially linked behavioral-level relationship nodes and tactical-level relationship nodes. Configure an influence weight value for each relationship node in the causal attack path. The specific steps are as follows:

[0067] S21: Receive the currently continuously generated security event sequence, parse the security event sequence, and extract key feature information from the security event sequence. The key feature information includes the source entity, target entity, event action type, and occurrence timestamp, specifically:

[0068] In a production environment, the raw log streams generated by the deployed log collection agent, security device log receiving component, and network traffic parsing component are connected to a streaming engine. The streaming engine operates on a distributed computing framework, treating the continuously input raw log records as a time-ordered data stream. Each log record is assigned an arrival sequence number and categorized according to its source type: network full traffic data stream, host system log data stream, security device alarm log data stream, and external threat intelligence data stream.

[0069] Within the streaming engine, corresponding event pattern rules are configured for each data stream. The event pattern rules for the network full traffic data stream specify the triggering conditions for three types of events: session start, session end, and access to a specific port. Network layer security events are generated by matching the source IP, destination IP, source port, destination port, transport protocol, and session identifier fields. The event pattern rules for the host system log data stream specify the triggering conditions for successful user login, failed user login, process startup, process command-line arguments, file creation, file modification, file deletion, and registry key modification. Host layer security events are generated by matching the user identifier, process identifier, command-line string, file path, and registry path fields. The event pattern rules for the security device alarm log data stream generate security events related to the defense device based on the alarm type and threat level fields, mapping the source asset identifier and target asset identifier involved to source and target entities. The event pattern rules for the external threat intelligence data stream generate intelligence events related to attack tools and security vulnerabilities based on the threat intelligence identifier, attack tool name, and security vulnerability number fields.

[0070] When the streaming engine receives a raw log record, it first selects the corresponding event pattern rule set based on the log source type and performs pattern matching on the log record. If a match is successful, a security event is generated. The source IP address or asset identifier from the log is filled into the source entity field, the target IP address or asset identifier into the target entity field, the event type into the event action type field, and the parsed time field into the occurrence timestamp field. For events involving network sessions, the target port field is filled with the destination port, and the transport protocol field is filled with the protocol type. For events involving file operations, the file hash value field is extracted from the raw log and stored as the file hash value. For events involving process startup, the process command-line arguments are stored as is. For events involving external threat intelligence matching, the corresponding threat intelligence identifier field is stored as the threat intelligence identifier.

[0071] Through the aforementioned streaming parsing process, the streaming processing engine continuously outputs structured security events, forming a security event sequence arranged in chronological order. Each event in the security event sequence fully contains key feature information, including the source entity, target entity, event action type, occurrence timestamp, destination port, protocol type, file hash value, process command-line parameters, and threat intelligence identifier. This provides the foundational data for subsequent mapping to behavioral relationships in a hierarchical security knowledge graph.

[0072] S22: For each independent event in the security event sequence, match its key feature information with the entity and relation attributes in the hierarchical security knowledge graph, mapping it to one or more corresponding behavioral-level relations in the hierarchical security knowledge graph, forming a set of initial behavioral-level relations, specifically:

[0073] First, when accessing the hierarchical security knowledge graph, the index structure of all behavioral-level relationships is loaded from the graph database. This index structure establishes a multi-level composite index based on the source entity identifier, target entity identifier, event type identifier, destination port, and protocol type of the behavioral-level relationship. For each behavioral-level relationship, a feature vector for semantic similarity calculation is pre-stored. The feature vector is composed of event action type encoding, asset importance encoding, vulnerability severity level encoding, and historical attack chain position encoding.

[0074] For each event in the security event sequence, the corresponding entity node is retrieved from the knowledge graph based on the source entity field and the target entity field. If the entity node corresponding to the source entity field does not exist in the knowledge graph, a new entity node is created based on the content of that field, and the entity type is set to network asset. Similarly, if the entity node corresponding to the target entity field does not exist, a new entity node is created. Subsequently, a set of candidate behavioral-level relationships is selected from the behavioral-level relationship index based on the event action type, destination port, protocol type, file hash value, process command-line arguments, and threat intelligence identifier. During the selection process, the event action type is matched with the event type in the atomic event list, the destination port is compared with the port attribute in the behavioral-level relationship attributes, the protocol type is compared with the protocol attribute in the behavioral-level relationship attributes, the file hash value is compared with the file feature attribute associated with the behavioral-level relationship, the process command-line arguments are compared with the process feature attribute associated with the behavioral-level relationship, and the threat intelligence identifier is compared with the threat intelligence attribute associated with the behavioral-level relationship.

