A method, device and storage medium for attack graph generation

Abstract

The application discloses a method and device for attack graph generation and a storage medium, and relates to the technical field of network security. A plurality of types of network data are semantically aligned and a unified data view is constructed, data is locally stored and only encrypted features are transmitted, and multiple-source data intercommunication and cross-organization privacy compliance are considered. Attack is identified by using a multi-modal large model to analyze the view, and the limitation of traditional rule identification is broken through. An attack technology dependency network is built in combination with an ATT&CK graph, and the internal correlation of various attack means is completely restored. A double-causal index attack link is generated through causal reasoning, false correlation and real pre-attack nodes are distinguished, attack key choke points are accurately located, attack risk levels are quantified, and defense intervention effects are simulated. An attack graph is generated based on the link, and the attack graph is accompanied by causal information, which provides complete and quantitative basis for directional subgraph generation, local incremental update, cross-domain collaborative research and judgment, visual simulation and automatic protection strategy output, and improves threat tracing and risk disposal efficiency.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and storage medium for generating attack graphs. Background Technology

[0002] With the increasing complexity and stealth of cyberattacks, especially the multi-stage penetration and cross-node spread characteristics of advanced persistent threats (APTS), traditional cybersecurity defenses based on static rule bases are no longer sufficient to cope with dynamically changing attack threats. Attack graphs, as a graph-based representation of potential attack chains, have become an important technical tool for enterprise threat analysis and risk management.

[0003] In existing technologies, most attack graph generation methods rely on offline modeling based on static network topology, vulnerability scanning results, and predefined rule bases. In the traditional workflow where generation precedes analysis, any network change necessitates recalculating the entire attack graph. Furthermore, most existing methods remain at the level of statistical correlation analysis of attack steps, failing to distinguish between causal and statistical relationships between attack steps from a causal reasoning perspective. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a method, apparatus, and storage medium for generating attack graphs, thereby eliminating reliance on static rule bases and constructing attack graphs with reasoning capabilities.

[0005] This application discloses a method for generating attack graphs, the method comprising: Multi-source data is semantically aligned using a federated contrastive learning framework to construct a data view; the multi-source data includes full network traffic data, multi-source log data, threat intelligence data, and system asset data. Attack behavior patterns are identified from the data view based on a multimodal large language model; By combining the aforementioned attack behavior patterns with the ATT&CK knowledge graph, an attack technique dependency network is constructed. Attack links with causal indices are dynamically generated based on the attack technique dependency network. An attack graph is generated based on the attack chain.

[0006] Optionally, the dynamic generation of attack links with causal exponents based on the attack technique dependency network includes: Identify the causal and statistical correlation relationships in the attack technique dependency network to obtain causal edges and statistically correlated edges; Based on the causal edges and the statistically relevant edges, the necessity causality index and the sufficiency causality index of the attack link are calculated respectively to obtain the attack link.

[0007] Optionally, the necessity causality index of the attack chain is calculated, including: The formula for calculating the necessity causality index based on the causal edge is as follows:

[0008] In the formula, v k For the k-th attack step in the attack chain, NCI(v) k ) for v k The necessity causality index, m is the number of times v can be bypassed. k The total number of all alternative attack paths, j is the number of the alternative attack path, T is the attack target, do(v k =0) indicates intervention v k It does not happen, Path j From the attack origin to T and bypassing v k The j-th alternative attack path, P(T|do(v) k =0), Path j ) indicates intervention in v k It does not happen and the attacker follows the path j Given the conditions for advancement, the conditional probability that T will be achieved.

[0009] Optionally, the sufficiency causality index of the attack chain is calculated, including: The formula for calculating the sufficiency causality index based on the statistically relevant edges is as follows:

[0010] In the formula, v k Let SCI be the k-th attack step in the attack chain, E be the currently detected set of attack evidence, and SCI(v) be the attack evidence set. k |E) is to execute v under E k The sufficiency causality index, where T is the attack target and n is the number of attacks from v. k The total number of all possible attack paths to T, where i is the number of the possible attack path, do(v k =1) indicates intervention v k Occurrence, Path i For from v k Starting from the i-th possible attack path to T, P(T|E, do(v) k =1), Path i ) indicates that given E, intervention v k Occurs, and along the Path i Given the conditions for advancement, the conditional probability that T will be achieved.

[0011] Optionally, generating the attack graph based on the attack chain includes: Each participant independently generates a local attack chain and a confidence score for the local attack chain; Based on the confidence score of the local attack link, a federated weighted average algorithm is used to calculate dynamic weights according to the historical accuracy and data quality scores of each participant, and aggregate to generate a global confidence score. In the case where the same attack event spans multiple participants, the local attack links of each participant are constructed into a cross-domain attack graph based on the global confidence score.

[0012] Optionally, after generating the attack graph based on the attack chain, the method further includes: The intent classification and entity extraction are performed on the security analysis requests from users to obtain intent information and entities. The intent information and the entity are mapped into a triple that includes a set of target nodes, a set of constraints, and an optimization objective; Starting from the target node set, a reverse search is performed, while a forward deduction is performed starting from the attack entry point. At the intersection of the bidirectional search, branches are pruned and merged, retaining the attack link subgraph that simultaneously satisfies both reverse and forward reachability. The attack graph is updated based on the attack link subgraph.

[0013] Optionally, after generating the attack graph based on the attack chain, the method further includes: A three-dimensional digital twin model is constructed based on the attack graph. The attack chain is set to flow dynamically along the network connection in the three-dimensional digital twin model in the form of a particle stream. The particle color in the particle stream represents the severity of the attack step, the particle flow velocity represents the real-time speed of the attack, the particle density represents the confidence score of the path, and the historical trajectory of the attack chain is preserved with a trailing effect. A time dimension is introduced into the three-dimensional digital twin model; A multi-user operation real-time synchronization function is introduced into the three-dimensional digital twin model.

[0014] Optionally, after generating the attack graph based on the attack chain, the method further includes: Based on the attack chain in the attack graph and the ATT&CK knowledge graph, a set of protection strategies is generated; the set of protection strategies includes blocking IPs, patching vulnerabilities, adjusting firewall rules, isolating infected nodes, and rotating credentials. For attack chains with confidence scores higher than the threshold, deploy protection strategies in advance; Successfully defended attack chains and corresponding protection strategies are stored in a memory database for reuse.

[0015] Based on the above-mentioned method for generating attack graphs, this application also discloses an apparatus for generating attack graphs, including: an alignment unit, an identification unit, a construction unit, a generation unit, and a graph generation unit; The alignment unit is used to semantically align multi-source data through a federated contrastive learning framework to construct a data view; the multi-source data includes full network traffic data, multi-source log data, threat intelligence data, and system asset data; The identification unit is used to identify attack behavior patterns from the data view based on a multimodal large language model; The construction unit is used to combine the attack behavior pattern and the ATT&CK knowledge graph to construct an attack technology dependency network. The generation unit is used to dynamically generate attack links with causal indices based on the attack technique dependency network. The graph generation unit is used to generate an attack graph based on the attack chain.

