A network security operation method and system based on dynamic security graph evolution

Abstract

The application discloses a network security operation method and system based on dynamic security graph evolution, and the operation method comprises the following steps: unified collection of multi-source heterogeneous security data; standardization processing and preprocessing of the collected data; cross-system entity consistency modeling based on a unified entity analysis mechanism; data structure expression mode based on a unified security graph; security event correlation analysis and attack chain identification based on a graph structure; automatic security response execution mechanism based on analysis results; feedback optimization mechanism based on response results. The continuous evolution of the unified security graph and the dynamic optimization of the security strategy are realized, and a closed-loop operation mechanism of network security detection, analysis, decision, response and continuous learning is formed.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security operation method and system based on dynamic security graph evolution. Background Technology

[0002] With the development of enterprise informatization and cloud computing technologies, network security protection systems are gradually evolving from the traditional perimeter protection model to the asset and data-driven Security Operations Center (SOC) model. Existing network security systems mainly include Security Information and Incident Management Systems (SIEM), Endpoint Detection and Response Systems (EDR), Extended Detection and Response Systems (XDR), and Security Orchestration, Automation and Response Systems (SOAR).

[0003] Existing solutions typically achieve security event detection and analysis through log collection modules, rule matching modules, correlation analysis modules, and alarm display modules.

[0004] Existing technical solutions, which primarily rely on rule matching and log-level event correlation, have the following technical problems: (1) The existing system uses logs as the core data unit and lacks a unified modeling mechanism for entities such as users, devices, processes, services and network connections, resulting in limited cross-system and cross-data source correlation analysis capabilities.

[0005] (2) Existing correlation analysis modules are usually based on static rules or time windows to correlate events, which makes it difficult to depict the multi-stage and multi-hop correlation in complex attack chains, thus failing to effectively identify advanced persistent threat (APT) attack paths.

[0006] (3) Due to the lack of a unified data fusion mechanism, the data structures and semantics of different security subsystems are inconsistent, making it difficult to integrate and analyze security events in real time under a unified view.

[0007] (4) Existing systems mainly rely on manual analysis and experience rules in the process of security incident analysis, with a low degree of automation analysis, and cannot process and support large-scale security incidents in real time.

[0008] (5) Although some SOAR systems have certain automated response capabilities, their response strategies usually rely on predefined playbooks, lack the ability to dynamically adjust based on changes in the global security situation, and lack a systematic evaluation mechanism for the response effect after the response operation is performed, thus failing to form a closed-loop optimization capability. Summary of the Invention

[0009] In view of the above problems, the present invention is proposed to provide a network security operation method and system based on dynamic security graph evolution to overcome or at least partially solve the above problems.

[0010] According to one aspect of the present invention, a network security operation method based on dynamic security graph evolution is provided, the operation method comprising: Unified collection of multi-source heterogeneous security data; The collected data will be standardized and preprocessed. Cross-system entity consistency modeling based on a unified entity resolution mechanism; Data structure representation based on unified security graph; Security event correlation analysis and attack chain identification based on graph structure; An automated security response execution mechanism based on analysis results; Feedback-based optimization mechanism based on response results.

[0011] Optionally, the unified collection of multi-source heterogeneous security data specifically includes: Collect data from terminal devices, network devices, security devices, identity authentication systems, cloud platforms, and third-party threat intelligence.

[0012] Optionally, the standardization process specifically includes: data parsing, format conversion, field mapping, time synchronization, and data cleaning.

[0013] Optionally, the cross-system entity consistency modeling based on the unified entity resolution mechanism specifically includes: A unified entity mapping relationship is established based on user identifier, device identifier, IP address, process identifier, and service identifier to achieve entity unification across systems.

[0014] Optionally, the data structure representation method based on the unified security graph specifically includes: A dynamic graph is constructed based on unified entities and their interaction relationships, and the graph structure is continuously updated by receiving new security events.

[0015] Optionally, the graph-based security event correlation analysis and attack chain identification specifically includes: performing event correlation analysis based on the node relationships and time sequence relationships in the graph; The attack path is deduced based on the correlation results, and a risk score is generated.

[0016] Optionally, the automated security response execution mechanism based on the analysis results specifically includes: Based on the risk score, the response strategy is invoked to execute security measures; Evaluate the response results and feed them back to the risk assessment and response strategy.

