An attack behavior intelligent early warning method, device and equipment based on multi-agent cooperation and a medium

Abstract

The application discloses an attack behavior intelligent early warning method and device based on multi-agent cooperation, equipment and medium, relates to the network security technical field, and the method comprises the following steps: processing original alarm data, determining the data format type of the original alarm data, if the confidence degree of the data format type is greater than or equal to the confidence degree preset threshold, converting the original alarm data into standardized alarm text; extracting a structured key field from the standardized alarm text; obtaining a threat intelligence retrieval score based on a threat intelligence knowledge graph and the structured key field; obtaining a graph model similarity score based on the structured key field and a historical threat event graph model library; obtaining a comprehensive threat score based on the threat intelligence retrieval score and the graph model similarity score; determining a threat level and a determination result according to the comprehensive threat score; if the threat level is greater than or equal to the early warning threshold and the determination result is True, triggering the early warning mode. The method improves the accuracy of threat assessment determination.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an intelligent early warning method, device, equipment and medium for attack behavior based on multi-agent collaboration. Background Technology

[0002] As cyberattack methods continue to evolve, sophisticated attacks such as advanced persistent threats (APPTs), ransomware, and zero-day vulnerabilities are becoming increasingly frequent, placing higher demands on cybersecurity protection capabilities across all industries. Threat assessment of alert data, a core component of the security operations system, directly impacts the speed of attack detection and response efficiency in terms of accuracy and real-time performance. However, with the deepening of enterprise IT infrastructure development, the types and number of security devices in the network environment are surging, leading to an exponential increase in alert data. Accurately and efficiently identifying real threats from massive amounts of alerts has become a pressing technical challenge in the cybersecurity field.

[0003] In existing technologies, threat assessment solutions for alarm data mainly employ rule-based matching or single-dimensional reputation scoring methods. Specifically, the system pre-configures static thresholds or maintains blacklists and whitelists for IP addresses / domains. When a new alarm is generated, key fields such as IP address and domain name are extracted from the alarm and compared precisely with the blacklists and whitelists or simple numerical comparisons. If a match is found in the blacklist or the value exceeds a preset threshold, the alarm data is identified as a threat and an alert is triggered; otherwise, the alarm data is ignored or marked as low-risk. Some solutions further incorporate external threat intelligence, comparing alarm characteristics with malicious indicators from intelligence sources as a basis for threat determination.

[0004] Because existing solutions rely solely on single-dimensional features for judgment, failing to integrate multi-dimensional information such as external threat intelligence, historical attack events, and attack chain context for correlation analysis, a large number of highly covert attacks are missed, while many harmless scanning behaviors are falsely reported as high-risk threats. Security operations teams struggle to effectively identify genuine attack behaviors from massive amounts of alerts. Therefore, the accuracy of the aforementioned solutions in threat assessment of alert data is poor. Summary of the Invention

[0005] This application provides a method, device, equipment, and medium for intelligent early warning of attack behavior based on multi-agent collaboration, which can improve the accuracy of threat assessment and judgment of alarm data.

[0006] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application provides an intelligent early warning method for attack behavior based on multi-agent cooperation, the method comprising: Receive raw alarm data; The original alarm data is processed to determine the data format type of the original alarm data, and the confidence level of the data format type is calculated; If the confidence level of the data format type is greater than or equal to the preset confidence threshold, then the original alarm data is converted into a standardized alarm text according to the data format type of the original alarm data; Extract structured key fields from the standardized alarm text; Based on the pre-built threat intelligence knowledge graph and the structured key fields, a threat intelligence retrieval score is obtained; The structured key fields are used to construct the current alarm graph model. The current alarm graph model is then matched with the historical threat event graph model library to obtain a graph model similarity score. The threat intelligence retrieval score and the graph model similarity score are aggregated to obtain a comprehensive threat score; The threat level and judgment result are determined based on the comprehensive threat score. If the threat level is greater than or equal to the threat level warning threshold, and the judgment result is a preset judgment result, then the warning mode is triggered.

[0007] In some possible implementations, the processing of the raw alarm data to determine the data format type of the raw alarm data includes: The byte sequence of the original alarm data is decoded into a string; format feature values ​​corresponding to multiple preset alarm data format types are extracted from the string; a weighted score is calculated on the extracted multiple format feature values, and the preset alarm data format type with the highest weighted score is determined as the data format type of the original alarm data.

[0008] In some possible implementations, converting the original alarm data into normalized alarm text according to the data format type of the original alarm data includes: When the data format is JSON, the original alarm data is recursively flattened using nested objects to obtain standardized alarm text. When the data format is XML, the original alarm data is traversed through a node tree, the tag text content of each node is extracted as field values, the tag attributes of each node are extracted and converted into independent key-value pairs, and the field values ​​and independent key-value pairs are combined to obtain standardized alarm text. When the data format is Syslog, the header field and body content are extracted from the original alarm data, and the header field and body content are recombined to obtain... The first key-value pair is used as the normalized alarm text. When the data format type is CEF, the first fixed header field and the first extended field are extracted from the original alarm data, and the first fixed header field and the first extended field are recombined to obtain the second key-value pair, which is used as the normalized alarm text. When the data format type is LEEF, the second fixed header field and the second extended field are extracted from the original alarm data, and the second fixed header field and the second extended field are recombined to obtain the third key-value pair, which is used as the normalized alarm text.

[0009] In some possible implementations, the threat intelligence knowledge graph is constructed in the following ways: Raw threat intelligence data is collected from multiple external threat intelligence sources; the raw threat intelligence data is preprocessed to obtain standardized threat intelligence data; threat entities and relationships between threat entities are extracted from the standardized threat intelligence data; a threat intelligence knowledge graph is constructed using the threat entities as nodes and the relationships between threat entities as edges; wherein, the threat entities include at least one of the following: technical ID, attack type, attack tactic, attack organization, attack tool, malicious IP address, malicious domain name, TLS certificate, vulnerability, and malware; the relationships between threat entities include attribution relationships where IP addresses are attributed to attack organizations, resolution relationships where domain names are resolved to IP addresses, usage relationships where attack organizations use attack tools, usage relationships where attack organizations use attack tactics, association relationships where attack organizations are associated with vulnerabilities, and association relationships where attack organizations launch attacks.

[0010] In some possible implementations, the threat intelligence retrieval score is obtained based on the pre-built threat intelligence knowledge graph and the structured key fields, including: The alarm initiator's IP address, domain name, and user identifier are extracted from the structured key fields. These three elements are then used to construct an alarm data triplet. The text similarity between the alarm data triplet and each threat entity node in the threat intelligence knowledge graph is calculated to obtain a text similarity score. Threat entity nodes with text similarity scores greater than or equal to a preset similarity threshold are selected from the threat entity nodes and designated as a related node set. At least one entity from the alarm data triplet is selected as a seed node. Starting from the seed node, a multi-hop search is performed in the threat intelligence knowledge graph. In each hop search, the search expands to include target nodes that are related to the current node. An alarm structured path chain is constructed based on the target nodes obtained from each hop search. The threat intelligence relevance score of the alarm structured path chain is calculated. A threat intelligence retrieval score is obtained based on the text similarity scores corresponding to each threat entity node in the related node set and the threat intelligence relevance score of the alarm structured path chain.

