Multi-dimensional network asset impersonation detection method based on AI technology

Abstract

The application relates to the technical field of security detection, in particular to a multi-dimensional network asset impersonation detection method based on AI technology, which comprises the following steps: respectively performing feature analysis on target asset identification data, target access behavior data and target response feature data to obtain corresponding target identification feature vectors, target behavior feature vectors and target response feature vectors; performing correlation mapping on the target identification feature vectors and the target behavior feature vectors to form identification behavior correlation feature vectors; and performing fusion on the identification behavior correlation feature vectors and the target response feature vectors to form multi-dimensional fusion feature vectors. The application can effectively distinguish the influence of asset behavior fluctuation and network environment disturbance on the deviation degree, avoids a large number of false alarms caused by a single fixed threshold in a business peak or network jitter scene, and makes the screening of a suspicious asset node set have stronger environmental self-adaptability and anti-interference capability.

Description

Technical Field

[0001] This invention relates to the field of security detection technology, specifically to a multi-dimensional network asset counterfeiting detection method based on AI technology. Background Technology

[0002] With the continuous evolution of network attack and defense technologies, network asset spoofing attacks have become a common carrier of advanced persistent threats. Attackers forge asset identifiers, mimic normal access behavior, and tamper with response characteristics to break through traditional perimeter protection and lurk in the internal network. Currently, detection methods based on static rules or simple statistical thresholds are still effective in steady-state environments. However, in complex scenarios such as peak business periods, network link jitter, or periodic fluctuations in asset behavior, these methods generally adopt fixed judgment criteria and cannot effectively distinguish between normal behavior fluctuations caused by changes in business load and abnormal deviations introduced by spoofing attacks. This results in a high false alarm rate and makes it difficult to adaptively adjust the detection scale according to real-time network environment changes.

[0003] Meanwhile, when determining the scope of the counterfeit impact, traditional methods usually rely solely on physical or logical topological adjacency relationships for diffusion inference, without considering the constraints of historical legitimate interaction records between nodes. This results in overly broad propagation boundary determinations, leading to the adoption of global isolation or large-scale blocking strategies, causing unnecessary expansion of the scope of business interruption and severely impacting the availability of the production system. Summary of the Invention

[0004] To achieve the above objectives, the present invention provides the following technical solution: a multi-dimensional network asset counterfeiting detection method based on AI technology, comprising:

[0005] Acquire target asset identification data, target access behavior data, and target response feature data in the target network space; perform feature parsing on the target asset identification data, target access behavior data, and target response feature data respectively to obtain the corresponding target identification feature vector, target behavior feature vector, and target response feature vector; The target identifier feature vector and the target behavior feature vector are associated and mapped to form an identifier-behavior associated feature vector. The identifier-behavior associated feature vector is then fused with the target response feature vector to form a multi-dimensional fused feature vector. Behavioral consistency analysis is performed on each asset node based on multi-dimensional fused feature vectors to obtain the behavioral deviation of each asset node. Based on the behavioral deviation and the association trust value of adjacent nodes in the network topology, preliminary anomaly screening is performed to obtain a set of suspicious asset nodes. Based on the communication time distribution characteristics and data packet header field encoding rules of each node in the suspicious asset node set, the potential pattern types of spoofing attacks are determined. Based on the potential pattern types, the suspicious asset node set is classified and clustered to obtain multiple suspected spoofing clusters. Based on the communication frequency fluctuation characteristics of nodes within each cluster and the differences in the response time of identity authentication requests in multiple suspected spoofing clusters, the spoofing confidence level within the cluster is determined. Based on the spoofing confidence level within the cluster, multiple suspected spoofing clusters are prioritized to obtain high-risk spoofing clusters. Based on the network access location and historical legitimate access records of each node in the high-risk counterfeit cluster, the scope of counterfeit impact is determined, and targeted isolation and blocking strategies are generated based on the scope of counterfeit impact to complete the disposal of counterfeit assets.

[0006] Preferably, the target asset identification data is used to reflect at least the identity attribute information of the network asset, the target access behavior data is used to reflect at least the access path information of the external request to the target asset, and the target response feature data is used to reflect at least the response difference information of the target asset to the external request. Feature parsing is performed on the target asset identification data, target access behavior data, and target response feature data respectively to obtain the corresponding target identification feature vector, target behavior feature vector, and target response feature vector, including: Each asset identification information unit in the target asset identification data is deconstructed into attributes to form an identification parsing feature vector; Each access behavior record unit in the target access behavior data is decomposed into a path to form a behavior parsing feature vector; Each response record unit in the target response feature data is compared for differences to form a response parsing feature vector; Among them, an asset identification information unit is used to reflect the identity attribute of a network asset, an access behavior record unit is used to reflect the access path of an external request, and a response record unit is used to reflect the differences in a response. Based on each identifier parsing feature vector, the target identifier feature vector is determined; Based on each behavior parsing feature vector, the target behavior feature vector is determined; Based on each response parsing feature vector, the target response feature vector is determined.

