Dynamic volatility coefficient aco and gnn fusion-path search method
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING ZHONGKE YUNJI TECHNOLOGY CO LTD
- Filing Date
- 2026-05-18
- Publication Date
- 2026-08-07
AI Technical Summary
[0003]现有脆弱性发现与路径搜索技术普遍存在明显局限：现有技术大多依赖单点漏洞扫描工具，仅能输出独立漏洞列表，无法建立资产、服务、漏洞、攻击技术之间的关联关系，难以挖掘跨资产、跨网段的漏洞利用链，导致威胁分析片面、渗透路径缺失，无法满足实战化测试需求
[0030]1、本发明通过动态挥发系数ACO与GNN融合搜索，可发现92%以上跨资产关联漏洞链，将局部最优率降至2.5%以下，漏洞链发现效率提升41.5%，显著提升脆弱性发现的全面性与精准度。
Smart Images
Figure CN122533818A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, specifically to a path search method that integrates dynamic volatile coefficient (ACO) and GNN. Background Technology
[0002] With the increasing demands for attack and defense drills, penetration testing, graded protection assessments, and realistic defense, network vulnerability analysis has shifted from single-point vulnerability detection to the discovery of interconnected vulnerability chains and the planning of optimal attack paths. In real network environments, a single vulnerability often fails to pose an effective threat, while exploitable chains formed by combinations of multiple devices, services, and vulnerabilities have become the core focus of threat intrusion and security hardening.
[0003] Existing vulnerability discovery and path finding technologies generally have significant limitations: most existing technologies rely on single-point vulnerability scanning tools, which can only output independent vulnerability lists and cannot establish the correlation between assets, services, vulnerabilities, and attack techniques. They are difficult to uncover vulnerability exploitation chains across assets and network segments, resulting in one-sided threat analysis, missing penetration paths, and failure to meet the needs of practical testing.
[0004] Existing vulnerability path analysis methods based on knowledge graphs and the ATT&CK framework can perform path deduction to a certain extent, but they generally adopt unidirectional deduction logic. They can only deduce from the vulnerability to the attack or only deduce from the target to the vulnerability. They have not formed a fusion mechanism of "forward analysis + backward analysis + multi-target optimization". Path selection lacks quantitative basis, and the output solution has low feasibility and poor practicality.
[0005] In terms of path search algorithms, the traditional Ant Colony Algorithm (ACO) is used for path optimization, but it is prone to premature convergence and getting trapped in local optima in large-scale node networks, resulting in low path search accuracy and a low rate of effective vulnerability chain discovery. At the same time, the algorithm is not combined with Graph Neural Networks (GNN) for associated feature mining, and the heuristic information depends on manual setting, resulting in insufficient search guidance.
[0006] In addition, existing risk assessment methods are too simplistic, mostly relying on CVSS basic scores without comprehensively considering multiple dimensions such as business impact, difficulty of exploitation, detection and avoidance capabilities, and repair costs. They also fail to dynamically adjust weights according to different scenarios such as industrial control, core business, and office networks, resulting in a serious disconnect between risk values and actual business scenarios and low decision-making reference value.
[0007] Meanwhile, existing systems generally lack adaptive iteration and incremental update capabilities, requiring full recalculation when assets change, vulnerabilities are patched, or topology changes occur. This results in complex engineering deployments, poor adaptability to large-scale networks, and low operating efficiency.
[0008] In summary, current vulnerability discovery and path search technologies cannot simultaneously achieve comprehensiveness, accuracy, practicality, and engineering feasibility, making it difficult to meet the urgent needs for efficient search, accurate decision-making, and practical utilization of associated vulnerability chains in scenarios such as enterprise intranets and industrial control systems. To address this, we propose a path search method that integrates dynamic volatility coefficient (ACO) and GNN. Summary of the Invention
[0009] In order to overcome the shortcomings of the prior art, at least one technical problem raised in the background art is solved.
[0010] This invention addresses the aforementioned technical problems by employing the following technical solution: It provides a method for fusing dynamic volatility coefficient (ACO) with Generative Neural Network (GNN) and path search, applied in the field of network security technology, including the following steps: Asset Awareness.
