Network intrusion adaptive response method, system and device based on causal constraints

Abstract

The application discloses a network intrusion self-adaptive response method, system and device based on causal constraints, and belongs to the technical field of network security. The method comprises the following steps: constructing a multi-source heterogeneous fusion feature space, constructing a response causal graph according to the feature space, and executing two time scale decisions respectively. A macroscopic response mode and causal safety constraints are output by the first time scale decision, and a microscopic candidate action is generated by the second time scale decision in combination with the above content. A composite reward function is constructed, causal intervention is carried out on the microscopic candidate action based on the response causal graph, and the risk utility difference value is calculated. The uncertainty upper bound of the difference value is estimated to obtain a safety confidence judgment value. Whether the microscopic candidate action meets the safety execution requirement is judged in combination with the difference value and the judgment value: if yes, the microscopic candidate action is executed, otherwise, a minimum damage replacement action is generated. The above scheme improves the stability and interpretability of the intrusion prevention strategy in a complex network environment.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically discloses a network intrusion adaptive response method, system and device based on causal constraints. Background Technology

[0002] As cyberattacks evolve towards multi-stage penetration, lateral movement, and low-frequency concealment, traditional intrusion response systems based on signature rules and static blocking strategies can only provide point-based responses to individual alert events. They cannot provide structured responses by considering attack propagation paths, business function dependencies, and the attacker's long-term goals. Faced with scenarios such as zero-day exploits and targeted persistent attacks, traditional systems typically only passively block attacks after they occur, failing to proactively mitigate the long-term risk of critical assets being compromised.

[0003] Existing deep reinforcement learning-based intrusion response methods can automatically select response actions based on state feedback. However, their decision-making process relies on the statistical correlation between states and actions, making them susceptible to training environment bias, reward sparsity, unobservable business side effects, and adversarial sample transfer. In real-world business networks, response actions themselves alter the business call chain, service exposure surface, and attack propagation topology. Decision-making based solely on correlation characteristics can easily misjudge "attack reduction" as the direct effect of the action, ignoring the influence of latent variables such as traffic migration, business degradation, or attacker lurking, leading to false isolation, excessive blocking, or policy oscillation.

[0004] Furthermore, existing reinforcement learning schemes lack causal verification and uncertainty constraints on response actions. Attackers can induce defenders to perform actions with high side effects by creating decoy traffic and disguising attack paths. In scenarios with insufficient training samples and rapidly changing network topology, the aggressiveness of the strategy cannot be adaptively adjusted, making it difficult to balance security and business continuity. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a network intrusion adaptive response method, system, and device based on causal constraints. By constructing a response causal graph, performing causal intervention reasoning, and introducing a confidence constraint risk envelope, causal verification and security constraints are completed before the reinforcement learning strategy is executed. This reduces erroneous responses caused by false correlations and environmental drift, achieving an adaptive intrusion response with low business impact and high interpretability.

[0006] To achieve the above-mentioned objectives, this application adopts the following technical solution:

[0007] Firstly, this application provides a network intrusion adaptive response method based on causal constraints, the method comprising: Collect network operation data and security incident data to construct a feature space for multi-source heterogeneous data fusion; A response causal graph is constructed based on the feature space, and a first time-scale decision and a second time-scale decision are executed based on the feature space; wherein, the first time-scale decision generates a macroscopic response pattern and causal security constraints, and the second time-scale decision generates microscopic candidate actions based on the macroscopic response pattern and the causal security constraints. Construct a composite reward function, perform causal intervention on the micro-candidate actions based on the response causal graph, and obtain the risk-utility difference of the micro-candidate actions; Estimate the upper bound of the uncertainty of the risk utility difference, and calculate the safety confidence value based on the upper bound of the uncertainty; Based on the risk utility difference and the safety confidence judgment value, it is determined whether the micro-candidate action meets the predefined safety execution conditions; if the predefined safety execution conditions are met, the micro-candidate action is executed; if not, a minimum damage alternative action that meets the predefined safety execution conditions is generated.

[0008] Optionally, the feature space of the multi-source heterogeneous data fusion includes dynamic intrusion causal graph features, asset functional coupling degree features, and response causal evidence features.