[0007] Preferably, based on each behavior parsing feature vector, the target behavior feature vector is determined, including: Based on the temporal evolution relationship between the corresponding access behavior record units, and combined with the jump relationship between the source address and the target address between the corresponding access behavior record units, the parsing feature vectors of each behavior are linked to form a target behavior link map. For any behavior parsing feature vector, extract the local behavior link subgraph corresponding to the behavior parsing feature vector in the target behavior link graph; The analytical feature vectors of each behavior in the local behavior link subgraph are concatenated to form a concatenated behavior feature vector. Based on the dimensionality of the analytical feature vector, the concatenated behavior feature vector is normalized to form a normalized behavior feature vector. Based on the normalized behavior feature vector, the behavior analysis feature vector is refined to form the refined behavior feature vector corresponding to the behavior analysis feature vector. Based on the convergence result of the extracted behavioral feature vectors corresponding to each behavioral parsing feature vector, the target behavioral feature vector is obtained.

[0008] Preferably, the target response feature vector is determined based on each response parsing feature vector, including: Based on multiple comparison dimensions, a difference analysis is performed on each response record unit in the target response feature data to determine at least one response unit group. The multiple comparison dimensions include at least one of the following: response latency fluctuation relationship, response packet structure deviation relationship, protocol field consistency relationship, certificate chain integrity relationship, service fingerprint deviation relationship, and abnormal traffic pattern relationship. For each response unit group, when there are multiple response record units in the response unit group, the multiple response parsing feature vectors corresponding to the multiple response record units are extracted in detail to form a group extracted feature vector. When there is only one response record unit in the response unit group, the response parsing feature vector corresponding to the response record unit is used as the corresponding group extracted feature vector. The target response feature vector is obtained by pooling the group-extracted feature vectors corresponding to each response unit group.

[0009] Preferably, the target identifier feature vector and the target behavior feature vector are correlated and mapped to form an identifier-behavior correlated feature vector. This identifier-behavior correlated feature vector is then fused with the target response feature vector to form a multi-dimensional fused feature vector, including: The target identifier feature vector and the target behavior feature vector are decomposed into multiple levels, and the decomposition results of each level are cross-compared to form a hierarchical related feature vector. Based on the dimension of the coarsest hierarchical association feature vector, the hierarchical association feature vectors of each other level are dimensionally aligned to form the corresponding aligned association feature vectors. Based on the nested fusion results of the coarsest hierarchical correlation feature vector and each aligned correlation feature vector, a hierarchical progressive superposition is performed with the target response feature vector to obtain a multi-dimensional fused feature vector.

[0010] Preferably, behavioral consistency analysis is performed on each asset node based on multi-dimensional fused feature vectors to obtain the behavioral deviation degree of each asset node. Based on the behavioral deviation degree and the association trust value of adjacent nodes in the network topology, preliminary anomaly screening is performed to obtain a set of suspicious asset nodes, including: The initial deviation index is determined based on the degree of difference between the multi-dimensional fused feature vector of each asset node and the historical benchmark behavior feature vector of that asset node in each dimension. The dynamic correction deviation value is determined based on the initial deviation index and the behavior stability coefficient of the asset node in different time periods. The degree of behavioral deviation is determined by comparing the dynamic correction deviation value with the preset normal fluctuation range of behavior. The deviation level of each asset node is determined based on its behavioral deviation, and the environmental trust score of the asset node is determined based on the association trust value of its neighboring nodes that are directly connected to it in the network topology. A comprehensive anomaly score for each asset node is determined by cross-judging based on deviation level and environmental trust score. A set of suspicious asset nodes is determined based on asset nodes whose comprehensive anomaly scores exceed a preset screening threshold.

[0011] Preferably, the intra-cluster spoofing confidence level is determined based on the communication frequency fluctuation characteristics of nodes within each cluster and the differences in the response timing of authentication requests in multiple suspected spoofing clusters, including: Frequency anomaly factors are extracted based on the communication frequency fluctuation characteristics of nodes within each cluster within a preset time window, and time sequence offset factors are extracted based on the response time sequence differences of nodes within each cluster during the identity authentication request process. The single spoofing evaluation value of each node in each cluster is determined based on the weighted correlation between the frequency anomaly factor and the temporal offset factor. The intra-cluster spoofing confidence level is obtained by performing intra-cluster aggregation calculation based on the single spoofing evaluation value of all nodes within each cluster.

[0012] Preferably, multiple suspected spoofing clusters are prioritized based on intra-cluster spoofing confidence to obtain high-risk spoofing clusters, including: The cluster risk index is determined based on the intra-cluster spoofing confidence of each suspected spoofing cluster and the proportion of the number of nodes in each suspected spoofing cluster to the total number of asset nodes in the network. Based on the cluster risk comprehensive index of each suspected spoofing cluster and the centrality weight of each suspected spoofing cluster in the network topology, inter-cluster comparisons are performed to obtain priority ranking results; Based on the priority ranking results, suspected counterfeit clusters that rank before a preset threshold are identified as high-risk counterfeit clusters.

[0013] Preferably, the scope of the spoofing impact is determined based on the access location and historical legitimate access records of each node in the high-risk spoofing cluster, including: Based on the access location of each node in the high-risk spoofing cluster in the network, the set of adjacent reachable nodes of each node is determined, and the set of historical interaction objects of each node is filtered out based on the historical legal access records of each node. The potential affected nodes of each node are determined by the intersection of the set of adjacent reachable nodes and the set of historical interaction objects, and the influence diffusion coefficient of each node is determined by the number of potential affected nodes of each node. The hierarchical propagation path of the counterfeit influence is determined based on the influence diffusion coefficient of each node and the topological connection tightness between each node, and the propagation range of the counterfeit influence is determined based on the node range covered by the hierarchical propagation path.

