A method for determining success of a bidirectional flow attack

Abstract

The application discloses a two-way flow attack success determination method, belongs to the field of network security intrusion detection and alarm research and judgment, and aims at solving the problems that the traditional intrusion detection system and intrusion prevention system are difficult to combine response flow to determine whether the attack is successful and the request response correlation is unstable under high concurrency. The two-way transaction unit with correlation confidence is constructed, the request, response, echo, time delay, length and state change characteristics are extracted, the two-branch coding, dynamic heterogeneous space-time graph, time sequence converter and three-branch evidence gate classifier are combined, and the determination conclusion is output, so that the technical effects of improving attack success research and judgment accuracy, reducing alarm noise and enhancing reproducibility are realized.

Description

Technical Field

[0001] This invention relates to the field of network security intrusion detection and alarm analysis, and in particular to a method for determining the success of a two-way traffic attack. Background Technology

[0002] As cyberattacks become increasingly sophisticated, intrusion detection and prevention systems are widely used in enterprise networks, cloud platforms, and data centers to detect abnormal access, attack payloads, and violations. Existing solutions typically trigger alerts based on rule hits in the request direction, payload characteristics, or access patterns, with security personnel then conducting further analysis using logs and traffic data.

[0003] However, existing technologies still have shortcomings related to attack success determination: First, alarm triggering is mostly concentrated on one-way request characteristics, lacking joint analysis of response status, response content, payload echo, and session state changes, making it difficult to distinguish between attack attempts and real intrusions; Second, in high-concurrency network environments, the accurate correlation between requests and responses is easily affected by connection reuse, missing transaction sequence numbers, time jitter, and out-of-order packets, leading to unstable judgment results; Third, the lack of unified modeling between multi-round request and response, asset status, and concurrent context makes the interpretability of alarm noise reduction, duplicate event aggregation, and attack chain presentation insufficient.

[0004] Therefore, a method for determining the success of bidirectional traffic attacks is needed to address the shortcomings of existing technologies. Summary of the Invention

[0005] One objective of this invention is to propose a method for determining the success of bidirectional traffic attacks. Addressing the limitations of existing intrusion detection and prevention systems, which often trigger alarms based on unidirectional request characteristics, making it difficult to accurately determine the success of an attack by combining response traffic, and exhibiting instability in request-response correlation and session reassembly in high-concurrency network environments, this invention proposes a technical solution that acquires bidirectional network traffic and multi-source security logs, generates candidate request-response transactions, calculates request-response correlation confidence, extracts features from the requesting side, the responding side, echo, latency, length, and state change, and utilizes a dual-branch encoder, dynamic heterogeneous spatiotemporal graph, graph neural network, time-series converter model, and evidence-gated classifier to output the determination conclusion. This invention achieves the technical effects of improving the accuracy of attack success determination, reducing alarm noise, and enhancing the interpretability and reproducibility of the analysis.

[0006] This invention provides a method for determining the success of a bidirectional traffic attack, comprising: S1, acquiring bidirectional network traffic, intrusion detection system alarm logs, intrusion prevention system alarm logs, protocol parsing logs, and asset service status logs; standardizing connection identifiers, 5-tuples, timestamps, protocol transaction sequence numbers, direction fields, and data packet sequence information to generate candidate request-response transactions; S2, performing deterministic association and soft matching on the candidate request-response transactions, calculating the request-response association confidence level, and forming bidirectional transaction units with request-response association confidence levels; S3, extracting attack intent features from the request side and response from the bidirectional transaction units. The system takes the following characteristics: Semantic features of the response protocol, payload echo features, response latency features, response content length features, and session state change features, and inputs them into a dual-branch encoder to obtain a bidirectional semantic alignment representation; S4, constructs a dynamic heterogeneous spatiotemporal graph from bidirectional transaction units, alarms, and asset service states, and generates a concurrent context representation using a graph neural network and a time-series converter model; S5, inputs the bidirectional semantic alignment representation, concurrent context representation, and request-response association confidence into a three-branch evidence gating classifier with association confidence constraints, and outputs the judgment conclusion of attack success, attack failure, or insufficient evidence, as well as the corresponding evidence label.

[0007] Optionally, S1 includes: Network bidirectional traffic is segmented into connection segments based on source address, destination address, source port, destination port, transport layer protocol, and direction field; Reassemble protocol transactions based on packet sequence information and protocol parsing logs; Map the intrusion detection system alarm logs, intrusion prevention system alarm logs, and asset service status logs to the corresponding connection segments by timestamp; The request-direction transactions and response-direction transactions within the same connection segment are paired according to the protocol transaction sequence number and time order to obtain the candidate request-response transactions.

[0008] Optionally, S2 includes: A deterministic association score is generated when the request-direction transaction and the response-direction transaction have the same connection identifier or the same 5-tuple and the same protocol transaction sequence number. When the protocol transaction sequence number is missing, a soft matching score is generated based on the time difference between the request end time and the response start time, the similarity of the payload digest, the combination of the protocol method and the response state, and the packet sequence interval. The deterministic association score and the soft match score are weighted and normalized according to the calibration weight to obtain a request-response association confidence score with a value range of 0 to 1, wherein the calibration weight is obtained by normalizing the deterministic association hit rate and soft match hit rate in historically labeled request-response pairing samples. The candidate request-response transaction and the confidence associated with the request-response are encapsulated into the bidirectional transaction unit.