[0016] Optionally, the graph generation unit includes: The identification subunit is used to identify causal relationships and statistical correlations in the attack technique dependency network, and to obtain causal edges and statistical correlation edges. The calculation subunit is used to calculate the necessity causality index and the sufficiency causality index of the attack link based on the causal edge and the statistical correlation edge, respectively, to obtain the attack link.

[0017] Optionally, the computing subunit includes: The necessity causality index calculation subunit uses the following formula to calculate the necessity causality index based on the causal edge:

[0018] In the formula, v k For the k-th attack step in the attack chain, NCI(v) k ) for v k The necessity causality index, m is the number of times v can be bypassed. k The total number of all alternative attack paths, j is the number of the alternative attack path, T is the attack target, do(v k =0) indicates intervention v k It does not happen, Path j From the attack origin to T and bypassing v k The j-th alternative attack path, P(T|do(v) k =0), Path j ) indicates intervention in v k It does not happen and the attacker follows the path j Given the conditions for advancement, the conditional probability that T will be achieved.

[0019] Optionally, the computing subunit includes: The sufficiency causality index calculation subunit uses the following formula to calculate the sufficiency causality index based on the statistical correlation edge:

[0020] In the formula, v k Let SCI be the k-th attack step in the attack chain, E be the currently detected set of attack evidence, and SCI(v) be the attack evidence set. k |E) is to execute v under E k The sufficiency causality index, where T is the attack target and n is the number of attacks from v. k The total number of all possible attack paths to T, where i is the number of the possible attack path, do(v k =1) indicates intervention v k Occurrence, Path i For from v k Starting from the i-th possible attack path to T, P(T|E, do(v) k =1), Path i ) indicates that given E, intervention v k Occurs, and along the Path i Given the conditions for advancement, the conditional probability that T will be achieved.

[0021] Optionally, the graph generation unit includes: An independent generation subunit is used by each participant to independently generate a local attack link and a confidence score for the local attack link; The aggregation subunit is used to calculate dynamic weights based on the confidence scores of the local attack link using a federated weighted average algorithm, according to the historical accuracy and data quality scores of each participant, and to aggregate and generate a global confidence score. A sub-unit is constructed to construct a cross-domain attack graph based on the global confidence score when the same attack event spans multiple participants.

[0022] Optionally, the device further includes: The extraction unit is used to classify intents and extract entities from security analysis requests from users, thereby obtaining intent information and entities. The mapping unit is used to map the intent information and the entity into a triple including a set of target nodes, a set of constraints, and an optimization objective; The merging unit is used to perform a reverse search starting from the target node set and a forward deduction starting from the attack entry point. It prunes and merges at the intersection of the bidirectional search and retains the attack link subgraph that satisfies both reverse reachability and forward reachability. An update unit is used to update the attack graph based on the attack link subgraph.

[0023] Optionally, the device further includes: The setting unit is used to construct a three-dimensional digital twin model based on the attack graph, and to set the attack chain to flow dynamically along the network connection in the three-dimensional digital twin model in the form of a particle flow; the particle color in the particle flow represents the severity of the attack step, the particle flow velocity represents the real-time progress speed of the attack, the particle density represents the confidence score of the path, and the historical trajectory of the attack chain is preserved with a trailing effect. A time-introduction unit is used to introduce a time dimension into the three-dimensional digital twin model; An operation introduction unit is used to introduce a multi-user operation real-time synchronization function into the three-dimensional digital twin model.

[0024] Optionally, the device further includes: The strategy generation unit is used to generate a set of protection strategies based on the attack links and ATT&CK knowledge graph in the attack graph; the set of protection strategies includes blocking IPs, patching vulnerabilities, adjusting firewall rules, isolating infected nodes, and rotating credentials; Pre-deployment units are used to pre-deploy protection strategies for attack links with confidence scores higher than a threshold; The storage unit is used to store the successfully defended attack chain and the corresponding protection strategy into the memory bank for reuse.

[0025] Based on the above-mentioned method for generating attack graphs, this application also discloses a storage medium for storing computer program instructions, which, when executed by a central processing unit, are used to implement any of the above-mentioned methods.

[0026] This application discloses a method, apparatus, and storage medium for attack graph generation. It utilizes a federated contrastive learning framework to process various types of multi-source network data, achieving semantic alignment and building a unified data view. This breaks down semantic barriers between different types of data, including traffic, logs, intelligence, and assets, eliminating analytical gaps caused by data heterogeneity and providing a unified, standardized analytical foundation for subsequent attack identification. By parsing the unified data view content using a multimodal large language model, it can decompose various atomic semantic elements of attacks, not only identifying known standard attack behaviors but also generalizing to capture zero-day and variant attack patterns. This overcomes the limitation of traditional fixed rules that can only match existing attacks, significantly broadening the scope of attack identification. Based on the identified attack behavior patterns and combined with the ATT&CK knowledge graph, a multi-layered attack technology dependency network is built, comprehensively outlining the multi-dimensional correlation logic of vulnerability exploitation, attack processes, and resource conditions. Compared to simple statistical correlation, this can completely reconstruct the attacker's complete penetration path and clarify the inherent linkages between various attack methods. Based on this network dependency, a causal reasoning mechanism is introduced to distinguish between statistical adjoint relationships and true causal preconditions. Two sets of quantitative causal indices are used to accurately mark critical attack nodes in the attack chain that cannot be bypassed. Simultaneously, it can simulate attack changes after defensive intervention, predicting attack risk levels in advance. This overcomes the limitations of previous methods that only performed temporal correlation analysis, upgrading attack assessment from superficial statistical analysis to root cause causal analysis. Attack graphs generated from complete attack chains with causal indices can carry the causal weights and risk levels of each attack step. This provides complete quantitative evidence for subsequent intent-oriented subgraph pruning, local incremental updates, cross-domain federated collaboration, visualization simulations, and automated protection strategy generation. The attack graph is no longer a simple topological connection but a verifiable analytical carrier with risk weights and causal logic, supporting security personnel in efficiently conducting threat tracing and risk mitigation. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0028] Figure 1 This is a flowchart illustrating a method for generating attack graphs disclosed in an embodiment of this application. Figure 2 This is a flowchart illustrating another method for generating attack graphs disclosed in an embodiment of this application. Figure 3 This is a schematic diagram of the structure of an attack graph generation device disclosed in an embodiment of this application. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] Example 1: This application discloses a method for generating attack graphs.

[0031] For details, please refer to Figure 1 The method for generating an attack graph disclosed in this embodiment includes the following steps: Step 101: Semantically align the multi-source data using a federated contrastive learning framework to construct a data view.

