A data analysis system and method applied to network security

Abstract

This invention discloses a data analysis system and method for network security, relating to the field of network security technology. It includes an intent reasoning module, a causal extraction module for extracting attack causal elements from multi-source security data, a knowledge fusion module for fusing and verifying the extracted attack causal elements to form fused knowledge, an intent reasoning module for constructing a dynamic causal graph using the fused knowledge, and for performing causal tracing and tactical intent deduction. An adversarial deduction module for conducting attack and defense simulations using the dynamic causal graph and generating new threat hypotheses. By incorporating the intent reasoning module, dynamic causal graph, causal tracing unit, and intent deduction unit, this invention achieves deep causal tracing of network security events and proactive deduction of attackers' subsequent tactical intentions and action paths, thereby enhancing the ability to respond to complex and targeted attacks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a data analysis system and method applied to network security. Background Technology

[0002] With the rapid development of information technology, cybersecurity threats are becoming increasingly complex and diverse. Traditional cybersecurity protection methods, such as firewalls, intrusion detection systems (IDS), and security information and event management (SIEM) systems, mainly rely on methods such as signature matching, rule engines, and statistical anomaly detection to identify and alert on known attack patterns. Although these methods play an important role in preventing known threats, they are essentially passive and reactive protection modes. They can usually only trigger alerts after an attack occurs and generates certain logs or traffic characteristics, lacking the ability to proactively understand and predict the attacker's deep intentions and the evolution logic of the attack chain.

[0003] Traditional network security systems often struggle to reflect changes in network status and attack dynamics in real time, and are even less capable of dynamically tracing and extrapolating the causal chains between attack events. This is especially true when facing complex attacks such as advanced persistent threats (APTs), where attack steps have strong logical connections and temporal sequences. Simply relying on static correlation analysis makes it difficult to reconstruct the full picture of the attack and also fails to effectively predict the attacker's subsequent tactical actions.

[0004] Patent CN103023655B discloses a network security system, which improves the security performance of the network layer.

[0005] The aforementioned patent fulfills the network layer security requirements through a security protection module, ensuring that emails entering the email receiving server are safe and reliable. However, there is still room for optimization in terms of dynamic tracing and deduction of attack methods.

[0006] Therefore, this application proposes a data analysis system and method for cybersecurity that enables in-depth causal tracing of security incidents and deduction of attackers' tactical intentions. Summary of the Invention

[0007] The purpose of this invention is to provide a data analysis system and method for network security, in order to solve the technical problems mentioned in the background art, that traditional network security systems are unable to reflect the dynamic changes of network status and attacks in real time, are unable to dynamically trace and deduce the causal chain between attack events, and are unable to effectively predict the attacker's subsequent tactical actions.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a data analysis system for network security, comprising a causal extraction module, a knowledge fusion module, an intent reasoning module, and an adversarial simulation module. The causal extraction module is used to extract attack causal elements from multi-source security data. The causal extraction module is connected to the knowledge fusion module, which is used to fuse and verify the extracted attack causal elements to form fused knowledge. The intent reasoning module is connected to the knowledge fusion module, which constructs a dynamic causal graph through fused knowledge and performs causal tracing and tactical intent simulation. The adversarial simulation module is connected to the intent reasoning module, which performs attack and defense simulation through the dynamic causal graph and generates new threat hypotheses.

[0009] The intent reasoning module includes a dynamic causal graph, a causal tracing unit, and an intent deduction unit. The causal tracing unit performs historical backtracking of attacks based on the dynamic causal graph, and the intent deduction unit performs future deduction of attacks based on the dynamic causal graph.

[0010] Preferably, the multi-source security data includes unstructured threat intelligence text and structured security device logs. The attack causal elements extracted by the causal extraction module from the multi-source security data include triple information of attack action, preconditions and consequences, which are used to provide raw knowledge materials for the knowledge fusion module.

[0011] Preferably, the knowledge fusion module includes a knowledge verifier, which is used to perform conflict detection on attack causal elements from the causal extraction module and resolve the attack causal elements through preset rules, thereby providing the intent reasoning module with fused knowledge that has undergone consistency processing.

