Network attack protection method, device, equipment, storage medium and product

Abstract

The application discloses a network attack protection method and device, equipment, storage medium and product, and relates to the technical field of network security, and the method comprises the steps of integrating multi-source threat intelligence data and constructing a network security knowledge graph; reasoning attack paths of different attack types based on the network security knowledge graph; constructing an attack prediction model based on the attack paths of different attack types; determining a current attack probability based on the attack prediction model; and generating a protection strategy based on the current attack probability. Through the above method, multi-source data is integrated, a multi-dimensional network security knowledge graph is constructed, attack paths are accurately reasoned in the graph, potential risks of multi-stage attacks are accurately judged, the probability of attack occurrence is calculated using an attack prediction model, a protection strategy is automatically generated, network security protection is quickly and accurately realized, and the technical problem of difficult and timely and accurate protection of network attacks is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to network attack protection methods, devices, equipment, storage media and products. Background Technology

[0002] With the rapid development of the internet and information technology, cyberattacks are frequent, especially complex Advanced Persistent Threats (APTs) and multi-stage attacks. These attacks often employ multiple methods and span multiple nodes, breaching traditional security systems and causing severe economic losses and data leaks. Currently, network security protection mainly relies on traditional firewalls, Intrusion Detection Systems (IDS), and antivirus software, using predefined rule sets and static features to identify known attack behaviors. However, as attack methods become increasingly complex, attackers often bypass existing defenses by circumventing rules and disguising network behavior. Furthermore, while threat detection technologies based on machine learning and big data analytics have been introduced, these methods typically rely on single-type network data sources and struggle to capture global information within multi-stage attacks. Moreover, existing technologies are inadequate in handling multi-step attack paths and the correlation of attacker behaviors, making it difficult to perform timely and accurate global inference and protection against cyberattacks.

[0003] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main purpose of this application is to provide a method, apparatus, device, storage medium and product for protecting against network attacks, in order to solve the technical problem that it is difficult to protect against network attacks in a timely and accurate manner in the prior art.

[0005] To achieve the above objectives, this application provides a network attack protection method, the method comprising:

[0006] Integrate multi-source threat intelligence data to construct a cybersecurity knowledge graph;

[0007] Based on the aforementioned network security knowledge graph, attack paths for different attack types can be deduced;

[0008] Based on the attack paths of the different attack types, an attack prediction model is constructed;

[0009] Based on the attack prediction model, determine the current attack probability;

[0010] A protection strategy is generated based on the current attack probability.

[0011] In one embodiment, the step of integrating multi-source threat intelligence data to construct a cybersecurity knowledge graph includes:

[0012] Acquire multi-source threat intelligence data, which includes at least vulnerability data from vulnerability databases, network device logs, and advanced persistent threat attack reports;

[0013] Entities are extracted from the multi-source threat intelligence data, and the entities include at least vulnerabilities, Internet Protocol addresses, attackers, attack tools, attack types, and software versions.

[0014] Extract the relationships between the entities, model the relationships between the entities, and form entity relationship triples;

[0015] The network security knowledge graph is obtained by processing the entity relationship triples based on a heterogeneous graph neural network.

[0016] In one embodiment, the step of processing the entity relationship triples based on a heterogeneous graph neural network to obtain the network security knowledge graph includes:

[0017] The feature vector of ordinary triplet in the entity relation triplet is extracted based on the convolutional neural network;

[0018] Extract the super-relation feature vector from the entity relation triples based on the heterogeneous graph neural network;

[0019] The enhanced feature vector is obtained by combining the ordinary triplet feature vector with the super relation feature vector.

[0020] Based on the enhanced feature vectors, the cybersecurity knowledge graph is constructed.

[0021] In one embodiment, the step of inferring attack paths for different attack types based on the network security knowledge graph includes:

[0022] Based on the feature matrix of entities in the aforementioned cybersecurity knowledge graph, multi-head attention features are calculated.

[0023] Based on the multi-head attention features, the target entity is determined among the entities;

[0024] Based on the target entity, attack paths of different attack types are generated.