[0014] Compared with the prior art, the beneficial effects of the present invention are: (1) This invention introduces a behavior stability coefficient to dynamically correct the initial deviation index, and combines the associated trust value of adjacent nodes to construct an environmental trust score, and performs cross-judgment to determine the comprehensive anomaly score; this mechanism can effectively distinguish the impact of asset behavior fluctuations and network environment disturbances on the deviation, avoids a large number of false alarms generated by a single fixed threshold in business peaks or network jitter scenarios, and makes the screening of suspicious asset node sets have stronger environmental adaptability and anti-interference ability; (2) This invention determines potentially affected nodes by calculating the intersection of the adjacency reachable set of nodes in a high-risk spoofing cluster and the historical legitimate interaction set, and accurately deduces the hierarchical propagation path of spoofing behavior by combining the topological connection tightness between nodes; this makes the delineation of the scope of impact propagation not only based on physical or logical topology, but also combined with historical trust relationships, and can accurately identify the specific asset boundaries that may be spread by spoofing behavior, thereby supporting the generation of a refined isolation and blocking strategy that minimizes business interruption, and avoiding ineffective handling of the entire network or irrelevant business areas. Attached Figure Description

[0015] Figure 1 This is a schematic flowchart of the overall method in one embodiment of the present invention; Figure 2 This is a schematic diagram of the steps involved in creating a target vector in one embodiment of the present invention; Figure 3 This is a schematic diagram of the steps involved in multi-dimensional feature vector fusion in one embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1, please refer to Figures 1-3 This invention provides a technical solution: a multi-dimensional network asset counterfeiting detection method based on AI technology, comprising: S1. Obtain target asset identification data, target access behavior data, and target response feature data in the target network space; perform feature parsing on the target asset identification data, target access behavior data, and target response feature data respectively to obtain the corresponding target identification feature vector, target behavior feature vector, and target response feature vector.

[0018] The target asset identification data includes network layer address, transport layer port, application layer protocol fingerprint, and service version information; the target access behavior data includes the timestamp sequence of request messages, source and destination address pairs, request method type, and message length statistical distribution; the target response feature data includes response status code, response latency, header field order, and payload content fragments; during feature parsing, the asset identification data uses a combination of active protocol stack detection and passive identification to extract the operating system type, open service category, and version number, forming an identification feature vector; the access behavior data uses time series analysis and traffic statistics to extract request frequency, session duration, and traffic direction ratio, forming a behavior feature vector; the response feature data uses state transition analysis and content hash sampling to extract response stability, latency fluctuation amplitude, and content structure patterns, forming a response feature vector.

[0019] For example, when performing cyberspace mapping tasks on an enterprise data center subnet, three types of raw data are collected through active scanning and bypass mirroring. For the collected asset identification data, the subnet is identified as containing web servers, database servers, and file storage devices, and corresponding service type and version combination vectors are generated. For access behavior data, the peak request rate and average session length are extracted by analyzing the HTTP request sequence during working hours, generating behavior pattern vectors. For response feature data, a stability assessment vector is generated based on the latency variance and status code distribution of multiple probe responses. These three vectors are then fused for subsequent network asset risk profiling and anomaly detection.

[0020] For example, the target asset identification data is used to reflect at least the identity attribute information of the network asset, the target access behavior data is used to reflect at least the access path information of the external request to the target asset, and the target response feature data is used to reflect at least the response difference information of the target asset to the external request; S101, each asset identification information unit in the target asset identification data is deconstructed to form an identification resolution feature vector; S102, each access behavior record unit in the target access behavior data is decomposed to form a behavior resolution feature vector; S103, each response record unit in the target response feature data is compared to form a response resolution feature vector; wherein, one asset identification information unit is used to reflect the identity attribute of a network asset, one access behavior record unit is used to reflect the access path of an external request, and one response record unit is used to reflect the difference in a response; S104, based on each identification resolution feature vector, a target identification feature vector is determined; based on each behavior resolution feature vector, a target behavior feature vector is determined; based on each response resolution feature vector, a target response feature vector is determined.

[0021] In this embodiment, data parsing is performed on the enterprise cloud platform subnet. For asset identification data, the IP, port, protocol, and service version of each server are deconstructed one by one, such as the 3306 port and MySQL version of the database server, and the 443 port and Nginx version of the web server. Identifier resolution vectors for each asset are generated and then summarized into target identifier feature vectors covering service type distribution and version concentration. For access behavior data, the path, parameters, and source of each HTTP request are broken down one by one, and high-frequency access interfaces and parameter variation patterns are extracted and summarized into target behavior feature vectors. For response data, the status code and latency of each response are compared with historical benchmarks one by one, and records with sudden increases in latency or abnormal status codes are filtered out and summarized into target response feature vectors. Finally, the three sets of target feature vectors provide a unified input for subsequent correlation analysis.