[0011] In some possible implementations, the method further includes: If the confidence level of the data format type is less than the preset confidence threshold, the original alarm data is determined to be an unrecognizable format, and the original alarm data is filtered.

[0012] In some possible implementations, the method further includes: If the threat level is lower than the threat level warning threshold, or if the judgment result is not the preset judgment result, the warning mode will not be triggered.

[0013] Secondly, this application provides an intelligent early warning device for attack behavior based on multi-agent collaboration, the device comprising: The receiving module is used to receive raw alarm data; The determination module is used to process the original alarm data, determine the data format type of the original alarm data, and calculate the confidence level of the data format type; The conversion module is used to convert the original alarm data into a normalized alarm text according to the data format type of the original alarm data if the confidence level of the data format type is greater than or equal to a preset confidence level threshold. The calculation module is used to extract structured key fields from the normalized alarm text; obtain a threat intelligence retrieval score based on a pre-built threat intelligence knowledge graph and the structured key fields; construct a current alarm graph model from the structured key fields; perform similarity matching between the current alarm graph model and a historical threat event graph model library to obtain a graph model similarity score; and aggregate the threat intelligence retrieval score and the graph model similarity score to obtain a comprehensive threat score. The early warning module is used to determine the threat level and judgment result based on the comprehensive threat score; if the threat level is greater than or equal to the threat level early warning threshold and the judgment result is a preset judgment result, then the early warning mode is triggered.

[0014] Thirdly, this application provides a computing device, including a memory and a processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of the first aspects.

[0015] Fourthly, this application provides a computer-readable storage medium for storing a computer program for performing the method as described in any one of the first aspects.

[0016] Fifthly, this application provides a computer program product comprising one or more computer instructions, wherein when the computer instructions are executed by a computer, the computer performs the method as described in any one of the first aspects.

[0017] As can be seen from the above technical solution, this application has at least the following beneficial effects: In this application, raw alarm data is received; the raw alarm data is processed to determine the data format type and calculate the confidence level of the data format type; if the confidence level of the data format type is greater than or equal to a preset confidence threshold, the raw alarm data is converted into normalized alarm text according to the data format type; structured key fields are extracted from the normalized alarm text; a threat intelligence retrieval score is obtained based on a pre-built threat intelligence knowledge graph and structured key fields; the structured key fields are used to construct the current alarm graph model, and the current alarm graph model is matched with the historical threat event graph model library to obtain a graph model similarity score; the threat intelligence retrieval score and the graph model similarity score are aggregated to obtain a comprehensive threat score; the threat level and judgment result are determined based on the comprehensive threat score; if the threat level is greater than or equal to the threat level warning threshold and the judgment result is a preset judgment result, a warning mode is triggered.

[0018] In existing technical solutions, threat assessment schemes mainly adopt judgment methods based on rule matching or single-dimensional reputation scoring. These methods rely solely on single-dimensional features such as IP addresses and domain names in alarm data for threat determination, failing to comprehensively analyze multi-dimensional information such as external threat intelligence, historical attack events, and attack chain context. This results in a large number of highly covert attacks being missed, while many harmless scanning behaviors are falsely reported as high-risk threats, leading to poor accuracy in threat assessment. Therefore, this application overcomes the problem of the lack of a unified parsing mechanism for multi-source heterogeneous alarm data by automatically identifying the data format types of multi-source heterogeneous alarm data and converting them into standardized alarm text through an alarm parsing intelligent agent. Furthermore, the threat assessment intelligent agent matches and retrieves structured key fields with the threat intelligence knowledge graph and performs similarity matching with a historical threat event graph model library. The threat intelligence retrieval score and graph model similarity score are aggregated to obtain a comprehensive threat score, achieving comprehensive threat assessment from two dimensions: external threat intelligence correlation and internal historical attack pattern matching. This improves the accuracy and reliability of threat assessment.

[0019] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0020] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application; Figure 2 A flowchart illustrating an intelligent early warning method for attack behavior based on multi-agent collaboration, provided for embodiments of this application; Figure 3 A schematic diagram of an intelligent early warning device for attack behavior based on multi-agent collaboration provided in an embodiment of this application; Figure 4 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0021] The terms "first," "second," and "third," etc., used in this application specification and accompanying drawings are used to distinguish different objects, not to limit a specific order.

[0022] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0023] To ensure clarity and conciseness in the description of the following embodiments, a brief introduction to the related technologies is given first: Raw alarm data refers to security event records output by data source devices when they detect abnormal behavior or potential threats. Data source devices include firewalls, intrusion detection systems, endpoint detection and response systems, identity authentication servers, network traffic monitoring systems, operating system log systems, and RASP systems. Different data source devices output raw alarm data in different formats, including JSON, XML, Syslog, CEF, and LEEF.

[0024] Threat intelligence refers to threat-related information collected from external threat intelligence sources such as open-source intelligence platforms and after being organized and analyzed. This includes malicious IP addresses, malicious domains, attack organizations, attack tools, vulnerability information, and attack tactics.

[0025] Threat assessment refers to the process of comprehensively analyzing collected alarm data to determine whether the behavior indicated by the alarm data is a real attack and to assess the threat level of the attack.

[0026] Currently, the cybersecurity field faces severe challenges from the ever-evolving sophisticated attack methods of advanced persistent threats, ransomware, and zero-day vulnerabilities. Threat assessment of alert data, as a crucial component of the security operations system, directly impacts the speed of attack detection and response efficiency. However, with the deepening of enterprise IT infrastructure development, the types and number of security devices in the network environment have surged, leading to an exponential increase in alert data. Accurately and efficiently identifying real threats from massive alerts has become a pressing technical challenge in the cybersecurity field.

[0027] In existing technologies, threat assessment solutions for alarm data mainly employ rule-based matching or single-dimensional reputation scoring methods. The system pre-configures static thresholds or maintains blacklists and whitelists for IP addresses and domain names. When a new alarm is generated, key fields such as IP address and domain name are extracted and precisely matched or simply compared against the blacklists and whitelists. If a match is found or the value exceeds a preset threshold, the alarm data is classified as a threat and an alert is triggered; otherwise, the alarm data is ignored or marked as low-risk. Some solutions further incorporate external threat intelligence, comparing alarm characteristics with malicious indicators from intelligence sources as a basis for threat determination. However, because existing solutions rely solely on single-dimensional features for judgment, they fail to comprehensively analyze multi-dimensional information such as external threat intelligence, historical attack events, and attack chain context. This results in a large number of highly stealthy attacks being missed, while many harmless scanning behaviors are falsely flagged as high-risk threats.