[0032] In this embodiment, the multi-source data includes full network traffic data, multi-source log data, threat intelligence data, and system asset data. The method integrates multi-source data collection with privacy protection, enabling the collection of full network traffic data, multi-source log data, threat intelligence data, and system asset data. A federated contrastive learning framework is used to achieve privacy-preserving semantic alignment across data sources, constructing a decentralized unified data view.

[0033] As a feasible solution, the federated contrastive learning framework specifically includes: extracting features from the original data locally at each data source to generate standardized feature vectors, with the original data remaining within its domain. Each participant only uploads the encrypted gradients of the feature vectors to the central server, which updates the global alignment model by aggregating the gradients, achieving feature semantic alignment across data sources. A differential privacy noise injection mechanism is introduced during the federated alignment process to ensure that the original data features of any single participant cannot be inferred from the aggregated gradients.

[0034] Step 102: Identify attack behavior patterns from the data view based on a multimodal large language model.

[0035] In this embodiment, a multimodal large language model is used to achieve the fusion and analysis of multi-source heterogeneous security data and the mining of attack behavior patterns. This addresses the shortcomings of traditional rule matching and single-modal identification schemes, which have narrow coverage and cannot identify variant attacks and zero-day attack variants. The unified data view aggregates various types of structured and unstructured mixed data, including traffic, logs, assets, and threat intelligence. Single regular expressions and feature rules can only match known fixed attack samples, and will miss some derivative attack behaviors generated by attackers tampering with fields and adjusting the execution order. At the same time, the formats of various data modalities are very different, making it difficult for humans to correlate behavioral features across log, traffic, and intelligence dimensions. This step leverages the unified semantic understanding of text and graphics and the multi-element correlation reasoning capabilities of the multimodal large language model to perform joint analysis on all security data within the unified data view, automatically extract attack atomic elements and summarize complete behavioral patterns, and balance the accurate identification of known attacks with the generalized detection capability of unknown variant attacks. This provides standardized attack behavior samples for subsequent attack techniques to rely on network construction and causal reasoning.

[0036] As a feasible solution, the decentralized unified data view from step 101 is read. This view contains multimodal data, including full traffic samples processed with federated semantic alignment, system operation logs, business operation logs, vulnerability threat intelligence, and network asset ledgers. The data undergoes unified feature alignment but retains its original text, message, and table formats. Multimodal data slices are then input into a finely tuned multimodal language model in batches. This model is pre-tuned using ATT&CK attack samples, real attack and defense exercise logs, and malicious traffic packets, possessing security-specific semantic understanding capabilities. It can simultaneously parse binary traffic translated text, multi-line log text, structured intelligence tables, and asset description paragraphs, among other data carriers.

[0037] The model executes a layered attack behavior decomposition logic. First, it extracts four main categories of atomic semantic elements from a single multimodal data record: attack intent, attack vector, target asset, and execution method, completing basic behavioral annotation for each record. Then, it aggregates and associates elements across multiple time-series related data, splicing together discrete logs and traffic fragments that are sequentially continuous, have consistent asset targets, and share the same behavioral vector, forming a complete single-stage attack behavior fragment. Subsequently, relying on the built-in ATT&CK knowledge base, it maps the standard attack technique numbers corresponding to each behavior fragment, summarizes behavior fragments with similar execution logic, extracts standardized attack behavior patterns with reusable characteristics, and distinguishes different pattern categories such as ransomware, lateral movement, vulnerability exploitation, persistent persistence, and information theft.

[0038] For zero-day attacks and alteration-based variant attacks, the model employs an element analogy reasoning mechanism for generalized identification, rather than relying solely on complete text matching to determine behavior attribution. When it detects partial element replacement or execution order adjustment in a known attack pattern, it determines that the behavior belongs to a variant of the original attack pattern by comparing the similarity of atomic elements, and simultaneously labels the variant dimension and stores it in the behavior pattern information, preventing direct missed detections due to incomplete feature matching. After completing all parsing, the model outputs a set of structured attack behavior patterns. Each pattern is bound to a corresponding temporal evidence fragment, a matched ATT&CK technology label, a variant marker, and a confidence score, completely preserving the identification evidence for subsequent construction of attack technology dependency networks.

[0039] This step leverages a multimodal large language model to break down semantic barriers between multi-source heterogeneous security data, enabling automatic behavioral correlation across traffic, logs, and intelligence dimensions. Through atomic element decomposition and analogical reasoning, it simultaneously covers standard attack and variant unknown attack scenarios, overcoming the limitations of traditional fixed feature rules for identification. It outputs standardized attack behavior patterns with complete evidence chains, providing reliable basic samples for subsequent causal modeling of attack chains.

[0040] Step 103: Combine the attack behavior patterns and the ATT&CK knowledge graph to construct an attack technology dependency network.

[0041] In this embodiment, the standardized attack behavior patterns identified in step 102 are used as observation samples. The ATT&CK knowledge graph serves as the underlying technology classification and association benchmark, enabling the construction of an attack technology dependency network capable of quantifying multiple types of pre- and post-processing logic. This addresses the problem that traditional attack modeling can only depict the chronological order and cannot distinguish between different dependencies such as vulnerability exploitation, permission transfer, and environmental preconditions. Simply relying on the original attack behavior sequence fragments can only record the order in which attacks occur, failing to extract the inherent pre-constraints, resource dependencies, and permission transfer logic between various attack technologies, making it difficult to support subsequent causal differentiation and counterfactual reasoning. While the ATT&CK knowledge graph comprehensively includes the applicable pre-conditions, achievable subsequent capabilities, supporting vulnerability carriers, and permission level constraints for each attack technology, it cannot be mapped and fused with attack behavior samples identified in the real environment. This step aligns the detected attack behavior patterns with the standardized ATT&CK technology system, mining the objectively existing multi-dimensional dependencies between technologies from real attack and defense samples. This forms a heterogeneous relationship network that combines standard technology definitions and real attack statistical characteristics, providing a complete graph structure input for subsequent causal discovery algorithms to distinguish between statistical accompaniment and causal necessity relationships.

[0042] As a feasible approach, the first step is to complete the bidirectional mapping and alignment operation between attack behavior patterns and the ATT&CK knowledge graph. Then, the ATT&CK technology tags bound to each attack behavior pattern generated in step 102 are read, and the identified real attack fragments are associated one by one with the corresponding attack technology nodes within the graph. Simultaneously, the co-occurrence frequency, sequential occurrence order, and prior resource overlap of each technology in real observation samples are statistically analyzed to provide real sample support for subsequent relationship determination. The ATT&CK knowledge graph pre-constructs complete attack technology nodes, asset nodes, and vulnerability nodes, and also pre-constructs three types of basic dependency logic frameworks: Common Vulnerabilities and Exposures (CVE) exploitation dependency, inherent order dependency of attack patterns, and network / permission environment condition dependency, serving as benchmark constraints for mining real associations.