[0009] Optionally, S3 includes: Encode the alarm rule identifier, attack type identifier, parameter name, parameter value, encoding method, and payload segment position in the request payload to obtain the attack intent characteristics of the requesting side; Encode the response status code, response header fields, protocol transaction status, response body terms, response latency, and response content length to obtain the protocol semantic features on the response side. The payload echo features are generated using the lexical overlap rate between the request payload fragment and the response body fragment, the hash digest similarity, and the cross-attention weight; Session state change features are generated by differentiating session summaries before and after the session based on authentication state, permission state, resource visibility, and subsequent access paths. The request-side attack intent features, the response-side protocol semantic features, the payload echo features, and the session state change features are input into the request branch encoder and the response branch encoder, and the bidirectional semantic alignment representation is output by the cross-attention matrix.

[0010] Optionally, S4 includes: The dynamic heterogeneous spatiotemporal graph is constructed using bidirectional transaction units, connections, hosts, services, alarms, and asset service status as nodes, and edges as belonging to the same connection, hitting the same alarm rule, accessing the same service, occurring within a preset time window, inheriting previous and subsequent states, and request-response association. Write the node timestamp, node type, edge type, and the confidence level associated with the request and response into the graph attributes; A graph context vector is obtained by aggregating neighborhood messages according to edge type using a graph neural network. The concurrent context representation is generated by inputting the graph context vectors ordered by time within the same session into the timing converter model.

[0011] Optionally, S5 includes: Attack intent score, response success evidence score, and state change score are generated from the bidirectional semantic alignment representation, and graph context score is generated from the concurrent context representation; Input the request payload encoding, response body encoding, response status code, response header field, response delay, response content length, protocol transaction status, session state summary, and the request-response association confidence into the three-branch evidence gating classifier; The three-branch evidence gating classifier includes an echo evidence branch, a protocol semantic evidence branch, and a state change evidence branch, and outputs the attack success confidence, evidence label, and the judgment conclusion. Furthermore, the echo evidence branch includes: segmenting the request payload into a request term sequence according to parameter name, parameter value, encoding tag and payload fragment position, and segmenting the response body into a response term sequence according to text fragment, structured field and binary digest; Calculate the lexical alignment ratio, summary similarity, and cross-attention weight for the request lexical sequence and the response lexical sequence; The weighted sum of the term alignment ratio, the summary similarity, and the cross-attention weights, based on the request-response association confidence, is subject to an upper limit constraint to obtain an echo evidence score ranging from 0 to 1, wherein the weights in the weighted sum are obtained by training with a calibration sample set. When the echo evidence score is not less than the echo threshold determined by the calibration sample set, an echo evidence label is generated; Furthermore, the protocol semantic evidence branch includes: generating a pattern hit vector based on the response status code, authentication jump address, error stack keywords, database error keywords, file return header fields, service banner fields, and abnormal response header fields, and concatenating the pattern hit vector with the response body encoding to generate a protocol success evidence score; The state change evidence branch includes: calculating the pre- and post-session differences for authentication state, permission state, resource visibility, response content length, response latency, and subsequent access path, and inputting the pre- and post-session differences into the state transition encoder to generate a state transition evidence score; Both the protocol success evidence score and the state transition evidence score are normalized to 0 to 1; Furthermore, the attack success confidence score is generated as follows: the echo evidence score, the protocol success evidence score, the state transition evidence score, the attack intent score, the graph context score, and the request-response association confidence score are input into the evidence fusion layer; The evidence fusion layer uses the fusion weights of the calibration sample set to calculate a basic fusion score, and the product of the basic fusion score and the confidence level associated with the request response is used as the confidence level of the attack success. When the confidence level of the request-response association is less than the association threshold, output insufficient evidence; when the attack intent score is not less than the intent threshold and the attack success confidence is not less than the success threshold, output attack success; when the attack intent score is not less than the intent threshold and the attack success confidence is less than the failure threshold, output attack failure; otherwise, output insufficient evidence. The association threshold, the intent threshold, the success threshold, and the failure threshold are determined by a preset quantile of the corresponding score distribution in the calibration sample set, and the failure threshold is not greater than the success threshold. Furthermore, the dual-branch encoder, the graph neural network, the time-series converter model, and the three-branch evidence gating classifier are trained in the following manner: attack success samples, attack failure samples, and insufficient evidence samples are constructed from historical bidirectional traffic samples, historical alarm handling records, and manual review records. The request-response association confidence calculation parameters are trained using request-response paired labels, the dual-branch encoder and the three-branch evidence gating classifier are trained using attack success labels, and the graph neural network and the time-series converter model are trained using multiple rounds of request-response sequence within the same session. Training losses include classification loss, request-response association loss, echo alignment loss, and state transition consistency loss; When the change in classification loss on the validation sample set does not exceed the preset convergence threshold within consecutive preset rounds, the model parameters are output.

[0012] The beneficial effects of this invention are: 1. By generating candidate request-response transactions based on connection identifier, 5-tuple, timestamp, protocol transaction sequence number, direction field, and data packet sequence information, and performing deterministic association and soft matching on the candidate request-response transactions, it can provide quantifiable association confidence for request-response pairing under conditions of missing transaction sequence number or high concurrency, thereby improving the stability of bidirectional traffic analysis.

[0013] 2. By extracting attack intent features from the request side, protocol semantic features from the response side, payload echo features, response latency features, response content length features, and session state change features, and obtaining bidirectional semantic alignment representations through a dual-branch encoder and cross-attention, a correspondence can be formed between the attack payload and the response evidence, thereby reducing misjudgments caused by relying solely on alerts from the request side.

[0014] 3. By constructing a dynamic heterogeneous spatiotemporal graph and combining it with a graph neural network, a time-series converter model, and an echo semantic state three-branch evidence gating classifier with association confidence constraints, it can integrate the state contexts of transactions, connections, hosts, services, alarms, and asset services. When the association quality is insufficient, it outputs "insufficient evidence," making the conclusions of attack success, attack failure, and insufficient evidence more interpretable and triggering value for handling. Attached Figure Description

[0015] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating a method for determining the success of a two-way traffic attack.