[0025] In one embodiment, the step of constructing an attack prediction model based on the attack paths of the different attack types includes:

[0026] Based on a multi-layer attention strategy, the information transfer between entities in the network security knowledge graph is enhanced;

[0027] The enhanced contextual semantic information between the entities is obtained, and the contextual semantic information is fused to obtain the semantic fusion feature between the entities;

[0028] Based on the attack paths of the different attack types and the semantic fusion features between the entities, the initial prediction model is trained to obtain the attack prediction model.

[0029] In one embodiment, the step of generating a protection strategy based on the current attack probability includes:

[0030] Based on the current attack probability, determine the matching probability range of the current attack probability;

[0031] Based on the matching probability range, the current threat level is determined;

[0032] Based on the current threat level, formulate corresponding protection strategies.

[0033] Furthermore, to achieve the above objectives, this application also proposes a network attack protection device, which includes:

[0034] The knowledge graph construction module is used to integrate multi-source threat intelligence data to build a cybersecurity knowledge graph.

[0035] The path reasoning module is used to reason out attack paths for different attack types based on the network security knowledge graph.

[0036] The attack prediction module is used to construct an attack prediction model based on the attack paths of the different attack types.

[0037] The attack prediction module is also used to determine the current attack probability based on the attack prediction model;

[0038] The attack protection module is used to generate a protection strategy based on the current attack probability.

[0039] In addition, to achieve the above objectives, this application also proposes a network attack protection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network attack protection method described above.

[0040] Furthermore, to achieve the above objectives, the present invention also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the network attack protection method described above.

[0041] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the network attack protection method described above.

[0042] This application provides a network attack protection method that integrates multi-source threat intelligence data to construct a network security knowledge graph; based on the network security knowledge graph, it infers attack paths for different attack types; based on the attack paths for different attack types, it constructs an attack prediction model; based on the attack prediction model, it determines the current attack probability; and based on the current attack probability, it generates a protection strategy. This application integrates multi-source data to construct a multi-dimensional network security knowledge graph, accurately infers attack paths from the graph, precisely judges the potential risks of multi-stage attacks, and uses the attack prediction model to calculate the probability of an attack occurring, automatically generating a protection strategy. This achieves rapid and accurate network security protection, solving the technical problem of difficulty in timely and accurate protection against network attacks. Attached Figure Description

[0043] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating an embodiment of the network attack protection method of this application;

[0046] Figure 2 This is a flowchart illustrating Embodiment 2 of the network attack protection method of this application;

[0047] Figure 3 A simplified flowchart illustrating the network attack protection method provided in Embodiment 2 of this application;

[0048] Figure 4 This is a schematic diagram of the module structure of the network attack protection device according to an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the network attack protection method in the embodiments of this application.

[0050] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0051] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0052] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of this application embodiment is: to integrate multi-source threat intelligence data and construct a network security knowledge graph; to infer attack paths of different attack types based on the network security knowledge graph; to construct an attack prediction model based on the attack paths of different attack types; to determine the current attack probability based on the attack prediction model; and to generate a protection strategy based on the current attack probability.

[0054] Currently, network security protection primarily relies on traditional methods such as firewalls, IDS (Intrusion Detection Systems), and antivirus software, using predefined rule sets and static features to identify known attack behaviors. However, as attack methods become increasingly complex, attackers often bypass existing defenses by circumventing rules and disguising network behavior. Furthermore, while threat detection technologies based on machine learning and big data analytics have been introduced, these methods typically depend on single types of network data sources and struggle to capture global information within multi-stage attacks. Moreover, existing technologies are inadequate in handling multi-step attack paths and the correlation of attacker behaviors, making it difficult to perform timely and accurate global inference and protection against network attacks.

[0055] This application provides a solution that integrates multi-source data to construct a multi-dimensional network security knowledge graph. The graph accurately infers attack paths, precisely judges the potential risks of multi-stage attacks, and uses an attack prediction model to calculate the probability of an attack occurring. It automatically generates protection strategies, enabling rapid and accurate network security protection and solving the technical problem of difficulty in timely and accurate protection against network attacks.

[0056] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or network attack protection device capable of performing the above functions. This embodiment does not specifically limit it in this regard. The following uses a network attack protection device as an example to describe this embodiment and the following embodiments.