[0012] Preferably, the dynamic causal graph includes nodes and edges. The nodes of the dynamic causal graph include assets, vulnerabilities, and attack actions, and the edges of the dynamic causal graph include causal and dependency relationships. The intent reasoning module injects triple information from the fused knowledge into the dynamic causal graph to continuously update the nodes and edges.

[0013] Preferably, the causal tracing unit receives a security alarm as input, performs reverse reasoning along the causal edges in the dynamic causal graph, and locates the defense failure point that caused the security alarm.

[0014] Preferably, the intent deduction unit takes the defense failure point located by the causal tracing unit and the value attributes of the assets in the dynamic causal graph as input, and performs forward reasoning along the edges in the dynamic causal graph to simulate the attacker's subsequent action path.

[0015] Preferably, the adversarial simulation module includes an attack path generator, which explores attack logic paths in the dynamic causal graph that are not covered by defense measures and have the lowest implementation cost during attack and defense simulation, in order to generate new threat hypotheses.

[0016] Preferably, when exploring logical paths, the attack path generator of the adversarial inference module quantitatively assesses the potential risks and defense costs of different attack paths based on the weights of causal edges and dependency edges and asset values ​​in the dynamic causal graph.

[0017] Preferably, the adversarial simulation module includes a defense strategy optimizer, which receives new threat hypotheses output by the attack path generator and outputs defense strategy adjustment suggestions for the new threat hypotheses.

[0018] Preferably, the method includes the following steps:

[0019] S1. The causal extraction module extracts attack causal elements in the form of triplets containing attack actions, preconditions, and consequences from multivariate security data.

[0020] S2. The knowledge fusion module performs conflict detection and resolution on the extracted attack causal elements to form fused knowledge.

[0021] S3, the intent reasoning module constructs and updates a dynamic causal graph by integrating knowledge, and uses the dynamic causal graph to trace the cause of input security alarms and infer tactical intent.

[0022] S4, the adversarial simulation module, uses dynamic causal graphs to simulate offense and defense, explores weak paths in defense to generate new threat hypotheses, and outputs corresponding suggestions for adjusting defense strategies.

[0023] Compared with the prior art, the beneficial effects of the present invention are:

[0024] 1. This invention, by incorporating an intent reasoning module, a dynamic causal graph, a causal tracing unit, and an intent deduction unit, achieves in-depth causal tracing of network security incidents and proactive deduction of attackers' subsequent tactical intentions and action paths. It solves the problem that traditional security analysis tools can only provide isolated alerts, failing to connect discrete attack steps into a logical attack chain, making it difficult to understand the full picture of an attack and predict future threats. This invention transforms security operations from passive to proactive. Through the dynamic causal graph, it constructs a contextual relationship network of attacks; the causal tracing unit can quickly locate the defense failure points that lead to alerts; and the intent deduction unit can simulate the attacker's perspective, deducing the most likely subsequent attack targets and paths, revealing risks in advance, and providing security teams with valuable early warning and intervention time windows, thus improving their ability to respond to complex and targeted attacks.

[0025] 2. This invention, by incorporating a causal extraction module, achieves standardized information extraction from diverse and heterogeneous network security data. This solves the problem of diverse sources, inconsistent formats, and severe information silos in raw security data, making accurate and in-depth causal tracing difficult. Through natural language processing technology and a log parsing engine, this invention can automatically and accurately extract attack causal elements in a unified format, consisting of attack actions, preconditions, and consequences, from massive amounts of heterogeneous raw data. This achieves automated accumulation of security knowledge, reduces the workload of security analysts manually organizing data, and provides high-quality and structured unified data input for subsequent knowledge fusion and reasoning.