[0016] Figure 2This is a flowchart of the internal processing of the three-branch evidence gating classifier in step S5 of the present invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-2 A method for determining the success of a bidirectional traffic attack includes: S1, acquiring bidirectional network traffic, intrusion detection system alarm logs, intrusion prevention system alarm logs, protocol parsing logs, and asset service status logs; standardizing connection identifiers, 5-tuples, timestamps, protocol transaction sequence numbers, direction fields, and packet sequence information to generate candidate request-response transactions; S2, performing deterministic association and soft matching on the candidate request-response transactions, calculating the request-response association confidence level, and forming bidirectional transaction units with request-response association confidence levels; S3, extracting attack intent features from the request side and attack intent features from the response side from the bidirectional transaction units. Protocol semantic features, payload echo features, response latency features, response content length features, and session state change features are input into a dual-branch encoder to obtain a bidirectional semantic alignment representation; S4, the bidirectional transaction unit, alarm, and asset service status are constructed into a dynamic heterogeneous spatiotemporal graph, and a concurrent context representation is generated using a graph neural network and a time-series converter model; S5, the bidirectional semantic alignment representation, concurrent context representation, and request-response association confidence are input into a three-branch evidence gating classifier with association confidence constraints, and the output is a judgment conclusion of attack success, attack failure, or insufficient evidence, as well as the corresponding evidence label.

[0019] In this specific embodiment, S1 includes: After receiving bidirectional network traffic, intrusion detection system alarm logs, intrusion prevention system alarm logs, protocol parsing logs, and asset service status logs, the system first performs field standardization processing on each data source. This standardizes the connection identifier to a unique identifier for the same connection within the collection period, unifies the 5-tuple to source address, destination address, source port, destination port, and transport layer protocol, standardizes the timestamp to milliseconds, standardizes the protocol transaction sequence number to a transaction number in the protocol parsing log that identifies a request or response, standardizes the direction field to request or response direction, and standardizes the packet sequence information to the packet sequence number, acknowledgment number, and arrival time arranged in transmission order within the same connection. Finally, the system segments the bidirectional network traffic according to connection fragment keys. Divide into, among which, Indicates the linking fragment splitting key, Indicates the source address. Indicates the destination address. Indicates the source port. Indicates the destination port. Indicates the transport layer protocol. Indicates the direction field; When dividing connected segments, segments with the same Furthermore, data packets with consecutive arrival times are grouped into the same connection segment. When the arrival time interval between adjacent data packets exceeds a preset session idle time threshold, they are split into new connection segments. In this embodiment, the preset session idle time threshold is set to three hundred seconds. Based on the data packet sequence information, the data packets within the same connection segment are rearranged out of order, duplicate packets are removed, and missing segments are marked. The protocol transaction is then reassembled by combining the protocol method, request path, response status code, protocol header fields, message body boundaries, and protocol transaction sequence number in the protocol parsing log. The protocol transaction refers to a protocol processing unit within the same connection segment that has a complete request start and end position or a complete response start and end position. After reorganizing the protocol transactions, the request direction transaction and the response direction transaction are determined based on the direction field and the service listening address, service listening port, service protocol and service online status in the asset service status log. The protocol transaction from the access initiator to the accessed service is determined as the request direction transaction, and the protocol transaction from the accessed service back to the access initiator is determined as the response direction transaction. The intrusion detection system alarm logs, intrusion prevention system alarm logs, and asset service status logs are mapped to the corresponding connection segments according to the unified timestamps. During the mapping, the source address, destination address, source port, destination port, transport layer protocol, and alarm occurrence time in the alarm log are used as indexes to find connection segments whose time range covers the alarm occurrence time and whose five-tuples are consistent. The alarm rule identifier, attack type identifier, handling action, blocking result, and alarm severity level are written into the transaction attributes of the connection segment. For asset service status logs, the authentication state, permission state, resource visibility, service online status and subsequent access path are mapped to connection segments within the same time range using host address, service port, service protocol and status collection time as indexes. Within the same connection segment, request-direction transactions and response-direction transactions are paired according to the consistency of protocol transaction sequence numbers. When the protocol transaction sequence numbers exist and match, a candidate request-response transaction is directly generated. When the protocol transaction sequence numbers do not exist, they are paired according to the order in which the end time of the request-direction transaction is earlier than the start time of the response-direction transaction and the time interval between the two does not exceed a preset response waiting time threshold. In this embodiment, the preset response waiting time threshold is set to ten seconds. The generated candidate request-response transaction record includes at least the connection identifier, a five-tuple, the request-direction transaction, the response-direction transaction, the request end time, the response start time, the protocol transaction sequence number, the direction field, the data packet sequence information, the associated intrusion detection system alarm, the associated intrusion prevention system alarm, the associated protocol parsing result, and the associated asset service status.