[0057] This application provides a network attack protection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network attack protection method of this application.

[0058] In this embodiment, the network attack protection method includes steps S10 to S50:

[0059] Step S10: Integrate multi-source threat intelligence data to construct a cybersecurity knowledge graph;

[0060] It should be noted that multi-source threat intelligence data refers to data / information related to cyberattacks from multiple sources. This can include vulnerability data from vulnerability databases, network device logs, and advanced persistent threat (APS) reports; there are no specific limitations. Vulnerability databases can include CVEs (Common Vulnerabilities and Exposures) and NVDs (National Vulnerability Databases); there are no specific limitations either. A cybersecurity knowledge graph is a structured representation of cybersecurity knowledge. Based on the structure of a heterogeneous graph neural network (HGNN), it processes various types of entities (such as vulnerabilities, internet protocols, and attack tools) and their relationships to construct a cybersecurity knowledge graph.

[0061] Understandably, by integrating threat intelligence data from different data sources and using Natural Language Processing (NLP) technology to extract entities and relationships, a multi-dimensional cybersecurity knowledge graph can be constructed, enabling a more comprehensive perception of cyber threats and improving the ability to understand and analyze complex attack scenarios.

[0062] Step S20: Based on the network security knowledge graph, infer the attack paths for different attack types;

[0063] It should be noted that in cybersecurity scenarios, attackers achieve their goals through a series of steps (attack paths). This embodiment establishes a multi-step attack path using triples representing the relationship between the attacker and the vulnerability in a knowledge graph.

[0064] Understandably, HGNN can be used to analyze cybersecurity knowledge graphs and automatically identify potential attack paths. For example, an attacker might gain access to a system through a vulnerability and gradually move laterally to control a target node.

[0065] In one feasible implementation, step S20 may include: calculating multi-head attention features based on the feature matrix of entities in the network security knowledge graph; determining a target entity among the entities based on the multi-head attention features; and generating attack paths of different attack types based on the target entity.

[0066] It should be noted that the attack types include at least DDoS (Distributed Denial of Service), SQL (Structured Query Language) injection, and buffer overflow. Multi-head attention features, extracted using a multi-head attention mechanism, can be used to focus on key entity nodes, i.e., the target entity, thereby inferring potential attack paths for various attack types.

[0067] It is understandable that multi-head attention mechanisms are used to enhance the transmission of relational information between entities, as shown in the following formula:

[0068]

[0069] Among them, Q, K, and V are the feature matrices of entity nodes. Through the attention mechanism, it is possible to focus on important nodes and paths related to the attack, deduce the attacker's behavior path, and through the multi-head attention mechanism, when dealing with complex attack paths, it can effectively extract important contextual information, accurately identify attack paths and related entities, and improve the reasoning ability for complex attack scenarios.

[0070] It should be understood that using a multi-head attention mechanism to focus on key nodes in different attack paths allows for the deduction of the attacker's multi-step behavioral paths, ensuring accurate assessment of the potential risks of multi-stage attacks in order to generate effective early warning and protection strategies.

[0071] Step S30: Construct an attack prediction model based on the attack paths of the different attack types;

[0072] In one feasible implementation, step S20 may include: enhancing the information transmission between entities in the network security knowledge graph based on a multi-layer attention strategy; obtaining the enhanced contextual semantic information between the entities, fusing the contextual semantic information to obtain semantic fusion features between the entities; and training an initial prediction model based on the attack paths of different attack types and the semantic fusion features between the entities to obtain the attack prediction model.

[0073] It should be noted that the initial prediction model, or preliminary model, can usually be a deep learning network model. All relevant parameters are initialized data. Through training, the final model, i.e. the attack prediction model, is obtained, which is used to predict the attack probability.

[0074] It is understood that in this embodiment, semantic fusion is used to fully utilize the contextual information and semantic features of entities, employing a semantic fusion unit based on a multi-layer attention mechanism. Through a multi-layer semantic enhancement model, the contextual semantic information between various entities is fused, thereby better understanding complex attack behaviors and scenarios. To improve the ability to detect complex attack scenarios, this embodiment combines semantic features and entity relationships, enhancing the information interaction between entity nodes and relationship nodes through a multi-layer attention mechanism. This multi-layer attention mechanism is used to enhance information transmission between different entities. For example, there is an implicit relationship between vulnerabilities and attack tools; attackers may use specific tools to launch attacks. The multi-head attention mechanism can strengthen the modeling of these relationships. The specific transmission mechanism is as follows:

[0075]

[0076] Among them, a ij W represents the attention weight between node i and its neighbor node j. α For training parameters, [h i ||h j [] represents the concatenated node features.