[0028] In view of this, this application provides an intelligent early warning method for attack behavior based on multi-agent collaboration. Compared with the prior art, this application solves the technical problem of lack of a unified parsing mechanism for multi-source heterogeneous alarm data by automatically identifying the format, standardizing and converting the alarm data, and extracting key fields through an alarm parsing agent; and solves the technical problem of single threat assessment dimension and poor assessment accuracy in the prior art by using a threat assessment agent to perform multi-dimensional comprehensive threat scoring based on threat intelligence knowledge graph and graph model similarity matching, thereby realizing automatic early warning of alarm events and improving the efficiency of security operation and maintenance.

[0029] To make the technical solution of this application clearer and easier to understand, the application scenarios of the technical solution of this application are described below with reference to the accompanying drawings. Figure 1 As shown in the figure, this figure is a schematic diagram of an application scenario provided by an embodiment of this application.

[0030] In this application scenario, the data source devices include firewalls, intrusion detection systems, endpoint detection and response systems, identity authentication servers, network traffic monitoring systems, operating system log systems, and RASP systems. Each data source device is deployed in different network areas of the power e-commerce business system to monitor various network behaviors in real time and generate raw alarm data. The raw alarm data generated by each data source device is sent to the alarm parsing agent via message queues or system log protocols.

[0031] The alarm parsing agent receives the aggregated raw alarm data and sequentially performs data format type identification, confidence calculation, normalization conversion, and structured key field extraction. The extracted structured key fields are then passed to the threat assessment agent.

[0032] After receiving structured key fields, the threat assessment agent performs parallel calculations of threat intelligence retrieval and scoring based on a threat intelligence knowledge graph, and graph model similarity scoring based on a historical threat event graph model library. These two scores are then aggregated to obtain a comprehensive threat score, which is used to determine the threat level and the assessment result. When the threat level is greater than or equal to the threat level warning threshold and the assessment result indicates a genuine attack, the threat assessment agent triggers an automatic warning generation process, outputting warning information to the terminal devices of security operations personnel and simultaneously recording the warning information to the security management platform for subsequent source tracing and analysis.

[0033] It should be understood that Figure 1 The application scenarios shown are merely illustrative examples. The methods provided in this application embodiment can also be applied to other types of network security protection scenarios, such as cloud security operation centers, data center security supervision platforms, and industrial internet security monitoring platforms. This application embodiment does not limit these applications.

[0034] To make the technical solution of this application clearer and easier to understand, the following describes an intelligent early warning method for attack behavior based on multi-agent collaboration, provided by an embodiment of this application, in conjunction with the above application scenarios. Figure 2 As shown, this figure is a flowchart of an intelligent early warning method for attack behavior based on multi-agent collaboration provided in an embodiment of this application. The method includes: S201, The alarm parsing agent receives the raw alarm data.

[0035] An alarm parsing agent is a functional module used to perform raw alarm data format type identification, normalization conversion, and key field extraction. Internally, the alarm parsing agent encapsulates alarm format identification tools, alarm format normalization tools, and parsing engine invocation tools.

[0036] A message queue is a middleware component used to transmit raw alarm data between data source devices and alarm parsing agents, and it has caching and asynchronous transmission functions.

[0037] The system log protocol is a network communication protocol used to transmit raw alarm data generated by data source devices to the alarm parsing agent in a standard format.

[0038] The alarm parsing agent receives raw alarm data from various data source devices via message queues or system log protocols. After generating raw alarm data, each data source device encapsulates it into a standard format transmission message and sends it to the alarm parsing agent via the publish-subscribe mechanism of the message queue or the push mechanism of the system log protocol. The alarm parsing agent continuously monitors the message queue's receive channel or the system log protocol's receive port. Upon receiving a transmission message, the alarm parsing agent decapsulates the message and extracts the raw alarm data from it.

[0039] After receiving the raw alarm data, the alarm parsing agent caches the raw alarm data in the form of a byte sequence in the alarm parsing agent's memory space.

[0040] S202. The alarm parsing agent processes the original alarm data, determines the data format type of the original alarm data, and calculates the confidence level of the data format type.

[0041] The alarm parsing agent decodes the byte sequence of the original alarm data into a string; extracts the format feature values ​​corresponding to various preset alarm data format types from the string; calculates a weighted score for the extracted multiple format feature values, and determines the preset alarm data format type with the highest weighted score as the data format type of the original alarm data.

[0042] Specifically, the alarm parsing agent reads the byte sequence of the raw alarm data cached in memory. This byte sequence of the raw alarm data is denoted as... The sequence is represented as:

[0043] in, This represents a byte sequence of a single raw alarm data. Indicates the first byte. This indicates the second byte. This represents the i-th byte. This represents the nth byte, where i ranges from 1 to n, and n represents the total length of the alarm data byte sequence.

[0044] The alarm parsing agent decodes the byte sequence of the raw alarm data into a string. This process is represented as:

[0045] in, This represents the string obtained after decoding. 'e' represents the decoding function, and 'e' represents the encoding method.

[0046] The alarm parsing agent extracts format feature values ​​corresponding to various preset alarm data format types from the decoded string. The preset alarm data format types include JSON, XML, Syslog, CEF, and LEEF, each with a corresponding format feature value. The alarm parsing agent extracts the format feature values ​​corresponding to each of the five preset alarm data format types from string S, constructing a feature vector:

[0047] in, This represents a structural feature vector with a dimension of 5. For JSON format feature values, For XML format feature values, These are the format feature values ​​for Syslog format. These are the format feature values ​​for CEF format. is the format feature value of LEEF format, and T is the transpose.

[0048] The format feature value of JSON is calculated as follows:

[0049] in, This represents the format feature value of JSON, with a value of [value]. , Indicates an indicator function, This represents logical AND. Represents the character " "exist The number of times it appears in Represents the character " "exist The number of times it appears in Represents the character " exist The number of times it appears in Represents the character " "exist The number of times it appears in This indicates that the JSON can be successfully parsed, and its value is 1.

[0050] The format feature values ​​of XML are calculated as follows:

[0051] in, The format feature value represents the XML format, and its value is... , This indicates the number of starting tags that the regular expression matches. This indicates the number of closing tags matched by the regular expression. Represents the character " "exist The number of times it appears in Represents the character " "exist The number of times it appears in This indicates that the XML parsing was successful and its value is 1.

[0052] The format feature values ​​of Syslog format are calculated as follows:

[0053] in, This represents the format feature value of the Syslog format, with a value of [value to be filled in]. , Represents logical OR, This indicates that the regular expression matches patterns that begin with the PRI value. This indicates that the regular expression matches the ISO-8601 timestamp format. This indicates a regular expression matching the RFC-3164 timestamp format.

[0054] The format feature value of CEF format is calculated as follows:

[0055] in, This represents the format feature value of the CEF format, with a value of [value]. , This function checks the prefix of a string; it returns true if the prefix starts with "CEF:".

[0056] The format feature values ​​of LEEF are calculated as follows:

[0057] in, This represents the format feature value of LEEF format, and its value is... , This function checks the prefix of a string; it returns true if the prefix starts with LEEF:.