[0020] In this specific embodiment, S2 includes: For each candidate request-response transaction, perform request-response association processing, record the request-direction transactions as request transactions to be associated, record the response-direction transactions as response transactions to be associated, and read the connection identifier, 5-tuple, protocol transaction sequence number, request end time, response start time, request payload digest, response payload digest, protocol method, response status code and data packet sequence information of both. When the request transaction and the response transaction to be associated have the same connection identifier and the same protocol transaction sequence number, or have the same quintuple and the same protocol transaction sequence number, the deterministic association score is set to 1. When none of the above conditions are met, the deterministic association score is set to 0. The deterministic association score is used to indicate whether the candidate request and response transactions satisfy the pairing relationship directly determined by the connection identifier, quintuple and protocol transaction sequence number. When the protocol transaction sequence number is missing, a soft matching score is further generated. The soft matching score is determined by the time difference between the request end time and the response start time, the similarity of the payload digest, the combination of the protocol method and the response state, and the data packet sequence interval. The time difference is the response start time minus the request end time. When the time difference is less than 0, the corresponding time difference component is 0. When the time difference is greater than the preset response waiting time threshold of ten seconds, the corresponding time difference component is 0. When the time difference is between 0 and ten seconds, it is linearly mapped to 0 to 1 in the manner that the smaller the time difference, the higher the component. Payload summary similarity is obtained by the ratio of the number of identical summary segments between the request payload summary and the response payload summary to the number of segments in the union of the two summary summaries; The protocol method and response status code combination generates a combination hit result according to the protocol method and response status code in the protocol parsing log. The result is 1 when the protocol method and response status code match the request-response semantic relationship under the protocol, and 0 otherwise. The data packet sequence interval is determined based on the interval between the sequence number of the last data packet in the request direction transaction and the sequence number of the first data packet in the response direction transaction. The closer the interval is to the continuous transmission relationship within the same connection segment, the higher the component is, and it is normalized to 0 to 1. The confidence level of the request-response association is calculated using the formula: ; in, This indicates the confidence level of the request-response association. Indicates the deterministic association score. Represents the time difference component. Indicates the similarity of payload summaries. This represents a combination of protocol method and response status components. Indicates the data packet sequence interval component. The calibration weights represent the deterministic association scores. The calibration weights represent the soft-match scores. The soft matching weights represent the time difference components. The soft-match weights represent the similarity between payload summaries. The soft matching weight represents the combination of protocol method and response state components. The soft-match weight represents the interval component of the data packet sequence. This indicates the minimum value operation. This indicates the operation of finding the maximum value. The calibration weights are determined from historically labeled request-response pairing samples. Specifically, the ratio of the number of correct pairings with deterministic association hits to the total number of deterministic association hits in the historically labeled request-response pairing samples is used to obtain the deterministic association hit rate. The ratio of the number of correct pairings with soft match hits to the total number of soft match hits is also used to obtain the soft match hit rate. Finally, the deterministic association hit rate and the soft match hit rate are normalized to ensure... ; The soft matching weight is obtained by normalizing the contributions of the time difference component, payload summary similarity, protocol method and response state combination component, and data packet sequence interval component to the correct matching result in the calibration sample set, so that... ; After obtaining the request-response association confidence score, the candidate request-response transaction and the request-response association confidence score are encapsulated into a bidirectional transaction unit. The bidirectional transaction unit includes at least a connection identifier, a 5-tuple, a request-direction transaction, a response-direction transaction, a protocol transaction sequence number, a request end time, a response start time, data packet sequence information, a deterministic association score, a soft match score, a request-response association confidence score, associated intrusion detection system alarms, associated intrusion prevention system alarms, associated protocol parsing results, and associated asset service status.

[0021] In this specific embodiment, S3 includes: For each bidirectional transaction unit, feature extraction and bidirectional semantic alignment are performed. First, the request-direction transaction, response-direction transaction, associated intrusion detection system alarm, associated intrusion prevention system alarm, associated protocol parsing result, associated asset service status, and request-response associated confidence are read from the bidirectional transaction unit. For request-oriented transactions, the request payload is located according to the request method, request path, request header fields, request parameters, and request body boundaries in the protocol parsing results. The alarm rule identifier, attack type identifier, parameter name, parameter value, encoding method, and payload fragment position in the request payload are converted into discrete identifiers. The alarm rule identifier is used to indicate the rule number that triggers the intrusion detection system alarm or the intrusion prevention system alarm. The attack type identifier is used to indicate one of the attack categories: injection, command execution, file reading, authentication bypass, directory traversal, deserialization, and cross-site scripting. The parameter name is used to indicate the field name that carries the attack payload. The parameter value is used to indicate the actual content corresponding to the field. The encoding method is used to indicate one of the encoding states: plaintext, percent encoding, Base64 encoding, Unicode encoding, and mixed encoding. The payload fragment position is used to indicate the position of the attack payload in the request path, request header fields, request parameters, or request body. The above discrete identifiers are input into the request-side embedding layer, which includes an alarm rule identifier embedding table, an attack type identifier embedding table, a parameter name embedding table, a parameter value lexical embedding table, an encoding method embedding table, and a payload fragment position embedding table. The output dimension of each embedding table is set to 128, and the embedding vectors corresponding to the same request lexical are added together to form the request-side attack intent feature. For response-oriented transactions, response-side information is extracted based on the response status code, response header fields, protocol transaction status, response body boundaries, response start time, response end time, and response content length from the protocol parsing results. The response status code indicates the protocol layer's return status; the response header fields represent key-value fields in the response message; the protocol transaction status indicates one of the following transaction outcomes: normal completion, redirection, authentication failure, permission denial, service exception, or connection interruption; the response body tokens represent the tokens obtained after segmenting the response body text fragments, structured fields, and binary digests; the response latency represents the difference between the response start time and the request end time; and the response content length represents the number of bytes in the response body. The response status code, response header field, protocol transaction status, and response body terms are input into the response-side embedding layer. The output dimension of each embedding table is set to 128. The response latency is normalized to a latency numerical feature according to the interval of 0 to 10 seconds. The response content length is normalized to a length numerical feature according to the maximum response content length in the current connection segment. The embedding vector, latency numerical feature, and length numerical feature are concatenated to form the response-side protocol semantic features. The payload echo features are generated by segmenting the request payload fragment and the response body fragment into word sequences and calculating the word overlap rate between them. The word overlap rate is the proportion of the number of words in the request payload fragment and the response body fragment to the total number of words in the request payload fragment. At the same time, the summary similarity between the hash digest of the request payload fragment and the hash digest of the response body fragment is calculated. The attention weights of the request words to the response words are read from the cross-attention matrix of the dual-branch encoder. The word overlap rate, summary similarity and cross-attention weights are concatenated to form the payload echo features. Generate session state change features by reading the authentication state, permission state, resource visibility, and subsequent access path of the same session before and after the transaction in the request direction from the associated asset service state. The authentication state is used to indicate whether the access subject has changed from an unauthenticated state to an authenticated state. The permission state is used to indicate whether the access subject's permission level has been upgraded. The resource visibility is used to indicate whether the resource that was not visible before the request has become visible after the response. The subsequent access path is used to indicate the set of service paths to continue accessing after the response. The authentication state difference, permission state difference, resource visibility difference, and subsequent access path difference are concatenated to form the session state change features. The request-side attack intent features and payload echo features are input into the request branch encoder, and the response-side protocol semantic features, payload echo features, and session state change features are input into the response branch encoder. Both the request branch encoder and the response branch encoder adopt a two-layer Transformer coding structure. Each layer includes four attention heads, a multi-head self-attention layer with a dimension of 128, a feedforward layer with a dimension of 256, a residual connection layer, and a layer normalization layer. The parameters of the two branches are independent of each other. The request branch encoder outputs the request hidden representation, the response branch encoder outputs the response hidden representation, and a bidirectional semantically aligned representation is obtained through a cross-attention matrix. The computational relationship is as follows: ,in, This represents bidirectional semantic alignment. Pool indicates an average pooling operation on the lexical dimension, and Concat indicates a vector concatenation operation. This indicates the request hidden representation of the output of the request branch encoder. This represents the response hidden representation of the response branch encoder output. This represents the cross-attention matrix between request terms and response terms. This represents the response-aligned representation obtained by weighting the response hidden representation according to the cross-attention matrix, where e represents the payload echo feature. Indicates characteristics of session state changes; The generated bidirectional semantic alignment representation, along with the request-response association confidence, request-side attack intent characteristics, response-side protocol semantic characteristics, response latency characteristics, response content length characteristics, payload echo characteristics, and session state change characteristics of the bidirectional transaction unit, is written into the feature field of the bidirectional transaction unit for use in step S4 to construct a dynamic heterogeneous spatiotemporal graph and in step S5 to perform evidence gating classification.

