A network attack tracing method and system based on multi-dimensional feature fusion

Abstract

The application belongs to the technical field of Internet of Things security, and discloses a network attack tracing method and system based on multi-dimensional feature fusion, which comprises the following steps: obtaining communication messages in a network, analyzing protocol fields, communication time sequences and node interaction relationships corresponding to network security communication protocols, constructing a multi-dimensional communication feature set, and generating network behavior correlation information according to the multi-dimensional communication feature set; calling the network behavior correlation information, extracting immutable protocol features from the communication messages passing through each network node to generate a communication message digest, storing the communication message digest into a member query bit array of a corresponding node based on hash mapping, and forming path evidence information corresponding to each network node; identifying attack propagation relationships according to the network behavior correlation information, and executing reverse member query in combination with the path evidence information corresponding to each network node; and accurately positioning and protecting against the network attack propagation process.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and more specifically, to a method and system for tracing network attacks based on multi-dimensional feature fusion. Background Technology

[0002] As network communication scale continues to expand, the data interaction relationships between network nodes are becoming increasingly complex, and network attacks are gradually exhibiting characteristics of concealment and linking. Existing network attack tracing technologies typically rely on network logs, traffic records, and node connection relationships to analyze attack paths. However, in real-world network environments, communication packets may be forwarded through multiple intermediate nodes. Traditional methods struggle to fully record the actual node information that packets pass through, easily leading to missing attack propagation paths and making it impossible to accurately reconstruct the propagation process of attack behaviors.

[0003] Meanwhile, existing source tracing methods based on traffic records typically require storing large amounts of communication logs or complete message information, which not only increases the storage pressure on the node side but is also susceptible to factors such as missing or incomplete logs in complex communication scenarios, leading to biases in attack path analysis. Furthermore, since some communication fields may change during transmission, existing methods struggle to guarantee the consistency of communication behavior records between different nodes and lack a mechanism for verifying the authenticity of suspicious messages based on the node's own communication evidence.

[0004] On the other hand, existing network access control methods typically employ pre-configured role permissions or fixed authorization policies. When network nodes are affected by attacks and participate in attack propagation, they may still retain their original permissions, making it impossible to dynamically adjust the node's access scope based on attack attribution results. Furthermore, existing permission management methods lack a way to analyze permissions by combining them with the node's historical legitimate behavior, making it difficult to accurately distinguish between a node's normal usage permissions and permissions that may be exploited by attacks.

[0005] In view of this, the present invention proposes a network attack tracing method based on multi-dimensional feature fusion to solve the above problems. Summary of the Invention

[0006] To overcome the aforementioned shortcomings of existing technologies and to achieve the above objectives, this invention provides the following technical solution: a network attack tracing method based on multi-dimensional feature fusion, comprising: S1. Obtain communication messages in the network, parse the protocol fields, communication timing and node interaction relationships corresponding to the network security communication protocol, construct a multi-dimensional communication feature set, and generate network behavior association information based on the multi-dimensional communication feature set; S2. Call the network behavior association information, extract the immutable protocol features of the communication messages passing through each network node to generate a communication message digest, and store the communication message digest into the member query bit array of the corresponding node based on hash mapping to form the path evidence information corresponding to each network node; S3. Identify attack propagation relationships based on network behavior association information, perform reverse member queries in conjunction with path evidence information corresponding to each network node, verify the authenticity of nodes through which suspicious packets pass, and generate network attack tracing paths and attack source node information. S4. Based on the attack source node information, determine the affected nodes located on the network attack tracing path, and generate permission masks based on the historical legitimate behavior of each affected node, and perform permission convergence on the affected nodes; when the affected node is a relay node in the network attack tracing path, reset the corresponding permissions to the preset minimum permission set and generate dynamic access control results.

[0007] Preferably, the method for constructing a multi-dimensional communication feature set includes: The system acquires communication messages transmitted between network nodes, parses the communication messages according to the network security communication protocol format corresponding to the communication messages, and obtains the protocol field information; based on the time stamps corresponding to several communication messages with the same source node identifier and destination node identifier, the communication messages are sorted by time, and the time intervals, message request and response order and protocol state change relationships between adjacent communication messages are obtained to form communication timing characteristics. Based on the source node identifier and destination node identifier corresponding to the communication message, the network nodes participating in the communication are determined. Based on the data sending direction, communication connection relationship and message exchange number between the network nodes, the interaction relationship between the network nodes is established, and node interaction characteristics are generated. Protocol fields, communication timing characteristics and node interaction characteristics are integrated to form a multi-dimensional communication characteristic set.

[0008] Preferably, the method for generating network behavior association information includes: Obtain protocol field information, communication timing features, and node interaction features from a multi-dimensional communication feature set. Determine the data transmission direction between network nodes based on the node interaction features, and determine the corresponding protocol state change relationship between network nodes based on the protocol field information. Based on the communication timing characteristics, the temporal sequence relationship between different communication behaviors is determined, and network nodes with continuous communication relationships, protocol state change relationships, and temporal correlation relationships are associated to generate node behavior correlation relationships; Based on the node behavior association, network nodes participating in communication are designated as associated nodes, and the communication relationships between network nodes are designated as associated connections. A network behavior association structure is constructed, and the associated connections are identified based on protocol field information, communication timing characteristics, and node interaction characteristics to generate network behavior association information.

[0009] Preferably, the method for generating a communication message digest includes: The system retrieves network behavior association information to determine the network nodes participating in the communication and the communication messages passing through each network node. It then parses the protocol fields of the communication messages to extract the source node address, destination node address, protocol type, source port number, destination port number, and payload characteristics as immutable protocol features. The immutable protocol features are combined according to a preset field order to form the feature data corresponding to the communication message, and a digest calculation is performed on the feature data to generate a communication message digest.