[0011] By integrating asset scanning tools with CMDB and ITSM systems, the system collects IP addresses, ports, service versions, asset fingerprints, and business ownership information for all assets on the target network. An asset topology association model is constructed, business dependencies are identified, and data is entered into a knowledge graph, providing complete asset context for vulnerability chain analysis. Vulnerability association is integrated with GNN-ACO for path search.
[0012] A four-dimensional knowledge graph of "vulnerability-asset-attack-business" is constructed, and vulnerabilities, assets, attack techniques, and businesses are modeled as nodes and related edges; a GNN graph neural network is used to encode the features of the knowledge graph nodes and output the node association weight matrix W, which is used to correct the ACO heuristic function; an optimized ACO algorithm is used to search for vulnerability chain paths.
[0013] ACO optimization includes:
[0014] Dynamic volatility coefficient: It adapts and adjusts adaptively with each iteration stage;
[0015] Ant swarming strategy: 30% exploratory ants and 70% convergent ants, using different α and β parameters;
[0016] Path pruning mechanism: For paths with a success rate of <75%, pheromone decays, and three consecutive non-optimal paths are directly pruned.
[0017] Local and global pheromone updates are combined to maintain dynamic pheromone balance and avoid local optima.
[0018] After iteration, the optimal associated vulnerability chain is output, and incremental updates and master-slave distributed parallel computing are supported, adapting to large-scale network scenarios. Threat modeling and NSGA-II bidirectional optimization are also implemented.
[0019] Employing forward parsing + backward parsing + NSGA-II third-order fusion logic:
[0020] Backward analysis: Deducing the set of attack paths that can be formed from vulnerabilities. ;
[0021] Forward analysis: Deducing the required set of vulnerabilities from the attack target. ;
[0022] NSGA-II Multi-Objective Optimization: With the goals of maximizing success rate, minimizing steps, and reducing risk, it performs fast non-dominated sorting, crowding calculation, and elite retention to output the Pareto optimal vulnerability chain combination.
[0023] Vulnerability Exploitation Constraints and Requirements Correlation Modeling
[0024] The preconditions for vulnerability exploitation are formalized into logical constraint expressions, and fuzzy constraints are introduced to handle uncertain scenarios. A constraint solver is used to match vulnerability combinations that meet the requirements of attack sub-targets, verifying the feasibility of vulnerability chains and improving the implementability of exploitation schemes. Decision-making and multi-dimensional risk scoring are also utilized.
[0025] Constructing a weighted risk scoring model:
[0026]
[0027] All dimensions are uniformly normalized to a score of 0–10, and remediation costs are calculated using linear normalization. Optimal exploitation schemes, attack heatmaps, and vulnerability dependency graphs are output in order of risk ranking. Effect feedback and adaptive iteration are implemented.
[0028] The results of vulnerability exploitation are fed back into the system to dynamically optimize ACO parameters (α, β, ρ(t)) and NSGA-II weights, and to update the knowledge graph associations in sync, forming a closed-loop iteration to continuously improve the accuracy of identification and decision-making.
[0029] Compared with existing technologies, this invention provides a path search method that integrates dynamic volatility coefficient (ACO) and GNN, which has the following advantages:
[0030] 1. This invention uses dynamic volatility coefficient ACO and GNN fusion search to discover more than 92% of cross-asset related vulnerability chains, reducing the local optimum rate to below 2.5%, improving vulnerability chain discovery efficiency by 41.5%, and significantly improving the comprehensiveness and accuracy of vulnerability discovery.
[0031] 2. This invention adopts a forward + backward + NSGA-II three-order fusion logic, which increases the success rate of the solution to 89%. Combined with multi-dimensional risk scoring, it reduces the risk judgment deviation rate to 11%, which greatly improves the accuracy and practicality of threat analysis and risk decision-making.