[0022] In this specific embodiment, S4 includes: A dynamic heterogeneous spatiotemporal graph is constructed for the bidirectional transaction units, connections, hosts, services, alarms, and asset service statuses after writing the feature fields in step S3. The dynamic heterogeneous spatiotemporal graph refers to a graph structure in which node type, edge type, and timestamp are explicitly recorded and can be incrementally updated as the collection time progresses. A transaction node is generated for each bidirectional transaction unit, a connection node is generated for the connection fragment in step S1, a host node is generated for the source address and destination address in the 5-tuple, a service node is generated for the service listening address, service listening port and service protocol in the asset service status log, an alarm node is generated for a single alarm record in the intrusion detection system alarm log and the intrusion prevention system alarm log, and an asset service status node is generated for the status snapshot of the same host and the same service at a collection time in the asset service status log. Graph connections are established according to edge types. When a transaction node originates from a connection segment, an edge belonging to the same connection is established between the transaction node and the connection node. When the alarm rule identifier associated with a transaction node is consistent with the alarm rule identifier in an alarm node, an edge hitting the same alarm rule is established between the transaction node and the alarm node. When the destination address, destination port, and transport layer protocol accessed by a transaction node are consistent with those of a service node, an edge accessing the same service is established between the transaction node and the service node. When the difference between the request end time or response start time of two transaction nodes does not exceed sixty seconds, an edge occurring within a preset time window is established between the two transaction nodes. When the current asset service state node and the next asset service state node correspond to the same host and the same service, and the snapshot time of the next state is later than the snapshot time of the previous state, a state transition edge is established between them. When two transaction nodes correspond to the request-direction transaction and the response-direction transaction in the same bidirectional transaction unit, a request-response association edge is established between the request-side representation and the response-side representation within the transaction node, and the request-response association confidence obtained in step S2 is used as the edge attribute of the request-response association edge. For each node, write the node timestamp, node type, and node characteristics. The node characteristics of a transaction node are formed by concatenating the bidirectional semantic alignment representation, request-side attack intent characteristics, response-side protocol semantic characteristics, payload echo characteristics, response latency characteristics, response content length characteristics, and session state change characteristics obtained in step S3. The node characteristics of a connection node are formed by encoding the connection identifier, 5-tuple, direction field, and packet sequence statistics. The node characteristics of a host node are formed by encoding the host address, host role, and historical alarm count. The node characteristics of a service node are formed by encoding the service listening port, service protocol, and service online status. The node characteristics of an alarm node are formed by encoding the alarm rule identifier, attack type identifier, handling action, blocking result, and alarm severity level. The node characteristics of an asset service status node are formed by encoding the authentication state, permission state, resource visibility, service online status, and subsequent access path. Write the edge type, edge timestamp, and edge attributes for each edge. The edge timestamp is the later timestamp of the transaction node or status node connected to the edge. The edge attributes include at least the request-response association confidence, time interval, and edge type embedding vector. The dimension of the edge type embedding vector is set to 64. After constructing the graph, a graph neural network is used to aggregate neighborhood messages according to edge type. The graph neural network adopts a two-layer heterogeneous graph attention aggregation structure with a hidden dimension of 128 and 4 attention heads. Each layer sets a message transformation matrix according to edge type and performs a weighted summation of neighborhood messages of different edge types. The aggregation relationship is as follows: ; in, Represents a node In the Layer node representation, This indicates the node that is currently being updated. This represents the layer number in a graph neural network. Represents a non-linear activation function. Indicates the first The self-node transformation matrix of the layer, Represents a node In the Layer node representation, Represents a set of edge types. Represents a set of edge types One of the edge types, Indicates by edge type With nodes The set of connected neighbor nodes, Represents the set of neighboring nodes One of the neighboring nodes, Representing neighboring nodes By edge type To the node Attention weights when transmitting messages Indicates the first Layer corresponding edge type The message transformation matrix, Representing neighboring nodes In the Layer node representation, This represents the summation operation; After the two-layer graph neural network outputs, the final node representation of each transaction node is read as a graph context vector and input into the timing converter model in the time order within the same session. The same session refers to a transaction sequence with the same connection identifier, or with the same source address, destination address, source port, destination port and transport layer protocol and adjacent transaction time intervals not exceeding 300 seconds. The time-series converter model adopts a two-layer Transformer encoding structure, with a hidden dimension of 128, an attention head of 4, and a feedforward layer dimension of 256. The input is obtained by adding the graph context vector, the position encoding corresponding to the node timestamp, and the adjacent transaction time interval encoding. When the adjacent transaction time interval is greater than 300 seconds, it is truncated to 300 seconds for encoding. The time-series converter model performs time-series modeling on the sequential relationship of multiple rounds of request and response, concurrent alarm relationship, access to the same service relationship, and the sequential relationship of asset service status within the same session. The output vector at the corresponding position of the transaction node is determined as the concurrent context representation of the bidirectional transaction unit. The concurrent context representation, along with the bidirectional semantic alignment representation, request-response association confidence, and graph context vector, are written into the bidirectional transaction unit for the three-branch evidence gating classifier in step S5 to determine whether the attack is successful, the attack is unsuccessful, or the evidence is insufficient.