[0075] After obtaining the set of candidate behavior-level relations, the semantic similarity between each candidate behavior-level relation and the current security event is calculated. Semantic similarity is based on two aspects: firstly, the event feature vector generated after isomorphic encoding of the key feature information of the current security event; and secondly, the feature vector of the behavior-level relation pre-stored in the knowledge graph. A combination of inter-vector distance and field matching metrics is used to calculate similarity. The event feature vector and the behavior-level relation feature vector are normalized, and the cosine of the angle between them is calculated. A comprehensive similarity score is then generated by combining the source entity matching, target entity matching, and event action type matching.

[0076] If the overall similarity score of a candidate behavior-level relationship is greater than a preset similarity threshold, the mapping between the current security event and that candidate behavior-level relationship is considered successful. The behavior-level relationship is then added to the initial behavior-level relationship set, and the unique identifier of the current security event is recorded in the attributes of that relationship as a new observation instance. When multiple candidate behavior-level relationships simultaneously meet the similarity threshold, all of these relationships are added to the initial behavior-level relationship set, thus allowing a single security event to correspond to multiple behavior-level relationships in the knowledge graph.

[0077] For security events where no candidate behavioral-level relationships can be found in the knowledge graph, or where the overall similarity score of all candidate behavioral-level relationships is below the similarity threshold, new entities and behavioral-level relationships are created based on the key feature information of the security event. When creating an entity, the asset identifier corresponding to the source entity field is created as a new network asset entity node, and the asset identifier corresponding to the target entity field is also created as a new network asset entity node. When creating a behavioral-level relationship, the starting entity of the relationship is set as the source entity node, the target entity is set as the target entity node, the relationship type is set to the event type in the corresponding atomic event list, and the destination port, protocol type, file hash value, process command-line parameters, and threat intelligence identifier are written into the attributes. This behavioral-level relationship is then added to the initial behavioral-level relationship set. After the above processing, a set of initial behavioral-level relationships covering the current security event sequence is generated, providing a set of starting nodes for subsequent path exploration.

[0078] S23: Starting with the initial behavioral-level relationships as the initial node set, execute a path exploration algorithm in the hierarchical security knowledge graph to generate a set of causal attack paths from the initial event to the preset attack target, specifically:

[0079] Before performing path exploration, all tactical-level relation definitions and tactical pattern rule bases are first read from the graph database, and entity nodes pre-marked as core assets in the knowledge graph are loaded into memory. Core asset entity nodes include three types: database server entity nodes, domain controller entity nodes, and critical application server entity nodes. These entity nodes have been set to high-level asset importance attributes and marked as attack target entity nodes when the knowledge graph was created.

[0080] The path exploration algorithm employs an improved depth-first search algorithm. The initial set of behavioral-level relations is treated as multiple search starting points. Each initial behavioral-level relation is pushed onto the search stack as the first node of a temporary path, and its timestamp and confidence attributes are recorded. For the path at the top of the stack, all edges originating from the current behavioral-level relation and pointing causally to other behavioral-level relations, as well as behavioral-level relations that occur after the current behavioral-level relation in chronological order, are queried in the hierarchical security knowledge graph. During the query, candidate behavioral-level relations with timestamps closest to the current behavioral-level relation's timestamp are prioritized. Among these candidate relations with similar timestamps, they are sorted from highest to lowest confidence attribute, and the current path is expanded sequentially according to the sorting results.