[0009] Optionally, constructing the dynamic intrusion cause-effect graph features includes: Each host node in the network is set as a vertex of the graph, and the detected attack events are set as directed edges between vertices; The weights of the directed edges are calculated based on the confidence level of the attack event and the time decay factor, and the directed graph structure at the current moment is generated. Based on the directed graph structure, the risk entropy of each host node is calculated according to the conditional probability of its neighboring nodes successfully intruding into that node, thus obtaining the dynamic intrusion causal graph features.

[0010] Optionally, constructing the asset functional coupling degree feature includes: Based on the call dependencies of business services in the network, calculate the functional coupling degree between any two host nodes and generate a functional coupling degree matrix. Based on the aforementioned functional coupling matrix, the distribution of business function call paths is statistically analyzed, and the functional path betweenness of each host node is calculated. Based on the functional path median, the irreplaceability of each host node in the overall business logic is quantified to obtain the asset functional coupling degree characteristics.

[0011] Optionally, constructing the causal evidence features of the response includes: The observable state variables, potential disturbance variables, long-term risk outcome variables, and business damage outcome variables are identified and used to form the variable set of the response causal diagram. For each type of preset response action, a corresponding action attribute vector is generated; the action attribute vector includes the scope of application, rollback level, and rollback statistics of similar historical actions; The action attribute vector is used as a causal intervention variable and connected to the response causal graph. The structure of the response causal graph is constructed by combining the variable set, and the response causal evidence features are obtained.

[0012] Optionally, the step of performing a first time-scale decision based on the feature space includes: Based on the feature space, global structural statistical features, global risk confidence intervals, distribution of vulnerable nodes in the critical business call chain, and distribution of historical rollback high-frequency periods are extracted as input state quantities for the first time scale decision. Decision calculations are performed based on the input state quantities according to a first preset period; Based on the results of the decision calculation, the macroeconomic response model is generated, and the causal security constraints are generated based on the global risk confidence interval; wherein, the causal security constraints include: counterfactual benefit constraints and confidence level constraints; Based on the macroscopic response pattern and the causal security constraints, adjust the available action space and reward function weights for the second timescale decision.

[0013] Optionally, performing the second time-scale decision based on the feature space includes: Read the local risk entropy change rate of a single host, real-time network and host operation indicators, local risk and return estimates, decision uncertainty measures, and minimum rollback set as input state quantities for decision-making on the second time scale. Decision calculations are performed according to a second preset period, the duration of which is less than the duration of the first preset period; By combining the macroscopic response pattern and the causal safety constraint, the candidate actions output by the decision calculation are verified, and candidate actions that do not meet the causal safety constraint are filtered out to obtain the microscopic candidate actions.

[0014] Optionally, estimating the upper bound of the uncertainty of the risk utility difference and calculating the safety confidence value based on the upper bound of the uncertainty includes: By combining historical sample distribution and environmental drift, the upper bound of the uncertainty of the risk-utility difference of the micro-candidate actions is estimated. The safety confidence judgment value is obtained by subtracting the weighted value of the uncertainty upper bound from the risk utility difference of the micro-candidate action; the safety confidence judgment value is compared with the preset safety threshold to determine whether the micro-candidate action meets the predefined safety execution conditions.

[0015] Secondly, this application provides a network intrusion adaptive response system based on causal constraints, comprising: The feature space construction module is used to collect network operation data and security event data to construct a feature space for the fusion of multi-source heterogeneous data. The decision execution module is used to construct a response causal graph based on the feature space, and to execute a first time-scale decision and a second time-scale decision based on the feature space; wherein, the first time-scale decision generates a macroscopic response pattern and causal security constraints, and the second time-scale decision generates microscopic candidate actions based on the macroscopic response pattern and the causal security constraints; The causal intervention module is used to construct a composite reward function, perform causal intervention on the micro-candidate actions based on the response causal graph, and obtain the risk-utility difference of the micro-candidate actions; An evaluation calculation module is used to estimate the upper bound of the uncertainty of the risk utility difference and calculate the safety confidence judgment value based on the upper bound of the uncertainty. The determination module is used to determine whether the micro-candidate action meets the predefined safe execution conditions based on the risk utility difference and the safety confidence judgment value; if the predefined safe execution conditions are met, the micro-candidate action is executed; if not, a minimum damage alternative action that meets the predefined safe execution conditions is generated.

[0016] Thirdly, this application provides an electronic device, the electronic device comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method described in any one of the first aspects.