[0043] Based on the aligned samples and pre-defined dependency framework, the relationships between different attack technology nodes are mined layer by layer, and the dependency types of the edges are distinguished simultaneously. For CVE vulnerability exploitation dependencies, directed edges from vulnerability nodes to corresponding vulnerability exploitation technology nodes are established based on the vulnerability carrier information recorded in the behavioral patterns. For inherent pattern sequence dependencies, directed edges representing the regular execution flow are generated by statistically analyzing high-frequency technology combinations that appear sequentially from a large number of temporal attack samples. For permission and network environment condition dependencies, constraint-type dependency edges requiring prior permissions and connectivity conditions are constructed based on asset access and privilege escalation records in the behavioral patterns.

[0044] After generating the initial related edges, a relational graph convolutional neural network is introduced to perform graph embedding encoding on all technical nodes and heterogeneous related edges. Differentiated aggregation functions are set for three different types of dependencies to learn node representations, enhancing the feature discrimination of different dependency logics and avoiding confusion between temporal co-occurrence and causal preconditions in the vector space. After the network encoding is completed, a weight score is added to each related edge based on the co-occurrence probability of all samples and the probability of satisfying the preconditions. The higher the weight, the higher the probability that this type of dependency will stably appear in real attack and defense scenarios.

[0045] Ultimately, all ATT&CK technology nodes, vulnerability nodes, asset nodes, and weighted, dependency-differentiated directed edges are integrated to form a complete attack technology dependency network. The network fully carries standardized attack technology definitions, attack and defense correlation patterns observed in real environments, and multi-dimensional pre- and post-constraint information. It fully retains all graph features required to distinguish causal relationships and statistical correlations, and directly supplies them to subsequent structural causal models and counterfactual reasoning stages.

[0046] This step breaks down the data barriers between real attack observation samples and the authoritative ATT&CK standard system, subdivides the dependency types between attack techniques in multiple dimensions, strengthens the feature differences of different correlation logics with the help of graph neural networks, and constructs a heterogeneous dependency network that takes into account both standard definitions and real attack and defense rules. This provides a reliable graph structure foundation for subsequent isolation of simple statistical association relationships through conditional independence tests and accurate location of attack causal links.

[0047] Step 104: Dynamically generate attack links with causal indices based on the attack technique dependency network.

[0048] In the method of this embodiment, based on the attack technique dependency network, a causal discovery algorithm is introduced to distinguish between statistical correlation and causal necessity from the observed data. For example, for the co-occurrence relationship between attack techniques A and B, the conditional independence test is used to determine whether A is a necessary precondition for B or merely a statistical association, refining the original dependency network into an attack causal graph, where edges are divided into causal edges and statistically correlated edges.

[0049] Based on the attack causal graph, a structural causal model is introduced to support the following counterfactual reasoning capabilities: Necessity Reasoning: Given a sequence of attack steps, this method works backward to determine whether the final attack objective could still be achieved if a certain step had not occurred. By calculating the necessity causality index for each attack link, key essential nodes in the attack link are identified. The closer the index is to 1, the fewer alternative paths there are to bypass a certain attack step, or the lower the probability of success. This indicates that the attack step is a crucial and unavoidable node in the attack link, and it is thus marked as a key essential node and recommended for priority defense.

[0050] Sufficiency Reasoning: Given the currently detected attack evidence, this method deduces whether an attacker performing a certain step would necessarily lead to the achievement of the final goal. The severity of the current attack situation is assessed by calculating a sufficiency causality index. The closer the index is to 1, the more likely the attacker, with the support of existing evidence, will reach the target via a certain path once they perform a certain attack step. Based on this, the current attack situation is determined to be highly dangerous, triggering a tiered warning.

[0051] Intervention effect simulation: Simulate how downstream nodes on the causal graph will change if defensive intervention is implemented at a certain step. By performing intervention operations on the causal graph through calculation, the blocking effect of defensive measures on the attack chain can be predicted in real time.

[0052] As an feasible approach, the formula for calculating the necessity causality index based on the causal edge is as follows: (1) In the formula, v k For the k-th attack step in the attack chain, NCI(v) k) for v k The necessity causality index, m is the number of times v can be bypassed. k The total number of all alternative attack paths, j is the number of the alternative attack path, T is the attack target, do(v k =0) indicates intervention v k It does not happen, Path j From the attack origin to T and bypassing v k The j-th alternative attack path, P(T|do(v) k =0), Path j ) indicates intervention in v k It does not happen and the attacker follows the path j Given the conditions for advancement, the conditional probability that T will be achieved.

[0053] As an feasible approach, the formula for calculating the sufficiency causality index based on the statistically relevant edges is as follows: (2) In the formula, v k Let SCI be the k-th attack step in the attack chain, E be the currently detected set of attack evidence, and SCI(v) be the attack evidence set. k |E) is to execute v under E k The sufficiency causality index, where T is the attack target and n is the number of attacks from v. k The total number of all possible attack paths to T, where i is the number of the possible attack path, do(v k =1) indicates intervention v k Occurrence, Path i For from v k Starting from the i-th possible attack path to T, P(T|E, do(v) k =1), Path i ) indicates that given E, intervention v k Occurs, and along the Path i Given the conditions for advancement, the conditional probability that T will be achieved.

[0054] Step 105: Generate an attack graph based on the attack chain.

[0055] In this embodiment, the attack chain obtained through inference is generated into a scalable dynamic attack graph structure. An intent-driven progressive generation strategy and incremental update mechanism are employed to support local subgraph updates when network states change. A federated learning framework is introduced to achieve cross-organizational collaborative construction of the attack graph and confidence aggregation. All participants jointly optimize the global attack graph model without leaving their domains with the original data.

[0056] As a feasible approach, the contextual understanding and reasoning capabilities of large language models can be leveraged to achieve generalized detection of zero-day and variant attacks through semantic similarity of attack behaviors and analogical reasoning of behavioral patterns. This involves breaking down attack behaviors into atomic semantic elements such as attack intent, attack vector, attack target, and attack method, and comparing each element with known attack patterns at the element-level similarity level to identify new attack variants that have not appeared in known patterns.

[0057] Specifically, this can be achieved by receiving the user's security analysis intent through natural language interaction, and using a fine-tuned large language model to classify the user's natural language input and extract key entities. The classified intent and extracted entities are mapped to a formal objective generated by the attack graph, defined as a triple (target node set, constraint set, optimization objective). A reverse search is performed starting from the target node set, while a forward deduction is performed starting from the attack entry point. At the intersection of the bidirectional search, branches are pruned and merged, retaining only the attack link subgraph that simultaneously satisfies both reverse and forward reachability.

[0058] As a feasible solution, the federated learning framework enables collaborative construction of cross-organizational attack graphs. Specifically, each participant independently generates attack chains and confidence scores based on local data. Using a federated weighted average algorithm, each participant encrypts its local attack chain confidence score and uploads it to a central server. The central server calculates dynamic weights based on each participant's historical accuracy and data quality score, aggregating them to generate a global confidence score. When the same attack event spans multiple participants, a federated graph alignment algorithm identifies the correspondence between cross-domain attack steps, stitching together the local attack graphs of each party into a complete cross-domain attack graph. No participant can know the complete network topology of the others.