[0017] This invention also provides a network security operation system based on dynamic security graph evolution, applying the aforementioned network security operation method based on dynamic security graph evolution. The network security operation system includes: A multi-source security data acquisition module is used for the unified acquisition of multi-source heterogeneous security data. The data standardization and preprocessing module is used to standardize and preprocess the collected data. The unified entity resolution module is used for cross-system entity consistency modeling based on the unified entity resolution mechanism. The unified security graph construction module is used for data structure representation based on the unified security graph. The security event correlation analysis module is used for graph-based security event correlation analysis. Attack chain reasoning and risk assessment module, used for attack chain identification; An automated response execution module is used for automated security response execution mechanisms based on analysis results. The response performance evaluation and feedback module is used for a feedback-based optimization mechanism based on response results.

[0018] This invention provides a network security operation method and system based on dynamic security graph evolution. The operation method includes: unified collection of multi-source heterogeneous security data; standardization and preprocessing of the collected data; cross-system entity consistency modeling based on a unified entity resolution mechanism; data structure representation based on a unified security graph; security event correlation analysis and attack chain identification based on graph structure; automated security response execution mechanism based on analysis results; and feedback optimization mechanism based on response results. This achieves continuous evolution of the unified security graph and dynamic optimization of security strategies, forming a closed-loop operation mechanism for network security detection, analysis, decision-making, response, and continuous learning.

[0019] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1A flowchart illustrating a network security operation method based on dynamic security graph evolution, provided as an embodiment of the present invention; Figure 2 This is a schematic diagram of the unified security graph structure provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the attack chain reasoning and risk assessment model provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of a closed-loop autonomous response system provided in an embodiment of the present invention; Figure 5 This is a flowchart illustrating the dynamic updating and continuous evolution of a unified security graph using a layered architecture, as provided in an embodiment of the present invention. Detailed Implementation

[0022] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0023] The terms "comprising" and "having," and any variations thereof, in the specification, embodiments, claims, and drawings of this invention are intended to cover non-exclusive inclusion, such as including a series of steps or units.

[0024] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0025] This invention provides a network security awareness and autonomous response system and method based on a unified security graph. The system uses a unified security graph as its core data structure and achieves closed-loop processing of network security incidents through multi-source heterogeneous security data fusion, real-time entity association modeling, attack chain reasoning analysis, and automated response execution.

[0026] The system described in this invention includes the following functional modules: (1) Multi-source security data acquisition module It is used to collect security log data, network traffic data, and event data from terminal devices, network devices, cloud platforms, security devices, and identity authentication systems.

[0027] (2) Data standardization and preprocessing module It is used to perform format conversion, field mapping and time synchronization processing on the collected multi-source heterogeneous data to form a unified structured data representation.

[0028] (3) Unified Entity Resolution Module Used to uniquely identify and cross-source map security entities such as users, devices, processes, services, and network connections, enabling consistent identification of entities across systems.

[0029] (4) Unified security graph construction module This tool is used to construct a security graph based on entities and their interaction relationships, where nodes represent security entities, edges represent behavioral relationships or event associations between entities, and supports real-time updates of dynamic graphs.

[0030] (5) Security Incident Correlation Analysis Module It is used to perform temporal and structural correlation analysis of security events based on a unified security graph, in order to identify multi-stage and multi-hop attack paths.

[0031] (6) Attack Chain Reasoning and Risk Assessment Module It is used to infer potential attack paths based on graph structure analysis results and to score the risk of security entities and events.

[0032] (7) Automated response execution module Used to perform security response operations based on risk assessment results and predefined or dynamically generated response policies, including but not limited to endpoint isolation, identity token revocation, access control adjustment, and alarm escalation.

[0033] (8) Response performance evaluation and feedback module It is used to evaluate the response process and response results, and feed the evaluation results back to the attack chain inference module and the response strategy module to optimize subsequent security decisions.

[0034] like Figure 1 As shown, the present invention provides a network security awareness and autonomous response system based on a unified security graph.

[0035] The system includes The system includes a multi-source security data acquisition module, a data standardization and preprocessing module, a unified entity parsing module, a unified security graph construction module, a security event correlation analysis module, an attack chain reasoning and risk assessment module, an automated response execution module, and a response performance evaluation and feedback module.

[0036] The multi-source security data acquisition module is used to collect data from terminal devices, network devices, security devices, identity authentication systems, cloud platforms, and third-party threat intelligence. The data standardization and preprocessing module is used to complete data parsing, format conversion, field mapping, time synchronization, and data cleaning. The unified entity resolution module establishes a unified entity mapping relationship based on user identifier, device identifier, IP address, process identifier, and service identifier, thereby achieving entity unification across systems.

[0037] The unified security graph construction module builds a dynamic graph based on unified entities and their interaction relationships, and continuously receives new security events to update the graph structure.