[0010] Preferably, the method for forming path evidence information corresponding to each network node includes: Establish a corresponding member query bit array for each network node and initialize each storage bit in the member query bit array to a preset state; obtain the member query bit array of the corresponding network node according to the transmission node corresponding to the communication message; The communication message digest is input into several independent hash functions for mapping to obtain several storage locations in the member query bit array; the storage bits corresponding to each storage location in the member query bit array are updated to the set state, while keeping the current state of the remaining storage bits unchanged; the set member query bit array is stored as the path evidence information of the corresponding network node.

[0011] Preferably, the method for generating network attack tracing paths and attack source node information includes: The system retrieves network behavior association information and determines candidate attack propagation relationships corresponding to suspicious communication behaviors based on data transmission direction, communication time correlation, and protocol state change relationships between network nodes. It then obtains path evidence information corresponding to candidate network nodes according to the propagation direction of the candidate attack propagation relationships and extracts immutable protocol features from suspicious packets to generate a query digest. The digest to be queried is mapped by several hash functions that are the same as those in the path evidence storage process. The query position in the corresponding member query bit array is obtained, and the member query is executed according to the storage state corresponding to each query position to generate the node authenticity verification result. When all the storage bits corresponding to all hash mapping positions in the member query bit array are set, it is determined that the suspicious message has passed through the corresponding candidate network node; based on the node authenticity verification results corresponding to several candidate network nodes, the candidate attack propagation relationship is filtered. The verified node relationships are combined to generate a network attack tracing path; the attack source node information is determined based on the propagation direction corresponding to the network attack tracing path and the order of communication behavior in the network behavior association information.

[0012] Preferably, the method for determining the affected nodes located on the network attack tracing path includes: The network attack tracing path and attack source node information are called. The attack source node is taken as the starting node of the attack propagation. The network nodes in the network attack tracing path are traversed in turn according to the data transmission direction corresponding to the network attack tracing path. The network nodes located after the attack source node and having a continuous propagation relationship with the attack source node are determined, and the set of affected nodes is generated. Obtain the order of communication behavior occurrence for each affected node in the network behavior association information, sort the network nodes in the affected node set according to the order of communication behavior occurrence, and generate the affected node sequence.

[0013] Preferably, the method for performing permission convergence on the affected nodes includes: Obtain the historical legal behavior records corresponding to the affected nodes. Based on the operation type, accessed resources, and command execution information in the historical legal behavior records, determine the set of legal operation permissions corresponding to the affected nodes. Generate the permission mask corresponding to the affected nodes based on the set of legal operation permissions. Obtain the current permission status of the affected nodes. Perform bitwise operations on the current permission status and the corresponding permission mask to generate the permission status after permission convergence.

[0014] Preferably, the method for generating dynamic access control results includes: Obtain information about affected nodes and the corresponding network attack tracing path. Based on the node connection relationship and data transmission direction in the network attack tracing path, determine whether the affected nodes receive communication messages sent by the preceding nodes in the attack propagation path and forward the corresponding communication messages to the following nodes. When an affected node has both preceding and following communication nodes, the affected node is identified as a relay node in the network attack tracing path. The current permission status of the relay node is obtained, the current permission status is adjusted to the preset minimum permission set, and the adjusted permission status is associated with the network attack tracing path to generate a dynamic access control result.

[0015] A network attack attribution system based on multi-dimensional feature fusion includes: The network communication construction module is used to acquire communication messages in the network, parse the protocol fields, communication timing and node interaction relationships corresponding to the network security communication protocol, construct a multi-dimensional communication feature set, and generate network behavior association information based on the multi-dimensional communication feature set; The path evidence storage module is used to call network behavior association information, extract immutable protocol features from communication messages passing through each network node to generate communication message digests, and store the communication message digests into the member query bit array of the corresponding node based on hash mapping, thus forming path evidence information corresponding to each network node. The attack path tracing module is used to identify attack propagation relationships based on network behavior association information, perform reverse member queries in combination with path evidence information corresponding to each network node, verify the authenticity of nodes through which suspicious packets pass, and generate network attack tracing paths and attack source node information. The permission dynamic convergence module is used to determine the affected nodes on the network attack tracing path based on the attack source node information, and generate permission masks based on the historical legitimate behavior of each affected node, and perform permission convergence on the affected nodes; when the affected node is a relay node in the network attack tracing path, the corresponding permissions are reset to the preset minimum permission set, and dynamic access control results are generated.

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention establishes an independent member query bit array for each network node, performs hash mapping based on communication message digests, and converts the information of communication messages passing through nodes into path evidence information. This allows each network node to autonomously save evidence related to communication behavior, providing node-level verification for subsequent attack path backtracking. This invention utilizes the immutable protocol characteristics in communication messages to generate digest information, avoiding reliance on volatile communication fields. This ensures that the same communication behavior maintains consistent feature expression across different nodes, improving the consistency and queryability of path evidence. By using digest mapping and bit array storage to record relevant information, it eliminates the need to save the complete communication message, retaining only the corresponding digest storage state, reducing the storage scale of path evidence on the node side, while supporting rapid querying of historical communication behavior.

[0017] This invention maps communication message digests using multiple hash functions and writes the mapped positions into the member query bit array of the corresponding node, allowing each node to generate independent path evidence information. In subsequent attack tracing, the path evidence stored by each node can be used to verify whether a suspicious message has passed through that node, providing a basis for identifying attack propagation relationships and locating the attack source node. This invention combines network behavior association information with node path evidence information to verify the authenticity of candidate attack propagation nodes. It ensures that attack propagation relationships are no longer determined solely by network connectivity, but rather by combining the communication evidence stored by each node to determine the nodes that suspicious messages actually pass through, thus improving the accuracy of attack tracing path determination. By using a member query mechanism to reverse-verify path evidence information, the network nodes that actually participate in attack propagation can be identified. Then, based on the verification results, an attack tracing path is generated, providing a reliable basis for locating the attack source node.