[0023] In this specific embodiment, S5 includes: For each bidirectional transaction unit after writing the concurrent context representation in step S4, perform echo semantic state three-branch evidence gating classification processing of the associated confidence constraint. First, read the bidirectional semantic alignment representation, concurrent context representation, request-response associated confidence, request payload encoding, response body encoding, response status code, response header field, response latency, response content length, protocol transaction status and session state summary in the bidirectional transaction unit. The bidirectional semantic alignment is used to represent the input attack intent scoring layer, which consists of a fully connected layer with an input dimension of 128, a fully connected layer with a hidden dimension of 64, and a sigmoid output layer. This layer is used to generate an attack intent score, which represents the degree to which the request-direction transaction has a genuine attack intent. The concurrent context is input to the graph context scoring layer, which consists of a fully connected layer with an input dimension of 128, a fully connected layer with a hidden dimension of 64, and a sigmoid output layer. It is used to generate a graph context score, which represents the degree of support for the success of attack determination by the same session, the same service, the same alarm rule, and the asset service status inheritance relationship. The three-branch evidence gating classifier includes an echo evidence branch, a protocol semantic evidence branch, and a state change evidence branch. The inputs of the three branches are first unified to the same feature space through a feature mapping layer with a dimension of 128, and then passed through two fully connected networks. The first hidden layer has a hidden dimension of 128, and the second hidden layer has a hidden dimension of 64. The activation function is ReLU, and the output layer uses Sigmoid, so that the outputs of each branch are normalized to 0 to 1. In the echo evidence branch, the request payload is segmented into a sequence of request tokens based on parameter names, parameter values, encoding markers, and payload fragment positions. The response body is segmented into a sequence of response tokens based on text fragments, structured fields, and binary digests. Parameter names represent the names of fields carrying the payload in the request, parameter values ​​represent the content corresponding to the fields, encoding markers represent plaintext, percent encoding, Base64 encoding, Unicode encoding, or mixed encoding, payload fragment positions represent the position of the payload in the request path, request header fields, request parameters, or request body, text fragments represent continuous text content in the response body, structured fields represent key-value content in JSON, XML, form, or protocol fields, and binary digests represent hash digests generated after dividing the non-text response body into fixed-length blocks. For the request and response token sequences, calculate the token alignment ratio, summary similarity, and cross-attention weight. The token alignment ratio is the proportion of tokens in the request sequence that can be matched in the response sequence out of the total number of request tokens. The summary similarity is the proportion of identical summary segments between the request payload segment summary and the response body segment summary out of the union of their summary segments. The cross-attention weight is calculated in step [step / step]. The average attention value between request and response terms within the cross-attention matrix; The echo evidence branch weights the token alignment ratio, summary similarity, and cross-attention weights according to the weights obtained from training on the calibration sample set, and generates an echo evidence score with the request-response association confidence as an upper limit constraint. When the echo evidence score is not less than the echo threshold of 0.65 determined and fixed by the calibration sample set, an echo evidence label is generated. The echo evidence label is used to identify that the attack payload or its key segments have appeared in the response body. In the protocol semantic evidence branch, a pattern hit vector is generated based on the response status code, authentication redirect address, error stack keyword, database error keyword, file return header field, service banner field, and abnormal response header field. The response status code is used to indicate the result returned by the protocol layer. The authentication redirect address is used to indicate the redirect position in the response header field that points to the login page or authorization page. The error stack keyword is used to indicate the abnormal call chain text that appears in the response body. The database error keyword is used to indicate the SQL execution exception, syntax error, or database type leakage text. The file return header field is used to indicate the response header related to file download, file type, or file length. The service banner field is used to indicate the service name, version number, or middleware identifier. The abnormal response header field is used to indicate the debugging field, internal path field, or error tracking field that appears in abnormal business responses. The pattern hit vector and response body encoding are concatenated and input into the protocol semantic evidence branch to generate a protocol success evidence score. When the protocol success evidence score reaches the corresponding evidence label threshold, evidence labels are generated in the status code success, sensitive file return, database error leakage, service banner leakage, or abnormal response header leakage. In the state change evidence branch, the differences before and after the session are calculated for the authentication state, permission state, resource visibility, response content length, response latency, and subsequent access path. The authentication state difference indicates whether the access subject has changed from an unauthenticated state to an authenticated state. The permission state difference indicates whether the access subject's permission level has been upgraded. The resource visibility difference indicates whether a resource that was not visible before the request has become visible after the response. The response content length difference indicates the change in the current response content length relative to the historical response content length of the same session. The response latency difference indicates the change in the current response latency relative to the historical response latency of the same session. The subsequent access path difference indicates the difference between the set of newly accessible paths after the response and the set of paths before the response. The state transition evidence score is generated by inputting the differential inputs of the above-mentioned sessions into the state transition encoder. The state transition encoder consists of a differential feature mapping layer with a dimension of 128, a gated recurrent unit with a dimension of 64, and a sigmoid output layer, which is used to encode the sequential relationship of state changes within the same session. The credibility of an attack's success and the determination of the outcome are based on the following formula: , ; in, Indicates the credibility of a successful attack. This indicates the confidence level of the request-response association. This indicates the score of the evidence to be displayed. Indicates the evidence score for the success of the agreement. Indicates the state transition evidence score. The score represents the intent to attack. Indicates the graph context score. The fusion weights of the echo evidence scores are represented and taken as follows: The fusion weight of the evidence score indicating the success of the protocol is taken. The fusion weights of the state transition evidence scores are taken as follows: The fusion weights represent the attack intent scores and are taken as follows: The fusion weights represent the graph context scores and are taken as follows: This indicates the conclusion of the judgment. Indicates the correlation threshold and takes Indicates the intent threshold and takes Indicates the success threshold and takes The failure threshold is set to 0.40, { indicates conditional judgment operation, and other cases indicate cases where the attack success condition and the attack failure condition are not met. The fusion weights are trained and solidified by the contribution of each score in the calibration sample set to the attack success label. The association threshold, intent threshold, success threshold and failure threshold are determined and solidified by the preset quantiles of the corresponding score distribution in the calibration sample set, and the failure threshold is not greater than the success threshold. When the judgment conclusion is that the attack was successful, the attack success confidence level, the judgment conclusion, and the evidence tags triggered by the echo evidence branch, the protocol semantic evidence branch, and the state change evidence branch are output. When the judgment conclusion is that the attack failed, the attack failure conclusion is output and the evidence tags of no successful response or no state transition are output. When the request-response association confidence level is less than the association threshold or the evidence does not meet the success or failure conditions, the evidence insufficient conclusion is output and the evidence tags of insufficient association confidence level, insufficient echo, insufficient protocol semantics, or insufficient state change are output.