[0059] As a feasible solution, an attack link confidence assessment mechanism based on Bayesian inference can be introduced. This mechanism calculates the confidence score for each attack link by comprehensively considering factors such as vulnerability exploitability score, attack behavior similarity, and network connectivity. For multiple concurrent or alternating attack links targeting the same target, a path fusion algorithm is used to identify the relationships between the paths, generating a multi-path interwoven attack link network.

[0060] In the method of this embodiment, after generating the attack graph, a three-dimensional model of cyberspace can be constructed based on digital twin technology. The spatiotemporal evolution of the attack chain is dynamically rendered in the form of three-dimensional particle flow, supporting immersive interaction in virtual reality / augmented reality and collaborative analysis by multiple users. Based on the inferred attack chain, protection strategies are automatically mapped, and the defense effect is simulated and deduced in the digital twin environment. High-confidence attack chains are proactively pre-deployed, and successfully defended attack patterns are stored in an immune memory bank to achieve millisecond-level response, forming a self-immune closed loop of "detection, response, learning, evolution, and pre-deployment".

[0061] As a feasible solution, this 3D model also supports real-time updates and visualization linkage of the attack posture. Specifically, each incremental update of the attack chain dynamic generation engine automatically triggers a partial refresh of the visualization interface, the three-level views maintain data synchronization, and user operations on one view are linked to updates in other views; based on user interaction behavior and focus, the display granularity of the attack graph is automatically adjusted through a dynamic aggregation algorithm driven by an attention heatmap. User analysis, annotation, and correction operations are recorded and used to back-optimize the attack chain inference model, forming a closed-loop optimization through human-machine collaboration.

[0062] As a feasible solution, four-dimensional immersive visualization interaction can specifically involve automatically constructing a three-dimensional digital twin model of the enterprise network based on system asset data. Servers are presented as three-dimensional icons, network connections are displayed as virtual optical cables, and data flow is simulated as dynamic particles. The inferred attack chain is dynamically flowing along the network connections in three-dimensional space as a stream of highlighted particles. The color of the particles indicates the severity of the attack steps, the flow rate indicates the real-time speed of the attack, and the particle density indicates the confidence score of the path. The historical trajectory of the attack chain is preserved with a trailing afterimage effect. It supports free roaming and observation in the three-dimensional network space through virtual reality headsets and supports augmented reality mode to overlay the three-dimensional attack map onto the real physical data center environment.

[0063] Simultaneously, a time dimension can be introduced into the three-dimensional space, allowing users to navigate and replay the complete sequence of an attack by dragging a timeline using gestures or controllers. Furthermore, it supports collaborative operation by multiple security analysts in the same three-dimensional virtual space, enabling them to simultaneously mark attack nodes, add analysis annotations, and delineate areas of interest, with all operations synchronized in real time.

[0064] As a feasible solution, based on the attack chain generated by reasoning and the ATT&CK knowledge graph, a corresponding set of protection strategies can be automatically generated for each attack path, including blocking IPs, patching vulnerabilities, adjusting firewall rules, isolating infected nodes, and rotating credentials. The generation of protection strategies is based on a pre-trained large-scale protection strategy model.

[0065] The automatic mapping of protection strategies is achieved through a pre-trained large-scale protection strategy model. This model is fine-tuned using a massive dataset of historical security incident handling cases (including attack chain descriptions and corresponding combinations of effective defense measures) as training corpus. During training, a generation paradigm of "attack chain description - protection strategy sequence" is adopted, enabling the model to learn the mapping rules from attack path characteristics to defense actions. During inference, the generated attack chain (including ATT&CK technical tags, confidence scores, and target asset information for each attack step) is constructed as a structured input protection strategy model. The model generates candidate protection strategies one by one through an encoder-decoder architecture. Each strategy is output as a triple of condition, action, and expected effect, such as "Condition: T1190 vulnerability exploit detected and target is a web server; Action: Block the source IP and install the patch; Expected effect: Block initial access." The generated results are then validated for consistency based on the defense relationships between technologies in the ATT&CK knowledge graph (e.g., ensuring that the generated strategy combinations do not conflict with each other), ultimately forming a set of protection strategies covering all steps of the attack chain.

[0066] As a feasible solution, the generated protection strategies can be simulated and extrapolated in a digital twin environment. This simulates changes in the attack chain after implementing defense measures, evaluates the expected blocking rate and potential side effects of the protection strategies, and selects the optimal protection strategy. This defense effect simulation is implemented based on a digital twin environment, specifically, where the digital twin environment has constructed a complete mirror of the enterprise network (including topology, vulnerability status, firewall rules, service configurations, etc.) using system asset data and continuously synchronizes real-time network status. During the simulation, candidate protection strategies are converted into intervention operations on the attack causal graph. For example, blocking an IP is equivalent to cutting off all outgoing edges from the attack source node; patching a vulnerability is equivalent to forcibly reducing the exploitability score of the corresponding vulnerable node to 0; and isolating a node is equivalent to cutting off the connection edges between that node and all other nodes in the network.

[0067] Subsequently, dependency reasoning and confidence assessment were re-run on the causal graph after intervention to calculate the change in confidence of the attack target after intervention. Simultaneously, the impact of the intervention on the reachability of business nodes (e.g., whether blocking a certain IP mistakenly blocked normal business traffic) was recorded to quantify side effects. By enumerating different combinations of protection strategies in parallel, an evaluation matrix containing strategy combinations, blocking effects, and side effect scores was generated. Multi-objective optimization (e.g., Pareto optimality) was used to automatically select the strategy with the greatest blocking effect and the fewest side effects as the optimal defense scheme.

[0068] In the method of this embodiment, for attack chains with confidence scores higher than a threshold, protection strategies are proactively pre-deployed before the attack is completed, achieving defense before the attack arrives. Simultaneously, successfully defended attack chain patterns are stored in an immune memory bank, and when a similar attack occurs again, the corresponding protection strategy is directly recalled from the immune memory bank.

[0069] In the method of this embodiment, the confidence level of the attack chain can be monitored in real time. When the confidence level of an attack chain exceeds a preset threshold (such as 0.7), an automatic response process is triggered. The optimal protection strategy, which has been confirmed through simulation, is automatically distributed and executed through a standardized API interface with the enterprise's existing security infrastructure (firewall, EDR, vulnerability management system, IAM system, etc.), thereby achieving proactive defense before the attack arrives.