[0018] This invention can identify affected nodes based on the attack tracing path, generate permission masks by combining the historical legitimate behavior of these nodes, and associate the current permission status of the nodes with the actual historical operation range. By adjusting the node permissions through bitwise permission convergence, it avoids the affected nodes retaining operation permissions unrelated to historical legitimate behavior. At the same time, it links attack tracing with access control, making network attack detection, attack path location and permission adjustment a continuous processing flow. It can dynamically adjust the access range of affected nodes according to the attack propagation, and realize dynamic permission management for attack behavior. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of a network attack tracing method based on multi-dimensional feature fusion according to the present invention; Figure 2 This is a schematic diagram of a network attack tracing system based on multi-dimensional feature fusion according to the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example

[0021] Please see Figure 1 As shown, this embodiment provides a network attack tracing method based on multi-dimensional feature fusion, which specifically includes the following steps: S1. Obtain communication messages in the network, parse the protocol fields, communication timing and node interaction relationships corresponding to the network security communication protocol, construct a multi-dimensional communication feature set, and generate network behavior association information based on the multi-dimensional communication feature set; S2. Call the network behavior association information, extract the immutable protocol features of the communication messages passing through each network node to generate a communication message digest, and store the communication message digest into the member query bit array of the corresponding node based on hash mapping to form the path evidence information corresponding to each network node; S3. Identify attack propagation relationships based on network behavior association information, perform reverse member queries in conjunction with path evidence information corresponding to each network node, verify the authenticity of nodes through which suspicious packets pass, and generate network attack tracing paths and attack source node information. S4. Based on the attack source node information, determine the affected nodes located on the network attack tracing path, and generate permission masks based on the historical legitimate behavior of each affected node, and perform permission convergence on the affected nodes; when the affected node is a relay node in the network attack tracing path, reset the corresponding permissions to the preset minimum permission set and generate dynamic access control results.

[0022] Methods for constructing multi-dimensional communication feature sets include: The system acquires communication messages transmitted between network nodes, parses the messages according to the network security communication protocol format, and obtains protocol field information, including protocol type, control status, address identifier, and session status. Based on the timestamps of several communication messages with the same source and destination node identifiers, the system sorts the communication messages by time and obtains the time intervals, message request-response order, and protocol status change relationships between adjacent communication messages, forming communication timing characteristics. In this embodiment, it should be noted that, based on the data structure of the network security communication protocol, the protocol type field, control state field, source node identifier, destination node identifier, and session state field in the communication message are parsed to obtain the protocol type, communication control state, and network node information involved in the current communication process. Specifically, the protocol type field distinguishes the data interaction methods corresponding to different communication protocols, the control state field records state changes such as connection establishment, data transmission, and connection release during communication, and the session state field determines the current communication stage of the corresponding protocol interaction. For example, in TCP communication, if a set of communication messages is obtained, where the control field of the first message is SYN, the control field of the second message is SYN+ACK, and the control field of the third message is ACK, then parsing the protocol fields can determine the connection establishment stage of the communication process and form the corresponding protocol field information.

[0023] Based on consecutive communication messages with the same source and destination node identifiers, the messages are sorted according to the timestamps they carry. This allows for the acquisition of time intervals between adjacent messages, the order of message requests and responses, and the relationship between protocol state changes, thus forming communication timing characteristics. For example, if three consecutive communication messages sent by node A to node B have timestamps of 10:00:01, 10:00:02, and 10:00:05, the time intervals between adjacent messages are determined to be 1 second and 3 seconds, respectively. Simultaneously, the interaction order of node A sending a request and node B returning a response is determined by combining the message direction, thus forming communication timing characteristics.

[0024] Based on the source node identifier and destination node identifier corresponding to the communication message, the network nodes participating in the communication are determined. Based on the data sending direction, communication connection relationship and message exchange number between the network nodes, the interaction relationship between the network nodes is established, and node interaction characteristics are generated. Protocol fields, communication timing characteristics and node interaction characteristics are integrated to form a multi-dimensional communication characteristic set.

[0025] Specifically, the node corresponding to the source address in the communication message is designated as the sending node, and the node corresponding to the destination address is designated as the receiving node. Based on the node correspondence in multiple communication messages, the data flow direction between different network nodes is determined, and node associations are established based on whether there is a continuous communication connection between nodes and the number of message exchanges. For example, if three communication messages are obtained, where node A sends 20 messages to node B and node B sends 15 messages to node C, the node interaction relationship is determined to be A→B→C, and corresponding node interaction features are generated to represent the data propagation direction in the network.

[0026] Methods for generating network behavior association information include: Obtain protocol field information, communication timing features, and node interaction features from a multi-dimensional communication feature set. Determine the data transmission direction between network nodes based on the node interaction features, and determine the corresponding protocol state change relationship between network nodes based on the protocol field information. It should be noted that, based on the source and destination node identifiers in the node interaction characteristics, the network nodes participating in the communication and the data transmission direction between them are determined. Simultaneously, based on the protocol state changes recorded in the protocol field information, the corresponding protocol state change relationships during communication between different network nodes are determined, thereby establishing the communication behavior connections between nodes. For example, by obtaining the node interaction characteristics from the multi-dimensional communication feature set, it is determined that node A sends a communication message to node B, and node B sends a communication message to node C, forming a data transmission direction A→B→C. Further parsing the protocol field information reveals that the connection between node A and node B changes from a connection establishment state to a data transmission state, and the data reception state between node B and node C changes from a data forwarding state. This establishes a continuous protocol state change relationship between nodes A, B, and C.