[0081] During each horizontal expansion, the connection between the current path's end node and candidate behavioral-level relationships is written into the path sequence, and the cumulative time span and number of nodes in the path are updated. After path expansion, a certain number of behavioral-level relationship nodes are traced back from the end of the path to construct a continuous path segment. The event type sequence corresponding to the behavioral-level relationships in this path segment is matched with tactical patterns in the tactical pattern rule base. The tactical pattern rule base defines the logical combination and sequence conditions of the required behavioral-level relationships for each tactical-level relationship, including the order of behavioral-level relationship types, the allowed time interval range, and the constraints of the participating entity types. When a path segment satisfies all the conditions of a tactical pattern, the set of behavioral-level relationships corresponding to that path segment is aggregated into a tactical-level relationship node, and this tactical-level relationship node replaces the behavioral-level relationship node of the path segment in the path, causing the path to generate vertical abstract convergence at that position.

[0082] After abstraction and aggregation, the tactical-level relationship node is used as the new current node. The knowledge graph is then queried for subsequent behavioral and tactical-level relationships originating from this node, and expanded using the aforementioned time proximity and confidence-priority strategy. During the expansion of each path, it is continuously checked whether the end of the path reaches the preset attack target entity node; that is, whether the behavioral or tactical-level relationship at the end of the path involves a core asset entity node. If the end of the path involves a core asset entity node, the current path is marked as a causal attack path ending at the attack target, and it is added to the causal attack path set.

[0083] Simultaneously, a path length threshold is set to limit the maximum number of relation nodes in the path. The path length threshold is calculated based on the maximum number of attack chain stages pre-configured by the defender. When the defender has configured a maximum number of attack chain stages, the path length threshold is obtained by multiplying that number of stages by the maximum allowed number of behavioral-level relations per stage. When the defender has not provided such a configuration, a fixed integer upper limit is used as the path length threshold. During path expansion, when the number of nodes in a path reaches the path length threshold, further expansion of that path is stopped, and the path is popped from the search stack to avoid unbounded expansion leading to an excessively large search space. By repeating the above search process for all initial behavioral-level relation starting points, a set of causal attack paths from the initial event to the preset attack target is finally obtained.

[0084] S24: Filter all causal attack paths that can reach the preset attack target from the causal attack path set, and configure influence weight values ​​for the path nodes to complete the quantification of causal attack paths, specifically:

[0085] After obtaining the set of causal attack paths, the endpoint of each path in the set is first checked to confirm whether the end node of the path involves core asset entity nodes. Only paths whose end nodes involve database server entity nodes, domain controller entity nodes, and critical application server entity nodes are retained, and these paths are used as causal attack paths that can reach the preset attack targets in the subsequent quantification process.

[0086] For each causal attack path involved in quantification, an influence weight value is assigned to each behavioral-level and tactical-level relation node on the path according to a predefined weight calculation model. The weight calculation model is an analytic hierarchy process (AHP) model. During the model construction phase, four criteria—asset value, vulnerability severity, historical probability of attack success, and coverage of defense measures—are set as the criterion layer for weight evaluation, while the risk contributions of behavioral-level and tactical-level relation nodes are set as the solution layer. Security experts conduct pairwise comparisons of the four criteria to construct a criterion-level judgment matrix. The weight vectors of the four criteria—asset value, vulnerability severity, historical probability of attack success, and coverage of defense measures—are calculated using the eigenvector method, and a consistency check is performed to ensure that the judgment matrix is ​​within the allowable error range.

[0087] When assigning influence weight values ​​to a specific node, the following steps are taken: First, the asset value score is retrieved from the asset information database based on the type of asset involved, the importance of the business to which the asset belongs, and the asset's location in the network topology. Next, the severity score of the vulnerability associated with the node is queried from the vulnerability information database. Then, based on historical attack data statistics, the frequency with which the corresponding behavioral or tactical relationship of the node appeared as a key step in past attack chains is searched in the historical attack case database, and a historical probability score of attack success is calculated. Finally, based on the currently deployed defense measures, the degree to which the corresponding behavioral or tactical relationship of the node is covered by existing detection and blocking mechanisms is assessed, resulting in a defense measure coverage score.