[0070] As a feasible solution, once an attack is successfully defended (i.e., the attack chain is effectively blocked by the strategy before reaching the target), the characteristic fingerprint of the attack chain (a hash vector generated by compressing the attack step sequence, ATT&CK technology combination, target asset type, and network path characteristics) is associated with the corresponding successful protection strategy combination and stored in the immune memory. When a new attack chain is inferred and generated, its characteristic fingerprint can be calculated first, and a vector similarity search can be performed in the immune memory. If a historical pattern with a similarity higher than the threshold is matched, the corresponding protection strategy is directly recalled and executed (the response time is usually in the milliseconds), without having to go through the complete protection strategy mapping and simulation process again, thus achieving a rapid response to newly emerging attacks.

[0071] In the method of this embodiment, the actual effect of the pre-deployment strategy can be evaluated periodically, and the evaluation results can be used as a reward signal for reinforcement learning to continuously optimize the entire chain of strategy networks, including attack chain inference, protection strategy mapping, and pre-deployment decision-making. Specifically, an evaluation time window (e.g., 30 minutes after strategy execution) can be set for each pre-deployment strategy, during which three types of feedback data can be continuously collected: Successful blocking indicator: whether the attack chain terminates before reaching the target (judged by tracking the progress of the attack steps). If it terminates, it is recorded as a "successful blocking"; if the attack still reaches the target, it is recorded as a "failed blocking". False positive indicator: whether the execution of the pre-deployment strategy affects normal business operations (e.g., mistakenly blocking IPs leading to business interruption, mistakenly isolating nodes leading to service unavailability), determined by monitoring the business health check interface and user complaint tickets. Confidence deviation indicator: comparing the difference between the expected blocking rate predicted before strategy execution and the actual observed blocking rate to quantify the accuracy of strategy prediction.

[0072] After each round of evaluation, the above three indicators are aggregated into a feedback vector, which serves as a reward signal for reinforcement learning. This vector is then input into a deep network or a near-end policy optimization algorithm to update the parameters of the policy generation network. This enables the network to generate more accurate and less side-effect-prone protection policies when facing similar attacks in the future, achieving adaptive evolution across the entire chain.

[0073] The method described in this embodiment, based on the dependency network constructed from the ATT&CK knowledge graph and graph neural network, introduces a structural causal model and a causal discovery algorithm. It distinguishes between causal necessity and statistical association relationships between attack steps through conditional independence testing. Furthermore, it achieves counterfactual reasoning through do-calculus. The Necessity Causality Index (NCI) can identify unavoidable key nodes in the attack chain, guiding the precise deployment of defense resources. The Sufficiency Causality Index (SCI) can infer the sufficiency of attack success given current evidence, enabling early warning of attack trends. This capability overcomes the limitations of existing methods that can only perform temporal correlation or statistical analysis.

[0074] The method described in this embodiment receives the user's security analysis intent through natural language interaction, converts the intent into a formalized objective, and uses a combination of reverse search and forward inference to generate only attack chain subgraphs related to the user's intent, avoiding state space explosion caused by full generation. Furthermore, when network topology, vulnerability status, or attack behavior changes, it identifies affected local attack chains through change impact analysis, recalculating and updating only the local subgraphs without regenerating the entire attack graph, significantly improving the efficiency of attack graph generation in large-scale dynamic network environments.

[0075] The method described in this embodiment also introduces a federated contrastive learning framework to achieve privacy-preserving semantic alignment across data sources. Under the premise that the original data does not leave its domain, each participant achieves collaborative construction and confidence aggregation of cross-organizational attack graphs through encrypted gradient uploading and differential privacy protection. When the same attack event spans multiple participants, the federated graph alignment algorithm automatically stitches together a complete cross-domain attack graph. No participant can know the complete network topology of other parties, thus achieving cross-domain collaborative attribution of large-scale attacks while meeting privacy compliance requirements.

[0076] Example 2: This application discloses another method for generating attack graphs; please refer to [link / reference]. Figure 2 This embodiment describes the method for generating and deploying attack graphs, as well as generating protection strategies.

[0077] Step 201: Perform multi-source data collection and privacy protection fusion processing to construct a data view.

[0078] In the method of this embodiment, multi-dimensional raw security data across devices, network segments, and business domains, such as network traffic, host logs, business audit records, threat intelligence, and asset mapping data, are aggregated and collected.

[0079] Since multi-source data often contains business-sensitive fields, user privacy information, and confidential content related to intranet topology, direct subsequent modeling and analysis may pose a risk of data leakage. Therefore, the method in this embodiment is equipped with a privacy-preserving fusion mechanism. It adopts federated data alignment, differential noise injection, and sensitive field desensitization and replacement to complete the normalization and fusion of the entire domain data without disclosing the original plaintext confidential information. This constructs a basic dataset that is transferable, analyzable, and compliant with data security standards, providing a compliant and usable data foundation for the subsequent construction of a unified data view and the identification of attack behaviors.

[0080] Step 202: Determine whether the attack behavior pattern has been identified based on the data view. If yes, proceed to step 203. If no, proceed to step 204.

[0081] In the method of this embodiment, if the parsing, extraction, and standardized labeling of attack behavior patterns have not been completed, then field completion, sample expansion, and feature correction view updates are required for the underlying fused dataset and the global data view. If it is determined that the attack behavior pattern identification has been completed, that is, if a set of structured attack behavior patterns with ATT&CK labels, temporal evidence, and confidence markers has been extracted from the global data, then the process moves down to the intelligent attack chain causal reasoning stage.

[0082] Step 203: Combining the attack behavior patterns and the ATT&CK knowledge graph, construct an attack technology dependency network and conduct intelligent attack chain causal reasoning. Proceed to Step 205.

[0083] In the method of this embodiment, the attack behavior pattern and attack technology dependency network are used as inputs to distinguish between simple temporal co-occurrence relationships and real causal pre-dependencies between attack behaviors. Interfering correlation items without necessary logical connection are eliminated. Based on the structural causal model and counterfactual reasoning algorithm, the complete causal attack chain of a single attack event from initial intrusion, privilege escalation, lateral movement to data theft or persistent residence is sorted out, clarifying the triggering premise, scope of impact and subsequent derivative threat paths of each attack action.

[0084] Step 204: Update the data view. Return to step 201.

[0085] In this embodiment, the underlying fused dataset and the global data view are updated by field completion, sample expansion, feature correction, and other processes. After returning to step 201, multi-source data collection and privacy-preserving fusion are performed again, iteratively completing the data dimensions.

[0086] Step 205: Determine if the attack chain reasoning is complete. If yes, proceed to step 206. If no, return to step 203.

[0087] In this embodiment, if the link inference process reveals issues such as missing nodes, missing relationships, or insufficient sample evidence in the dependent network, preventing the formation of a complete and credible causal attack link, then the attack link inference is determined to be incomplete. The process then reverts to the previous step to initiate a new round of causal inference calculation, supplementing the graph network association weights and constraints before resolving the attack link. Once the attack link inference is determined to be complete, and a set of multiple traceable and verifiable standardized causal attack links is output, the process proceeds to the dynamic generation and federated collaborative processing of the attack graph.

[0088] Step 206: Dynamically generate attack graphs and coordinate with federation based on the attack chain.