[0058] The alarm parsing agent calculates a weighted score based on the five extracted feature values. The weighted score is calculated as follows:

[0059] in, Indicates the data format type. Represents a string Determined as a data format type The weighted score, for The weighting coefficients of the format feature values. for The weighting coefficients of the format feature values. for The weighting coefficients of the format feature values. for The weighting coefficients of the format feature values. express The weighting coefficients of the format feature values. , , , and The sum of the weighting coefficients is 1. The values ​​of the weighting coefficients are initially determined by engineering experience in the field within a commonly used range, and then verified and solidified by objective technical indicators. In the embodiments of this application, they can be respectively taken as: , , , and .

[0060] The alarm parsing agent determines the preset alarm data format type with the highest weighted score as the original alarm data data format type. This determination method is expressed as follows:

[0061] in, The data format type that yields the highest weighted score is specified by argmax, which indicates the data format type that returns the data format type that maximizes the weighted score.

[0062] The alarm parsing agent calculates the confidence score for the data format type. The confidence score is calculated as follows:

[0063] in, This indicates the confidence level for alarm data format identification, with a value range of [value range missing]. , for The weighted score, , This is a smoothing factor.

[0064] The alarm parsing agent compares the calculated confidence level with a preset confidence threshold. The preset confidence threshold is denoted as... In this embodiment of the application, based on experience, the preset confidence threshold can be set to 0.65. When Greater than or equal to At that time, the alarm parsing agent determines the format of the original alarm data as... The raw alarm data can then enter the normalization and transformation process, i.e., execute S203. When Less than When the alarm parsing agent determines that the original alarm data is in an unrecognizable format, it marks the original alarm data as Unstructured and performs a filtering operation, and the original alarm data does not enter the subsequent processing flow.

[0065] This application extracts structural feature values ​​for five preset formats—JSON, XML, Syslog, CEF, and LEEF—from the decoded string, and calculates a weighted score for each feature value. The format with the highest weighted score is determined as the data format type of the alarm data. This achieves automated identification of multi-source heterogeneous alarm data formats, avoiding the inefficiency and error-proneness of relying on manually preset parsing rules. This step calculates the confidence level of format identification and compares it with a preset threshold to filter out unrecognizable formats, reducing the interference of low-quality data on the threat assessment process and improving the overall efficiency of alarm data processing.

[0066] S203. If the confidence level of the data format type is greater than or equal to the preset confidence threshold, the original alarm data is converted into a standardized alarm text according to the data format type of the original alarm data.

[0067] Specifically, normalized alarm text refers to converting raw alarm data into a text representation in key-value pair format according to a unified structure. This normalized alarm text eliminates structural differences between different data formats, making it easier to extract key fields.

[0068] Recursive flattening of nested objects refers to the process of unfolding a multi-level nested object structure in JSON format layer by layer, combining the key names at each level of the nesting path into a single key name, and using the corresponding value as the value of that key, ultimately forming a first-level key-value pair set.

[0069] Node tree traversal refers to the process of sequentially visiting all child nodes starting from the root node according to the tree structure of an XML document, and extracting the tag text content and tag attributes of each node.

[0070] Header fields refer to the fixed structure at the beginning of a message in formats such as Syslog, CEF, and LEEF, which include predefined fields such as timestamp, hostname, and process identifier.

[0071] Extended fields refer to the optional key-value pairs in CEF and LEEF formats that follow the header fields and are used to carry additional event information.

[0072] The first, second, and third key-value pairs represent the sets of key-value pairs generated after normalization transformation of Syslog, CEF, and LEEF formats, respectively. They are only used to distinguish different sources and have no other meaning.

[0073] After determining the data format type of the original alarm data in S202, the alarm parsing agent performs the corresponding normalization conversion operation based on the data format type. There are five conversion operations, corresponding to JSON, XML, Syslog, CEF, and LEEF formats.

[0074] When the data format is JSON, the original alarm data is recursively flattened using nested objects to obtain standardized alarm text. When the data format is XML, the original alarm data is traversed through a node tree, extracting the tag text content of each node as field values, extracting the tag attributes of each node and converting them into independent key-value pairs, and combining the field values ​​and independent key-value pairs to obtain standardized alarm text. When the data format is Syslog, the header fields and body content are extracted from the original alarm data, and the header fields and body content are recombined to obtain... The first key-value pair is used as the normalized alarm text. When the data format is CEF, the first fixed field and the first extended field of the header are extracted from the original alarm data. The first fixed field and the first extended field are recombined to obtain the second key-value pair, which is used as the normalized alarm text. When the data format is LEEF, the second fixed field and the second extended field of the header are extracted from the original alarm data. The second fixed field and the second extended field are recombined to obtain the third key-value pair, which is used as the normalized alarm text.

[0075] This application performs corresponding structured conversion operations on five different raw alarm data formats: JSON, XML, Syslog, CEF, and LEEF. It converts alarm data of all formats into standardized alarm text in key-value pair format, eliminating differences in field naming, encoding methods, and organizational structures between different data sources, thus giving alarm data from different devices a unified data format.

[0076] S204. The alarm parsing agent extracts structured key fields from the normalized alarm text.

[0077] The alarm parsing agent reads predefined field mapping rules. These rules include extraction configurations for three types of fields: the first is the alarm type field, the second is the alarm initiator information field, and the third is the attack target information field.

[0078] The alarm parsing agent, based on the alarm type field extraction configuration, searches for keys matching the alarm type in the key-value pairs of the normalized alarm text and extracts the value corresponding to that key as the value of the alarm type field. If multiple keys related to the alarm type exist in the normalized alarm text, the alarm parsing agent attempts to match them sequentially in descending order of priority, and uses the first successful match as the value of the alarm type field.

[0079] The alarm parsing agent, based on the configuration for extracting the alarm initiator information field, searches for keys matching the alarm initiator's IP address, domain name, user identifier, and Uniform Resource Locator (URL) in the key-value pairs of the normalized alarm text, and extracts the values ​​corresponding to each key as the values ​​of each field. For cases where similar information may have multiple different key name representations, the alarm parsing agent attempts to match them one by one according to priority, selecting the value corresponding to the first successfully matched key name.

[0080] The alarm parsing agent, based on the configuration for extracting attack target information fields, searches for keys in the key-value pairs of the normalized alarm text that match the affected asset's IP address, hostname, service name, media access control address, and attack port, and extracts the value corresponding to each key as the value of each field.

[0081] The alarm parsing agent combines the extracted alarm type, alarm initiator IP address, alarm initiator domain name, user identifier, Uniform Resource Locator (URL), affected asset IP address, hostname, service name, media access control address, and attack port fields into structured key fields. These structured key fields are organized as a set of key-value pairs, with each field name corresponding to a field value. For fields that cannot be extracted from the normalized alarm text, the alarm parsing agent sets the field's value to null, while retaining the field's position in the structured key fields.