[0032] 3. This invention improves the efficiency of knowledge graph updates by more than 70% and the efficiency of large-scale network processing by more than 60% through incremental updates and distributed parallel computing. At the same time, it has adaptive iterative optimization capabilities, which can continuously improve the recognition and utilization effect, and significantly enhance the engineering implementation and expansion capabilities. Attached Figure Description
[0033] Figure 1 The flowchart of the vulnerability discovery and utilization method based on knowledge graph and ACO for the dynamic volatility coefficient ACO and GNN fusion-path search method provided by the present invention;
[0034] Figure 2 A schematic diagram of the "vulnerability-asset-attack-business" four-dimensional knowledge graph structure of the dynamic volatility coefficient ACO and GNN fusion-path search method provided by the present invention;
[0035] Figure 3 The optimized ACO algorithm path search logic diagram for the dynamic volatility coefficient ACO and GNN fusion-path search method provided by this invention;
[0036] Figure 4 The present invention provides a two-way threat analysis and NSGA-II fusion optimization logic block diagram for the dynamic volatility coefficient ACO and GNN fusion-path search method. Detailed Implementation
[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0038] Please see Figures 1-4 As shown, this embodiment discloses a method for fusing dynamic volatility coefficient (ACO) and GNN with path search, applied in the field of network security technology, including the following steps: Asset awareness.
[0039] By integrating asset scanning tools with CMDB and ITSM systems, the system collects IP addresses, ports, service versions, asset fingerprints, and business ownership information for all assets on the target network. An asset topology association model is constructed to clarify the business dependencies between assets, forming a topology structure of "OA front-end server → OA back-end server → MySQL database," providing foundational data support for subsequent vulnerability association. Vulnerability association is then integrated with GNN-ACO for search.
[0040] Construct a four-dimensional knowledge graph of "vulnerability-asset-attack-business", inputting vulnerability information, attack techniques, and business relationships; use GNN to encode the features of knowledge graph nodes, outputting the node association weight matrix W; start the optimized ACO algorithm and set the parameters: The initial value of ρ(t) is 0.25, and the total number of ants is m=50. The ants are divided into 30% exploratory and 70% convergent types. An iterative search is performed using a dynamic evaporation coefficient and path pruning mechanism. After 32 iterations, the optimal associated vulnerability chain is output: CVE-2020-1938 → Code execution → CVE-2016-6662 → Privilege escalation → Stealing core official document data. Threat modeling and NSGA-II bidirectional optimization are employed.
[0041] Backward analysis derives a set of attack paths from vulnerabilities. Forward analysis deduces the vulnerability requirement set from the attack target. The NSGA-II algorithm was employed, with the goal of maximizing success rate, minimizing steps, and reducing risk. Non-dominated sorting and congestion calculations were used to select the optimal vulnerability chain, achieving a 92% success rate, 4 attack steps, and a risk score of 8.9. Vulnerability exploitation constraints and requirements were matched.
[0042] The conditions are formalized into logical constraint expressions, and fuzzy constraints are introduced to handle uncertain scenarios. Verification using the Z3Solver constraint solver confirms that the vulnerability chain meets all sub-objective requirements, including version matching, network reachability, and privilege availability. Decision and risk scoring are then utilized.
[0043] Substitute into the multi-dimensional risk scoring formula:
[0044] With weights w1 to w5 set to 0.3, 0.3, 0.2, 0.1, and 0.1 respectively, a risk score of 8.9 is calculated. An attack heatmap and vulnerability dependency graph are output, providing the optimal exploitation execution plan. In this embodiment, for a large-scale enterprise intranet scenario with 1000 assets, 5000 vulnerabilities, and 6000 knowledge graph nodes, it can quickly discover high-value cross-asset vulnerability chains. Compared to the traditional ACO algorithm, the local optimum rate is reduced from 10% to 2.2%, vulnerability chain discovery efficiency is improved by 45%, and the risk assessment deviation rate is only 9%, demonstrating high precision, high efficiency, and high practicality.
[0045] In this embodiment, the entire process of asset awareness, vulnerability association, threat modeling, exploitation decision-making, and effect feedback is executed automatically without human intervention. It can be directly integrated into penetration testing platforms and security assessment systems, and is suitable for complex scenarios such as enterprise intranets and industrial control systems.