[0089] In this embodiment, the attack chain serves as the core framework. By combining global asset topology, network segment access permissions, and vulnerability distribution information, the discrete attack chain is mapped onto the actual network environment topology, dynamically constructing a global attack projection graph. Simultaneously, a federated collaboration mechanism is introduced to connect heterogeneous security nodes across multiple branches and security partitions. This enables the collaborative merging of cross-domain attack graph nodes and associated edges without transmitting core classified topology data in plaintext across domains, achieving a unified stitching of the global attack situation view in a distributed environment.

[0090] Step 207: Determine if the attack graph has been generated and the collaboration has been completed. If yes, proceed to step 208. If no, proceed to step 209.

[0091] In this embodiment, if the attack graph topology is incomplete or the cross-domain federated collaboration node data is not synchronized, it is determined that the attack graph generation and collaboration are incomplete. An incremental update process for the attack graph is then initiated, locally supplementing the existing attack graph for missing nodes, newly added vulnerabilities, and cross-domain access paths. Once the attack graph generation and cross-domain federated collaboration are verified to be complete, and the complete global dynamic attack graph is constructed, the process moves to four-dimensional immersive visualization interaction and self-immune protection.

[0092] Step 208: Based on the attack graph, perform visual interaction and self-immune protection to generate a protection strategy. Proceed to Step 210.

[0093] In the method of this embodiment, a four-dimensional visualization display interface is built for the global attack graph, which completes the immersive situation presentation from the dimensions of spatial topology, temporal evolution, threat level, and asset impact. It supports operation and maintenance personnel to interactively click to trace a single attack path, view the original alarm evidence, and locate the affected core business assets.

[0094] Simultaneously, based on the vulnerable attack entry points exposed by the attack graph, native self-immune protection rules are generated. Lightweight temporary protection policies are then deployed across multiple nodes, including gateways, endpoints, and firewalls, enabling immediate blocking and risk mitigation of identified attack paths. After completing the deployment of the visual interface and the distribution of basic self-immune protection rules, the system enters the defense simulation and deployment effect verification phase.

[0095] Step 209: Incrementally update the attack graph. Return to step 206.

[0096] In the method of this embodiment, the existing attack graph is locally incrementally supplemented with missing nodes, newly added vulnerabilities, and cross-domain access paths.

[0097] Step 210: Conduct simulation exercises based on the protection strategy and attack graph to determine whether the defense simulation and deployment are complete. If yes, end the process. If not, proceed to step 211.

[0098] In the method of this embodiment, attack and defense simulation is carried out based on the issued protection strategy and attack graph to simulate various scenarios in which attackers bypass existing protection measures to launch intrusions. The interception coverage, vulnerability blocking effectiveness and false positives and false negatives of the current protection strategy are verified to determine whether the defense simulation and strategy deployment are completed.

[0099] If the simulation results show that the protection strategy has issues such as vulnerability bypass paths, lack of protection for core assets, and substandard interception efficiency, then the deployment objective has not been achieved. If the attack and defense simulation verifies that the current defense system can effectively block known attack links and block high-risk intrusion entry points, and the protection strategy deployment and simulation verification both pass, then the overall process is completed and the task ends normally.

[0100] Step 211: Optimize the defense rule logic to address the shortcomings exposed by the simulation, and regenerate a more adaptable protection strategy based on the attack graph. Return to step 208.

[0101] Based on the attack graph generation method disclosed in the above embodiments, this embodiment correspondingly discloses an attack graph generation apparatus. Please refer to... Figure 3 The attack graph generation device includes: an alignment unit 301, an identification unit 302, a construction unit 303, a generation unit 304, and a graph generation unit 305; The alignment unit 301 is used to semantically align multi-source data through a federated contrastive learning framework to construct a data view; the multi-source data includes network full traffic data, multi-source log data, threat intelligence data, and system asset data; The identification unit 302 is used to identify attack behavior patterns from the data view based on a multimodal large language model; The construction unit 303 is used to combine the attack behavior pattern and the ATT&CK knowledge graph to construct an attack technology dependency network. The generation unit 304 is used to dynamically generate attack links with causal indices based on the attack technique dependency network. The graph generation unit 305 is used to generate an attack graph based on the attack chain.

[0102] Optionally, the graph generation unit 305 includes: The identification subunit is used to identify causal relationships and statistical correlations in the attack technique dependency network, and to obtain causal edges and statistical correlation edges. The calculation subunit is used to calculate the necessity causality index and the sufficiency causality index of the attack link based on the causal edge and the statistical correlation edge, respectively, to obtain the attack link.

[0103] Optionally, the computing subunit includes: The necessity causality index calculation subunit uses the following formula to calculate the necessity causality index based on the causal edge:

[0104] In the formula, v k For the k-th attack step in the attack chain, NCI(v) k ) for v k The necessity causality index, m is the number of times v can be bypassed. k The total number of all alternative attack paths, j is the number of the alternative attack path, T is the attack target, do(v k =0) indicates intervention v k It does not happen, Path j From the attack origin to T and bypassing v k The j-th alternative attack path, P(T|do(v) k =0), Path j ) indicates intervention in v k It does not happen and the attacker follows the path j Given the conditions for advancement, the conditional probability that T will be achieved.

[0105] Optionally, the computing subunit includes: The sufficiency causality index calculation subunit uses the following formula to calculate the sufficiency causality index based on the statistical correlation edge:

[0106] In the formula, v k Let SCI be the k-th attack step in the attack chain, E be the currently detected set of attack evidence, and SCI(v) be the attack evidence set.k |E) is to execute v under E k The sufficiency causality index, where T is the attack target and n is the number of attacks from v. k The total number of all possible attack paths to T, where i is the number of the possible attack path, do(v k =1) indicates intervention v k Occurrence, Path i For from v k Starting from the i-th possible attack path to T, P(T|E, do(v) k =1), Path i ) indicates that given E, intervention v k Occurs, and along the Path i Given the conditions for advancement, the conditional probability that T will be achieved.

[0107] Optionally, the graph generation unit 305 includes: An independent generation subunit is used by each participant to independently generate a local attack link and a confidence score for the local attack link; The aggregation subunit is used to calculate dynamic weights based on the confidence scores of the local attack link using a federated weighted average algorithm, according to the historical accuracy and data quality scores of each participant, and aggregate to generate a global confidence score. A sub-unit is constructed to construct a cross-domain attack graph based on the global confidence score when the same attack event spans multiple participants.

[0108] Optionally, the device further includes: The extraction unit is used to classify intents and extract entities from security analysis requests from users, thereby obtaining intent information and entities. The mapping unit is used to map the intent information and the entity into a triple including a set of target nodes, a set of constraints, and an optimization objective; The merging unit is used to perform a reverse search starting from the target node set and a forward deduction starting from the attack entry point. It prunes and merges at the intersection of the bidirectional search and retains the attack link subgraph that satisfies both reverse reachability and forward reachability. An update unit is used to update the attack graph based on the attack link subgraph.