[0082] The alarm parsing agent transmits the assembled structured key fields to the threat assessment agent.

[0083] S205. The threat assessment agent obtains a threat intelligence retrieval score based on a pre-built threat intelligence knowledge graph and structured key fields.

[0084] A threat intelligence knowledge graph is a threat intelligence knowledge base organized in a graph structure, with threat entities as nodes and the relationships between threat entities as edges, used to store and express threat intelligence information.

[0085] Threat intelligence knowledge graphs are constructed in the following ways: Raw threat intelligence data is collected from multiple external threat intelligence sources. This raw data is then preprocessed to obtain standardized threat intelligence data. Preprocessing operations include deduplication, redundancy removal, and format standardization. Deduplication involves identifying and removing duplicate threat intelligence entries. Redundancy removal involves identifying and removing threat intelligence entries with highly overlapping content. Format standardization involves converting threat intelligence data from different sources into a unified field structure and encoding format.

[0086] The threat intelligence data is used to extract threat entities and the relationships between them. A threat intelligence knowledge graph is constructed with threat entities as nodes and the relationships between them as edges. Threat entities include at least one of the following: technical ID, attack type, attack tactic, attack organization, attack tool, malicious IP address, malicious domain name, TLS certificate, vulnerability, and malware. The relationships between threat entities include attribution relationships where IP addresses are attributed to attack organizations, resolution relationships where domain names are resolved to IP addresses, usage relationships where attack organizations use attack tools, usage relationships where attack organizations use attack tactics, association relationships where attack organizations are associated with vulnerabilities, and association relationships where attack organizations launch attacks.

[0087] The threat intelligence knowledge graph is denoted as G=(V,E), where V represents the set of threat entity nodes and E represents the set of relation edges.

[0088] After the threat intelligence knowledge graph is constructed, the threat assessment agent extracts the alert initiator's IP address, alert initiator's domain name, and user identifier from the structured key fields, and constructs an alert data triple from the alert initiator's IP address, alert initiator's domain name, and user identifier, denoted as . ,in, For alarm data triples, The IP address of the alarm initiator. For the domain name of the party initiating the alarm, Used as a user identifier.

[0089] The threat assessment agent calculates the text similarity between the alarm data triples and each threat entity node in the threat intelligence knowledge graph, obtaining a text similarity score between the alarm data triples and each threat entity node. For each threat entity node in the threat intelligence knowledge graph, the threat assessment agent obtains the corresponding text description information. The threat assessment agent concatenates the three fields in the alarm data triples into a query text, inputs the query text and the text description information of each node into a text encoding function, and obtains their respective vector representations. The threat assessment agent calculates the similarity between the query text vector and the text vectors of each node using a similarity function, obtaining a text similarity score between the alarm data triples and each threat entity node. This process is represented as:

[0090] in, The text similarity score is calculated between the alarm data triples and each threat entity node. The text description information corresponding to the threat entity node, , This represents an entity node in a threat intelligence knowledge graph. This represents the vector representation obtained after inputting the textual description information of the threatening entity node into a text encoding function. This represents the vector representation obtained after inputting the alarm data triples into a text encoding function. This is the similarity function.

[0091] The threat assessment agent selects threat entity nodes from each threat entity node whose text similarity score is greater than or equal to a preset similarity threshold, and uses the selected threat entity nodes as a set of related nodes; in this embodiment of the application, the preset similarity threshold is set to 0.65 based on experience.

[0092] The threat assessment agent selects at least one entity from the alarm data triples as a seed node. Starting from the seed node, it performs a multi-hop search in the threat intelligence knowledge graph. In each hop search, it expands the search to find target nodes that are related to the current node. Based on the target nodes obtained from each hop search, it constructs an alarm structured path chain. The specific process is as follows: First, we use alarm data triplet. The core entity is the seed node. A direct neighbor search is performed within the threat intelligence knowledge graph to find nodes that are related to the seed node. For nodes and edges with a one-hop relationship, the one-hop retrieval result is defined as follows:

[0093] In the above formula, Indicates Starting from the first node, follow any relation r to reach the first target node. Let R be the set of triples, and let R be the set of all relation edges in the threat intelligence knowledge graph. Represents seed node The set of neighboring nodes, that is, with The set of all nodes directly connected by a relation edge.

[0094] For all seed entities The one-hop search result is:

[0095] In the above formula, This represents a one-hop search result for all seed entities. This indicates the union operation.

[0096] Using the first target node in the first-hop search results as a new seed entity, a second-hop extended search is performed to uncover deeper related intelligence. The second-hop search focuses on the extended attributes of intermediate nodes such as attack organizations, historical campaigns, and historical attack events. This is based on the first target node in the first-hop results. , This represents the set of target nodes extracted from the one-hop search results. The two-hop search results are defined as follows:

[0097] In the above formula, Indicates Starting from the beginning, along any relation Reaching the second target node The set of triples.

[0098] For all seed entities The two-hop search results are:

[0099] In the above formula, This represents the two-hop search results for all seed entities.

[0100] Then, using the target node from the two-hop search results as the new seed entity, a three-hop extended search is performed to construct a complete attack chain fragment. Based on the second target node from the two-hop results... , This represents the set of target nodes extracted from the two-hop results. The three-hop retrieval result is defined as:

[0101] In the above formula, Indicates Starting from the beginning, along any relation Reach the third target node The set of triples.

[0102] For all seed entities The three-hop search results are:

[0103] In the above formula, This is the result of a three-hop retrieval for all seed entities.

[0104] Based on the three-hop retrieval results, the alarm structured path chain is constructed as follows:

[0105] In the above formula, This indicates the structured alarm path chain. , , , .

[0106] The threat assessment agent calculates the threat intelligence-related score of the alarm structured path chain, and the calculation formula is as follows:

[0107]

[0108] in, Threat intelligence-related scores for structured alert paths. The weighting coefficient for path density is initially determined by engineering experience in the field within a commonly used range, and then verified and solidified through objective technical indicators. In the embodiments of this application, it can be set as follows: , For path density, Indicates the number of hops in the path. for Confidence weights This refers to the i-th relation edge in the structured path chain P that triggers the alarm, where the value of i ranges from 1 to k. for The number of out-degree neighbors, The alarm is triggered at the (j-1)th node in the structured path chain P, which is the node in the path before the j-th relation edge, where the value of j ranges from 1 to k.

[0109] The threat assessment agent obtains a threat intelligence retrieval score based on the text similarity score corresponding to each threat entity node in the relevant node set, and the threat intelligence-related score of the alarm structured path chain. The calculation formula is as follows:

[0110] in, Scoring of threat intelligence retrieval; The sigmoid function is an S-shaped function used to map input values ​​to the range of 0 to 1, ensuring that threat intelligence retrieval scores have a uniform value range; N is the set of nodes. The number of related nodes in the data.