[0022] Furthermore, for example, based on the temporal evolution relationship between the corresponding access behavior record units and the jump relationship between the source and target addresses between the corresponding access behavior record units, each behavior parsing feature vector is chained to form a target behavior chain graph. For any behavior parsing feature vector, a local behavior chain subgraph corresponding to the behavior parsing feature vector is extracted from the target behavior chain graph. The behavior parsing feature vectors in the local behavior chain subgraph are concatenated to form a concatenated behavior feature vector. Based on the dimensionality of the behavior parsing feature vector, the concatenated behavior feature vector is normalized to form a normalized behavior feature vector. Based on the normalized behavior feature vector, the behavior parsing feature vector is refined to form a refined behavior feature vector corresponding to the behavior parsing feature vector. Based on the convergence result of the refined behavior feature vectors corresponding to each behavior parsing feature vector, the target behavior feature vector is obtained.

[0023] In this embodiment, for the access sequence initiated by a terminal in the office network: accessing the file server at 9:00 AM, jumping to the database server via the file server at 9:05 AM, and then jumping to the backup server at 9:10 AM; in the target behavior link graph constructed by the time sequence and jump relationship, the local link subgraph corresponding to the file server access event contains the two nodes before and after it; the behavior analysis feature vectors of the three access events in this subgraph are concatenated in sequence, and normalized according to the original number of dimensions of each vector to eliminate length differences; after normalization, the contribution of each dimension is evaluated, and three high-contribution dimensions are extracted: access frequency, session duration, and requested resource type, forming the extracted behavior feature vector corresponding to the event; all access events are traversed one by one and the extracted results are aggregated to finally obtain the target behavior feature vector reflecting the overall access behavior pattern.

[0024] Furthermore, for example, based on multiple comparison dimensions, a difference analysis is performed on each response record unit in the target response feature data to determine at least one response unit group. The multiple comparison dimensions include at least one of the following: response latency fluctuation relationship, response packet structure deviation relationship, protocol field consistency relationship, certificate chain integrity relationship, service fingerprint deviation relationship, and abnormal traffic pattern relationship. For each response unit group, when there are multiple response record units in the group, the multiple response parsing feature vectors corresponding to these multiple response record units are extracted to form a group extracted feature vector. When there is only one response record unit in the group, the response parsing feature vector corresponding to that response record unit is used as the corresponding group extracted feature vector. Based on the aggregation result of the group extracted feature vectors corresponding to each response unit group, the target response feature vector is obtained.

[0025] In this embodiment, a difference analysis is performed on the response data of the online transaction system over the past hour. Using response latency fluctuations and packet structure deviations as the main dimensions, most normal responses are classified into a low-latency stable group, while a small number of responses with sudden latency increases and abnormal packet fields are classified into a high-latency distortion group. The former contains hundreds of response records, and their corresponding response parsing feature vectors are extracted in detail, retaining three core dimensions: mean latency, status code distribution, and header order, to form a group-extracted feature vector. The latter contains only two records, and their respective response parsing feature vectors are directly used as the group-extracted feature vector. The extraction results of the two groups are combined to obtain a target response feature vector covering both normal and abnormal response modes for subsequent comprehensive analysis.

[0026] S2. Associate and map the target identifier feature vector and the target behavior feature vector to form an identifier-behavior associated feature vector. Then, fuse the identifier-behavior associated feature vector with the target response feature vector to form a multi-dimensional fused feature vector.

[0027] Among them, association mapping refers to using timestamps and network session quintuples as association keys to align and couple asset identification attributes such as operating system type and open service version with access behavior patterns such as request frequency and session length within the corresponding time period, forming a combined representation that reflects a specific asset in a specific behavioral context; fusion refers to integrating and weighting the associated combined representation with the response feature vector to construct a multi-perspective fusion representation that covers the inherent attributes of the asset, dynamic access patterns, and response quality.

[0028] For example, for a database server in a data center, its identifier feature vector indicates that the operating system is Windows Server and the database version is MySQL 8.0. The behavioral feature vector shows that the server has a large number of query requests during the backup period. After association mapping, identifier-behavioral association features are generated, indicating that the Windows server performs high-frequency read operations within the backup window. Further integration of the server's response features, including query response latency that is stable at a low threshold and an error rate that is close to zero, results in a multi-dimensional fused feature vector that can be used to evaluate the server's operational health during the backup task and provide a comprehensive basis for anomaly detection.

[0029] For example, S201, the target identifier feature vector and the target behavior feature vector are decomposed into multiple levels, and the decomposition results of each level are cross-compared to form a hierarchical related feature vector; S202, based on the dimension scale of the coarsest hierarchical related feature vector, the hierarchical related feature vectors corresponding to each other level are dimensionally aligned to form a corresponding aligned related feature vector; S203, based on the nested fusion result of the coarsest hierarchical related feature vector and each aligned related feature vector, it is progressively superimposed with the target response feature vector to obtain a multi-dimensional fused feature vector.