[0077] It should be understood that semantic fusion enables more effective identification of complex attack patterns, such as multi-stage attacks and APT attacks, achieving the prediction and identification of potential attack paths. The initial prediction model is trained using a large dataset of historical network attacks, enabling it to identify complex attack patterns based on knowledge graphs, particularly multi-stage attacks and Advanced Persistent Threats (APTs). Through a multi-layered semantic fusion mechanism, entities, relationships, and their semantic features within the attack path are transmitted and enhanced at multiple levels, especially in complex multi-stage attack scenarios, ensuring that each node receives global semantic information and achieving accurate attack determination.

[0078] Step S40: Determine the current attack probability based on the attack prediction model;

[0079] It should be noted that by combining cybersecurity knowledge graphs and attack prediction models, potential attack behaviors can be automatically identified and warnings provided. Assuming an attack behavior is represented as a vector, the probability of an attack occurring is predicted using a trained attack prediction model, as shown below:

[0080] P(y=1|x=σ(W) T x+b)

[0081] In the formula, σ is the activation function, W and b are model parameters, and P(y=1|x) represents the probability of a network attack occurring.

[0082] Understandably, based on the trained model, when new entities and relationships appear in the network, it can determine potential attack paths and behaviors according to the paths and entities in the current network security knowledge graph, and calculate the probability of an attack by using the features extracted by GNN.

[0083] Step S50: Generate a protection strategy based on the current attack probability.

[0084] It should be noted that, based on the attack type and attack path (such as using CVE vulnerabilities to enter the system or moving laterally to other servers), combined with time series analysis, a multi-dimensional attack threat assessment is made.

[0085] In one feasible implementation, step S50 may include: determining a matching probability range of the current attack probability based on the current attack probability; determining the current threat level based on the matching probability range; and formulating a corresponding protection strategy based on the current threat level.

[0086] It should be noted that the current attack probability is the calculated probability that an attack currently exists. Based on the current attack probability, a corresponding probability interval can be found, i.e., the matching probability interval. For example, assuming there are 3 intervals: [0,0.4], (0.4,0.8), and [0.8,1], if the current attack probability is 0.6, then the matching probability interval is (0.4,0.8).

[0087] Understandably, each probability interval corresponds to a threat level. For example, [0, 0.4] corresponds to a low threat level, (0.4, 0.8) corresponds to a medium threat level, and [0.8, 1] corresponds to a high threat level. Based on the matching probability interval, the threat level corresponding to the current attack probability is found, i.e., the current threat level. For example, assuming the probability interval (0.4, 0.8) corresponds to a medium threat level, if the current attack probability is 0.6, then the current threat level is medium.

[0088] It should be noted that the protection strategy refers to the protection method against attacks, such as blocking IPs or isolating nodes. This embodiment does not make specific limitations on this and should be set according to the actual situation.

[0089] It should be understood that by combining the attack path reasoning results, the attack prediction model is used to calculate the probability of an attack occurring, automatically determine the threat level, generate protection strategies, and achieve intelligent network security protection.

[0090] This embodiment provides a network attack protection method that integrates multi-source threat intelligence data to construct a network security knowledge graph; based on the network security knowledge graph, it infers attack paths for different attack types; based on the attack paths for different attack types, it constructs an attack prediction model; based on the attack prediction model, it determines the current attack probability; and based on the current attack probability, it generates a protection strategy. This embodiment integrates multi-source data to construct a multi-dimensional network security knowledge graph, accurately infers attack paths from the graph, precisely judges the potential risks of multi-stage attacks, and uses the attack prediction model to calculate the probability of an attack occurring, automatically generating a protection strategy to quickly and accurately achieve network security protection.