[0017] Compared with the closest prior art, the beneficial effects of this application are: This invention proposes a network intrusion adaptive response method, system, and device based on causal constraints. By constructing a multi-source heterogeneous feature space that integrates dynamic intrusion causal graph features, asset functional coupling features, and response causal evidence features, it comprehensively characterizes intrusion response scenarios from three dimensions: attack propagation topology, business dependencies, and response mechanisms. This breaks through the limitations of traditional solutions that rely solely on single-point alarm features for decision-making and can adapt to complex attack scenarios such as multi-stage targeted attacks and cross-node lateral movement.

[0018] This invention adopts a dual-timescale hierarchical decision-making architecture. The first timescale outputs macroscopic response patterns and causal security constraints, while the second timescale generates microscopic execution actions. This ensures the stability of the global defense strategy and avoids strategy oscillations, while also taking into account the real-time nature of local responses, thus achieving a balance between strategic stability and tactical flexibility.

[0019] This invention introduces a causal intervention mechanism and a composite reward function. By reasoning the difference in the true risk utility of response actions through the do operator, it removes the false correlations caused by hidden variables such as business traffic fluctuations and attacker infiltration, avoids misjudging the migration of attack traffic as effective defense, and significantly improves the interpretability and accuracy of response decisions.

[0020] This invention constructs a security confidence constraint mechanism based on an upper bound of uncertainty, and dynamically adjusts the conservatism of decisions in conjunction with the degree of environmental drift. In scenarios with insufficient training samples and rapid changes in network topology, it automatically reduces the aggressiveness of the strategy. At the same time, it designs a minimum damage alternative action search mechanism, which automatically selects the alternative with the best business cost when a high-risk action cannot pass the security check, effectively balancing network security and business continuity.

[0021] This invention sets up a strategy feedback and iterative correction mechanism. By monitoring the status after the response, it automatically identifies erroneous response actions, stores them in a counterexample sample library to correct the response cause-effect graph parameters and decision model, and realizes closed-loop iterative optimization of the defense strategy, which can continuously adapt to the evolution of network environment and attack methods. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0023] Figure 1 This is a flowchart of a network intrusion adaptive response method based on causal constraints provided in this application; Figure 2 This is a schematic diagram of a network intrusion adaptive response system structure based on causal constraints provided in this application; Figure 3 This is a diagram of the internal structure of the electronic device provided in this application. Detailed Implementation

[0024] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be construed as limiting the scope of protection of this application.

[0025] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0026] This application provides a network intrusion adaptive response method, system, and device based on causal constraints. Embodiments of this application are described below with reference to the accompanying drawings.

[0027] Example 1: As Figure 1 As shown, Embodiment 1 of this application provides a network intrusion adaptive response method based on causal constraints. This method specifically includes the following steps: S101 collects network operation data and security event data to construct a feature space for multi-source heterogeneous data fusion. S102 constructs a response causal graph based on the feature space, and performs a first time-scale decision and a second time-scale decision based on the feature space; wherein, the first time-scale decision generates a macroscopic response pattern and causal security constraints, and the second time-scale decision generates microscopic candidate actions based on the macroscopic response pattern and the causal security constraints. S103 constructs a composite reward function, performs causal intervention on the micro-candidate actions based on the response causal graph, and obtains the risk-utility difference of the micro-candidate actions; S104 Estimates the upper bound of the uncertainty of the risk utility difference and calculates the safety confidence judgment value based on the upper bound of the uncertainty; S105 determines whether the micro-candidate action meets the predefined safe execution conditions based on the risk utility difference and the safety confidence judgment value; if the predefined safe execution conditions are met, the micro-candidate action is executed; if not, a minimum damage alternative action that meets the predefined safe execution conditions is generated.

[0028] The term "minimum damage" refers to the minimum damage achieved after a comprehensive balance between causal net benefit and rollback cost, provided that the predefined safe execution conditions are met.

[0029] The feature space of the multi-source heterogeneous data fusion described in step S101 above includes dynamic intrusion causal graph features, asset functional coupling degree features, and response causal evidence features.

[0030] In one embodiment, step S101 above, which constructs the dynamic intrusion cause-effect graph features, includes: Each host node in the network is set as a vertex of the graph, and the detected attack events are set as directed edges between vertices; The weights of the directed edges are calculated based on the confidence level and time decay factor of the attack event, generating the directed graph structure at the current moment, as shown in the following formula: ;in For the set of vertices, Let be the set of directed edges at time t; Based on the directed graph structure, the risk entropy of each host node is calculated according to the conditional probability of its neighboring nodes successfully intruding into that node, thus obtaining the dynamic intrusion causal graph features. These dynamic intrusion causal graph features are used to characterize the attack propagation topology and are independently constructed with the response causal graph used for subsequent causal intervention reasoning.