[0109] Optionally, the device further includes: The setting unit is used to construct a three-dimensional digital twin model based on the attack graph, and to set the attack chain to flow dynamically along the network connection in the three-dimensional digital twin model in the form of a particle stream; the particle color in the particle stream represents the severity of the attack step, the particle flow velocity represents the real-time advancement speed of the attack, the particle density represents the confidence score of the path, and the historical trajectory of the attack chain is preserved with a trailing effect. A time-introduction unit is used to introduce a time dimension into the three-dimensional digital twin model; An operation introduction unit is used to introduce a multi-user operation real-time synchronization function into the three-dimensional digital twin model.

[0110] Optionally, the device further includes: The strategy generation unit is used to generate a set of protection strategies based on the attack links and ATT&CK knowledge graph in the attack graph; the set of protection strategies includes blocking IPs, patching vulnerabilities, adjusting firewall rules, isolating infected nodes, and rotating credentials; Pre-deployment units are used to pre-deploy protection strategies for attack links with confidence scores higher than a threshold; The storage unit is used to store the successfully defended attack chain and the corresponding protection strategy into the memory bank for reuse.

[0111] Based on the above-mentioned method for generating attack graphs, this application also discloses a storage medium for storing computer program instructions, which, when executed by a central processing unit, are used to implement any of the above-mentioned methods.

[0112] The embodiments in this specification are described in a progressive manner. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant details can be found in the method section.

[0113] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0114] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0115] The features described in the embodiments of this specification can be substituted for or combined with each other, so that those skilled in the art can implement or use this application.

[0116] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating attack graphs, characterized in that, include: Multi-source data is semantically aligned using a federated contrastive learning framework to construct a data view; the multi-source data includes full network traffic data, multi-source log data, threat intelligence data, and system asset data. Attack behavior patterns are identified from the data view based on a multimodal large language model; By combining the aforementioned attack behavior patterns with the ATT&CK knowledge graph, an attack technique dependency network is constructed. Attack links with causal indices are dynamically generated based on the attack technique dependency network. An attack graph is generated based on the attack chain.

2. The method according to claim 1, characterized in that, The dynamic generation of attack links with causal indices based on the attack technique dependency network includes: Identify the causal and statistical correlation relationships in the attack technique dependency network to obtain causal edges and statistically correlated edges; Based on the causal edges and the statistically relevant edges, the necessity causality index and the sufficiency causality index of the attack link are calculated respectively to obtain the attack link.

3. The method according to claim 2, characterized in that, Calculate the necessity causality index of the attack chain, including: The formula for calculating the necessity causality index based on the causal edge is as follows: In the formula, v k For the k-th attack step in the attack chain, NCI(v) k ) for v k The necessity causality index, m is the number of times v can be bypassed. k The total number of all alternative attack paths, j is the number of the alternative attack path, T is the attack target, do(v k =0) indicates intervention v k It does not happen, Path j From the attack origin to T and bypassing v k The j-th alternative attack path, P(T|do(v) k =0), Path j ) indicates intervention in v k It does not happen and the attacker follows the path j Given the conditions for advancement, the conditional probability that T will be achieved.

4. The method according to claim 2, characterized in that, Calculate the sufficiency causality index of the attack chain, including: The formula for calculating the sufficiency causality index based on the statistically relevant edges is as follows: In the formula, v k Let SCI be the k-th attack step in the attack chain, E be the currently detected set of attack evidence, and SCI(v) be the attack evidence set. k |E) is to execute v under E k The sufficiency causality index, where T is the attack target and n is the number of attacks from v. k The total number of all possible attack paths to T, where i is the number of the possible attack path, do(v k =1) indicates intervention v k Occurrence, Path i For from v k Starting from the i-th possible attack path to T, P(T|E, do(v) k =1), Path i ) indicates that given E, intervention v k Occurs, and along the Path i Given the conditions for advancement, the conditional probability that T will be achieved.

5. The method according to claim 1, characterized in that, The generation of the attack graph based on the attack chain includes: Each participant independently generates a local attack chain and a confidence score for the local attack chain; Based on the confidence score of the local attack link, a federated weighted average algorithm is used to calculate dynamic weights according to the historical accuracy and data quality scores of each participant, and aggregate to generate a global confidence score. In the case where the same attack event spans multiple participants, the local attack links of each participant are constructed into a cross-domain attack graph based on the global confidence score.

6. The method according to claim 1, characterized in that, After generating the attack graph based on the attack chain, the method further includes: The intent classification and entity extraction are performed on the security analysis requests from users to obtain intent information and entities. The intent information and the entity are mapped into a triple that includes a set of target nodes, a set of constraints, and an optimization objective; Starting from the target node set, a reverse search is performed, while a forward deduction is performed starting from the attack entry point. At the intersection of the bidirectional search, branches are pruned and merged, retaining the attack link subgraph that simultaneously satisfies both reverse and forward reachability. The attack graph is updated based on the attack link subgraph.

7. The method according to claim 1, characterized in that, After generating the attack graph based on the attack chain, the method further includes: A three-dimensional digital twin model is constructed based on the attack graph. The attack chain is set to flow dynamically along the network connection in the three-dimensional digital twin model in the form of a particle stream. The particle color in the particle stream represents the severity of the attack step, the particle flow velocity represents the real-time speed of the attack, the particle density represents the confidence score of the path, and the historical trajectory of the attack chain is preserved with a trailing effect. A time dimension is introduced into the three-dimensional digital twin model; A multi-user operation real-time synchronization function is introduced into the three-dimensional digital twin model.

8. The method according to claim 1, characterized in that, After generating the attack graph based on the attack chain, the method further includes: Based on the attack chain in the attack graph and the ATT&CK knowledge graph, a set of protection strategies is generated; the set of protection strategies includes blocking IPs, patching vulnerabilities, adjusting firewall rules, isolating infected nodes, and rotating credentials. For attack chains with confidence scores higher than the threshold, deploy protection strategies in advance; Successfully defended attack chains and corresponding protection strategies are stored in a memory database for reuse.

9. An apparatus for generating attack graphs, characterized in that, include: Alignment unit, recognition unit, construction unit, generation unit, and graph generation unit; The alignment unit is used to semantically align multi-source data through a federated contrastive learning framework to construct a data view; the multi-source data includes full network traffic data, multi-source log data, threat intelligence data, and system asset data; The identification unit is used to identify attack behavior patterns from the data view based on a multimodal large language model; The construction unit is used to combine the attack behavior pattern and the ATT&CK knowledge graph to construct an attack technology dependency network. The generation unit is used to dynamically generate attack links with causal indices based on the attack technique dependency network. The graph generation unit is used to generate an attack graph based on the attack chain.

10. A storage medium, characterized in that, Used to store computer program instructions, which, when executed by a central processing unit, are used to implement the method described in any one of claims 1 to 8.

Images