[0088] The basic influence weight value of the node is obtained by multiplying the four scores mentioned above with the four criterion weights calculated in the analytic hierarchy process (AHP) model and summing the results. For behavioral-level relationship nodes, the basic influence weight value is directly used as the influence weight value of the behavioral-level relationship node. For tactical-level relationship nodes, a weighting factor based on the number and value of downstream key assets is introduced on top of the basic influence weight value. The number of all core asset entity nodes reachable downstream from the tactical-level relationship node is counted, and a weighted average value is calculated based on the asset value scores of these core assets. The number of downstream key assets and the weighted average value are combined into a weighting factor, which is then multiplied by the basic influence weight value to obtain the final influence weight value of the tactical-level relationship node.

[0089] After configuring influence weight values ​​for all nodes, the total influence weight value is calculated for each causal attack path. The total influence weight value is a weighted sum of the influence weight values ​​of all behavioral and tactical relationship nodes along that path. Nodes closer to the attack target can be assigned higher in-path weight coefficients based on their chronological order, thus highlighting the importance of terminal-stage behavior when calculating the total influence weight value. After calculating the total influence weight value, all causal attack paths are sorted from largest to smallest, generating a sorted list of causal attack paths. This list is then output as a risk assessment result for use by the subsequent path simulator and defense decision module.

[0090] S3: Input the causal attack path and the influence weights of each node into the path simulator; the path simulator simulates the attacker's advance along the path and the defender's blocking actions, and iteratively calculates and deduces the optimal adversarial decision sequence that minimizes the overall threat level of the path under the constraint of defensive resources; the adversarial decision sequence is a set of a series of defensive actions and their execution sequence; the specific steps for executing the adversarial decision sequence are as follows:

[0091] S31: Based on the causal attack path and the influence weights of each node, initialize the path simulator. Each behavioral-level and tactical-level relation node in the causal attack path is mapped to an attack state node in the path simulator, and each attack state node is assigned a corresponding influence weight. Simultaneously, define the atomic defense action library and defense resource constraints available to the defender in the path simulator, and set a loss function that minimizes the sum of the attacker's final loss and the defense cost. Specifically:

[0092] First, the set of causal attack paths, filtered and quantified in step S2, is loaded into the path simulator. Internally, the path simulator constructs a graph-based attack state space, mapping each behavioral-level and tactical-level relation node in each causal attack path to an attack state node. A unique state identifier is assigned to each attack state node, and the influence weight value calculated in step S24 is written into its state attributes. For shared nodes located at the intersection of multiple causal attack paths, the path simulator creates only one corresponding attack state node in the state space and records the node's position index sequence across all paths for subsequent joint inference across multiple paths.

[0093] Subsequently, the path simulator establishes state transition relationships between attack state nodes. For two adjacent behavioral or tactical relationship nodes in the same causal attack path, the path simulator establishes a directed state transition edge between them, taking the preceding node as the current state and the following node as the successor state, and records the attack advancement base probability value estimated by historical attack data or expert rules on the state transition edge. For the branching relationship between a tactical relationship node and its multiple downstream behavioral relationship nodes, the path simulator establishes state transition edges between the tactical relationship node and each downstream behavioral relationship node, and assigns base transition probability allocations to these state transition edges that conform to the attacker's selection preferences.

[0094] After constructing the attack state space, the path simulator defines the atomic defense action library. This library is a list of atomic defense actions available to the defender. Each atomic defense action in the list has a fixed action type identifier, applicable attack state node types, and corresponding cost attributes. The atomic defense action library includes at least: network connection blocking actions, host isolation actions, user session reset actions, access credential revocation actions, virtual patch application actions, enhanced logging enable actions, and network topology switching path actions. The path simulator configures the scope of each atomic defense action's applicable targets. For example, a network connection blocking action can be applied to the states of all nodes involved in a specific network connection behavior level relationship, and a host isolation action can be applied to all attack state nodes involving a specific host asset.