[0031] In one embodiment, the weight of the directed edge The calculation formula is:

[0032] in, Let be the confidence level of the attack event detected at time t from node j to node i, with a value range of [0,1]. The time when the attack occurred; This is the time decay coefficient, used to characterize the rate at which the threat of an attack decays over time; This is a normalization coefficient used to map edge weights to the [0,1] interval. Time decay coefficient. Normalization coefficient The system can be pre-set with fixed parameters, which can be flexibly configured according to network size and security protection level. The larger the value, the faster the threat of the attack event decays.

[0033] Conditional probability of successful intrusion at node i Positively correlated with the corresponding edge weights, obtained by normalizing all incoming edge weights: = ; in, Let k be the edge weight from neighbor node k to node i; Specifically, the risk entropy of node i The calculation formula is:

[0034] in, Let i be the set of neighboring nodes. This represents the conditional probability that node i can successfully invade its neighbor node j at time t. The higher the risk entropy, the higher the risk of the node being targeted by a multi-source coordinated attack.

[0035] In one embodiment, step S101 above, which constructs the asset functional coupling degree feature, includes: Based on the call dependencies of business services in the network, calculate the functional coupling degree between any two host nodes and generate a functional coupling degree matrix. Based on the aforementioned functional coupling matrix, the distribution of business function call paths is statistically analyzed, and the functional path betweenness of each host node is calculated. Based on the functional path median, the irreplaceability of each host node in the overall business logic is quantified to obtain the asset functional coupling degree characteristics.

[0036] In one embodiment, the functional path betweenness of node v The calculation formula is:

[0037] in, This represents the number of function call paths from u to w that pass through node v. This represents the total number of function call paths from node u to node w. The functional coupling degree between nodes u and w; functional coupling degree The coupling degree is calculated based on the frequency of business calls and the service dependency level between the two hosts. The more frequent the calls and the higher the dependency level, the greater the coupling degree.

[0038] In one embodiment, step S101 above, which constructs the causal evidence features of the response, includes: The observable state variables, potential disturbance variables, long-term risk outcome variables, and business damage outcome variables are identified and used to form the variable set of the response causal diagram. For each type of preset response action, a corresponding action attribute vector is generated; the action attribute vector includes the scope of application, rollback level, and rollback statistics of similar historical actions; The action attribute vector is used as a causal intervention variable and connected to the response causal graph. The structure of the response causal graph is constructed by combining the variable set, and the response causal evidence features are obtained.

[0039] The above step S102, which constructs a response causal graph based on the feature space, specifically includes: Extract response causal evidence features from the feature space; The observable state variables, potential disturbance variables, long-term risk outcome variables, and business damage outcome variables are identified to form the variable set of the response causal diagram; The structure of the response causal graph is constructed based on the set of variables, and the response causal evidence features are incorporated into the response causal graph as causal intervention variables.

[0040] In one embodiment, step S102 above, which involves performing a first time-scale decision based on the feature space, includes: Based on the feature space, global structural statistical features, global risk confidence intervals, distribution of vulnerable nodes in the critical business call chain, and distribution of historical rollback high-frequency periods are extracted as input state quantities for the first time scale decision. Decision calculations are performed based on the input state quantities according to a first preset period; Based on the results of the decision calculation, the macro-response model is generated, and the causal security constraint is generated based on the global risk confidence interval; wherein, the macro-response model is a qualitative description of the global defense strategy, including at least an aggressive defense model, a balanced defense model, and a conservative monitoring model; The causal security constraints include: counterfactual benefit constraints and confidence constraints; the counterfactual benefit constraints are used to screen and filter candidate actions, which are different from the counterfactual security reward item used to calculate the risk utility difference in the composite reward function.

[0041] Based on the macroscopic response pattern and the causal security constraints, adjust the available action space and reward function weights for the second timescale decision.

[0042] In one embodiment, step S102 above, which involves performing a second time-scale decision based on the feature space, includes: Read the local risk entropy change rate of a single host, real-time network and host operation indicators, local risk and return estimates, decision uncertainty measures, and minimum rollback set as input state quantities for decision-making on the second time scale. Decision calculations are performed according to a second preset period, the duration of which is less than the duration of the first preset period; By combining the macroscopic response pattern and the causal safety constraint, the candidate actions output by the decision calculation are verified, and candidate actions that do not meet the causal safety constraint are filtered out to obtain the microscopic candidate actions.