[0026] 3. This invention, by incorporating a knowledge fusion module and a knowledge verifier, achieves conflict detection and intelligent resolution of attack knowledge from multiple sources, constructs a highly reliable unified security knowledge base, and solves the problem that directly using original knowledge leads to low credibility or even misleading results in the deduction of subsequent tactical intentions and action paths due to differences in the credibility of information sources, contradictory descriptions, or inconsistent terminology. It ensures the accuracy and authority of the knowledge base on which the system's intention reasoning relies, improves the credibility of subsequent causal tracing and intention deduction results, reduces false alarms and false negatives caused by knowledge errors, makes the system's analysis conclusions more valuable for decision-making, and enhances the overall robustness and reliability of the system.

[0027] 4. This invention, by incorporating an adversarial simulation module, an attack path generator, and a defense strategy optimizer, achieves proactive attack and defense simulation and iterative optimization of defense strategies, constructing an adaptive security closed loop. It addresses the problem that traditional defense systems are mostly statically configured and cannot dynamically optimize for deep causal tracing, subsequent tactical intentions, and action paths. The attack path generator, operating from an attacker's perspective, explores the attack path in the network security graph that is not covered by defenses and has the lowest cost, generating new threat hypotheses. The defense strategy optimizer evaluates and outputs specific defense strategy adjustment suggestions, transforming network security protection from static protection into a dynamically and continuously optimized adaptive and resilient defense system. This achieves closed-loop optimization and proactive hardening of defense strategies, improving security and reliability against new and unknown threats. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the overall workflow of the present invention;

[0029] Figure 2 This is a flowchart illustrating the data processing and knowledge construction process of this invention.

[0030] Figure 3 This is a flowchart of the active reasoning and defense process of the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Please see Figure 1 The present invention provides an embodiment of a data analysis system for network security, wherein the causal extraction module is used to extract attack causal elements from multi-dimensional security data, the causal extraction module is connected to a knowledge fusion module, the knowledge fusion module is used to fuse and verify the extracted attack causal elements to form fused knowledge, the intent reasoning module is connected to the knowledge fusion module, the intent reasoning module constructs a dynamic causal graph through fused knowledge, performs causal tracing and tactical intent deduction, the adversarial deduction module is connected to the intent reasoning module, the adversarial deduction module performs attack and defense simulation through the dynamic causal graph, and generates new threat hypotheses;

[0033] Furthermore, after the system starts running, the causal extraction module is activated. The causal extraction module connects to the data source interface, which includes the threat intelligence platform interface, the security information and event management system interface, the endpoint detection and response system interface, and the firewall log server interface. The causal extraction module obtains diverse security data from the data source interface in real time. The diverse security data includes unstructured threat intelligence reports, hacker forum texts, structured security device logs, and network traffic records.

[0034] The causal extraction module uses Natural Language Processing (NLP) technology to analyze unstructured text. NLP, a branch of artificial intelligence, enables computers to understand, interpret, and generate human language. In network security systems, it is used to identify and extract key information about structured attack actions, preconditions, and consequences from unstructured threat intelligence and security reports. Simultaneously, it processes structured logs through a log parsing engine, a dedicated software component within the causal extraction module that handles structured security device logs. Using built-in parsing templates or adapters, it converts standardized logs generated by firewalls (such as JSON and Syslog formats) into a unified data structure that the system can process. This structured data provides the structured data input for constructing attack causal elements. For each identified attack-related information, the causal extraction module formats the information into a standard triplet: "Attack Action - Precondition - Consequence," providing a unified data format foundation for subsequent fusion and analysis. For example, from a threat intelligence report, the attack action might be "Exploiting the CVE-2023-1234 vulnerability," and the precondition is "The target system is running Apache Tomcat." Versions 9.0.0 to 9.0.30 without patches resulted in "obtaining remote code execution privileges on the target system".