[0095] Next, the path simulator loads defense resource constraints. These constraints include an upper limit on the number of defense actions that can be executed simultaneously, the time cost required to execute a specific defense action, and the budget for computational and human resources consumed in executing that action. The path simulator assigns a time cost parameter and a resource consumption parameter to each atomic defense action. The concurrency upper limit parameter in the defense resource constraints controls the number of atomic defense actions that can be selected for execution at any given simulation time step, while the budget parameter set controls the total amount of resources that the defender can consume throughout the entire simulation time, ensuring that any candidate adversarial decision sequence must satisfy these defense resource constraints.

[0096] After constructing the attack state space and defense action space, the path simulator defines an overall loss function. The loss function consists of a weighted sum of three parts: the sum of the accumulated impact weights when the attacker reaches the final target node, the total cost of the defender executing the candidate adversarial decision sequence, and the penalty for the indirect impact of the defense action on normal business operations. The path simulator accumulates the impact weights of all attack state nodes along the attack path when the attacker reaches the final target node to obtain the attack loss; it sums the time cost parameters and resource consumption parameters of each atomic defense action in the candidate adversarial decision sequence according to predefined weights to obtain the defense cost; and it retrieves the corresponding business impact penalty factors from the business impact model based on the type of atomic defense action, the business assets involved, and the execution sequence, and accumulates them to obtain the business impact penalty. The loss function weights and sums the attack loss, defense cost, and business impact penalty according to the defender's preset weight coefficients to obtain the total loss value used to evaluate the merits of the candidate adversarial decision sequence. The goal of the path simulator is to select the adversarial decision strategy that minimizes the value of this loss function while satisfying defense resource constraints.

[0097] S32: In the initialized path simulator, using the causal attack path as the deduction baseline, the process of the attacker gradually advancing from the initial node to the target node is simulated. At each attack state node, based on the defense resource constraints, one or more defense actions that the defender can select from the atomic defense action library are enumerated. The expected loss change of the attacker due to the change in the attack path or the blocking of the attack state node caused by the defense action is calculated. Through multiple rounds of iterative deduction, multiple candidate adversarial decision sequences containing different combinations of defense actions and execution sequences and their corresponding expected loss evaluation values ​​are generated. Specifically:

[0098] During the simulation phase, the path simulator constructs a Markov decision process model based on the aforementioned attack state space and atomic defense action library. The state space of the Markov decision process model consists of all attack state nodes and two additional termination state nodes: one for successful attack and one for blocked attack. Based on the causal attack path structure and historical attack data, the path simulator assigns a basic state transition probability to each state transition edge in the state space. In scenarios without reliable historical data, the path simulator assigns reasonable basic state transition probabilities to state transition edges based on prior information from the attack phase and expert rules, ensuring that the state transition probabilities are normalized across all subsequent states of each state.

[0099] In each simulation, the path simulator first starts from the initial attack state node of a causal attack path, taking this node as the current state. Based on the set of atomic defense actions that have not yet been executed, the defense resource constraints, and the attack stage characteristics of the current state, it enumerates the currently available combinations of defense actions from the atomic defense action library. For each candidate combination of defense actions, the path simulator modifies the state transition structure of the current state according to the mechanism of action. Blocking a network connection reduces the probability of state transition edges involving the target network connection to zero and connects the corresponding subsequent attack state nodes to the attack-blocked termination state node; isolating a host causes all attack state nodes involving the isolated host to transition to the attack-blocked termination state node; resetting a user session resets the state related to the corresponding user session, requiring subsequent attacks to re-enter the preceding state; revoking access credentials significantly reduces the probability of subsequent state transitions relying on those credentials; applying virtual patches reduces the transition probability of attack state nodes exploiting specific security vulnerabilities; enabling enhanced logging does not directly block states but increases the probability of subsequent attack state nodes being detected and triggering additional defense actions; switching network topology paths changes the topology of certain state transition edges, altering the feasible attack paths for attackers in the network.

[0100] For each current state and candidate defense action combination, the path simulator models the attack effect propagation based on the modified state transition structure. Starting from the current state, the attack effect propagation model traverses downstream along all possible attack paths, calculating the probability distribution of the attacker reaching each attack state node under a given defense action combination. These probabilities are multiplied by the influence weights of the corresponding attack state nodes and accumulated along the path to obtain the expected attack loss under that defense action combination. Simultaneously, the path simulator accumulates the defense cost increment for the current time step based on the time cost and resource consumption parameters of the upcoming defense action combination. Based on the impact of this defense action combination on the availability of the business system, it searches for the corresponding business impact penalty increment from the business impact model and adds these three increments to the loss function to obtain the expected loss change corresponding to the current defense action combination.