[0043] The micro-level candidate actions include, but are not limited to: dropping packets on a specific port, suspending a specified process, dynamically writing to an eBPF hook, adjusting iptables rules, executing time-limited and rate-limited actions, process shadow copying, redirecting a session to a decoy environment, and demoting temporary tokens.

[0044] In the above step S103, the composite reward function is constructed, which includes an immediate reward item, a short-term penalty item, a long-term risk reward item, and a counterfactual safety reward item. The definitions of each reward item are as follows: Instant rewards: used to measure the benefits of blocking malicious flows, the losses from false blocking of normal flows, and the cost of resource consumption; Short-term penalty: A penalty used to measure the increase in attack graph risk entropy and the decrease in the availability of critical nodes; Long-term risk reward: Used to simulate the maximum value of a critical asset that can be compromised within K steps from the attacker's perspective; Counterfactual safety reward: used to measure the difference in risk utility between a candidate response action and a minimum-damage alternative action.

[0045] In the above embodiments, constructing the counterfactual security reward item specifically includes: For the micro-candidate actions in the current state, causal intervention reasoning is performed based on the response causal graph to calculate the expected long-term risk after the micro-candidate action intervention; Calculate the expected long-term risk after performing a pre-set minimum-damage alternative action intervention under the same conditions; The risk utility difference of the micro-candidate action is obtained by removing the weighted value of business damage from the difference between the two types of long-term risk expectations, and the risk utility difference is used as the basis for determining the value of the counterfactual security reward item.

[0046] Furthermore, step S103 above, which involves performing causal intervention on micro-candidate actions based on the response causal graph to obtain the risk-utility difference of the micro-candidate actions, specifically includes: Using the micro-candidate actions as causal intervention variables, the do-operator operation is performed on the response causal graph to obtain the state of the response causal graph after intervention. Based on the response causal graph state after the intervention, the system state evolution trajectory after the execution of the micro-candidate action is deduced; Based on the system state evolution trajectory, calculate the long-term risk expectation and business damage expectation of the micro-candidate actions; The weighted difference between the expected long-term risk and the expected business damage is used as the risk utility difference of the micro-level candidate action.

[0047] Specifically, when performing causal intervention, firstly, all incident edges pointing to the current candidate action variable are deleted in the response causal graph, while the outgoing edges pointing to its child nodes are retained to obtain the intervention graph; then, based on the intervention graph, multiple parallel state trajectories are deduced through forward random sampling, the long-term risk value on each trajectory is calculated, and the average long-term risk of all trajectories is used as the estimated value of the expected long-term risk.

[0048] In one embodiment, the specific implementation of extrapolating multiple parallel state trajectories using forward random sampling includes the following steps: First, the system sets the sampling count, with a default value of 1000, which can be adjusted by operations personnel within the range of 100 to 5000 based on real-time requirements. Then, starting from the response causal graph at the current moment, all incident edges pointing to the current candidate action variable are deleted, retaining only the outgoing edges pointing to its child nodes, resulting in an intervention graph. Next, based on the conditional probability distribution of each variable in the intervention graph; wherein the conditional probability distribution of each variable in the response causal graph is obtained offline statistically through maximum likelihood estimation based on historical security event logs, and is incrementally updated using Bayesian methods as the counterexample sample library accumulates during system operation. The Monte Carlo forward sampling method is used to sequentially determine the state value of each variable, generating a system state evolution trajectory from the current moment to a preset number of future steps (default 10 steps). The above sampling process is repeated until the preset sampling count is reached, resulting in multiple parallel state trajectories. Finally, the long-term risk value of the terminal state of each trajectory is calculated. This long-term risk value is the weighted sum of the risk entropy of each host node at the end of the trajectory and its asset function coupling degree. The average of the long-term risk values ​​of all trajectories is taken as the estimated value of the expected long-term risk.

[0049] Step S104 above, estimating the upper bound of the uncertainty of the risk utility difference, and calculating the safety confidence value based on the upper bound of the uncertainty, includes: By combining historical sample distribution and environmental drift, the upper bound of the uncertainty of the risk-utility difference of the micro-candidate actions is estimated. After removing the weighted value of the uncertainty upper bound from the risk utility difference of the micro-candidate actions, it is compared with the preset safety threshold to obtain the safety confidence judgment value, and the safety confidence judgment value is used as the basis for judging the predefined safe execution conditions.