[0030] In this embodiment, for an application server in an enterprise network, its identification feature vector is decomposed into network layer attributes of IP network segment and AS number, transport layer attributes of port and service protocol, and application layer attributes of application type and version. Simultaneously, its behavioral feature vector is decomposed into network layer behavior of external target network segment distribution, transport layer behavior of connection number and latency, and application layer behavior of requested resource type and method. Network layer cross-comparison reveals abnormal external connections to the IP network segment, forming network layer correlation features. Transport layer cross-comparison reveals a sudden increase in the number of connections to port 443, forming transport layer correlation features. Application layer cross-comparison reveals a large number of non-standard API requests, forming application layer correlation features. Using a fixed number of dimensions for the network layer correlation features as a benchmark, the dimensions of the transport layer and application layer correlation features are aligned to ensure consistency. Subsequently, the network layer correlation features are fused with the link quality indicators in the response features, and then the transport layer correlation features are superimposed. Finally, the application layer correlation features are superimposed with the response content integrity indicators to form a multi-dimensional fused feature vector, comprehensively representing the server's overall status at the topology location, transmission status, and business logic levels.

[0031] S3. Based on the multi-dimensional fusion feature vector, perform behavioral consistency analysis on each asset node to obtain the behavioral deviation degree of each asset node. Based on the behavioral deviation degree and the association trust value of adjacent nodes in the network topology, perform preliminary anomaly screening to obtain a set of suspicious asset nodes.

[0032] Among them, behavioral consistency analysis refers to comparing the multi-dimensional integrated characteristics of the current time period of an asset node with its historical baseline characteristics to assess the degree of deviation in its protocol behavior, traffic patterns, and response performance; behavioral deviation is a quantifiable measure of this deviation, reflecting the degree of abnormality of the node's behavior relative to the normal benchmark; the association trust value is a trust score dynamically maintained based on the historical interaction records of neighboring nodes and the current link quality, used to transmit and correct anomaly judgments in the topology; the preliminary anomaly screening combines the node's own deviation with the neighborhood trust weighting, eliminates isolated fluctuation interference, and screens out suspicious nodes with high confidence.

[0033] For example, in an enterprise data center intranet, a file server's recent multi-dimensional fusion characteristics show that it has exhibited abnormally high-frequency external connection behavior during non-working hours, with a deviation significantly exceeding the threshold. The associated trust values ​​of the firewall nodes and switch nodes adjacent to this server are all at a high level, indicating that the link and the surrounding environment are normal, and the anomaly originates from the node itself. Based on this, the node is included in the set of suspicious asset nodes for subsequent in-depth analysis and processing. For nodes whose deviation temporarily increases due to network jitter, if the trust values ​​of adjacent nodes decrease synchronously, they are no longer marked as suspicious, effectively suppressing false alarms.

[0034] For example, an initial deviation index is determined based on the degree of difference between the multi-dimensional fused feature vector of each asset node and the historical baseline behavior feature vector of that asset node in each dimension; a dynamic correction deviation value is determined based on the initial deviation index and the behavior stability coefficient of the asset node in different time periods; the behavior deviation degree is determined by comparing the dynamic correction deviation value with a preset normal fluctuation range of behavior; the deviation level of each asset node is determined based on the behavior deviation degree of each asset node, and the environmental trust score of the asset node is determined based on the association trust value of the adjacent nodes directly connected to the asset node in the network topology; a comprehensive anomaly score of each asset node is determined by cross-judging based on the deviation level and the environmental trust score; and a set of suspicious asset nodes is determined based on asset nodes whose comprehensive anomaly scores exceed a preset screening threshold.

[0035] In this embodiment, for a web server in the data center, the current multi-dimensional fusion characteristics show that its number of outbound requests during non-working hours is three times higher than the historical baseline, and the sum of the differences in each dimension results in a high initial deviation index. The server's behavior stability coefficient is low during nighttime in the historical records, indicating that nighttime fluctuations are relatively common. After dynamic correction, the deviation value falls back to near the threshold. After comparing it with the normal fluctuation range, the behavior deviation is rated as medium, corresponding to a moderate deviation level. At the same time, the trust score associated with the switch node directly connected to the server is high, indicating that there is no abnormality in the network environment. After cross-judgment, the comprehensive anomaly score does not exceed the screening threshold, so the node is not included in the suspicious set. Conversely, if another database server has a high deviation rating, and the trust score of the adjacent node decreases due to link anomalies, and the cross-judgment comprehensive score exceeds the threshold, it will be included in the suspicious asset node set for subsequent analysis and handling.

[0036] S4. Based on the communication time distribution characteristics and data packet header field encoding rules of each node in the suspicious asset node set, determine the potential pattern type of spoofing attack, and classify and cluster the suspicious asset node set based on the potential pattern type to obtain multiple suspected spoofing clusters.

[0037] Among them, the communication time period distribution characteristics refer to the periodicity, sudden concentration, or idle interval pattern of node activity in the time dimension; the data packet header field encoding pattern refers to the statistical distribution, sequence change, or specific marking pattern of protocol header values ​​such as IP identifier, liveness time, window size, and option fields; potential pattern types include but are not limited to timed spoofing injection, scanning and probing spoofing, and response delay simulation, each type corresponding to specific time strategies and protocol stack fingerprint differences; classification and clustering classify suspicious nodes into different clusters based on pattern similarity, with nodes in the same cluster sharing similar spoofing behavior characteristics, and different clusters corresponding to different spoofing strategies or attack sources.