[0035] Then, the knowledge fusion module receives attack causal elements from the causal extraction module. The knowledge verifier inside the knowledge fusion module first standardizes the input triples to ensure the consistency of terminology. For example, it unifies the three different expressions "RCE", "remote code execution", and "remote code execution" into standard terms. Then, the knowledge verifier starts the conflict detection process, comparing the newly input causal elements with existing knowledge. When a conflict is detected, such as when different sources describe the exploitation conditions of the same vulnerability in a contradictory way, the knowledge verifier will resolve it according to preset rules. The preset rules include prioritizing data from authoritative threat intelligence vendors and prioritizing data with more recent timestamps. When a conflict cannot be resolved automatically, the conflict is marked and manually reviewed by a security analyst. The knowledge fusion module can transform the original security information from different channels, which contains noise and contradictions, into fused knowledge that has undergone consistency processing, improving the quality of knowledge on which subsequent reasoning depends and ensuring the reliability of the analysis conclusions of the entire system.

[0036] Then, the knowledge fusion module passes the fused knowledge to the intent reasoning module. The intent reasoning module first constructs and continuously updates a dynamic causal graph using the fused knowledge. The nodes of the dynamic causal graph represent various entities in the cybersecurity field, including assets (such as servers and workstations), vulnerabilities (such as CVE numbers), attack actions (such as phishing emails and credential theft), and security status (such as "port open" and "patches installed"). The edges of the dynamic causal graph are used to represent the relationships between entities, including causal edges representing causal relationships and dependency edges representing dependency relationships. For example, the causal edge "The existence of vulnerability CVE-2023-1234" (node ​​A) leads to "being exploitable to gain remote code execution privileges" (node ​​B), and the dependency edge "Exploiting the CVE-2023-1234 vulnerability" (attack action node C) depends on "the target system running a specific version of Apache". Tomcat (Prerequisite Node D): The intent reasoning module parses and maps each fused knowledge triple into nodes and edges in the graph, thereby realizing the dynamic growth and correction of the graph. When the system receives a new security alarm, such as "abnormal attack traffic against the web server is detected", the causal tracing unit inside the intent reasoning module is activated. The causal tracing unit starts from the security alarm and performs reverse reasoning along the "causal" edges in the dynamic causal graph to trace the cause of this phenomenon. For example, it may trace back to an unpatched known vulnerability on a certain server or a misconfigured access control policy. The causal tracing unit associates discrete alarm events with the underlying defense failure points, answering the question of why this attack occurred.

[0037] Then the intent deduction unit starts working. Taking the defense failure point located by the causal tracing unit as a new starting point, and combining the value attributes attached to each asset node in the dynamic causal graph, such as the database server having a higher importance level than the test server, the intent deduction unit will perform forward reasoning along the "dependency" and "causality" edges in the graph. The intent deduction unit will simulate the next action that a rational attacker might take after successfully exploiting the current vulnerability in order to achieve the final goal (such as stealing core data or disrupting critical services). For example, after compromising an edge web server, the attacker might use the server as a springboard to move laterally to the internal network database server. Through forward deduction, the system can predict the potential evolution path of the attack, realizing the leap from what has happened to what might happen, and providing a critical time window for proactive defense.

[0038] Finally, the adversarial simulation module is activated. It first uses the dynamic causal graph and predicted attack paths output by the intent reasoning module to create a virtual attack and defense simulation environment. The attack path generator within the adversarial simulation module first verifies the predicted paths, then actively explores other attack paths in the dynamic causal graph, especially those not yet covered by current defenses (such as firewall rules and intrusion detection rules) and with low implementation costs for attackers (such as the complexity of required tools and the difficulty of bypassing detection). These newly discovered paths are output as new threat hypotheses. The defense strategy optimizer then receives these new threat hypotheses, evaluates the effectiveness of existing defenses against these new paths in the simulation environment, and automatically generates defense strategy adjustment suggestions. For example, it might suggest adding a traffic monitoring rule to a critical network node or prioritizing the implementation of a specific security patch for a certain type of asset. These suggestions can be automatically or manually confirmed and then distributed to the corresponding security protection devices, thereby achieving dynamic hardening and optimization of the network defense system.

[0039] Please see Figure 1 , Figure 2 and Figure 3 The present invention provides an embodiment of a data analysis system for network security, wherein the multi-dimensional security data includes unstructured threat intelligence text and structured security device logs, and the attack causal elements extracted by the causal extraction module from the multi-dimensional security data include triple information of attack action, preconditions and consequences, which are used to provide original knowledge materials for the knowledge fusion module.