[0027] Based on the communication timing characteristics, the temporal sequence relationship between different communication behaviors is determined, and network nodes with continuous communication relationships, protocol state change relationships, and temporal correlation relationships are associated to generate node behavior correlation relationships; Specifically, based on the timestamps corresponding to the communication messages, the communication behaviors generated between different nodes are sorted to determine whether there is a continuous temporal correlation between the different nodes. When a subsequent communication behavior occurs within a preset time range after the previous communication behavior, a temporal correlation is determined to exist between the corresponding network nodes. For example, if node A sends a message to node B at 10:00:01 and node B sends a message to node C at 10:00:03, with a 2-second interval between the two communication behaviors, and node B is both the receiving node of the previous communication behavior and the sending node of the subsequent communication behavior, then a continuous communication relationship and a temporal correlation are determined to exist between nodes A, B, and C.

[0028] Furthermore, network nodes that simultaneously satisfy continuous communication relationships, protocol state change relationships, and time-related relationships are associated to generate node behavior association relationships. Specifically, network nodes are used as association objects, and data transmission relationships between nodes that satisfy the above association conditions are used as node connection relationships. Multiple communication behaviors are combined to form node behavior association relationships that can reflect the behavioral connections between network nodes. For example, if there are nodes A, B, and C in the network, and there is a message transmission relationship between node A and node B, and a subsequent message forwarding relationship between node B and node C, and the protocol state changes of the two sets of communication behaviors are continuous with a time interval of 2 seconds, then the node behavior association relationship corresponding to A→B→C is established.

[0029] Based on the node behavior association, network nodes participating in communication are designated as associated nodes, and the communication relationships between network nodes are designated as associated connections. A network behavior association structure is constructed, and the associated connections are identified based on protocol field information, communication timing characteristics, and node interaction characteristics to generate network behavior association information.

[0030] Specifically, each network node is treated as an associated node. An association connection is established between two nodes with a behavioral relationship. This association connection is identified based on protocol field information, communication timing characteristics, and node interaction characteristics. Each association connection includes corresponding protocol state change information, time sequence information, and data interaction direction information, ultimately generating network behavior association information. For example, if there is a communication association connection between node A and node B, the information corresponding to this connection is determined based on the corresponding communication message: data transmission direction: A→B; protocol state change: connection established → data transmission; time interval: 1 second. This information is appended to the association connection between node A and node B to form network behavior association information with communication behavior attributes.

[0031] Methods for generating communication message digests include: The system retrieves network behavior association information to determine the network nodes participating in the communication and the communication messages passing through each network node. It then parses the protocol fields of the communication messages to extract the source node address, destination node address, protocol type, source port number, destination port number, and payload characteristics as immutable protocol features. The immutable protocol features are combined according to a preset field order to form the feature data corresponding to the communication message, and a digest calculation is performed on the feature data to generate a communication message digest.

[0032] In this embodiment, it should be noted that the network behavior association information records the data transmission direction and corresponding communication relationship between network nodes. Based on the communication relationship, the sending and receiving nodes corresponding to the communication messages are determined, and the communication messages transmitted between these nodes are obtained. For example, if the network behavior association information records a data transmission relationship between node A and node B, with the data direction being A→B, then node A is determined to be the communication message sending node, and node B is the communication message receiving node. The corresponding communication message sent from node A to node B is then obtained.

[0033] Furthermore, the acquired communication messages are parsed for protocol fields. Based on the network security communication protocol format corresponding to the communication message, the source node address, destination node address, protocol type, source port number, destination port number, and payload characteristics are extracted to form immutable protocol characteristics. Specifically, the source node address and destination node address represent the network nodes corresponding to the communicating parties, the protocol type represents the communication protocol used in the communication message, the source port number and destination port number represent the service ports corresponding to the communicating parties, and the payload characteristics represent the data content characteristics carried in the communication message. For example, if a TCP communication message is acquired, its protocol field information includes: source node address: 192.168.1.10; destination node address: 192.168.1.20; protocol type: TCP; source port number: 52000; destination port number: 443; payload length: 1024 bytes. These fields are then extracted as the immutable protocol characteristics corresponding to this communication message.

[0034] Furthermore, the extracted immutable protocol features are arranged and combined according to a preset field order to form feature data corresponding to the communication message. Specifically, the fields are concatenated in the order of source node address, destination node address, protocol type, source port number, destination port number, and payload features to form feature data in a unified format. For example, the immutable protocol features are combined in a preset order as: 192.168.1.10|192.168.1.20|TCP|52000|443|1024; thus obtaining the feature data corresponding to the communication message. A digest calculation is performed on the feature data to convert it into a fixed-length digest value, generating a communication message digest. For example, after inputting the above feature data into the digest calculation process, the following is generated: A82F5C91D73B6E24, which serves as the communication message digest corresponding to this communication message.

[0035] Methods for generating path evidence information for each network node include: Establish a corresponding member query bit array for each network node and initialize each storage bit in the member query bit array to a preset state; obtain the member query bit array of the corresponding network node according to the transmission node corresponding to the communication message; Specifically, firstly, a corresponding member query bit array is established for each network node. This array consists of several binary storage bits, with each bit initially set to 0. Then, the first... The member lookup bit array corresponding to each network node is denoted as The member lookup bit array contains One storage bit; Member lookup bit array ;in, Indicates the first An array of member query bits corresponding to each network node; Indicates the network node number; Indicates the first element in the member lookup bit array. One storage bit; This indicates the index of the bit stored in the member lookup bit array; This indicates the total number of storage bits contained in the member lookup bit array.