[0024] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0025] This invention maps bidirectional network traffic, alarm logs, protocol parsing logs, and asset service status logs into bidirectional transaction units with associated confidence levels. This enables the attack intent on the requesting side, the success evidence on the responding side, the payload echo relationship, session state changes, and concurrency context to be modeled in the same processing chain. This provides a reproducible technical process to address the problem that traditional unidirectional alarms make it difficult to confirm whether an attack was successful.

[0026] The present invention further sets up a three-branch evidence gating module for echo semantic state with associated confidence constraints, and uses the association confidence of request and response as the upper limit of the gating or penalty factor for evidence fusion, so that the credibility of the final attack success is simultaneously constrained by echo evidence, protocol semantic evidence, state transition evidence and association quality, thereby reducing the noise of attack attempt alarms and supporting the triggering of subsequent processing.

Claims

1. A method for determining the success of a bidirectional traffic attack, characterized in that, include: S1. Obtain bidirectional network traffic, intrusion detection system alarm logs, intrusion prevention system alarm logs, protocol parsing logs, and asset service status logs. Standardize the connection identifier, 5-tuple, timestamp, protocol transaction sequence number, direction field, and data packet sequence information to generate candidate request-response transactions. S2. A deterministic association score is generated when the request-direction transaction and the response-direction transaction have the same connection identifier or the same 5-tuple and the protocol transaction sequence number is consistent. When the protocol transaction sequence number is missing, a soft matching score is generated based on the time difference between the request end time and the response start time, the similarity of the payload digest, the combination of the protocol method and the response state, and the packet sequence interval. The deterministic association score and the soft match score are weighted and normalized according to calibration weights to obtain a request-response association confidence score with a value range of 0 to 1, wherein the calibration weights are obtained by normalizing the deterministic association hit rate and soft match hit rate in historically labeled request-response pairing samples; the candidate request-response transaction and the request-response association confidence score are encapsulated into a bidirectional transaction unit. S3. Extract the attack intent features on the request side, the protocol semantic features on the response side, the payload echo features, the response latency features, the response content length features, and the session state change features from the bidirectional transaction unit, and input them into the dual-branch encoder to obtain a bidirectional semantic alignment representation; S4. Using bidirectional transaction units, connections, hosts, services, alarms, and asset service status as nodes, and edges belonging to the same connection, hitting the same alarm rule, accessing the same service, occurring within a preset time window, inheriting previous and subsequent states, and request-response association, a dynamic heterogeneous spatiotemporal graph is constructed; the node timestamp, node type, edge type, and the request-response association confidence are written into the graph attributes; the graph neural network is used to aggregate neighborhood messages according to edge type to obtain the graph context vector; the graph context vectors within the same session are input into the time-series converter model; The timing converter model performs timing modeling on the sequential relationship of multiple rounds of request responses, concurrent alarm relationships, access to the same service relationships, and the sequential relationship of asset service status within the same session, and determines the output vector at the corresponding position of the transaction node as the concurrent context representation of the bidirectional transaction unit; S5. Input the bidirectional semantic alignment representation, concurrent context representation, and request-response association confidence into the echo semantic state three-branch evidence gating classifier with association confidence constraint, and output the judgment conclusion of attack success, attack failure, or insufficient evidence, as well as the corresponding evidence label.