[0040] Furthermore, the causal extraction module includes an unstructured data preprocessing channel. This channel receives threat intelligence subscriptions, security incident analysis reports, and compliantly collected text from the dark web and hacker forums. The unstructured data preprocessing channel removes irrelevant HTML tags and advertising information before feeding the text into a natural language processing (NLP) model for extraction. The NLP model uses NLP technology to understand cybersecurity terminology and context, identifying entities (such as vulnerability numbers, malware names, and attack techniques) and relationships between entities. For example, when processing the sentence "The attacker exploited L...", the NLP model... When the Log4j2 vulnerability (CVE-2021-44228) is used to "execute arbitrary code on the target server", the natural language processing model will identify "exploitation" as the action, "Log4j2 vulnerability (CVE-2021-44228)" as the object to be exploited (a component of the attack action), and "execute arbitrary code on the target server" as the consequence. The natural language processing model will assemble the information into a structured triple: (Attack action: exploit CVE-2021-44228, Prerequisite: the target system uses the vulnerable Log4j2 component, Consequence: gain remote code execution privileges).

[0041] The causal extraction module is equipped with a structured data parsing channel, which directly connects to the log output interfaces of various security devices and systems, such as standardized logs from SIEM systems, NetFlow records from network firewalls, and detection logs from endpoint protection software. For different types of logs, the structured data parsing channel has built-in parsing templates or adapters. For example, for EVE-JSON format logs generated by the Suricata intrusion detection system, the parser extracts the signature, source IP, and attack category information from the alert event. Finally, the preliminary causal elements output from the two channels are converged to the standardization unit. The standardization unit is responsible for performing terminology standardization, such as unifying "cmd.exe execution" to "command line execution", normalizing timestamps, and performing deduplication based on content similarity to avoid the same attack information being entered repeatedly. The high-quality attack causal elements after standardization are sent to the knowledge fusion module, ensuring that the causal extraction module can efficiently and accurately extract security knowledge from heterogeneous data sources, laying a solid data foundation for the system's subsequent intelligent reasoning.

[0042] Please see Figure 1 , Figure 2 and Figure 3 The present invention provides an embodiment of a data analysis system for network security, wherein the knowledge fusion module includes a knowledge verifier, which is used to perform conflict detection on attack causal elements from the causal extraction module and resolve the attack causal elements through preset rules, thereby providing the intent reasoning module with fused knowledge that has undergone consistency processing.

[0043] Furthermore, when the attack causal element reaches the knowledge fusion module, the knowledge verifier extracts the attack causal element for processing. The knowledge verifier matches and links the entities in the attack causal element (such as vulnerability number and attack technique name) with the concepts in the ontology library. For example, it links "CVE-2021-44228" to "Log4Shell vulnerability" in the ontology library, ensuring that the system uses a unified language to describe security events.

[0044] Then, conflict detection is performed. Conflicts are divided into two categories: explicit conflicts and implicit conflicts. Explicit conflicts are direct factual contradictions between new attack causal elements and existing fused knowledge. For example, new attack causal element A describes "Patch KB5000001 fully defends against CVE-2023", while the existing causal element B in the knowledge base describes "The attacker bypasses the protection of patch KB5000001 through technique Y". Implicit conflicts are logical inconsistencies between new attack causal elements and existing knowledge. For example, new attack causal element C describes "Attack action Z requires user interaction to trigger", while the knowledge base already has an attack causal element D describing the same attack action, with the prerequisite "requires local administrator privileges", which is an implicit contradiction in the attack threshold.