[0111] This application constructs a threat intelligence knowledge graph encompassing various threat entities and their relationships, including technology IDs, attack types, attack tactics, attack organizations, attack tools, malicious IP addresses, malicious domains, TLS certificates, vulnerabilities, and malware. This connects fragmented alert metrics with systematic threat intelligence knowledge, addressing the problem of existing technologies relying solely on single-dimensional features for threat assessment. By performing multi-hop searches starting from alert data triples, a structured alert path chain is constructed, expanding isolated attack metrics in alerts into attack chain fragments containing contextual information such as attack organizations, attack tactics, and attack tools. This enables threat assessment to possess attack chain context awareness capabilities. By calculating the threat intelligence relevance score of the structured alert path chain and aggregating this score with a text similarity score to obtain a threat intelligence retrieval score, a quantitative assessment of the correlation strength between alert data and external threat intelligence is achieved.

[0112] S206. The threat assessment agent constructs the current alarm graph model from the structured key fields, performs similarity matching between the current alarm graph model and the historical threat event graph model library, and obtains the graph model similarity score.

[0113] The threat assessment agent constructs a graph model of the current alarm data based on the structured key fields output by the alarm parsing agent. (Nodes) The construction method involves mapping the alarm initiator's IP address, affected asset IP address, alarm initiator's domain name, user identifier, attacking hostname, attacking service name, attacking media access control address, and attacking port as nodes in a graph model. (Edges) The construction method is as follows: alarm type is used as an edge label to connect related node pairs. The threat assessment agent records the completed current alarm graph model as follows: .

[0114] The threat assessment agent reads a pre-built library of historical threat event graph models. It then searches this library for candidate historical graph models similar to the current alert graph model. The search method involves calculating the cosine similarity between the current alert graph model and each historical graph model in the library. The cosine similarity calculation uses the adjacency matrix or feature vector of the graph model as input. Finally, the threat assessment agent selects the historical graph model with the highest cosine similarity score from all historical graph models. Where y represents the identifier of the selected historical graph model. The highest score is output as the graph model similarity score. Graph Model Similarity Score The calculation method is expressed as follows:

[0115] This application achieves a quantitative assessment of the structural similarity between current alerts and historical attack events by constructing a current alert graph model from structured key fields and performing cosine similarity matching with a historical threat event graph model library.

[0116] S207. The threat assessment agent aggregates the threat intelligence retrieval score and the graph model similarity score to obtain a comprehensive threat score.

[0117] The threat assessment agent aggregates the threat intelligence retrieval score and the graph model similarity score to obtain a comprehensive threat score, calculated using the following formula:

[0118] in, This is used for comprehensive threat scoring.

[0119] S208. The threat assessment agent determines the threat level and judgment result based on the comprehensive threat score.

[0120] The threat assessment agent determines the threat level based on a preset threshold range.

[0121] The threshold range is divided into five intervals, each corresponding to one of the five threat levels. When the Score is greater than or equal to 0 and less than or equal to 0.3, the threat assessment agent determines the current alert as a false alarm. When the Score is greater than 0.3 and less than or equal to 0.5, the threat assessment agent determines the current alert as a low-risk threat. When the Score is greater than 0.5 and less than or equal to 0.7, the threat assessment agent determines the current alert as a medium-risk threat. When the Score is greater than 0.7 and less than or equal to 0.9, the threat assessment agent determines the current alert as a high-risk threat. When the Score is greater than 0.9 and less than or equal to 1, the threat assessment agent determines the current alert as an extremely high-risk threat.

[0122] The threat assessment agent determines the judgment result based on the threshold range of the comprehensive threat score. When the comprehensive threat score falls into the false alarm range (Score greater than or equal to 0 and less than or equal to 0.3), the threat assessment agent sets the judgment result to False, indicating that the current alarm is judged as a false alarm and does not represent a real attack. When the comprehensive threat score falls into the low-risk, medium-risk, high-risk, or very high-risk threat range, the threat assessment agent sets the judgment result to True, indicating that the current alarm is judged as a real attack.

[0123] The threat assessment agent combines the threat score, threat level, and judgment result into a threat assessment output, which is then transmitted to the automatic warning generation tool.

[0124] S209. If the threat level is greater than or equal to the threat level warning threshold, and the judgment result is a preset judgment result, then the warning mode is triggered.

[0125] The automatic early warning generation tool receives the comprehensive threat score, threat level, and judgment result from the threat assessment agent.

[0126] The automatic alert generation tool reads the pre-configured threat level alert threshold. This threshold is set to high-risk threat level. The tool also reads the pre-configured preset judgment result. This preset judgment result is set to True.

[0127] The automatic alert generation tool performs trigger condition determination. The trigger condition is that the threat level is greater than or equal to the threat level alert threshold, and the determination result is equal to the preset determination result. Specifically, a threat level greater than or equal to the threat level alert threshold means the threat level is high-risk or extremely high-risk. A determination result equal to the preset determination result means the determination result is True.

[0128] When the threat level is high-risk or extremely high-risk, and the assessment result is True, the automatic alert generation tool determines that the triggering conditions are met and initiates the alert generation process. The alert generation process includes: the automatic alert generation tool assembles alert information based on the current alert's comprehensive threat score, threat level, structured key fields, and alert timestamp; encapsulates the alert information into a standard format alert message; outputs the alert notification to the terminal devices of security operations personnel via push notification service; and simultaneously writes the alert information to the alert record storage area of ​​the security management platform for security operations personnel to perform source tracing and analysis.

[0129] This application sets a dual trigger condition: a high-risk threat level threshold and a preset judgment result of True. This ensures that warnings are only triggered for alerts that are confirmed as genuine attacks and have a threat level of high risk or above. This avoids interference from low-risk threats and false alarms for security operations personnel, reduces the number of invalid warnings, and improves the efficiency of security operations.

[0130] S210. If the threat level is less than the threat level warning threshold, or the judgment result is not the preset judgment result, the warning mode will not be triggered.

[0131] After the automatic warning generation tool performs the trigger condition determination, if the threat level is less than the threat level warning threshold (i.e., the threat level is a false alarm, low-risk threat, or medium-risk threat), the automatic warning generation tool determines that the trigger condition is not met and does not initiate the warning generation process. If the determination result is not equal to the preset determination result (i.e., the determination result is False), the automatic warning generation tool determines that the trigger condition is not met and does not initiate the warning generation process.

[0132] If the triggering conditions are not met, the automatic alert generation tool will not generate a real-time alert notification for the current alarm. Instead, it combines the current alarm's comprehensive threat score, threat level, judgment result, structured key fields, and alarm timestamp into a record entry, writing it to the security management platform's alarm record storage area according to a unified data format for subsequent historical queries and statistical analysis. For alarms with a threat level of false alarm or low-risk threat, and alarms with a judgment result of False, the automatic alert generation tool only performs record archiving and does not send any alert notifications to security operations personnel.

[0133] This application uses clearly defined trigger conditions to determine whether alarms with a threat level below the warning threshold or with a judgment result of False will generate real-time warnings. Instead, they will only be logged and archived. This avoids invalid warnings for low-risk threats and false alarms, reduces the alarm handling burden on security operations personnel, and allows them to focus their attention on real high-risk attack events.