[0036] Initialize each storage bit in the member lookup bit array to its preset state: ;in, This indicates the initial state of the storage bits; for example, if a member query bit array of length 1024 is created for node A and a member query bit array of length 1024 is created for node B, then node A and node B each have independent member query bit arrays, and the initial state of both is 1024 consecutive 0s.

[0037] The communication message digest is input into several independent hash functions for mapping to obtain several storage locations in the member query bit array; the storage bits corresponding to each storage location in the member query bit array are updated to the set state, while keeping the current state of the remaining storage bits unchanged; the set member query bit array is stored as the path evidence information of the corresponding network node.

[0038] In one optional implementation, it should be noted that multiple hash mapping calculations are performed on the communication message digest to obtain multiple mapping positions. Specifically, the same communication message digest is input into multiple independent hash functions, and each hash function outputs a corresponding array position number, with each position number falling within the length range of the member query bit array.

[0039] Based on the transmission node corresponding to the communication message, obtain the member query bit array of the corresponding network node; and digest the communication message. Enter them separately By mapping using several independent hash functions, multiple array storage locations corresponding to the communication message digest are obtained: ;in, It represents a message digest, which is generated by digest calculation from the immutable protocol features corresponding to the message. Indicates the first One hash mapping function; Indicates the number of hash functions used; Indicates the first The storage location of the member query bit array calculated by each hash function; Indicates the sequence number of the hash mapping function. Communication message digest. ;in, The digest calculation function is implemented using the existing SHA-256 digest algorithm. This indicates a communication message to be processed. The message feature data represents the message digest to be generated. It does not directly refer to the complete message, but rather to the combination of immutable protocol features extracted from the message. For example, the message digest is: A82F5C91D73B6E24... The member lookup bit array is 1024 bits long. Using three hash functions for mapping, the position numbers are obtained as follows: 125, 486, and 903.

[0040] Furthermore, based on the network nodes through which the communication message passes, the storage bit corresponding to the position number in the corresponding network node member query bit array is set to 1, while the remaining storage bits remain unchanged. That is: ;in, Indicates the first Each network node corresponds to a position in the member query bit array determined by the hash result; This indicates that the corresponding storage location will be updated to the set state; For example, when a communication message passes through node A, bits 125, 486, and 903 in node A's member lookup bit array are changed from 0 to 1. When another communication message passes through node A and is mapped to position numbers 210, 486, and 700, bits 210 and 700 are set to 1, while bit 486 remains 1, without being written repeatedly. As another example, when the same communication message passes through node B, the same message digest is used to perform a hash mapping, and the corresponding positions 125, 486, and 903 in node B's member lookup bit array are set to 1, thus creating a corresponding storage record in node B.

[0041] After multiple communication messages are continuously written, each network node forms its own corresponding member query bit array. The storage bits set to 1 in each member query bit array together constitute the path evidence information corresponding to that network node. For example, if the values ​​of bits 125, 210, 486, 700, and 903 in node A's member query bit array are all 1, and the remaining bits remain 0, then the current state of node A's corresponding member query bit array is saved as the path evidence information corresponding to node A. Node B performs the same hash mapping process based on the communication message digests passing through it, forming the path evidence information corresponding to node B.

[0042] Methods for generating network attack attribution paths and attack source node information include: The system retrieves network behavior association information and determines candidate attack propagation relationships corresponding to suspicious communication behaviors based on data transmission direction, communication time correlation, and protocol state change relationships between network nodes. It then obtains path evidence information corresponding to candidate network nodes according to the propagation direction of the candidate attack propagation relationships and extracts immutable protocol features from suspicious packets to generate a query digest. In one optional implementation, the communication connection relationships between network nodes recorded in the network behavior association information are obtained, and the connection order between nodes is established according to the data transmission direction; then, the communication behaviors between nodes are sorted according to the time identifier corresponding to each communication behavior to form the order of occurrence of communication behaviors; simultaneously, the protocol state change relationships corresponding to each communication behavior are obtained, and the connection relationships of nodes with continuous occurrence order of communication behaviors and continuous protocol state changes are combined to form candidate attack propagation relationships. For example, the following communication behaviors are recorded in the network behavior association information: A B 10:00:01 Connection established → Data transmission B C 10:00:03 Data transmission → Data forwarding C D 10:00:05 Data forwarding → Data reception The data transmission direction is then formed by sorting the communication times: A→B→C→D; combined with the protocol state change relationships corresponding to each communication behavior, the above node connection relationships are combined to form the candidate attack propagation relationship: A→B→C→D.

[0043] Furthermore, according to the propagation direction corresponding to the candidate attack propagation relationship, the corresponding path evidence information is sequentially obtained for the candidate network nodes, and suspicious packets to be traced are obtained. For the suspicious packets, immutable protocol features are extracted according to the aforementioned digest generation method. The source node address, destination node address, protocol type, source port number, destination port number, and payload features are combined according to a preset field order, and digest calculation is performed to generate the digest to be queried. For example, the immutable protocol features corresponding to the suspicious packet are obtained as follows: 192.168.1.10|192.168.1.20|TCP|52000|443|1024; after combining them according to the preset field order, digest calculation is performed to obtain the digest to be queried: A82F5C91D73B6E24. Subsequently, the path evidence information corresponding to nodes A, B, C, and D is obtained respectively, and member query verification is performed based on the digest to be queried to determine whether the suspicious packet passed through the corresponding network node.