[0038] For example, in an enterprise intranet, analysis of communication periods reveals that some suspicious asset node clusters initiate abnormal external connections during the daily early morning backup period. The initial TTL value and window size in the packet header are consistent with legitimate devices but have a fixed offset. This indicates that their potential pattern type is backup period spoofing injection, and these nodes are clustered into one suspected spoofing cluster. Another group of nodes are randomly distributed throughout the day, and their IP identifier fields show an arithmetic progression, indicating that they are scanning spoofing and are assigned to another cluster. Ultimately, two independent suspected spoofing clusters are formed, facilitating subsequent targeted tracing and handling.

[0039] S5. Based on the communication frequency fluctuation characteristics of nodes in each cluster and the difference in the response time of identity authentication requests in multiple suspected counterfeit clusters, determine the counterfeit confidence level within the cluster. Based on the counterfeit confidence level within the cluster, prioritize multiple suspected counterfeit clusters to obtain high-risk counterfeit clusters.

[0040] Among them, the communication frequency fluctuation characteristics refer to the variance, peak offset, and abrupt change period of the packet transmission rate of nodes within a cluster within a continuous time window, reflecting the stability of the communication rhythm; the response timing difference of authentication requests refers to the distribution of response delay, retransmission interval, and timeout ratio of nodes within a cluster to authentication challenge messages, used to measure the consistency of protocol stack behavior; the cluster spoofing confidence is a comprehensive measure of the above two types of characteristics. Clusters with more drastic fluctuations and higher response timing dispersion have higher credibility in judging spoofing behavior; the priority ranking is arranged in descending order of confidence, and the cluster with the highest confidence is identified as a high-risk spoofing cluster, which is given priority for blocking and tracing.

[0041] For example, the two suspected spoofing clusters obtained from the previous clustering were analyzed: the communication frequency of nodes in cluster A showed intermittent bursts without a fixed period, and the authentication response delay fluctuated greatly, with multiple timeout retransmissions, and the spoofing confidence was rated as high; the communication frequency of nodes in cluster B was relatively stable, and the response delay was concentrated in a small range, and the confidence was rated as low; based on the priority ranking, cluster A was identified as a high-risk spoofing cluster and a blocking strategy should be initiated immediately, while cluster B was temporarily placed in a low priority and kept under observation.

[0042] For example, frequency anomaly factors are extracted based on the communication frequency fluctuation characteristics of nodes within each cluster within a preset time window, and time-series offset factors are extracted based on the response time-series differences of nodes within each cluster during the identity authentication request process; a single spoofing assessment value for each node within a cluster is determined based on the weighted correlation between the frequency anomaly factors and the time-series offset factors; intra-cluster aggregation calculation is performed based on the single spoofing assessment values ​​of all nodes within each cluster to obtain the intra-cluster spoofing confidence; a cluster risk comprehensive index is determined based on the intra-cluster spoofing confidence of each suspected spoofing cluster and the proportion of the number of nodes in each suspected spoofing cluster to the total number of asset nodes in the network; inter-cluster comparison is performed based on the cluster risk comprehensive index of each suspected spoofing cluster and the centrality weight of each suspected spoofing cluster in the network topology to obtain the priority ranking result; and high-risk spoofing clusters are identified based on the suspected spoofing clusters ranked before a preset threshold in the priority ranking result.

[0043] In this embodiment, there are two suspected spoofing clusters in the network. Cluster A contains five nodes, with generally high frequency anomaly factors, moderate time-series offset factors, and high weighted individual evaluation values. The cluster's aggregate confidence level is relatively high, and the number of nodes accounts for 5% of the total number of nodes in the network. In the network topology, all nodes in Cluster A are deployed in the core switching area, resulting in a high centrality weight and a high calculated cluster risk index. Cluster B contains three nodes, with moderate frequency anomaly factors but significant time-series offset factors. The distribution of individual evaluation values ​​is relatively scattered, and the aggregate confidence level is moderate to low. The number of nodes accounts for only 2%, and most of the nodes are located at the access edge. The centrality weight is low, resulting in a low comprehensive index. After comparing and ranking the clusters, Cluster A ranks higher and exceeds the preset threshold, so it is judged as a high-risk spoofing cluster and is immediately processed. Cluster B is downgraded to a low priority and included in the observation list.

[0044] S6. Based on the access location and historical legitimate access records of each node in the high-risk counterfeit cluster in the network, determine the scope of counterfeit impact propagation, generate targeted isolation and blocking strategies based on the scope of counterfeit impact propagation, and complete the disposal of counterfeit assets.

[0045] The access location refers to the switch port, access VLAN, and uplink affiliation of the node; the historical legitimate access records refer to the session logs, authorized resources, and normal communication peers authenticated by the node before the spoofing occurred; the scope of the spoofing impact is comprehensively determined based on the subnet boundary under the access location and the list of historical access peers, covering the adjacent areas that may be used as a springboard or attack target by the spoofed node; the isolation and blocking strategy is dynamically generated according to the differences in scope, including tiered measures such as port-level disabling, VLAN isolation, ACL blacklisting, or neighbor node trust revocation, to ensure that spoofing behavior is blocked without affecting normal business operations.

[0046] For example, a node in a high-risk spoofing cluster accesses port Gig0 / 1 of the data center core switch, located in VLAN 10 of the server area. Its historical access records show that the node has established legitimate sessions with the database server and file server. Based on this, it is determined that the affected scope is the database and file service subnet within this VLAN. A policy is then generated: the port is closed and the MAC forwarding table entry of the node on the adjacent switch is revoked. At the same time, the access control list is updated to prevent its IP address from communicating with the database and file server, thus completing the rapid isolation and disposal of the spoofed asset, which will then be handed over for forensic analysis.