[0050] In one embodiment, the aforementioned environmental drift degree is used to characterize the magnitude of changes in network topology, service traffic, and attack patterns compared to the initial training environment of the system, and the value is calculated by combining the topology change rate, traffic fluctuation coefficient, and attack feature variability.

[0051] Specifically, when the number of historical samples of similar actions is lower than a preset threshold, the manually set expansion coefficient is automatically increased through Bayesian prior regularization, thereby raising the upper bound of uncertainty to reflect the decrease in estimation reliability caused by insufficient samples.

[0052] The specific process is as follows: estimating the upper bound of the uncertainty of the risk-utility difference of the micro-candidate actions; the upper bound of uncertainty is used to characterize the upper limit of the estimation error of the risk-utility difference under scenarios such as insufficient training samples, topological changes, and attacker inducement; Construct the confidence constraint determination formula, that is, the determination rule for the safety confidence value:

[0053] in, The uncertainty penalty coefficient, This is a preset safety threshold. and These are fixed parameters preset by the system, configured according to the current network size and security protection level. The left side of the formula represents the security confidence threshold; when the threshold is greater than or equal to the preset security threshold... At that time, it is considered that the action meets the conditions for safe execution.

[0054] In one embodiment, the uncertainty upper bound of the risk-utility difference of the aforementioned micro-candidate actions is described in the following embodiment. Estimate using the following formula:

[0055] in, The standard deviation of the risk-utility differences for similar actions in the historical sample database; ρ This is the drift sensitivity coefficient; The degree of environmental drift; This represents the total number of samples in the historical sample database. This represents the number of historical samples of the same type of action.

[0056] Step S105 above, which determines whether the micro-candidate action meets the predefined safe execution conditions based on the risk utility difference and the safety confidence judgment value, specifically includes: Based on the structure of the response causal graph, causal intervention reasoning is performed on the micro-candidate actions to generate counterfactual state trajectories for the corresponding micro-candidate actions; Calculate the risk utility difference and uncertainty upper bound of the micro-candidate actions based on the counterfactual state trajectory; The calculated risk utility difference and uncertainty upper bound are compared with the security confidence judgment value to determine whether the micro-candidate action meets the predefined security execution conditions.

[0057] In the above embodiments, the predefined safe execution condition is: the difference between the risk utility of the micro-candidate action and the uncertainty penalty value is greater than or equal to a preset safety threshold; wherein, the uncertainty penalty value is obtained by multiplying the uncertainty penalty coefficient by the uncertainty upper bound.

[0058] Specifically: when candidate action a satisfies When the time comes, add it to the execution queue; If not, then search the set of reversible actions for the minimum damage alternative action 'a' that satisfies the safe execution conditions and has the best overall causal net benefit and rollback cost. The calculation formula is as follows:

[0059] in, It is a set of reversible actions. For action Rollback costs, This is the rollback cost weighting coefficient.

[0060] Furthermore, generating a minimum damage alternative action that satisfies the predefined safe execution conditions specifically includes: Iterate through each candidate scrollable action in the preset set of scrollable actions; Calculate the risk utility difference, uncertainty penalty, and rollback cost for each alternative rollback operation; The comprehensive evaluation value of each alternative reversible operation is obtained by subtracting the uncertainty penalty value and the rollback cost weighting value from the risk utility difference of each alternative reversible operation. The candidate action with the highest comprehensive evaluation value is selected as the least damaging alternative action to replace the original microscopic candidate action.

[0061] In one embodiment, the specific process for generating the minimum damage alternative action that meets the predefined security execution conditions is as follows: The system first iterates through each candidate rollback action in the preset rollback action set. For each candidate action, its risk utility difference, uncertainty penalty value, and rollback cost value are calculated. The rollback cost value is determined based on the number of hosts involved, the estimated rollback duration (in minutes), and the number of affected business functions. The number of affected business functions refers to the total number of business functions that have a direct call dependency relationship with the hosts. Specifically, the number of hosts involved, the estimated rollback duration, and the number of affected business functions are multiplied, and then divided by a system-preset normalization constant (this constant is equal to the product of the total number of hosts in the entire network and the maximum rollback duration allowed by the system; the maximum rollback duration allowed by the system is a system-level timeout threshold preset by the administrator). Then, the risk utility difference of each candidate action is subtracted from its uncertainty penalty value, and then the product of the rollback cost value and the rollback cost weighting coefficient is subtracted. The resulting difference is used as the comprehensive evaluation value of the candidate action. All candidate actions are sorted from highest to lowest based on their comprehensive evaluation value. Each action is then checked to ensure it meets the safety execution conditions. The first candidate action that meets the safety execution conditions is selected as the least damaging alternative action.