[0091] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Step S10 may include steps S101 to S104:

[0092] Step S101: Obtain multi-source threat intelligence data, which includes at least vulnerability data from vulnerability databases, network device logs, and advanced persistent threat attack reports.

[0093] It should be noted that, in this embodiment, the multi-source threat intelligence data includes at least vulnerability data from a vulnerability database, network device logs, and Advanced Persistent Threat (APT) attack reports. The vulnerability database includes at least CVEs and NVDs, and the APT attack reports are also known as APT attack reports. When integrating data, data such as IP (Internet Protocol) addresses and malware activity are typically selected from network device logs, and attacker activity data is selected from APT attack reports.

[0094] In practice, vulnerability data from CVE and NVD vulnerability databases, IP addresses and malware activity from network device logs, and attacker activities from APT attack reports are all used as data sources for knowledge graph construction.

[0095] Step S102: Extract entities from the multi-source threat intelligence data. The entities include at least vulnerabilities, Internet Protocol addresses, attackers, attack tools, attack types, and software versions.

[0096] Understandably, natural language processing techniques are used to extract key entities from vulnerability data in vulnerability databases, network device logs, and APT attack reports. Through entity identification, the extracted entities include at least the vulnerability (CVE), internet protocol address (IP address), attacker, attack tool, attack type, and software version.

[0097] Step S103: Extract the relationships between the entities, model the relationships between the entities, and form entity relationship triples;

[0098] It should be noted that relation extraction technology is used to extract the relationships between entities and model the relationships between entities. The extracted relationships include at least "IP address exploiting a vulnerability to attack", "attacker using a certain attack tool", "attack targeting a certain software version", etc.

[0099] It is understandable that the entity-relationship triple is the "entity-relationship-entity" triple, which is constructed based on the extracted entities and the relationship between them.

[0100] Step S104: Process the entity relationship triples based on the heterogeneous graph neural network to obtain the network security knowledge graph.

[0101] It should be noted that this embodiment uses a heterogeneous graph neural network to process different types of entities and relationships. Complex attack paths and associations are constructed through the nodes (entities) and edges (relationships) of the heterogeneous graph. The feature representation of each node is iteratively updated through the heterogeneous graph neural network, and the calculated relationship is shown below:

[0102]

[0103] In the formula, Represents node v i Features at layer l+1, N r (v i ) indicates the relationship with node v i Connected neighbor nodes, W r Let σ be the weight matrix for different relationships, and σ be the activation function.

[0104] Understandably, HGNN's hierarchical information transmission can distinguish different types of entities (such as vulnerabilities, attackers, IP addresses, etc.) and relationships (such as exploitation, attack sources, etc.), thereby capturing the deep-seated connections between entities such as attackers, vulnerabilities, and attack methods, and enhancing the expression of cybersecurity threat intelligence.

[0105] In one feasible implementation, step S104 may include: extracting ordinary triplet feature vectors from the entity relationship triplets based on a convolutional neural network; extracting super-relation feature vectors from the entity relationship triplets based on a heterogeneous graph neural network; combining the ordinary triplet feature vectors with the super-relation feature vectors to obtain enhanced feature vectors; and constructing the network security knowledge graph based on the enhanced feature vectors.

[0106] It should be noted that this embodiment introduces a feature enhancement unit. Based on the existing graph construction, the feature enhancement unit adds a convolutional neural network (CNN) to extract ordinary triple feature vectors and uses HGNN to capture complex entity associations, further reducing the interference of information noise on the attack path.

[0107] Specifically, the feature enhancement unit includes a regular triplet feature learning layer and a super-relation feature learning layer. The regular triplet feature learning layer uses a CNN to learn regular triplet features and extract regular triplet feature vectors, while the super-relation feature learning layer uses an HGNN to learn super-relation features and extract super-relation feature vectors.

[0108] For the ordinary triplet feature learning layer, a convolutional neural network is used as the main tool to effectively capture the facts of ordinary triplets. First, the triples (h, r, t) are initialized as embedding vectors, which encode the semantic information of the entities and relations. Then, these embedding vectors are used as input and passed through a 3×3 convolutional filter to capture the correlation between the head entity, relation, and tail entity. This convolutional operation slides across the embedding vectors and performs a series of local feature extractions, generating a feature map where each position corresponds to a local feature of the input. Pooling is then used to reduce the dimensionality, enhancing feature invariance. Finally, the processed feature map is flattened into a triplet feature vector. This vector contains a comprehensive representation of the head entity, relation, and tail entity.