[0045] For detected conflicts, the knowledge verifier employs a resolution strategy based on credibility weighting and contextual attribution. Each attack causality is assigned an initial credibility score, determined by the authority of the data source, the freshness of the data, and the confidence level of the model that extracted the attack causality. When a conflict occurs, the knowledge verifier collects all attack causality related to the conflict point, including both new and existing ones. It compares the total credibility weights of the attack causality, temporarily assigning higher credibility to the one with the higher weight. Then, the knowledge verifier analyzes the original context of the conflicting causality, such as item 5 from Report A, and attempts to find corroborating evidence from broader background information. For example, through source tracing, it was discovered that the causal element B describing "the patch can be bypassed" is contextually limited to the condition that the attacker needs to have local access rights, while the causal element A describing "the patch can defend against" refers to a remote exploitation scenario. The conflict is then transformed into a more refined description of the attack scenario. By adding precondition qualifiers, such as "in a remote attack scenario", the conflict is resolved and a more accurate new causal element is generated. For complex conflicts that cannot be resolved by automatic mechanisms, the knowledge verifier marks them as pending review and pushes them to the security analyst console for final adjudication by human experts. The adjudication results are used as feedback to optimize automatic resolution rules and models.

[0046] Through multi-layered conflict detection and intelligent resolution mechanisms, the knowledge fusion module can ensure that the output fused knowledge has a high degree of consistency and reliability, thereby improving the credibility of subsequent reasoning conclusions.

[0047] Please see Figure 1 , Figure 2 and Figure 3The present invention provides an embodiment of a data analysis system for network security, wherein the dynamic causal graph includes nodes and edges. The intent reasoning module injects triple information from fused knowledge into the dynamic causal graph to continuously update the nodes and edges. The causal tracing unit receives security alarms as input and performs reverse reasoning along the causal edges in the dynamic causal graph to locate the defense failure point that caused the security alarm. The intent deduction unit uses the defense failure point located by the causal tracing unit and the value attributes of assets in the dynamic causal graph as input and performs forward reasoning along the edges in the dynamic causal graph to simulate the attacker's subsequent action path.

[0048] Furthermore, the intent reasoning module includes a graph construction engine. For each triple of fused knowledge (attack action A, precondition P, consequence C), the graph construction engine performs the following operations: First, it checks if a node representing A, P, and C already exists in the dynamic causal graph. If not, it creates a new node and assigns it a type attribute (such as attack action, vulnerability, or permission status). Then, the graph construction engine creates a directed edge between node A and node C, with node A pointing to node C. The edge type is "cause," representing the causal relationship between the attack action and the result. Simultaneously, it creates a path between node A and node P... Directed edges, with the type of dependency edges, represent the conditions required for an attack to be carried out. For example, for a triple (attack action: delivering malicious documents via phishing emails, precondition: user clicks email attachment, consequence: implanting a backdoor program on the terminal), the dynamic causal graph will establish a causal edge from the node "delivering malicious documents via phishing emails" to the node "implanting a backdoor program", and then establish a dependency edge from the node "delivering malicious documents via phishing emails" to the node "user clicks attachment". Through continuous injection and fusion of knowledge, the dynamic causal graph describes the complex causal and dependency relationships between various attack techniques, vulnerabilities and asset states.

[0049] When a security alert is entered, such as "Suspicious lateral movement behavior detected on host 192.168.1.100", the causal tracing unit starts working. The causal tracing unit first maps the alert event to a temporary node in a dynamic causal graph or associates it with an existing node. Then, the causal tracing unit searches backward along the causal edges to find the preceding attack steps or system states that may have led to the current alert event. The causal tracing unit considers the weight of the edges, such as based on historical occurrence frequency or confidence levels set by experts, and prioritizes exploring high-weight paths. During the search process, the causal tracing unit temporarily stores the nodes and paths found. Finally, it integrates all the paths found in the reverse search to find the common and most fundamental system defects or security states, such as "The local firewall policy of host 192.168.1.100 is misconfigured" and "Multiple shared credentials exist on this host". These causes are defense failure points.