[0038] The security event correlation analysis module performs event correlation analysis based on the node relationships and time sequence relationships in the graph.

[0039] The attack chain reasoning and risk assessment module deduces the attack path based on the correlation results and generates a risk score.

[0040] The automated response execution module invokes response strategies based on risk scores to perform security actions.

[0041] The response performance evaluation and feedback module is responsible for evaluating the response results and feeding the evaluation results back to the risk assessment and response strategy to achieve continuous optimization.

[0042] Deployed on the same server or in a distributed manner across multiple computing nodes, the modules can communicate with each other through message bus, RPC interface, REST interface or message queue, and this invention does not limit the scope of communication.

[0043] Example 2: Unified Security Graph Construction Process like Figure 2 As shown, this invention uses a unified security graph as the core of data organization for the entire system.

[0044] The security graph consists of entity nodes and relation edges.

[0045] Among them, entity nodes include at least security objects such as users, devices, processes, services, IP addresses, network connections, files, containers, cloud resources, and business systems.

[0046] Relationship edges are used to describe the interaction relationships between entities, including but not limited to login relationships, access relationships, execution relationships, communication relationships, control relationships, permission inheritance relationships, file read / write relationships, and data transmission relationships.

[0047] When the system receives a new security event, it first performs entity parsing based on the entity identifier in the event. If the corresponding entity does not exist in the graph, a new entity node is created; if it already exists, the entity attributes are updated. Subsequently, corresponding relationship edges are established according to the event type, and the event occurrence time, event type, and related security attributes are recorded to achieve dynamic updates of the unified security graph.

[0048] Compared to traditional log-based analysis methods, this embodiment uses a unified security graph to describe security entities and their relationships in cyberspace, enabling dispersed security events to be transformed into a unified data structure, providing a unified data foundation for subsequent attack chain reasoning.

[0049] Example 3: Attack Chain Reasoning and Risk Assessment Process like Figure 3 As shown, after completing the construction of the unified security graph, the system enters the attack chain reasoning stage.

[0050] The attack chain reasoning module first obtains the newly added event nodes in the security graph and constructs candidate attack paths by combining entity relationships, behavioral relationships and temporal relationships.

[0051] Subsequently, path analysis, behavior pattern matching, and threat intelligence correlation analysis were performed on the candidate attack paths to identify whether the attackers were engaged in attack phases such as initial access, malicious execution, privilege escalation, lateral movement, data access, and data leakage.

[0052] The risk assessment module calculates a comprehensive risk score and generates a risk level based on attack path length, asset importance, degree of behavioral abnormality, historical attack characteristics, threat intelligence credibility, and business impact.

[0053] When the risk score reaches a preset threshold, the attack chain inference module sends a response request to the automated response execution module; when the risk score is lower than the preset threshold, only a security alarm is generated and the status of the relevant entities is continuously monitored.

[0054] In this embodiment, attack chain reasoning can be implemented using graph traversal algorithms, rule-based reasoning, machine learning models, large language model reasoning, or any combination thereof. This invention does not limit this method.

[0055] Example 4: Closed-Loop Autonomous Response Process like Figure 4 As shown, this invention establishes a closed-loop autonomous response mechanism for detection, analysis, decision-making, response, and evaluation.

[0056] First, the system completes security event detection; then, it performs correlation analysis based on a unified security graph and generates attack chains and risk scores; based on the risk scores, it automatically generates response strategies, including endpoint isolation, identity token revocation, network access control adjustment, alarm escalation, and manual confirmation.

[0057] After the response is completed, the response effectiveness evaluation module automatically collects indicators such as response time, attack blocking effect, false alarm rate, business impact and risk elimination status to comprehensively evaluate the response process.

[0058] The evaluation results are fed back to the risk assessment model to dynamically adjust risk parameters; they are also fed back to the response strategy module to continuously optimize response priorities and strategies; and they can also be fed back to the knowledge base to update attack characteristics, strategy rules, and model parameters.

[0059] Through the above feedback mechanism, the system can form a closed-loop operation process of "detection-analysis-decision-response-evaluation-feedback", realizing continuous learning and continuous optimization of security operation capabilities.

[0060] In another embodiment, the attack chain inference module can employ different types of inference algorithms; the automated response module can connect to SOAR platforms, EDR systems, firewalls, zero-trust systems, or identity authentication platforms from different vendors; and the response performance evaluation module can add functions such as strategy optimization, knowledge base updates, and model training according to actual business needs, without changing the core technical solution of the present invention.