[0109] For the hyper-relation feature learning layer, in a hyper-relation knowledge graph, a hyperedge can connect multiple entity nodes, not just two nodes. This characteristic makes hyper-relation graphs better able to represent higher-order relationships, multiple relationships, and complex semantic associations between entities. A hypergraph on a hyper-relation knowledge graph can be represented as G. h =(ε H E H W H ), which contains the entity set ε H and super edge set E H and the hyperedge weight matrix W H Among them, W H Each element can be viewed as:

[0110]

[0111] Where, v∈ε H ,e∈E HTherefore, in order to effectively handle complex hyperrelation features, HGNN is used in this layer to capture hyperrelation facts. First, the entity vector is initialized with node embedding N. 0 =(n v1 ,n v2 ,...,n vm Initialize the hypergraph as a hyperedge embedding. This is used to generate the hyperedge cluster W H Next, the node embeddings are fed into the HGNN along with the hyperedge clusters to obtain the message passing for each layer:

[0112] N (L+1) =N (L) +σ(WN (L) Θ (L+1) +b (L+1) )

[0113] In the formula, It is a learnable parameter used to perform feature transformation on the node embedding N. For bias, σ is the nonlinear activation function, and N (L) For message passing at layer L, the weight of the hyperedge can be considered as:

[0114]

[0115] Among them, D v It is a diagonal matrix corresponding to the degree of the nodes. In hypergraph representation, the degree of a node can be represented as the number of edges connecting it to other nodes, and D... e This represents the diagonal matrix corresponding to the degree of the hyperedge. The degree of the hyperedge can be represented by the number of nodes connected to it. Therefore, the degree of a node and the degree of the hyperedge can be represented as:

[0116]

[0117] Where d(v) is the degree of the node, δ(e) is the degree of the hyperedge, w(e) is the weight of the hyperedge e, and h(v,e) is the indicator function. Then, according to the modeling principle of HGNN, the output of the Lth layer is combined with the input to obtain the updated entity representation N = NL. 0 +N L Then, by fusing the updated entities and relations, the super-relation feature vector X is obtained. j Finally, the eigenvectors of ordinary triples are combined with the eigenvectors of superrelations to obtain the enhanced eigenvector, i.e., the enhanced eigenvector X = X. i +X j .

[0118] It should be understood that the feature enhancement unit utilizes convolutional neural networks (CNNs) and heterogeneous graph neural networks (HGNNs) to process ordinary triplet features and super-relation features respectively, thereby more comprehensively capturing and representing the complex relationships and information in cybersecurity data. Fusing features from CNNs and HGNNs can better integrate information from different data sources, enhancing the comprehensive analytical capabilities for complex cybersecurity scenarios.

[0119] This embodiment provides a network attack protection method. It acquires multi-source threat intelligence data, including at least vulnerability data from a vulnerability database, network device logs, and advanced persistent threat (APS) reports. Entities are extracted from the multi-source threat intelligence data, with each entity including at least a vulnerability, Internet Protocol address (IPA), attacker, attack tool, attack type, and software version. Relationships between entities are extracted and modeled to form entity-relationship triples. These triples are then processed using a heterogeneous graph neural network to obtain the network security knowledge graph. The heterogeneous graph neural network processes different types of entities and relationships in the network security knowledge graph, extracting and updating features of entities and relationships to capture complex associations in attack paths, thereby more accurately reasoning about and identifying key links and potential threats in attack paths.

[0120] For example, to help understand the implementation process of the network attack protection method obtained by combining this embodiment with the above-described embodiment two, please refer to... Figure 3 , Figure 3 A simplified flowchart of a network attack protection method is provided, specifically:

[0121] By leveraging a cybersecurity knowledge graph, multi-source threat intelligence data is integrated to extract key entities and their relationships. In cybersecurity scenarios, HGNN is used to analyze the cybersecurity knowledge graph and automatically identify potential attack paths. Through a multi-layer semantic fusion mechanism, key nodes in different attack paths are enhanced to construct an attack prediction model. Combining the cybersecurity knowledge graph and the attack prediction model, possible attack behaviors are automatically determined and early warnings are provided.