[0062] In one embodiment, the method of this embodiment further includes: After executing the microscopic candidate action or the minimum damage replacement action, the process of performing feedback and model correction specifically includes: Continuously collect monitoring data on global risk entropy, functional coupling of key nodes, service operation indicators, and attack path reachability to obtain the system status after response; The system state after the response is compared with a preset threshold. If the key business indicators drop abnormally or the global attack risk increases instead of decreasing, the strategy rollback is triggered, and the corresponding state-action pair is stored in the taboo memory set and the counterexample sample library at the same time. Based on the samples in the negative example sample library, the edge weight parameters and latent variable configuration of the response causal graph are modified, and the modified samples are used as negative training samples for the reinforcement learning policy to achieve iterative update of the policy.

[0063] Example 2: Based on the same technical concept, Example 2 of this application also provides a network intrusion adaptive response system based on causal constraints, such as... Figure 2 As shown, it includes: a feature space construction module 210, a decision execution module 220, a causal intervention module 230, an evaluation calculation module 240, and a judgment module 250. Wherein: The feature space construction module 210 is used to collect network operation data and security event data to construct a feature space for multi-source heterogeneous data fusion. The decision execution module 220 is used to construct a response causal graph based on the feature space, and to execute a first time-scale decision and a second time-scale decision based on the feature space; wherein, the first time-scale decision generates a macroscopic response pattern and a causal safety constraint, and the second time-scale decision generates a microscopic candidate action based on the macroscopic response pattern and the causal safety constraint; The causal intervention module 230 is used to construct a composite reward function, perform causal intervention on the micro-candidate action based on the response causal graph, and obtain the risk-utility difference of the micro-candidate action; The evaluation calculation module 240 is used to estimate the upper bound of the uncertainty of the risk utility difference and calculate the safety confidence judgment value based on the upper bound of the uncertainty. The determination module 250 is used to determine whether the micro-candidate action meets the predefined safe execution conditions based on the risk utility difference and the safety confidence judgment value; if the predefined safe execution conditions are met, the micro-candidate action is executed; if not, a minimum damage alternative action that meets the predefined safe execution conditions is generated.

[0064] Example 3: In one embodiment, Example 3 of this application also provides an electronic device; the electronic device may be a terminal, and its internal structure diagram may be as follows. Figure 3As shown. The electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements the network intrusion adaptive response method based on causal constraints as described in any one of steps S101 to S105. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0065] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0066] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0068] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0069] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0070] The above are merely embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application shall be included within the scope of the claims of this application pending approval.

Claims

1. A network intrusion adaptive response method based on causal constraints, characterized in that, The method includes: Collect network operation data and security incident data to construct a feature space for multi-source heterogeneous data fusion; A response causal graph is constructed based on the feature space, and a first time-scale decision and a second time-scale decision are executed based on the feature space; wherein, the first time-scale decision generates a macroscopic response pattern and causal security constraints, and the second time-scale decision generates microscopic candidate actions based on the macroscopic response pattern and the causal security constraints. Construct a composite reward function, perform causal intervention on the micro-candidate actions based on the response causal graph, and obtain the risk-utility difference of the micro-candidate actions; Estimate the upper bound of the uncertainty of the risk utility difference, and calculate the safety confidence value based on the upper bound of the uncertainty; Based on the risk utility difference and the safety confidence judgment value, it is determined whether the micro-candidate action meets the predefined safety execution conditions; if the predefined safety execution conditions are met, the micro-candidate action is executed; if not, a minimum damage alternative action that meets the predefined safety execution conditions is generated.

2. The method according to claim 1, characterized in that, The feature space of the multi-source heterogeneous data fusion includes dynamic intrusion causal graph features, asset functional coupling degree features, and response causal evidence features.