[0044] The digest to be queried is mapped by several hash functions that are the same as those in the path evidence storage process. The query position in the corresponding member query bit array is obtained, and the member query is executed according to the storage state corresponding to each query position to generate the node authenticity verification result. Among them, for candidate network nodes and suspicious messages According to the query summary Results of compute node member query: ;in, This indicates that a suspicious message passed through a node. The verification results; Indicates the first Each hash function is used to process the query digest. The query location obtained through mapping; When all the storage bits corresponding to all hash mapping positions in the member query bit array are set, it is determined that the suspicious message has passed through the corresponding candidate network node; based on the node authenticity verification results corresponding to several candidate network nodes, the candidate attack propagation relationship is filtered. The verified node relationships are combined to generate a network attack tracing path; the attack source node information is determined based on the propagation direction corresponding to the network attack tracing path and the order of communication behavior in the network behavior association information.

[0045] Specifically, the network node that first engages in communication and is verified through member queries in the network attack tracing path is identified as the attack source node. Subsequent network nodes are then identified sequentially according to the order of communication, forming the corresponding attack propagation path. For example, if the network attack tracing path obtained after member verification is B→C→D, where the network behavior association information records the communication time between node B and node C as 10:00:03 and the communication time between node C and node D as 10:00:05, then node B's communication behavior occurred earliest. Therefore, node B is identified as the attack source node, and the attack source node information is generated as follows: Attack Source Node: B; Attack Propagation Path: B→C→D.

[0046] For example, during an abnormal communication detection process, the following candidate attack propagation relationship is determined based on network behavior correlation information: A→B→C→D; where node D is the target node that detected the abnormal communication, and nodes A, B, and C are intermediate nodes that may participate in the attack propagation.

[0047] Obtain suspicious messages to be traced The message's immutable protocol features are extracted and a digest is calculated to obtain the query digest. Subsequently, a reverse member lookup is performed starting from node D. Assuming a query is performed on the path evidence information corresponding to node C, the member lookup bit array for node C is denoted as... Three hash functions are used to digest the data. Perform mapping to obtain the query location: , , ;Query the member query bit array corresponding to node C: , , ;but ; Determine that the suspicious message passed through node C.

[0048] Further querying the path evidence information corresponding to node B, after the same digest calculation and hash mapping, yields: , , The query results are: , , ,but It was determined that the suspicious message passed through node B.

[0049] Continuing to query the path evidence information corresponding to node A, we obtain: , , However, when querying the bit array of node A members, the following was found: ,but The suspicious message was determined not to have passed through node A.

[0050] Based on the above verification results, only the node associations that passed the verification are retained: B→C→D; combined with the data transmission direction and communication time sequence recorded in the network behavior association information, node B is determined as a candidate attack source node for this abnormal communication, and a corresponding network attack tracing path is generated: B→C→D; at the same time, attack source node information is generated: attack source node: B; propagation node: C; target node: D.

[0051] Methods for identifying affected nodes on the network attack attribution path include: The network attack tracing path and attack source node information are called. The attack source node is taken as the starting node of the attack propagation. The network nodes in the network attack tracing path are traversed in turn according to the data transmission direction corresponding to the network attack tracing path. The network nodes located after the attack source node and having a continuous propagation relationship with the attack source node are determined, and the set of affected nodes is generated. Obtain the order of communication behavior occurrence for each affected node in the network behavior association information, sort the network nodes in the affected node set according to the order of communication behavior occurrence, and generate the affected node sequence.

[0052] For example, if the network attack tracing path is A→B→C→D→E, and the attack source node information determines that node B is the attack source node, then node B is taken as the attack propagation starting node, and nodes C, D and E are determined sequentially along the data transmission direction of the network attack tracing path, generating the affected node set {C, D, E}.

[0053] The network behavior association information records that the communication behavior occurrence times for nodes C, D, and E are 10:00:03, 10:00:05, and 10:00:08, respectively. Therefore, the affected node sequence is generated according to the communication behavior occurrence time: C→D→E.

[0054] Methods for implementing permission convergence on affected nodes include: Obtain the historical legal behavior records corresponding to the affected nodes. Based on the operation type, accessed resources, and command execution information in the historical legal behavior records, determine the set of legal operation permissions corresponding to the affected nodes. Generate the permission mask corresponding to the affected nodes based on the set of legal operation permissions. Obtain the current permission status of the affected nodes. Perform bitwise operations on the current permission status and the corresponding permission mask to generate the permission status after permission convergence.

[0055] Current permission status of affected nodes: ;in, Indicates the first The current permission status vector of each affected node; Indicates the number of the affected node; Represents the first in the permission status vector The permission bits corresponding to class operation permissions; Indicates the operation permission category number; Indicates the total number of permission categories; Generate an access mask based on the historical legitimate behavior of the affected nodes: ;in, Indicates according to the first Permission mask generated from the historical legitimate behavior of each affected node; The first character in the permission mask The mask bits corresponding to the class operation permissions; Furthermore, perform a bitwise AND operation based on the current permission status and the permission mask: ;in, Indicates the first The permission state vector of each affected node after permission convergence; This indicates a bitwise AND operation, meaning that if both permission bits at the corresponding positions are 1, the output permission bit is 1; otherwise, the output permission bit is 0.

[0056] For example, if node Current permission status is: This indicates that the node has 5 permission categories, of which the first 4 categories are executable, and the 5th category is not. A permission mask is generated based on historical valid actions. This indicates that only the first three types of historically valid operation permissions will be retained. Perform a bitwise AND operation. get: Among them, the fourth type of permission is converged to 0 because it is not included in the permission mask corresponding to the historical legitimate behavior.

[0057] Methods for generating dynamic access control results include: Obtain information about affected nodes and the corresponding network attack tracing path. Based on the node connection relationship and data transmission direction in the network attack tracing path, determine whether the affected nodes receive communication messages sent by the preceding nodes in the attack propagation path and forward the corresponding communication messages to the following nodes. When an affected node has both preceding and following communication nodes, the affected node is identified as a relay node in the network attack tracing path. The current permission status of the relay node is obtained, the current permission status is adjusted to the preset minimum permission set, and the adjusted permission status is associated with the network attack tracing path to generate a dynamic access control result.