2. The method for determining the success of a bidirectional traffic attack according to claim 1, characterized in that, S1 includes: Network bidirectional traffic is segmented into connection segments based on source address, destination address, source port, destination port, transport layer protocol, and direction field; Based on the data packet sequence information and protocol parsing logs, reassemble the protocol transactions; map the intrusion detection system alarm logs, intrusion prevention system alarm logs, and asset service status logs to the corresponding connection segments according to their timestamps; pair the request-direction transactions and response-direction transactions within the same connection segment according to their protocol transaction sequence number and time order to obtain the candidate request-response transactions.

3. The method for determining the success of a bidirectional traffic attack according to claim 1, characterized in that, S3 includes: encoding the alarm rule identifier, attack type identifier, parameter name, parameter value, encoding method, and payload fragment position in the request payload to obtain the request-side attack intent feature; encoding the response status code, response header field, protocol transaction status, response body lexical, response latency, and response content length to obtain the response-side protocol semantic feature; generating payload echo features based on the lexical overlap rate, hash digest similarity, and cross-attention weight between the request payload fragment and the response body fragment; generating session state change features based on the session before-and-after digest difference of the authentication state, permission state, resource visibility, and subsequent access paths; the authentication state indicates whether the access subject has changed from an unauthenticated state to an authenticated state, and the permission state indicates whether the access subject's permission level has been upgraded; inputting the request-side attack intent feature, the response-side protocol semantic feature, the payload echo feature, and the session state change feature into the request branch encoder and the response branch encoder, and outputting the bidirectional semantic alignment representation by the cross-attention matrix.

4. The method for determining the success of a bidirectional traffic attack according to claim 1, characterized in that, S5 includes: generating an attack intent score, a response success evidence score, and a state change score from the bidirectional semantic alignment representation; generating a graph context score from the concurrent context representation; inputting the request payload encoding, response body encoding, response status code, response header field, response latency, response content length, protocol transaction state, session state summary before and after, and the request-response association confidence score into the three-branch evidence gating classifier; the three-branch evidence gating classifier includes an echo evidence branch, a protocol semantic evidence branch, and a state change evidence branch, and outputs the attack success confidence score, evidence label, and the judgment conclusion.

5. The method for determining the success of a bidirectional traffic attack according to claim 4, characterized in that, The echo evidence branch includes: segmenting the request payload into a request lexical sequence based on parameter name, parameter value, encoding tag, and payload fragment position; segmenting the response body into a response lexical sequence based on text fragment, structured field, and binary summary; calculating the lexical alignment ratio, summary similarity, and cross-attention weight for the request lexical sequence and the response lexical sequence; applying an upper limit constraint to the weighted sum of the lexical alignment ratio, the summary similarity, and the cross-attention weight based on the request-response association confidence, to obtain an echo evidence score ranging from 0 to 1, wherein the weights in the weighted sum are obtained by training with a calibration sample set; and generating an echo evidence label when the echo evidence score is not less than the echo threshold determined by the calibration sample set.

6. The method for determining the success of a bidirectional traffic attack according to claim 4, characterized in that, The protocol semantic evidence branch includes: generating a pattern hit vector based on the response status code, authentication jump address, error stack keywords, database error keywords, file return header fields, service banner fields, and abnormal response header fields, and concatenating the pattern hit vector with the response body encoding to generate a protocol success evidence score; the state change evidence branch includes: calculating the session difference before and after for authentication state, permission state, resource visibility, response content length, response latency, and subsequent access path, and inputting the session difference before and after for the state transition encoder to generate a state transition evidence score; both the protocol success evidence score and the state transition evidence score are normalized to 0 to 1.

7. The method for determining the success of a bidirectional traffic attack according to claim 6, characterized in that, The attack success confidence is generated as follows: the echo evidence branch weights the token alignment ratio, summary similarity and cross attention weights according to the weights obtained by training the calibration sample set, and generates the echo evidence score with the request-response association confidence as the upper limit constraint; The echo evidence score, the protocol success evidence score, the state transition evidence score, the attack intent score, the graph context score, and the request-response association confidence score are input into the evidence fusion layer. The evidence fusion layer calculates a basic fusion score using the fusion weights of the calibration sample set, and uses the product of the basic fusion score and the request-response association confidence score as the attack success confidence score. When the confidence level of the request-response association is less than the association threshold, the output is "insufficient evidence". When the attack intent score is not less than the intent threshold and the attack success confidence level is not less than the success threshold, the output is "attack successful". When the attack intent score is not less than the intent threshold and the attack success confidence level is less than the failure threshold, the output is "attack failed". In other cases, the output is "insufficient evidence". The association threshold, the intent threshold, the success threshold and the failure threshold are determined by the preset quantile of the corresponding score distribution in the calibration sample set, and the failure threshold is less than the success threshold.

8. The method for determining the success of a bidirectional traffic attack according to claim 1, characterized in that, The dual-branch encoder, the graph neural network, the time-series converter model, and the three-branch evidence gating classifier are trained in the following manner: successful attack samples, failed attack samples, and insufficient evidence samples are constructed from historical bidirectional traffic samples, historical alarm handling records, and manual review records. The request-response association confidence calculation parameters are trained using request-response paired labels, the dual-branch encoder and the three-branch evidence gating classifier are trained using attack success labels, and the graph neural network and the time-series converter model are trained using multiple rounds of request-response sequence within the same session. The training loss includes classification loss, request-response association loss, echo alignment loss, and state transition consistency loss. When the classification loss on the validation sample set does not change by more than a preset convergence threshold within consecutive preset rounds, the model parameters are output.

Images