[0047] For example, the set of adjacent reachable nodes for each node in a high-risk spoofing cluster is determined based on the access location of each node in the network, and the set of historical interaction objects for each node is filtered based on the historical legitimate access records of each node; the potential affected nodes for each node are determined based on the intersection of the set of adjacent reachable nodes and the set of historical interaction objects, and the influence diffusion coefficient of each node is determined based on the number of potential affected nodes; the hierarchical propagation path of the spoofing influence is determined based on the influence diffusion coefficient of each node and the topological connection tightness between each node, and the propagation range of the spoofing influence is determined based on the node range covered by the hierarchical propagation path.

[0048] In this embodiment, node A in the high-risk spoofing cluster is connected to the data center core switch. Its adjacent reachable node set includes the database server and file server in the same VLAN, as well as the uplink interconnection border firewall. Node A's historical legitimate access records show that it has regularly interacted with the database server and file server, but has never communicated with the firewall. After intersection calculation, the database server and file server are listed as potentially affected nodes, with a quantity of 2, and the impact diffusion coefficient is rated as high. Further analysis of the topology connection density shows that the link bandwidth between node A and the database server is high and the communication frequency is dense, followed by the link between node A and the file server. Therefore, it is determined that the hierarchical propagation path will preferentially spread from node A to the database server, and then extend to the file server. The node range covered by this hierarchical propagation path is the database and file storage subnet. Finally, the scope of the spoofing impact propagation is defined as all related assets within this subnet, providing a precise boundary basis for subsequent isolation and blocking strategies.

[0049] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A multi-dimensional network asset counterfeiting detection method based on AI technology, characterized in that, include: Acquire target asset identification data, target access behavior data, and target response characteristic data in the target cyberspace; Feature parsing is performed on the target asset identification data, target access behavior data, and target response feature data respectively to obtain the corresponding target identification feature vector, target behavior feature vector, and target response feature vector; The target identifier feature vector and the target behavior feature vector are associated and mapped to form an identifier-behavior associated feature vector. The identifier-behavior associated feature vector is then fused with the target response feature vector to form a multi-dimensional fused feature vector. Behavioral consistency analysis is performed on each asset node based on multi-dimensional fused feature vectors to obtain the behavioral deviation of each asset node. Based on the behavioral deviation and the association trust value of adjacent nodes in the network topology, preliminary anomaly screening is performed to obtain a set of suspicious asset nodes. Based on the communication time distribution characteristics and data packet header field encoding rules of each node in the suspicious asset node set, the potential pattern types of spoofing attacks are determined. Based on the potential pattern types, the suspicious asset node set is classified and clustered to obtain multiple suspected spoofing clusters. Based on the communication frequency fluctuation characteristics of nodes within each cluster and the differences in the response time of identity authentication requests in multiple suspected spoofing clusters, the spoofing confidence level within the cluster is determined. Based on the spoofing confidence level within the cluster, multiple suspected spoofing clusters are prioritized to obtain high-risk spoofing clusters. Based on the network access location and historical legitimate access records of each node in the high-risk counterfeit cluster, the scope of counterfeit impact is determined, and targeted isolation and blocking strategies are generated based on the scope of counterfeit impact to complete the disposal of counterfeit assets.

2. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 1, characterized in that, The target asset identification data is used to reflect at least the identity attribute information of the network asset, the target access behavior data is used to reflect at least the access path information of the external request to the target asset, and the target response characteristic data is used to reflect at least the response difference information of the target asset to the external request. Feature parsing is performed on the target asset identification data, target access behavior data, and target response feature data respectively to obtain the corresponding target identification feature vector, target behavior feature vector, and target response feature vector, including: Each asset identification information unit in the target asset identification data is deconstructed into attributes to form an identification parsing feature vector; Each access behavior record unit in the target access behavior data is decomposed into a path to form a behavior parsing feature vector; Each response record unit in the target response feature data is compared for differences to form a response parsing feature vector; Among them, an asset identification information unit is used to reflect the identity attribute of a network asset, an access behavior record unit is used to reflect the access path of an external request, and a response record unit is used to reflect the differences in a response. Based on each identifier parsing feature vector, the target identifier feature vector is determined; Based on each behavior parsing feature vector, the target behavior feature vector is determined; Based on each response parsing feature vector, the target response feature vector is determined.

3. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 2, characterized in that, Based on each behavior parsing feature vector, the target behavior feature vector is determined, including: Based on the temporal evolution relationship between the corresponding access behavior record units, and combined with the jump relationship between the source address and the target address between the corresponding access behavior record units, the parsing feature vectors of each behavior are linked to form a target behavior link map. For any behavior parsing feature vector, extract the local behavior link subgraph corresponding to the behavior parsing feature vector in the target behavior link graph; The analytical feature vectors of each behavior in the local behavior link subgraph are concatenated to form a concatenated behavior feature vector. Based on the dimensionality of the analytical feature vector, the concatenated behavior feature vector is normalized to form a normalized behavior feature vector. Based on the normalized behavior feature vector, the behavior analysis feature vector is refined to form the refined behavior feature vector corresponding to the behavior analysis feature vector. Based on the convergence result of the extracted behavioral feature vectors corresponding to each behavioral parsing feature vector, the target behavioral feature vector is obtained.

4. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 3, characterized in that, Based on each response parsing feature vector, the target response feature vector is determined, including: Based on multiple comparison dimensions, a difference analysis is performed on each response record unit in the target response feature data to determine at least one response unit group. The multiple comparison dimensions include at least one of the following: response latency fluctuation relationship, response packet structure deviation relationship, protocol field consistency relationship, certificate chain integrity relationship, service fingerprint deviation relationship, and abnormal traffic pattern relationship. For each response unit group, when there are multiple response record units in the response unit group, the multiple response parsing feature vectors corresponding to the multiple response record units are extracted in detail to form a group extracted feature vector. When there is only one response record unit in the response unit group, the response parsing feature vector corresponding to the response record unit is used as the corresponding group extracted feature vector. The target response feature vector is obtained by pooling the group-extracted feature vectors corresponding to each response unit group.

5. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 4, characterized in that, The target identifier feature vector and the target behavior feature vector are correlated and mapped to form an identifier-behavior correlated feature vector. This correlated feature vector is then fused with the target response feature vector to form a multi-dimensional fused feature vector, including: The target identifier feature vector and the target behavior feature vector are decomposed into multiple levels, and the decomposition results of each level are cross-compared to form a hierarchical related feature vector. Based on the dimension of the coarsest hierarchical association feature vector, the hierarchical association feature vectors of each other level are dimensionally aligned to form the corresponding aligned association feature vectors. Based on the nested fusion results of the coarsest hierarchical correlation feature vector and each aligned correlation feature vector, a hierarchical progressive superposition is performed with the target response feature vector to obtain a multi-dimensional fused feature vector.

6. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 5, characterized in that, Behavioral consistency analysis is performed on each asset node based on multi-dimensional fused feature vectors to obtain the behavioral deviation degree of each asset node. Based on the behavioral deviation degree and the association trust value of adjacent nodes in the network topology, preliminary anomaly screening is performed to obtain a set of suspicious asset nodes, including: The initial deviation index is determined based on the degree of difference between the multi-dimensional fused feature vector of each asset node and the historical benchmark behavior feature vector of that asset node in each dimension. The dynamic correction deviation value is determined based on the initial deviation index and the behavior stability coefficient of the asset node in different time periods. The degree of behavioral deviation is determined by comparing the dynamic correction deviation value with the preset normal fluctuation range of behavior. The deviation level of each asset node is determined based on its behavioral deviation, and the environmental trust score of the asset node is determined based on the association trust value of its neighboring nodes that are directly connected to it in the network topology. A comprehensive anomaly score for each asset node is determined by cross-judging based on deviation level and environmental trust score. A set of suspicious asset nodes is determined based on asset nodes whose comprehensive anomaly scores exceed a preset screening threshold.

7. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 6, characterized in that, Based on the communication frequency fluctuation characteristics of nodes within multiple suspected spoofing clusters and the differences in the response timing of authentication requests, the intra-cluster spoofing confidence level is determined, including: Frequency anomaly factors are extracted based on the communication frequency fluctuation characteristics of nodes within each cluster within a preset time window, and time sequence offset factors are extracted based on the response time sequence differences of nodes within each cluster during the identity authentication request process. The single spoofing evaluation value of each node in each cluster is determined based on the weighted correlation between the frequency anomaly factor and the temporal offset factor. The intra-cluster spoofing confidence level is obtained by performing intra-cluster aggregation calculation based on the single spoofing evaluation value of all nodes within each cluster.

8. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 7, characterized in that, Based on the intra-cluster spoofing confidence level, multiple suspected spoofing clusters are prioritized to obtain high-risk spoofing clusters, including: The cluster risk index is determined based on the intra-cluster spoofing confidence of each suspected spoofing cluster and the proportion of the number of nodes in each suspected spoofing cluster to the total number of asset nodes in the network. Based on the cluster risk comprehensive index of each suspected spoofing cluster and the centrality weight of each suspected spoofing cluster in the network topology, inter-cluster comparisons are performed to obtain priority ranking results; Based on the priority ranking results, suspected counterfeit clusters that rank before a preset threshold are identified as high-risk counterfeit clusters.

9. The multi-dimensional network asset counterfeiting detection method based on AI technology according to claim 8, characterized in that, Based on the network access location and historical legitimate access records of each node in the high-risk spoofing cluster, the scope of the spoofing impact is determined, including: Based on the access location of each node in the high-risk spoofing cluster in the network, the set of adjacent reachable nodes of each node is determined, and the set of historical interaction objects of each node is filtered out based on the historical legal access records of each node. The potential affected nodes of each node are determined by the intersection of the set of adjacent reachable nodes and the set of historical interaction objects, and the influence diffusion coefficient of each node is determined by the number of potential affected nodes of each node. The hierarchical propagation path of the counterfeit influence is determined based on the influence diffusion coefficient of each node and the topological connection tightness between each node, and the propagation range of the counterfeit influence is determined based on the node range covered by the hierarchical propagation path.

Images