3. The method according to claim 2, characterized in that, The features for constructing the dynamic intrusion cause-effect graph include: Each host node in the network is set as a vertex of the graph, and the detected attack events are set as directed edges between vertices; The weights of the directed edges are calculated based on the confidence level of the attack event and the time decay factor, and the directed graph structure at the current moment is generated. Based on the directed graph structure, the risk entropy of each host node is calculated according to the conditional probability of its neighboring nodes successfully intruding into that node, thus obtaining the dynamic intrusion causal graph features.

4. The method according to claim 2, characterized in that, The asset functional coupling characteristics are constructed as follows: Based on the call dependencies of business services in the network, calculate the functional coupling degree between any two host nodes and generate a functional coupling degree matrix. Based on the aforementioned functional coupling matrix, the distribution of business function call paths is statistically analyzed, and the functional path betweenness of each host node is calculated. Based on the functional path median, the irreplaceability of each host node in the overall business logic is quantified to obtain the asset functional coupling characteristics.

5. The method according to claim 2, characterized in that, Constructing the causal evidence features of the response includes: The observable state variables, potential disturbance variables, long-term risk outcome variables, and business damage outcome variables are identified and used to form the variable set of the response causal diagram; For each type of preset response action, a corresponding action attribute vector is generated; the action attribute vector includes the scope of application, rollback level, and rollback statistics of similar historical actions; The action attribute vector is used as a causal intervention variable and connected to the response causal graph. The structure of the response causal graph is constructed by combining the variable set, and the response causal evidence features are obtained.

6. The method according to claim 1, characterized in that, The first time-scale decision-making based on the feature space includes: Based on the feature space, global structural statistical features, global risk confidence intervals, distribution of vulnerable nodes in the critical business call chain, and distribution of historical rollback high-frequency periods are extracted as input state quantities for the first time scale decision. Decision calculations are performed based on the input state quantities according to a first preset period; Based on the results of the decision calculation, the macroeconomic response model is generated, and the causal security constraints are generated based on the global risk confidence interval; wherein, the causal security constraints include: counterfactual benefit constraints and confidence level constraints; Based on the macroscopic response pattern and the causal security constraints, adjust the available action space and reward function weights for the second timescale decision.

7. The method according to claim 1, characterized in that, The second time-scale decision-making based on the feature space includes: Read the local risk entropy change rate of a single host, real-time network and host operation indicators, local risk and return estimates, decision uncertainty measures, and minimum rollback set as input state quantities for decision-making on the second time scale. The decision calculation is performed according to the second preset period, the duration of which is shorter than the duration of the first preset period; By combining the macroscopic response pattern and the causal safety constraint, the candidate actions output by the decision calculation are verified, and candidate actions that do not meet the causal safety constraint are filtered out to obtain the microscopic candidate actions.

8. The method according to claim 1, characterized in that, The estimation of the upper bound of the uncertainty of the risk utility difference, and the calculation of the safety confidence value based on the upper bound of the uncertainty, include: By combining historical sample distribution and environmental drift, the upper bound of the uncertainty of the risk-utility difference of the micro-candidate actions is estimated. The safety confidence judgment value is obtained by subtracting the weighted value of the uncertainty upper bound from the risk utility difference of the micro-candidate action; the safety confidence judgment value is compared with the preset safety threshold to determine whether the micro-candidate action meets the predefined safety execution conditions.

9. A network intrusion adaptive response system based on causal constraints, characterized in that, include: The feature space construction module is used to collect network operation data and security event data to construct a feature space for the fusion of multi-source heterogeneous data. The decision execution module is used to construct a response causal graph based on the feature space, and to execute a first time-scale decision and a second time-scale decision based on the feature space; wherein, the first time-scale decision generates a macroscopic response pattern and causal security constraints, and the second time-scale decision generates microscopic candidate actions based on the macroscopic response pattern and the causal security constraints; The causal intervention module is used to construct a composite reward function, perform causal intervention on the micro-candidate actions based on the response causal graph, and obtain the risk-utility difference of the micro-candidate actions; An evaluation calculation module is used to estimate the upper bound of the uncertainty of the risk utility difference and calculate the safety confidence judgment value based on the upper bound of the uncertainty. The determination module is used to determine whether the micro-candidate action meets the predefined safe execution conditions based on the risk utility difference and the safety confidence judgment value; if the predefined safe execution conditions are met, the micro-candidate action is executed; if not, a minimum damage alternative action that meets the predefined safe execution conditions is generated.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1-8.

Images