[0101] To find the optimal defense strategy under the constraint of defense resources, the path simulator employs a reinforcement learning algorithm based on value iteration or policy iteration for multiple rounds of iterative deduction. In the value iteration algorithm, the path simulator maintains a state value function for each attack state node. This state value function is initialized to the loss function value of the attacker progressing along the causal attack path from this state to the successfully terminated state node without any defense. In each iteration, the path simulator traverses all states, calculates the expected loss function value that the current state can obtain after executing each possible combination of defense actions, and selects the defense action combination with the smallest expected loss function value as the candidate optimal action combination for that state, updating the state value function.

[0102] In the strategy iteration algorithm, the path simulator first proposes an initial defense strategy, which involves selecting a combination of defensive actions at each attack state node. Then, the path simulator performs several complete simulations of the entire state space under this defense strategy, evaluating the loss function values ​​starting from each attack state node. This evaluation result is used as the output of the strategy evaluation phase. Next, based on the evaluation results, the path simulator improves the combination of defensive actions at each attack state node, replacing the original combination with one that significantly reduces the loss function value, thus completing one strategy improvement. By alternately executing strategy evaluation and strategy improvement, the path simulator gradually converges to an approximately optimal defense strategy under defense resource constraints.

[0103] During multiple rounds of iterative simulation, the path simulator treats the attacker as a party with adaptive response capabilities. The path simulator introduces adversarial game parameters into the state transition model to represent the attacker's probability of bypassing defensive actions. For a state transition edge affected by a deployed defensive action, the path simulator considers two scenarios: one where the defensive action effectively disables the state transition edge or significantly reduces its probability; and another where the attacker uses a modified attack technique to bypass the defensive action with a certain probability and continue along an alternative attack path. The adversarial game parameters control the weights of these two scenarios, thus reflecting the attacker's adversarial behavior in the calculation of expected loss changes. Through multiple rounds of iterative simulation, the path simulator generates several candidate adversarial decision sequences containing different combinations of defensive actions and execution sequences, and calculates and records the corresponding expected loss assessment value for each candidate adversarial decision sequence.

[0104] S33: From multiple candidate adversarial decision sequences, select the candidate adversarial decision sequence with the smallest expected loss assessment value, determine it as the optimal adversarial decision sequence, and, based on the defensive actions and their execution sequence specified in the optimal adversarial decision sequence, schedule corresponding security resources and drive automated response tools to execute the optimal adversarial decision sequence, specifically as follows:

[0105] After the reinforcement learning algorithm converges or reaches the preset number of iterations, the path simulator sorts all recorded candidate adversarial decision sequences according to their expected loss evaluation values ​​from smallest to largest, and selects the candidate adversarial decision sequence with the smallest expected loss evaluation value as the optimal adversarial decision sequence. The optimal adversarial decision sequence consists of a series of defense action entries arranged in chronological order. Each defense action entry includes at least a defense action type identifier, a target attack status node identifier, a planned execution time, and a description of the required security resources.

[0106] During the execution phase, the optimal adversarial decision sequence is first distributed to the security resource scheduling module. The security resource scheduling module parses each defense action entry in the optimal adversarial decision sequence and, based on the defense action type identifier, converts actions such as blocking network connections into corresponding firewall access control policy change instructions, isolating hosts into isolation instructions for the endpoint detection and response platform, resetting user sessions into session termination instructions for the identity authentication system, revoking access credentials into credential invalidation instructions for the access control system, applying virtual patches into policy update instructions for the vulnerability protection system, enabling enhanced logging into configuration change instructions for the security logging system, and switching network topology paths into routing policy adjustment instructions for the network control plane.

[0107] The security resource scheduling module sorts these instructions by time and checks their dependencies based on the planned execution time and dependency order of each defensive action item in the optimal adversarial decision sequence, generating a set of directly executable automated response tasks.