[0061] Example 5: A method for dynamic updating and continuous evolution of a unified security map This embodiment further illustrates the dynamic updating and continuous evolution mechanism of the unified security graph in the network security operation process of the present invention.

[0062] Unlike traditional security systems that use static asset models or periodic synchronization methods to update data, the unified security graph in this invention adopts a dynamic update mechanism that combines event-driven and state-driven approaches, enabling the security graph to continuously evolve with changes in the network environment and always remain consistent with the current network security status.

[0063] In this embodiment, the data objects in the unified security graph mainly include entity nodes, relationship edges, and entity attributes.

[0064] Among them, entity nodes include at least security entities such as users, devices, processes, services, files, IP addresses, domain names, network connections, container instances, and cloud resources; relationship edges are used to describe the associations between entities such as login, access, execution, communication, control, permission inheritance, and data transmission; entity attributes are used to record information such as entity status, risk level, business attributes, timestamps, and historical behavior.

[0065] like Figure 5 As shown, the present invention adopts a layered architecture to realize the dynamic updating and continuous evolution of the unified security graph, including a perception layer, a cognition layer, a decision-making layer and an action layer.

[0066] The system consists of three layers: the perception layer, the cognition layer, and the action layer. The perception layer performs unified entity parsing, dynamic graph construction, and attack chain reasoning on the collected data to achieve network security situational awareness. The decision layer conducts risk assessment based on the attack chain reasoning results and generates corresponding security response strategies. The action layer executes automated security responses, evaluates the effectiveness of the response process and results, and feeds the evaluation results back to the dynamic graph and risk assessment module. This enables the continuous evolution of the unified security graph and the dynamic optimization of security strategies, forming a closed-loop operation mechanism for network security detection, analysis, decision-making, response, and continuous learning.

[0067] When the system detects a new security event, the unified security graph is dynamically updated according to the following steps: Step S501: Receive data events from terminals, networks, security devices, cloud platforms, or third-party threat intelligence; Step S502: Call the unified entity parsing module to perform identity parsing and unique identifier mapping on the entities involved in the event; if the corresponding entity does not exist, create a new entity node; if the entity already exists, update the corresponding entity attributes. Step S503: Automatically establish or update the relationship edges between entities based on the event type, and record the event occurrence time, event type, behavioral characteristics, and credibility information; Step S504: Determine whether the new event changes the existing attack chain structure; if it does, recalculate the relevant attack paths and update the attack chain topology. Step S505: Recalculate the risk scores of relevant entities and the overall risk level based on the changes in the attack chain; Step S506: If the risk score exceeds the preset threshold, trigger the automated response execution module; otherwise, continue monitoring for subsequent security events. Step S507: After the response is completed, the response performance evaluation module obtains the response execution results, including response time, blocking effect, false alarms, business impact, and risk elimination. Step S508: Update the risk assessment model parameters, response strategy parameters, and entity risk attributes in the security graph based on the response assessment results, thereby completing this graph evolution.

[0068] The unified security graph in this invention does not simply store historical events, but continuously updates entity attributes, relation edge weights, risk levels, and historical behaviors after each security event occurs, attack chain changes, and response is completed, so that the graph can dynamically reflect the current state of the network environment.

[0069] In another implementation, the relationship edge can be set with a lifecycle attribute. When a preset time has elapsed and no related behavior has occurred again, the system automatically reduces the weight of the corresponding relationship edge or deletes the invalid relationship. For continuously occurring related behaviors, the weight of the corresponding relationship edge is increased, thereby more accurately reflecting the long-term relationship between entities.

[0070] In another implementation, the response performance evaluation module also adaptively adjusts the risk assessment model, attack chain inference model, and response strategy based on historical response results, so that the unified security graph not only records the network status, but also can continuously learn and optimize the decision-making process as the network environment changes.

[0071] Through dynamic updates and continuous evolution mechanisms, this invention enables the transformation of the unified security graph from a static data structure to a dynamic security knowledge carrier, ensuring that attack chain reasoning, risk assessment, and autonomous response are always based on the latest network security status, thereby improving the accuracy of attack identification, the real-time nature of response, and the system's continuous optimization capabilities in complex network environments.

[0072] Beneficial effects: (1) Enhance the unified analysis capability of multi-source heterogeneous security data By standardizing multi-source heterogeneous security data from terminal devices, network devices, and cloud platforms, and performing unified modeling based on a unified entity resolution mechanism, data from different security subsystems can be expressed and associated in a unified semantic space, thereby improving the efficiency of cross-system data fusion and the consistency of analysis.