[0134] Based on the above, the intelligent attack behavior early warning method based on multi-agent collaboration provided in the above embodiments of this application automatically identifies, standardizes, and extracts key structured fields from multi-source heterogeneous alarm data through an alarm parsing agent, aggregates the data format types of the alarm data through an alarm parsing agent, obtains a comprehensive threat score through an alarm assessment agent based on threat intelligence knowledge graph retrieval scores and graph model similarity scores, and determines the threat level and judgment result based on the comprehensive threat score. When the threat level reaches the early warning threshold and the judgment result is a real attack behavior, an early warning mode is triggered, thereby realizing automated threat assessment and early warning of alarm data.

[0135] The above text combined Figures 1 to 2 The intelligent early warning method for attack behavior based on multi-agent collaboration provided in the embodiments of this application has been described in detail. The apparatus and equipment provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0136] This application also provides an intelligent early warning device for attack behavior based on multi-agent collaboration, such as... Figure 3 As shown in the figure, this is a schematic diagram of an intelligent early warning device for attack behavior based on multi-agent collaboration provided in an embodiment of this application. The device includes: Receiver module 301 is used to receive raw alarm data; The determination module 302 is used to process the original alarm data, determine the data format type of the original alarm data, and calculate the confidence level of the data format type; The conversion module 303 is used to convert the original alarm data into a standardized alarm text according to the data format type of the original alarm data if the confidence level of the data format type is greater than or equal to the confidence level preset threshold. The calculation module 304 is used to extract structured key fields from the normalized alarm text; obtain a threat intelligence retrieval score based on a pre-built threat intelligence knowledge graph and the structured key fields; construct a current alarm graph model from the structured key fields; perform similarity matching between the current alarm graph model and a historical threat event graph model library to obtain a graph model similarity score; and aggregate the threat intelligence retrieval score and the graph model similarity score to obtain a comprehensive threat score. The early warning module 305 is used to determine the threat level and judgment result based on the comprehensive threat score; if the threat level is greater than or equal to the threat level early warning threshold and the judgment result is a preset judgment result, then the early warning mode is triggered.

[0137] In some possible implementations, the determining module 302 is specifically used to decode the byte sequence of the original alarm data into a string; extract format feature values ​​corresponding to multiple preset alarm data format types from the string; perform weighted score calculation on the extracted multiple format feature values, and determine the preset alarm data format type with the highest weighted score as the data format type of the original alarm data.

[0138] In some possible implementations, the conversion module 303 is specifically used to: when the data format type is JSON, perform nested object recursive flattening processing on the original alarm data to obtain standardized alarm text; when the data format type is XML, perform node tree traversal processing on the original alarm data, extract the tag text content of each node as field values, extract the tag attributes of each node and convert them into independent key-value pairs, and combine the field values ​​and the independent key-value pairs to obtain standardized alarm text; when the data format type is Syslog, extract the header field and body content of the original alarm data, and combine the header field with... The main text content is reorganized to obtain a first key-value pair, which is used as the normalized alarm text. When the data format type is CEF, a first fixed header field and a first extended field are extracted from the original alarm data. The first fixed header field and the first extended field are reorganized to obtain a second key-value pair, which is used as the normalized alarm text. When the data format type is LEEF, a second fixed header field and a second extended field are extracted from the original alarm data. The second fixed header field and the second extended field are reorganized to obtain a third key-value pair, which is used as the normalized alarm text.

[0139] In some possible implementations, the threat intelligence knowledge graph is constructed in the following ways: Raw threat intelligence data is collected from multiple external threat intelligence sources; the raw threat intelligence data is preprocessed to obtain standardized threat intelligence data; threat entities and relationships between threat entities are extracted from the standardized threat intelligence data; a threat intelligence knowledge graph is constructed using the threat entities as nodes and the relationships between threat entities as edges; wherein, the threat entities include at least one of the following: technical ID, attack type, attack tactic, attack organization, attack tool, malicious IP address, malicious domain name, TLS certificate, vulnerability, and malware; the relationships between threat entities include attribution relationships where IP addresses are attributed to attack organizations, resolution relationships where domain names are resolved to IP addresses, usage relationships where attack organizations use attack tools, usage relationships where attack organizations use attack tactics, association relationships where attack organizations are associated with vulnerabilities, and association relationships where attack organizations launch attacks.

[0140] In some possible implementations, the calculation module 304 is specifically used to extract the alarm initiator's IP address, alarm initiator's domain name, and user identifier from the structured key fields; construct an alarm data triplet using the alarm initiator's IP address, alarm initiator's domain name, and user identifier; calculate the text similarity between the alarm data triplet and each threat entity node in the threat intelligence knowledge graph to obtain a text similarity score between the alarm data triplet and each threat entity node; select threat entity nodes from the threat entity nodes whose text similarity score is greater than or equal to a preset similarity threshold, and then select... The extracted threat entity nodes are used as a set of related nodes; at least one entity is selected from the alarm data triples as a seed node, and a multi-hop search is performed in the threat intelligence knowledge graph starting from the seed node. In each hop search, the search is expanded to include target nodes that are related to the current node. An alarm structured path chain is constructed based on the target nodes obtained from each hop search; the threat intelligence relevance score of the alarm structured path chain is calculated; and the threat intelligence retrieval score is obtained based on the text similarity score corresponding to each threat entity node in the set of related nodes and the threat intelligence relevance score of the alarm structured path chain.

[0141] In some possible implementations, the device further includes: The determination module is used to determine that the original alarm data is an unrecognizable format and filter the original alarm data if the confidence level of the data format type is less than a preset confidence threshold.

[0142] In some possible implementations, the warning module 305 is further configured not to trigger the warning mode if the threat level is less than the threat level warning threshold or the judgment result is not a preset judgment result.

[0143] The intelligent early warning device for attack behavior based on multi-agent collaboration according to the embodiments of this application can correspond to the execution of the method described in the embodiments of this application, and the other operations and / or functions of each module / unit of the intelligent early warning device for attack behavior based on multi-agent collaboration are respectively for implementing Figure 2 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0144] This application also provides a computing device. For example... Figure 4 As shown in the figure, this is a schematic diagram of a computing device provided in an embodiment of this application. The computing device 400 includes a bus 401, a processor 402, a communication interface 403, and a memory 404. The processor 402, the memory 404, and the communication interface 403 communicate with each other via the bus 401.

[0145] Bus 401 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0146] Processor 402 can be any one or more of the following processors: central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0147] The communication interface 403 is used for communication with external devices. For example, if the computing device is a first switch, the communication interface 403 can be used for communication between the first switch and a first user terminal, or for communication between the first switch and a second switch.

[0148] Memory 404 may include volatile memory, such as random access memory (RAM). Memory 404 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0149] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the aforementioned intelligent early warning method for attack behavior based on multi-agent cooperation.