[0122] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the network attack protection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0123] This application also provides a network attack protection device; please refer to... Figure 4 The network attack protection device includes:

[0124] The knowledge graph construction module 10 is used to integrate multi-source threat intelligence data to build a cybersecurity knowledge graph.

[0125] The path reasoning module 20 is used to reason out attack paths for different attack types based on the network security knowledge graph.

[0126] The attack prediction module 30 is used to construct an attack prediction model based on the attack paths of the different attack types.

[0127] The attack prediction module 30 is also used to determine the current attack probability based on the attack prediction model;

[0128] The attack protection module 40 is used to generate a protection strategy based on the current attack probability.

[0129] In one feasible implementation, the map construction module 10 is further configured to acquire multi-source threat intelligence data, which includes at least vulnerability data from a vulnerability database, network device logs, and advanced persistent threat attack reports.

[0130] Entities are extracted from the multi-source threat intelligence data, and the entities include at least vulnerabilities, Internet Protocol addresses, attackers, attack tools, attack types, and software versions.

[0131] Extract the relationships between the entities, model the relationships between the entities, and form entity relationship triples;

[0132] The network security knowledge graph is obtained by processing the entity relationship triples based on a heterogeneous graph neural network.

[0133] In one feasible implementation, the graph construction module 10 is further configured to extract the feature vector of ordinary triplets in the entity relation triplets based on a convolutional neural network.

[0134] Extract the super-relation feature vector from the entity relation triples based on the heterogeneous graph neural network;

[0135] The enhanced feature vector is obtained by combining the ordinary triplet feature vector with the super relation feature vector.

[0136] Based on the enhanced feature vectors, the cybersecurity knowledge graph is constructed.

[0137] In one feasible implementation, the path reasoning module 20 is further configured to calculate multi-head attention features based on the feature matrix of entities in the network security knowledge graph;

[0138] Based on the multi-head attention features, the target entity is determined among the entities;

[0139] Based on the target entity, attack paths of different attack types are generated.

[0140] In one feasible implementation, the attack prediction module 30 is further configured to enhance the information transfer between entities in the network security knowledge graph based on a multi-layer attention strategy.

[0141] The enhanced contextual semantic information between the entities is obtained, and the contextual semantic information is fused to obtain the semantic fusion feature between the entities;

[0142] Based on the attack paths of the different attack types and the semantic fusion features between the entities, the initial prediction model is trained to obtain the attack prediction model.

[0143] In one feasible implementation, the attack protection module 40 is further configured to determine a matching probability range for the current attack probability based on the current attack probability.

[0144] Based on the matching probability range, the current threat level is determined;

[0145] Based on the current threat level, formulate corresponding protection strategies.

[0146] The network attack protection device provided in this application, employing the network attack protection method described in the above embodiments, can solve the technical problem of difficulty in timely and accurate protection against network attacks. Compared with the prior art, the beneficial effects of the network attack protection device provided in this application are the same as those of the network attack protection method described in the above embodiments, and other technical features in the network attack protection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0147] This application provides a network attack protection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network attack protection method in the above embodiment 1.

[0148] The following is for reference. Figure 5The diagram illustrates a structural schematic suitable for implementing network attack protection devices according to embodiments of this application. The network attack protection devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 5 The network attack protection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0149] like Figure 5 As shown, a network attack protection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the network attack protection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the network attack protection device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows network attack protection devices with various systems, it should be understood that implementing or having all of the systems shown is not required. More or fewer systems may be implemented alternatively.

[0150] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0151] The network attack protection device provided in this application, employing the network attack protection method described in the above embodiments, can solve the technical problem of difficulty in timely and accurate protection against network attacks. Compared with the prior art, the beneficial effects of the network attack protection device provided in this application are the same as those of the network attack protection method described in the above embodiments, and other technical features of this network attack protection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0152] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0153] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0154] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the network attack protection method described in the above embodiments.