[0073] (2) Improve the ability to identify complex attack behaviors By constructing a unified security graph, security entities such as users, devices, processes, and network connections and their relationships are expressed in a structured manner. Based on the graph structure, correlation analysis is performed, enabling the system to identify multi-stage and multi-hop attack paths that are difficult to capture using traditional rule-based or time-window methods, thereby improving the detection capability of advanced persistent threat (APT) attacks.

[0074] (3) Improve the real-time performance and accuracy of security incident analysis By using a real-time update mechanism based on graph structures, dynamic correlation analysis of security events is performed, enabling the system to complete analysis and modeling synchronously during the occurrence of security events, without relying on post-event batch processing, thereby improving the real-time performance and accuracy of security analysis results.

[0075] (4) Reduce reliance on human experience and rule configuration By introducing an automated correlation analysis and risk assessment mechanism based on a unified security graph, the security incident analysis process is transformed from relying on manual rule configuration to a data-driven automated reasoning process, thereby reducing the workload of manual analysis and improving the degree of automation.

[0076] (5) Improve safety response efficiency and automation level By automatically triggering security response mechanisms based on risk assessment results, automated security handling operations, including endpoint isolation, identity token revocation, and access control adjustment, are achieved, thereby shortening security incident response time and improving overall security operation efficiency.

[0077] (6) Achieve closed-loop optimization capability for the safety response process By systematically evaluating the security response process and results, and feeding the evaluation results back to the attack chain reasoning and response strategy module, the system has the ability to continuously optimize based on historical response effects, thereby improving the accuracy and adaptability of subsequent security decisions.

[0078] (7) Improve the scalability of the system in large-scale complex network environments. By adopting a unified security graph as the core data structure, the system can manage large-scale security entities and their relationships in a unified manner, thereby improving the system's scalability and stability in high-concurrency, multi-node complex network environments.

[0079] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network security operation method based on dynamic security graph evolution, characterized in that, The operating method includes: Unified collection of multi-source heterogeneous security data; The collected data will be standardized and preprocessed. Cross-system entity consistency modeling based on a unified entity resolution mechanism; Data structure representation based on unified security graph; Security event correlation analysis and attack chain identification based on graph structure; An automated security response execution mechanism based on analysis results; Feedback-based optimization mechanism based on response results.

2. The network security operation method based on dynamic security graph evolution according to claim 1, characterized in that, The unified collection of multi-source heterogeneous security data specifically includes: Collect data from terminal devices, network devices, security devices, identity authentication systems, cloud platforms, and third-party threat intelligence.

3. The network security operation method based on dynamic security graph evolution according to claim 1, characterized in that, The standardization process specifically includes: data parsing, format conversion, field mapping, time synchronization, and data cleaning.

4. The network security operation method based on dynamic security graph evolution according to claim 1, characterized in that, The cross-system entity consistency modeling based on the unified entity resolution mechanism specifically includes: A unified entity mapping relationship is established based on user identifier, device identifier, IP address, process identifier, and service identifier to achieve entity unification across systems.

5. A network security operation method based on dynamic security graph evolution according to claim 1, characterized in that, The data structure representation method based on the unified security graph specifically includes: A dynamic graph is constructed based on unified entities and their interaction relationships, and the graph structure is continuously updated by receiving new security events.

6. A network security operation method based on dynamic security graph evolution according to claim 1, characterized in that, The graph-based security event correlation analysis and attack chain identification specifically includes: performing event correlation analysis based on the node relationships and time sequence relationships in the graph; The attack path is deduced based on the correlation results, and a risk score is generated.

7. A network security operation method based on dynamic security graph evolution according to claim 1, characterized in that, The automated security response execution mechanism based on the analysis results specifically includes: Based on the risk score, the response strategy is invoked to execute security measures; Evaluate the response results and feed them back to the risk assessment and response strategy.

8. A network security operation system based on dynamic security graph evolution, employing the network security operation method based on dynamic security graph evolution as described in any one of claims 1-7, characterized in that, The network security operation system includes: A multi-source security data acquisition module is used for the unified acquisition of multi-source heterogeneous security data. The data standardization and preprocessing module is used to standardize and preprocess the collected data. The unified entity resolution module is used for cross-system entity consistency modeling based on the unified entity resolution mechanism. The unified security graph construction module is used for data structure representation based on the unified security graph. The security event correlation analysis module is used for graph-based security event correlation analysis. Attack chain reasoning and risk assessment module, used for attack chain identification; An automated response execution module is used for automated security response execution mechanisms based on analysis results. The response performance evaluation and feedback module is used for a feedback-based optimization mechanism based on response results.

Images