[0150] Specifically, in achieving Figure 3 In the case of the illustrated embodiment, and Figure 3 When the modules or units of the intelligent early warning device for attack behavior based on multi-agent collaboration described in the embodiments are implemented through software, the execution... Figure 3 The software or program code required for the functions of each module / unit can be partially or entirely stored in memory 404. Processor 402 executes the program code corresponding to each unit stored in memory 404, and executes the aforementioned intelligent early warning method for attack behavior based on multi-agent cooperation.

[0151] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the aforementioned intelligent early warning method for attack behavior based on multi-agent cooperation.

[0152] This application also provides a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0153] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0154] When the computer program product is executed by a computer, the computer executes any of the aforementioned methods of the intelligent early warning method for attack behavior based on multi-agent cooperation. The computer program product can be a software installation package; when any of the aforementioned methods of the intelligent early warning method for attack behavior based on multi-agent cooperation needs to be used, the computer program product can be downloaded and executed on the computer.

[0155] The descriptions of the processes or structures corresponding to the above-mentioned figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0156] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A method for intelligent early warning of attack behavior based on multi-agent cooperation, characterized in that, The method includes: Receive raw alarm data; The original alarm data is processed to determine the data format type of the original alarm data, and the confidence level of the data format type is calculated; If the confidence level of the data format type is greater than or equal to the preset confidence threshold, then the original alarm data is converted into a standardized alarm text according to the data format type of the original alarm data; Extract structured key fields from the standardized alarm text; Based on the pre-built threat intelligence knowledge graph and the structured key fields, a threat intelligence retrieval score is obtained; The structured key fields are used to construct the current alarm graph model. The current alarm graph model is then matched with the historical threat event graph model library to obtain a graph model similarity score. The threat intelligence retrieval score and the graph model similarity score are aggregated to obtain a comprehensive threat score; The threat level and judgment result are determined based on the comprehensive threat score. If the threat level is greater than or equal to the threat level warning threshold, and the judgment result is a preset judgment result, then the warning mode is triggered.

2. The method according to claim 1, characterized in that, The process of processing the original alarm data to determine the data format type of the original alarm data includes: Decode the byte sequence of the original alarm data into a string; Extract format feature values ​​corresponding to various preset alarm data format types from the string; A weighted score is calculated on the extracted multiple format feature values, and the preset alarm data format type with the highest weighted score is determined as the data format type of the original alarm data.

3. The method according to claim 1, characterized in that, The step of converting the original alarm data into standardized alarm text according to the data format type of the original alarm data includes: When the data format type is JSON, the original alarm data is recursively flattened by nested objects to obtain the standardized alarm text; When the data format type is XML, the original alarm data is processed by node tree traversal, the label text content of each node is extracted as field value, the label attributes of each node are extracted and converted into independent key-value pairs, and the field value and the independent key-value pairs are combined to obtain the standardized alarm text. When the data format type is Syslog, the header field and the body content are extracted from the original alarm data, the header field and the body content are recombined to obtain the first key-value pair, and the first key-value pair is used as the normalized alarm text. When the data format type is CEF, the first header fixed field and the first extended field are extracted from the original alarm data, and the first header fixed field and the first extended field are recombined to obtain the second key-value pair, and the second key-value pair is used as the normalized alarm text. When the data format type is LEEF, the second header fixed field and the second extended field are extracted from the original alarm data. The second header fixed field and the second extended field are recombined to obtain a third key-value pair, and the third key-value pair is used as the normalized alarm text.

4. The method according to claim 1, characterized in that, The threat intelligence knowledge graph is constructed in the following ways: Raw threat intelligence data is collected from multiple external threat intelligence sources; The raw threat intelligence data is preprocessed to obtain standardized threat intelligence data; Extract threat entities and the relationships between them from the standardized threat intelligence data; A threat intelligence knowledge graph is constructed using the threat entities as nodes and the relationships between them as edges. The threat entities include at least one of the following: technical ID, attack type, attack tactic, attack organization, attack tool, malicious IP address, malicious domain name, TLS certificate, vulnerability, and malware. The relationships between threat entities include attribution relationships where IP addresses are attributed to attack organizations, domain name resolution relationships where IP addresses are resolved to IP addresses, relationships where attack organizations use attack tools, relationships where attack organizations use attack tactics, relationships where attack organizations are associated with vulnerabilities, and relationships where attack organizations launch attacks.

5. The method according to claim 1, characterized in that, The threat intelligence retrieval score, based on the pre-built threat intelligence knowledge graph and the structured key fields, includes: Extract the alarm initiator's IP address, alarm initiator's domain name, and user identifier from the structured key fields, and construct an alarm data triplet from the alarm initiator's IP address, the alarm initiator's domain name, and the user identifier; Calculate the text similarity between the alarm data triple and each threat entity node in the threat intelligence knowledge graph to obtain the text similarity score between the alarm data triple and each threat entity node; Select threat entity nodes whose text similarity scores are greater than or equal to a preset similarity threshold from each threat entity node, and use the selected threat entity nodes as a set of related nodes; At least one entity is selected from the alarm data triple as a seed node. Starting from the seed node, a multi-hop search is performed in the threat intelligence knowledge graph. In each hop search, the search is expanded to include target nodes that are related to the current node. An alarm structured path chain is constructed based on the target nodes obtained from each hop search. Calculate the threat intelligence-related score for the structured alarm path chain; The threat intelligence retrieval score is obtained based on the text similarity score corresponding to each threat entity node in the relevant node set and the threat intelligence-related score of the alarm structured path chain.

6. The method according to claim 1, characterized in that, The method further includes: If the confidence level of the data format type is less than the preset confidence threshold, the original alarm data is determined to be an unrecognizable format, and the original alarm data is filtered.

7. The method according to claim 1, characterized in that, The method further includes: If the threat level is lower than the threat level warning threshold, or if the judgment result is not the preset judgment result, the warning mode will not be triggered.

8. An intelligent early warning device for attack behavior based on multi-agent collaboration, characterized in that, The device includes: The receiving module is used to receive raw alarm data; The determination module is used to process the original alarm data, determine the data format type of the original alarm data, and calculate the confidence level of the data format type; The conversion module is used to convert the original alarm data into a standardized alarm text according to the data format type of the original alarm data if the confidence level of the data format type is greater than or equal to a preset confidence level threshold. The calculation module is used to extract structured key fields from the normalized alarm text; obtain a threat intelligence retrieval score based on a pre-built threat intelligence knowledge graph and the structured key fields; construct a current alarm graph model from the structured key fields; perform similarity matching between the current alarm graph model and a historical threat event graph model library to obtain a graph model similarity score; and aggregate the threat intelligence retrieval score and the graph model similarity score to obtain a comprehensive threat score. The early warning module is used to determine the threat level and judgment result based on the comprehensive threat score; if the threat level is greater than or equal to the threat level early warning threshold and the judgment result is a preset judgment result, then the early warning mode is triggered.

9. A computing device, characterized in that, Including memory and processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for performing the method as described in any one of claims 1 to 7.

Images