[0046] In this embodiment, through four-dimensional knowledge graph, GNN feature enhancement, dynamic ACO search, NSGA-II multi-objective optimization and multi-dimensional risk scoring, accurate vulnerability chain mining and optimal path decision-making without intranet access are achieved. It does not rely on active scanning and has strong concealment and high stability.
[0047] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0048] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A method for fusing dynamic volatility coefficient (ACO) with GNN and path search, characterized in that, Applied to the field of cybersecurity technology, it includes the following six steps: asset awareness, vulnerability association, threat modeling, vulnerability exploitation constraint and demand association modeling, exploitation decision, effect feedback and iteration; by constructing a four-dimensional knowledge graph of "vulnerability-asset-attack-business", the dynamic evaporation coefficient ACO and GNN are integrated for path search, and combined with bidirectional threat analysis and NSGA-II multi-objective optimization, the accurate search of associated vulnerability chains and the optimal exploitation decision are achieved.
2. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 1, characterized in that, In the asset awareness step: the IP, port, service version, asset fingerprint and business ownership information of all assets in the target network are collected by connecting to the CMDB and ITSM system through asset scanning tools; an asset topology association model is constructed, the business dependencies between assets are sorted out and entered into the knowledge graph, and asset and business context support is provided for vulnerability chain search.
3. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 1, characterized in that, In the vulnerability association step: a four-dimensional knowledge graph of "vulnerability-asset-attack-business" is constructed; GNN is used to encode the features of the knowledge graph nodes and output the node association weight matrix W; the weight matrix is substituted into the ACO state transition probability formula to correct the heuristic function, thereby realizing the fusion of GNN feature mining and ACO path search.
4. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 3, characterized in that, The ACO employs a dynamic volatility coefficient update mechanism: the volatility coefficient calculation formula is as follows: ; in , k=0.8, T=100; the iteration is divided into three phases for adaptive adjustment, and the dynamic balance of pheromones is achieved in conjunction with the local and global pheromone update formulas.
5. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 3, characterized in that, The ACO employs an ant diversity strategy: Ants were divided into exploratory (30%) and convergent (70%) types; exploratory ants had parameters α=0.6 and β=1.8; convergent ants had parameters α=1.2 and β=1.8; the two types of ants worked together to balance the diversity of path search and the global convergence speed.
6. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 3, characterized in that, The ACO employs a path pruning mechanism: Pheromones are decayed for locally optimal paths with a success rate of less than 75%; paths that fail to become globally optimal after three consecutive iterations are pruned directly; this reduces the risk of local optima and improves the accuracy and availability of vulnerability chain search.
7. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 1, characterized in that, The threat modeling step employs third-order fusion logic: Backward analysis derives a set of attack paths from vulnerabilities. Forward analysis derives the vulnerability requirement set from the attack target. The NSGA-II algorithm is used to select the optimal non-dominated vulnerability chain with the goal of maximizing success rate, minimizing steps, and reducing risk.
8. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 1, characterized in that, In the vulnerability exploitation constraint and requirement correlation modeling step: The preconditions for exploiting vulnerabilities are formalized into logical constraint expressions, and fuzzy constraints are introduced to handle uncertain scenarios. By using a constraint solver to match vulnerability combinations that meet the requirements of attack sub-targets, the feasibility of exploitation schemes is improved.
9. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 1, characterized in that, The method of constructing a multi-dimensional risk scoring model using decision steps: The risk calculation formula is: ； Each dimension was normalized to a score of 0-10, and the repair cost was converted into a score using linear normalization.
10. The dynamic volatility coefficient ACO and GNN fusion-path search method according to claim 1, characterized in that, In the effect feedback and iteration steps: The actual exploit results are fed back into the vulnerability association module and threat modeling module; the ACO algorithm parameters and NSGA-II objective function weights are dynamically optimized, the knowledge graph associations are updated, and the framework achieves adaptive iteration, continuously improving the recognition accuracy.