[0050] Then, the intent deduction unit is activated. Using the set of defense failure points found by the tracing unit as the basis for reasoning, the intent deduction unit performs a forward graph search, simulating the attacker's perspective. Starting from the defense failure point, it explores outward along dependency edges and causal edges to find paths that can achieve higher-value attack targets. During the exploration process, the intent deduction unit dynamically evaluates the attack benefits (such as the value of assets at the end of the path) and attack costs (such as the success rate, complexity, and detection risk of each step on the path) of each potential path. For example, starting from the defense failure point of "shared credential leakage", the intent deduction unit deduces that the attacker will next try to log in to the file server and database server using credentials. The intent deduction unit will output one or more attack evolution paths with the highest probability and identify key nodes on the path (such as the assets most likely to be attacked next), enabling security protection to shift from passive response to proactive deployment at key nodes, effectively interrupting the continuation of the attack chain.

[0051] Please see Figure 1 , Figure 2 and Figure 3 The present invention provides an embodiment of a data analysis system for network security. The adversarial simulation module includes an attack path generator. In attack and defense simulation, the attack path generator explores attack logic paths in a dynamic causal graph that are not covered by defense measures and have the lowest implementation cost, in order to generate new threat hypotheses. When exploring logic paths, the attack path generator quantifies the potential risks and defense costs of different attack paths. The adversarial simulation module includes a defense strategy optimizer. The defense strategy optimizer receives the new threat hypotheses output by the attack path generator and outputs suggestions for adjusting the defense strategy for the new threat hypotheses.

[0052] Furthermore, the attack path generator of the adversarial simulation module is activated. The attack path generator receives the predicted path given by the intent simulation unit and searches outward. The search goal of the attack path generator is to find a path that meets the following conditions: condition one is that it can reach high-value target assets from the initial attack point; condition two is that the attack steps on the path utilize blind spots of current defense measures (such as intrusion detection rules and access control lists); and condition three is that the overall attack chain is highly covert or the required tools and skills are relatively low-threshold. These discovered attack paths, which may not yet be observed in the real environment, are new threat hypotheses. For example, the attack path generator may discover that by taking advantage of low-risk configuration errors and unexpected service interactions, it is possible to bypass existing Web Application Firewall rules and directly access the backend database.

[0053] The attack path generator submits new threat hypotheses to the defense strategy optimizer. The defense strategy optimizer first simulates the deployment of defense measures in the simulation environment for each new threat hypothesis. For example, it may add new detection rules (Snort rules, YARA rules) at critical path nodes, modify access control policies, or hypothetically apply virtual patches to a certain asset. Then, the defense strategy optimizer will rerun the attack simulation to evaluate the effectiveness of the defense measures in blocking the attack path. The effectiveness is reflected in whether the defense measures can interrupt the attack chain at critical steps when the attack path is re-executed.

[0054] The final defense strategy optimizer outputs a structured defense strategy adjustment suggestion report. The suggestion report lists the identified new threat hypotheses and defense measures (such as adding rules on the firewall between network partitions A and B to detect abnormal SMB traffic). The suggestion report can be integrated into the security orchestration and automated response platform, supporting one-click or automatic implementation of some measures after approval (such as issuing firewall rules). It can also be pushed to the security operations center as a high-quality reference for human decision-making. When the new defense measures are deployed in the real network, the defense effect will be fed back to the cause-effect extraction module through security logs, thereby restarting the security system and forming an intelligent security adaptive closed loop of continuous perception, learning and optimization. This transforms network security defense from static protection against known threats to a resilient defense system that can proactively discover and fix unknown vulnerabilities.

[0055] Working principle: The system first uses the causal extraction module to automatically extract attack causal elements from diverse and heterogeneous security data, which are structured as attack actions, preconditions and consequences. Then, the knowledge fusion module performs conflict detection and resolution on the attack causal elements to form high-quality and consistent fused knowledge.

[0056] Then, the intent reasoning module constructs and updates a dynamic causal graph in real time based on fused knowledge. When a security alarm is received, the causal tracing unit reverses the location of the defense failure point, and the intent inference unit forward simulates the tactical path that the attacker may take.

[0057] Finally, the adversarial simulation module conducts attack and defense simulations, actively explores defense weaknesses and generates new threat hypotheses, and outputs targeted protection strategy suggestions through the defense strategy optimizer, enabling network security protection to shift from passive response to proactive prediction and adaptive reinforcement.