[0058] For example, if the network attack tracing path is determined to be A→B→C→D, where node A is the attack source node, and nodes B and C are located between the attack source node and the target node D, and node B receives communication messages from node A and forwards them to node C, and node C receives communication messages from node B and forwards them to node D, then nodes B and C are determined to be relay nodes in the network attack tracing path.

[0059] Get the current permission status of node B, recording that it has four types of operation permissions: file read, file write, command execution, and configuration modification, with a corresponding permission status of (1, 1, 1, 1, 0). Get the preset minimum permission set and set it to retain only basic access permissions, with a corresponding permission status of (1, 0, 0, 0, 0). When node B is determined to be a relay node, adjust node B's permission status to the preset minimum permission set. Node C is processed in the same way, adjusting node C's original permissions to (1, 0, 0, 0, 0).

[0060] The final dynamic access control result is generated, recording the attack propagation path A→B→C→D, as well as the permission adjustment status of relay nodes B and C. Nodes B and C retain only basic access permissions, while other operation permissions are restricted. Example

[0061] Please see Figure 2 As shown, parts not described in detail in this embodiment are described in Embodiment 1. A network attack tracing system based on multi-dimensional feature fusion is provided, including: The network communication construction module is used to acquire communication messages in the network, parse the protocol fields, communication timing and node interaction relationships corresponding to the network security communication protocol, construct a multi-dimensional communication feature set, and generate network behavior association information based on the multi-dimensional communication feature set; The path evidence storage module is used to call network behavior association information, extract immutable protocol features from communication messages passing through each network node to generate communication message digests, and store the communication message digests into the member query bit array of the corresponding node based on hash mapping, thus forming path evidence information corresponding to each network node. The attack path tracing module is used to identify attack propagation relationships based on network behavior association information, perform reverse member queries in combination with path evidence information corresponding to each network node, verify the authenticity of nodes through which suspicious packets pass, and generate network attack tracing paths and attack source node information. The dynamic access control module identifies affected nodes on the network attack tracing path based on attack source node information, generates access control masks based on the historical legitimate behavior of each affected node, and performs access control convergence on the affected nodes. When an affected node is a relay node in the network attack tracing path, its corresponding permissions are reset to a preset minimum permission set, generating a dynamic access control result. All modules are connected via wired and / or wireless means to enable data transmission between modules. Example

[0062] This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for tracing network attacks based on multi-dimensional feature fusion.

[0063] Since the electronic device described in this embodiment is the one used to implement the network attack tracing method and system based on multi-dimensional feature fusion in this application embodiment, those skilled in the art can understand the specific implementation and various variations of the electronic device in this embodiment based on the network attack tracing method and system based on multi-dimensional feature fusion described in this application embodiment. Therefore, how the electronic device implements the method in this application embodiment will not be described in detail here. Any electronic device used by those skilled in the art to implement the network attack tracing method and system based on multi-dimensional feature fusion in this application embodiment falls within the scope of protection of this application.

[0064] It should be noted that all formulas in this manual are calculated by removing dimensions and taking their numerical values. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0065] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A network attack attribution method based on multi-dimensional feature fusion, characterized in that, include: S1. Obtain communication messages in the network, parse the protocol fields, communication timing and node interaction relationships corresponding to the network security communication protocol, construct a multi-dimensional communication feature set, and generate network behavior association information based on the multi-dimensional communication feature set; S2. Call the network behavior association information, extract the immutable protocol features of the communication messages passing through each network node to generate a communication message digest, and store the communication message digest into the member query bit array of the corresponding node based on hash mapping to form the path evidence information corresponding to each network node; S3. Identify attack propagation relationships based on network behavior association information, perform reverse member queries in conjunction with path evidence information corresponding to each network node, verify the authenticity of nodes through which suspicious packets pass, and generate network attack tracing paths and attack source node information. S4. Based on the attack source node information, determine the affected nodes located on the network attack tracing path, and generate permission masks based on the historical legitimate behavior of each affected node, and perform permission convergence on the affected nodes; when the affected node is a relay node in the network attack tracing path, reset the corresponding permissions to the preset minimum permission set and generate dynamic access control results.

2. The network attack tracing method based on multi-dimensional feature fusion according to claim 1, characterized in that, The method for constructing a multi-dimensional communication feature set includes: The system acquires communication messages transmitted between network nodes, parses the communication messages according to the network security communication protocol format corresponding to the communication messages, and obtains the protocol field information; based on the time stamps corresponding to several communication messages with the same source node identifier and destination node identifier, the communication messages are sorted by time, and the time intervals, message request and response order and protocol state change relationships between adjacent communication messages are obtained to form communication timing characteristics. Based on the source node identifier and destination node identifier corresponding to the communication message, the network nodes participating in the communication are determined. Based on the data sending direction, communication connection relationship and message exchange number between the network nodes, the interaction relationship between the network nodes is established, and node interaction characteristics are generated. Protocol fields, communication timing characteristics and node interaction characteristics are integrated to form a multi-dimensional communication characteristic set.

3. The network attack tracing method based on multi-dimensional feature fusion according to claim 2, characterized in that, The method for generating network behavior association information includes: Obtain protocol field information, communication timing features, and node interaction features from a multi-dimensional communication feature set. Determine the data transmission direction between network nodes based on the node interaction features, and determine the corresponding protocol state change relationship between network nodes based on the protocol field information. Based on the communication timing characteristics, the temporal sequence relationship between different communication behaviors is determined, and network nodes with continuous communication relationships, protocol state change relationships, and temporal correlation relationships are associated to generate node behavior correlation relationships; Based on the node behavior association, network nodes participating in communication are designated as associated nodes, and the communication relationships between network nodes are designated as associated connections. A network behavior association structure is constructed, and the associated connections are identified based on protocol field information, communication timing characteristics, and node interaction characteristics to generate network behavior association information.