[0155] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0156] The aforementioned computer-readable storage medium may be included in a network attack protection device; or it may exist independently and not be assembled into a network attack protection device.

[0157] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by a network attack protection device, the network attack protection device causes the network attack protection device to: integrate multi-source threat intelligence data to construct a network security knowledge graph; infer attack paths of different attack types based on the network security knowledge graph; construct an attack prediction model based on the attack paths of different attack types; determine the current attack probability based on the attack prediction model; and generate a protection strategy based on the current attack probability.

[0158] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0159] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0160] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0161] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., computer programs) for executing the above-described network attack protection method, thereby solving the technical problem of difficulty in timely and accurate protection against network attacks. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the network attack protection method provided in the above embodiments, and will not be repeated here.

[0162] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network attack protection method described above.

[0163] The computer program product provided in this application can solve the technical problem of difficulty in timely and accurate protection against network attacks. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the network attack protection method provided in the above embodiments, and will not be repeated here.

[0164] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for protecting against network attacks, characterized in that, The method includes: Integrate multi-source threat intelligence data to construct a cybersecurity knowledge graph; Based on the aforementioned network security knowledge graph, attack paths for different attack types can be deduced; Based on the attack paths of the different attack types, an attack prediction model is constructed; Based on the attack prediction model, determine the current attack probability; A protection strategy is generated based on the current attack probability.

2. The method as described in claim 1, characterized in that, The steps for integrating multi-source threat intelligence data and constructing a cybersecurity knowledge graph include: Acquire multi-source threat intelligence data, which includes at least vulnerability data from vulnerability databases, network device logs, and advanced persistent threat attack reports; Entities are extracted from the multi-source threat intelligence data, and the entities include at least vulnerabilities, Internet Protocol addresses, attackers, attack tools, attack types, and software versions. Extract the relationships between the entities, model the relationships between the entities, and form entity relationship triples; The network security knowledge graph is obtained by processing the entity relationship triples based on a heterogeneous graph neural network.

3. The method as described in claim 2, characterized in that, The step of processing the entity relationship triples based on a heterogeneous graph neural network to obtain the network security knowledge graph includes: The feature vector of ordinary triplet in the entity relation triplet is extracted based on the convolutional neural network; Extract the super-relation feature vector from the entity relation triples based on the heterogeneous graph neural network; The enhanced feature vector is obtained by combining the ordinary triplet feature vector with the super relation feature vector. Based on the enhanced feature vectors, the cybersecurity knowledge graph is constructed.

4. The method as described in claim 1, characterized in that, The steps for inferring attack paths for different attack types based on the network security knowledge graph include: Based on the feature matrix of entities in the aforementioned cybersecurity knowledge graph, multi-head attention features are calculated. Based on the multi-head attention features, the target entity is determined among the entities; Based on the target entity, attack paths of different attack types are generated.

5. The method as described in claim 1, characterized in that, The steps for constructing an attack prediction model based on the attack paths of the different attack types include: Based on a multi-layer attention strategy, the information transfer between entities in the network security knowledge graph is enhanced; The enhanced contextual semantic information between the entities is obtained, and the contextual semantic information is fused to obtain the semantic fusion feature between the entities; Based on the attack paths of the different attack types and the semantic fusion features between the entities, the initial prediction model is trained to obtain the attack prediction model.

6. The method according to any one of claims 1 to 5, characterized in that, The step of generating a protection strategy based on the current attack probability includes: Based on the current attack probability, determine the matching probability range of the current attack probability; Based on the matching probability range, the current threat level is determined; Based on the current threat level, formulate corresponding protection strategies.

7. A network attack protection device, characterized in that, The device includes: The knowledge graph construction module is used to integrate multi-source threat intelligence data to build a cybersecurity knowledge graph. The path reasoning module is used to reason out attack paths for different attack types based on the network security knowledge graph. The attack prediction module is used to construct an attack prediction model based on the attack paths of the different attack types. The attack prediction module is also used to determine the current attack probability based on the attack prediction model; The attack protection module is used to generate a protection strategy based on the current attack probability.

8. A network attack protection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network attack protection method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the network attack protection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the network attack protection method as described in any one of claims 1 to 6.

Images