[0108] Subsequently, the security resource scheduling module sends the corresponding instructions or scripts to at least one of the firewall management system, endpoint detection and response platform, and security orchestration and automated response platform through a pre-configured interface, triggering these systems to execute the corresponding automated response operations.

[0109] During execution, the security resource scheduling module continuously monitors the number of defense actions currently being executed, the cumulative resource consumption, and the execution progress based on the defense resource constraints, ensuring that the actual execution of the optimal confrontation decision sequence does not exceed the preset resource budget.

[0110] After driving the automated response tool to execute the optimal adversarial decision sequence, the system also tracks the status changes of attack state nodes after the defensive actions are performed by real-time monitoring of each attack state node along the causal attack path. The monitoring information comes from network traffic data, host system logs, security device alarm logs, and external threat intelligence data. By re-analyzing this data, the system determines whether attack state nodes that were originally active are no longer showing new related events, and marks this result as a change in the node's status from active to blocked.

[0111] The monitoring results are fed back to the path simulator, which adjusts the state transition probabilities and adversarial game parameters in the Markov decision process model based on the actual execution results. The new execution samples are added to the empirical dataset of the reinforcement learning algorithm, so that when the path simulation is triggered again in the future, the optimal adversarial decision sequence that is more in line with reality can be obtained based on the updated model, thus forming a dynamic closed-loop optimization mechanism for attack simulation and defense execution.

[0112] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0113] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A risk intelligent decision optimization method based on security knowledge graph reasoning, characterized in that, Includes the following steps: S1: Collect multi-source security data and extract entities and their relationships; divide the relationships into behavioral-level relationships and tactical-level relationships; wherein, behavioral-level relationships represent specific atomic security events that can be directly observed or recorded, and tactical-level relationships represent combination patterns of multiple behavioral-level relationships that are logically aggregated to achieve specific attack phase objectives; store entities, behavioral-level relationships and tactical-level relationships in association to form a hierarchical security knowledge graph; S2: Receive the currently occurring security event sequence, map the security event sequence to a set of initial behavioral-level relationships in the hierarchical security knowledge graph; starting from the initial behavioral-level relationships, expand horizontally along the behavioral-level relationships in the hierarchical security knowledge graph, and abstract and converge vertically along the tactical-level relationships to generate a causal attack path from the initial event to the preset attack target; the causal attack path consists of sequentially linked behavioral-level relationship nodes and tactical-level relationship nodes; configure an influence weight value for each relationship node in the causal attack path; S3: Input the causal attack path and the influence weight values ​​of each node into the path simulator; the path simulator simulates the attacker's advance along the path and the defender's blocking action, and iteratively calculates and deduces the optimal adversarial decision sequence that can minimize the overall threat level of the path under the constraint of defense resources; the adversarial decision sequence is a set of a series of defense actions and their execution sequence; execute the adversarial decision sequence.

2. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 1, characterized in that, S1 includes: S11: Collect multi-source security data from network traffic sensors, terminal detection response logs, and security intelligence platforms, and clean and standardize the multi-source security data to form standardized multi-source security data; S12: Based on the standardized multi-source security data, using entity recognition model and relation extraction model, extract entities that represent network assets, attack tools, and security vulnerabilities, as well as the association relationships that connect the entities and represent causal or temporal relationships between events. S13: Based on the predefined atomic event list and tactical framework mapping rules, the association is divided into behavioral-level relationships and tactical-level relationships, wherein the behavioral-level relationships are marked as specific event types in the atomic event list, and the tactical-level relationships are marked as specific tactical stages in the tactical framework mapping rules; S14: The entities, behavioral-level relationships, and tactical-level relationships, as well as their subordinate and aggregation relationships, are associated and stored according to a graph structure to form the hierarchical security knowledge graph.

3. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 2, characterized in that, The multi-source security data includes full network traffic data, host system logs, security device alarm logs, and external threat intelligence data; the cleaning and standardization preprocessing includes field parsing, timestamp unification, data deduplication, and outlier removal of the multi-source security data.

4. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 2, characterized in that, The entity recognition model is a named entity recognition model based on a pre-trained language model, used to identify and extract the entities from the standardized multi-source security data; the relation extraction model is a relation extraction model based on dependency parsing and sequence labeling, used to extract the associations from the standardized multi-source security data.

5. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 2, characterized in that, S2 includes: S21: Receive the currently continuously generated security event sequence, parse the security event sequence, and extract the key feature information in the security event sequence. The key feature information includes the source entity, the target entity, the event action type, and the occurrence timestamp. S22: For each independent event in the security event sequence, match its key feature information with the entity and relation attributes in the hierarchical security knowledge graph, and map it to one or more corresponding behavioral-level relations in the hierarchical security knowledge graph to form a set of initial behavioral-level relations; S23: Using the initial behavioral-level relationship as the starting node set, a path exploration algorithm is executed in the hierarchical security knowledge graph. The path exploration algorithm first expands the relationship horizontally along the behavioral-level relationship to find the next behavioral-level relationship that has a direct causal or temporal connection with the current node. At the same time, it checks whether the explored continuous behavioral-level relationships meet the definition conditions of any tactical-level relationship. If they do, it performs vertical abstraction and aggregation along the tactical-level relationship to generate a tactical-level relationship node as the aggregation node of the current path. It continues to explore subsequent possible behavioral-level relationships or tactical-level relationships from this tactical-level relationship node until the preset attack target entity node is reached or the path length reaches a threshold, thereby generating a set of causal attack paths from the initial event to the preset attack target. S24: Select all causal attack paths that can reach the preset attack target from the set of causal attack paths, and configure an influence weight value for each behavioral-level relation node and tactical-level relation node in each selected causal attack path according to a predefined weight calculation model to complete the quantification of the causal attack path.

6. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 5, characterized in that, In step S21, the security event sequence is parsed in real time using a streaming processing engine, which matches and extracts features from continuous raw log streams based on predefined event patterns.

7. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 5, characterized in that, In step S22, mapping events to corresponding behavioral-level relationships in the hierarchical security knowledge graph is achieved by calculating the semantic similarity between the key feature information of the event and the existing behavioral-level relationship attributes in the graph. If the similarity exceeds a preset threshold, the mapping is considered successful.

8. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 5, characterized in that, S3 includes: S31: Based on the causal attack path and the influence weight values ​​of each node, initialize the path simulator, wherein each behavioral-level relation node and tactical-level relation node in the causal attack path is mapped to an attack state node in the path simulator, and each attack state node is assigned its corresponding influence weight value. At the same time, define the atomic defense action library and defense resource constraints available to the defender in the path simulator, and set a loss function with the objective of minimizing the sum of the final loss caused by the attacker and the defense cost. S32: In the initialized path simulator, the causal attack path is used as the deduction baseline to simulate the process of the attacker gradually advancing from the initial node to the target node. At each attack state node, according to the defense resource constraints, one or more defense actions that the defender can select from the atomic defense action library are enumerated. The expected loss change after the attacker changes the attack path or the attack state node is blocked due to the defense action is calculated. Through multiple rounds of iterative deduction, multiple candidate adversarial decision sequences containing different combinations of defense actions and execution sequences and their corresponding expected loss evaluation values ​​are generated. S33: From the plurality of candidate adversarial decision sequences, select the candidate adversarial decision sequence with the smallest expected loss assessment value, determine it as the optimal adversarial decision sequence, and schedule the corresponding security resources and drive the automated response tool to execute the optimal adversarial decision sequence according to the defensive actions and their execution sequence specified in the optimal adversarial decision sequence.

9. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 8, characterized in that, The atomic defense action library includes blocking network connections, isolating hosts, resetting user sessions, revoking access credentials, applying virtual patches, enabling enhanced logging, and switching network topology paths.

10. The risk intelligent decision optimization method based on security knowledge graph reasoning according to claim 8, characterized in that, The defense resource constraints include the upper limit on the number of defense actions that can be executed simultaneously, the time cost required to execute a specific defense action, and the budget for computing and human resources consumed in executing the defense action.

Images