4. The network attack tracing method based on multi-dimensional feature fusion according to claim 3, characterized in that, The method for generating communication message digests includes: The system retrieves network behavior association information to determine the network nodes participating in the communication and the communication messages passing through each network node. It then parses the protocol fields of the communication messages to extract the source node address, destination node address, protocol type, source port number, destination port number, and payload characteristics as immutable protocol features. The immutable protocol features are combined according to a preset field order to form the feature data corresponding to the communication message, and a digest calculation is performed on the feature data to generate a communication message digest.

5. The network attack tracing method based on multi-dimensional feature fusion according to claim 4, characterized in that, The method for forming path evidence information corresponding to each network node includes: Establish a corresponding member query bit array for each network node and initialize each storage bit in the member query bit array to a preset state; obtain the member query bit array of the corresponding network node according to the transmission node corresponding to the communication message; The communication message digest is input into several independent hash functions for mapping to obtain several storage locations in the member query bit array; the storage bits corresponding to each storage location in the member query bit array are updated to the set state, while keeping the current state of the remaining storage bits unchanged; the set member query bit array is stored as the path evidence information of the corresponding network node.

6. The network attack tracing method based on multi-dimensional feature fusion according to claim 5, characterized in that, The method for generating network attack tracing paths and attack source node information includes: The system retrieves network behavior association information and determines candidate attack propagation relationships corresponding to suspicious communication behaviors based on data transmission direction, communication time correlation, and protocol state change relationships between network nodes. It then obtains path evidence information corresponding to candidate network nodes according to the propagation direction of the candidate attack propagation relationships and extracts immutable protocol features from suspicious packets to generate a query digest. The digest to be queried is mapped by several hash functions that are the same as those in the path evidence storage process. The query position in the corresponding member query bit array is obtained, and the member query is executed according to the storage state corresponding to each query position to generate the node authenticity verification result. When all the storage bits corresponding to all hash mapping positions in the member query bit array are set, it is determined that the suspicious message has passed through the corresponding candidate network node; based on the node authenticity verification results corresponding to several candidate network nodes, the candidate attack propagation relationship is filtered. The verified node relationships are combined to generate a network attack tracing path; the attack source node information is determined based on the propagation direction corresponding to the network attack tracing path and the order of communication behavior in the network behavior association information.

7. The network attack tracing method based on multi-dimensional feature fusion according to claim 6, characterized in that, The method for determining affected nodes located on the network attack tracing path includes: The network attack tracing path and attack source node information are called. The attack source node is taken as the starting node of the attack propagation. The network nodes in the network attack tracing path are traversed in turn according to the data transmission direction corresponding to the network attack tracing path. The network nodes located after the attack source node and having a continuous propagation relationship with the attack source node are determined, and the set of affected nodes is generated. Obtain the order of communication behavior occurrence for each affected node in the network behavior association information, sort the network nodes in the affected node set according to the order of communication behavior occurrence, and generate the affected node sequence.

8. A network attack attribution method based on multi-dimensional feature fusion according to claim 7, characterized in that, The method for performing permission convergence on affected nodes includes: Obtain the historical legal behavior records corresponding to the affected nodes. Based on the operation type, accessed resources, and command execution information in the historical legal behavior records, determine the set of legal operation permissions corresponding to the affected nodes. Generate the permission mask corresponding to the affected nodes based on the set of legal operation permissions. Obtain the current permission status of the affected nodes. Perform bitwise operations on the current permission status and the corresponding permission mask to generate the permission status after permission convergence.

9. A network attack attribution method based on multi-dimensional feature fusion according to claim 8, characterized in that, The method for generating dynamic access control results includes: Obtain information about affected nodes and the corresponding network attack tracing path. Based on the node connection relationship and data transmission direction in the network attack tracing path, determine whether the affected nodes receive communication messages sent by the preceding nodes in the attack propagation path and forward the corresponding communication messages to the following nodes. When an affected node has both preceding and following communication nodes, the affected node is identified as a relay node in the network attack tracing path. The current permission status of the relay node is obtained, the current permission status is adjusted to the preset minimum permission set, and the adjusted permission status is associated with the network attack tracing path to generate a dynamic access control result.

10. A network attack tracing system based on multi-dimensional feature fusion, used to implement the network attack tracing method based on multi-dimensional feature fusion as described in any one of claims 1 to 9, characterized in that, include: The network communication construction module is used to acquire communication messages in the network, parse the protocol fields, communication timing and node interaction relationships corresponding to the network security communication protocol, construct a multi-dimensional communication feature set, and generate network behavior association information based on the multi-dimensional communication feature set; The path evidence storage module is used to call network behavior association information, extract immutable protocol features from communication messages passing through each network node to generate communication message digests, and store the communication message digests into the member query bit array of the corresponding node based on hash mapping, thus forming path evidence information corresponding to each network node. The attack path tracing module is used to identify attack propagation relationships based on network behavior association information, perform reverse member queries in combination with path evidence information corresponding to each network node, verify the authenticity of nodes through which suspicious packets pass, and generate network attack tracing paths and attack source node information. The permission dynamic convergence module is used to determine the affected nodes on the network attack tracing path based on the attack source node information, and generate permission masks based on the historical legitimate behavior of each affected node, and perform permission convergence on the affected nodes; when the affected node is a relay node in the network attack tracing path, the corresponding permissions are reset to the preset minimum permission set, and dynamic access control results are generated.

Images