[0058] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of equivalents of the claims be included within the present invention.

Claims

1. A data analysis system applied to network security, comprising a cause and effect extraction module, a knowledge fusion module, an intention reasoning module and a countermeasure deduction module, characterized in that: The causal extraction module is used to extract attack causal elements from multi-source security data. The causal extraction module is connected to the knowledge fusion module, which is used to fuse and verify the extracted attack causal elements to form fused knowledge. The intent reasoning module is connected to the knowledge fusion module, which constructs a dynamic causal graph through fused knowledge and performs causal tracing and tactical intent deduction. The adversarial deduction module is connected to the intent reasoning module, which performs attack and defense simulation through the dynamic causal graph and generates new threat hypotheses. The intent reasoning module includes a dynamic causal graph, a causal tracing unit, and an intent deduction unit. The causal tracing unit performs historical backtracking of attacks based on the dynamic causal graph, and the intent deduction unit performs future deduction of attacks based on the dynamic causal graph.

2. The data analysis system for network security according to claim 1, characterized in that: The multi-source security data includes unstructured threat intelligence text and structured security device logs. The attack causal elements extracted by the causal extraction module from the multi-source security data contain triple information of attack action, preconditions and consequences, which are used to provide raw knowledge materials for the knowledge fusion module.

3. A data analysis system for network security according to claim 2, characterized in that: The knowledge fusion module includes a knowledge verifier, which is used to detect conflicts in attack causal elements from the causal extraction module and resolve the attack causal elements through preset rules, thereby providing the intent reasoning module with fused knowledge that has undergone consistency processing.

4. A data analysis system for network security according to claim 1, characterized in that: The dynamic causal graph includes nodes and edges. The nodes of the dynamic causal graph contain assets, vulnerabilities, and attack actions. The edges of the dynamic causal graph include causal edges and dependency edges. The intent reasoning module injects triple information from the fused knowledge into the dynamic causal graph to continuously update the nodes and edges.

5. A data analysis system for network security according to claim 4, characterized in that: The causal tracing unit receives security alarms as input, performs reverse reasoning along the causal edges in the dynamic causal graph, and locates the defense failure point that caused the security alarm.

6. A data analysis system for network security according to claim 5, characterized in that: The intent deduction unit takes the defense failure point located by the causal tracing unit and the value attributes of assets in the dynamic causal graph as input, and performs forward reasoning along the edges in the dynamic causal graph to simulate the attacker's subsequent action path.

7. A data analysis system for network security according to claim 1, characterized in that: The adversarial simulation module includes an attack path generator. In the attack and defense simulation, the attack path generator explores the attack logic path that is not covered by the defense measures and has the lowest implementation cost in the dynamic causal graph, and is used to generate new threat hypotheses.

8. A data analysis system for network security according to claim 7, characterized in that: When exploring logical paths, the attack path generator of the adversarial simulation module quantitatively assesses the potential risks and defense costs of different attack paths based on the weights of causal edges and dependency edges and asset values ​​in the dynamic causal graph.

9. A data analysis system for network security according to claim 8, characterized in that: The adversarial simulation module includes a defense strategy optimizer, which receives new threat hypotheses from the attack path generator and outputs defense strategy adjustment suggestions based on the new threat hypotheses.

10. A method for a data analysis system applied to network security, applicable to the data analysis system for network security as described in any one of claims 1-9, characterized in that: The method includes the following steps: S1. The causal extraction module extracts attack causal elements in the form of triplets containing attack actions, preconditions, and consequences from multivariate security data. S2. The knowledge fusion module performs conflict detection and resolution on the extracted attack causal elements to form fused knowledge. S3, the intent reasoning module constructs and updates a dynamic causal graph by integrating knowledge, and uses the dynamic causal graph to trace the cause of input security alarms and infer tactical intent. S4, the adversarial simulation module, uses dynamic causal graphs to simulate offense and defense, explores weak paths in defense to generate new threat hypotheses, and outputs corresponding suggestions for adjusting defense strategies.

Images