Hierarchical visualization global terminal intelligent management and control system

Abstract

The application discloses a layered visual global terminal intelligent management and control system and belongs to the technical system of terminal intelligent management and control. Two mutual information coupling coefficients and corresponding clock increasing frequencies are weighted and fused to generate device ontology anchor point identification. An observation merging graph is constructed with each terminal observation event as a vertex. The coupling fingerprint similarity between the device ontology anchor point identifications corresponding to two observation events is taken as an edge weight. Causal cone constraints are applied to the observation merging graph, and hierarchical condensed clustering is performed. Multiple observation events belonging to the same terminal are merged into a single ontology cluster to eliminate topological ghosts. When a time gap exists between adjacent events in an attack trace source chain, the spatiotemporal intersection area of the causal future cone of the previous event and the causal past cone of the subsequent event is calculated. In the spatiotemporal intersection area, an implicit intermediate observation satisfying the device ontology anchor point identification matching condition is searched. The searched implicit intermediate observation is inserted into the trace source chain to complete the suture.

Description

Technical Field

[0001] This invention relates to terminal intelligent management and control technology systems, specifically to a hierarchical, visualized, full-domain terminal intelligent management and control system. Background Technology

[0002] The global endpoint includes a large number of mobile devices, short-lived containers, and employee-owned devices. These devices frequently connect to different networks, change IP addresses, and change physical locations. Traditional hierarchical management topology visualization, which builds associations based on periodic scans, is prone to producing "topology phantoms." This means that the same device may appear in two geographical areas within a short period of time, resulting in two nodes on the visualization. Operations personnel may isolate the wrong target. Alternatively, during incident tracing, dynamic IP addresses and short-lived key allocations may cause the attack path to "break" on the visualization graph, making it impossible to reconstruct the entire chain. This results in topology phantoms and broken tracing in dynamic environments. Summary of the Invention

[0003] The purpose of this invention is to provide a hierarchical, visualized, full-domain intelligent control system for terminals, which solves the technical problems mentioned in the background art.

[0004] The objective of this invention can be achieved through the following technical solutions: A hierarchical, visualized, full-domain intelligent terminal control system includes: Multi-dimensional data acquisition, processing, and identifier generation module: Collects the TCP timestamp option field of all terminals, extracts the clock increment frequency and clock drift rate of each terminal, and simultaneously collects the TLS session ticket multiplexing interval sequence and ARP / NDP response timing jitter sequence of the terminal. It calculates the mutual information coupling coefficient between the clock drift rate and the TLS session ticket multiplexing interval sequence, as well as the mutual information coupling coefficient between the clock drift rate and the ARP / NDP response timing jitter sequence. The two mutual information coupling coefficients are weighted and fused with the corresponding clock increment frequency to generate a cross-network invariant device body anchor identifier. The observation merging graph and source chain construction optimization module: Based on the generated device ontology anchor point identifiers, an observation merging graph is constructed with each terminal observation event as a vertex. The similarity of the coupling fingerprint between the device ontology anchor points corresponding to two observation events is used as the edge weight. A causal cone constraint is applied to the observation merging graph, and hierarchical agglomerative clustering is performed to merge multiple observation events belonging to the same terminal into a single ontology cluster, eliminating topological phantoms. When a time gap is detected between adjacent events in the attack source chain, the spatiotemporal intersection region of the causal future cone of the preceding event and the causal past cone of the following event is calculated. Within the spatiotemporal intersection region, a hidden intermediate observation that satisfies the device ontology anchor point identifier matching condition is searched. The searched hidden intermediate observation is inserted into the source chain to complete the stitching.

[0005] Furthermore, when performing linear regression fitting to calculate the clock increment frequency and clock drift rate, the arrival time series is used as the independent variable and the corrected TSval series is used as the dependent variable. Least squares linear regression fitting is performed, and the slope and intercept of the linear regression are solved by the least squares method. Based on the slope and intercept of the solved linear regression, the regression residual for each data point is calculated, and the clock drift rate is calculated based on the regression residual for each data point.

[0006] Furthermore, when calculating the ideal response interval, the time interval between two adjacent ARP / NDP response messages is regarded as an observation sample; when calculating the timing jitter sequence, the mean of all adjacent time intervals is calculated as an estimate of the ideal response interval; and the deviation of each time interval from the mean is calculated to obtain the ARP / NDP response timing jitter sequence.

[0007] Furthermore, the first coupling coefficient Characterizing the clock drift rate sequence With TLS multiplexing interval resampling sequence The statistical dependence between them is calculated using the following formula: In the formula, The first coupling coefficient; The mutual information value between sequence X and sequence Y; The number of bins during discretization; For sequence X to fall into the first The bins are bins, and sequence Y falls into the bin. The joint probability of the bins, with values ​​ranging from 1 to 2. ; For sequence X to fall into the first The marginal probability of each bin; For sequence Y to fall into the first The marginal probability of each bin; For the binning index of sequence X, ; For the binning index of sequence Y, .

[0008] Furthermore, the second coupling coefficient The statistical dependence between the clock drift rate sequence X and the ARP / NDP jitter resampling sequence Z is represented by the following formula: In the formula, This is the second coupling coefficient; The mutual information value between sequence X and sequence Z; For sequence X to fall into the first The bins are bins, and sequence Z falls into the bin. The joint probability of each sub-bin; For sequence X to fall into the first The marginal probability of each bin; For sequence Z to fall into the first The marginal probability of each bin; For the binning index of sequence Z, .

[0009] Furthermore, when implementing Locality Sensitive Hashing to generate anchor point identifiers, the three-dimensional feature vector is... It is mapped to a 128-bit device body anchor identifier through locality-sensitive hashing. ; These are the normalized first coupling coefficient, second coupling coefficient, and clock increment frequency, respectively.

[0010] Furthermore, when calculating the coupling fingerprint similarity as the edge weight, for each candidate edge in the candidate edge set, its edge weight is calculated. The edge weight is defined as the cosine similarity between the three-dimensional feature vectors corresponding to the two observation events. All edges with edge weights greater than zero in the candidate edge set are added to the edge set, and the corresponding edge weights are added to the weight set to obtain the weighted observation merge graph.

[0011] Furthermore, when calculating the lower bound of the signal propagation delay, for each edge in the weighted observation merge graph, the Euclidean distance between the physical locations of the two observed events is calculated, and the lower bound of the signal propagation delay is also calculated. For each edge, calculate the absolute time difference between two observed events. If the absolute time difference is less than the lower bound of the signal propagation delay... .

[0012] Furthermore, an initial attack attribution chain is constructed, mapping alarm events to ontology clusters. For the first attack in the attribution chain... The and the first For two alarm events, calculate their time interval. If the time interval is greater than the set upper limit threshold for the duration of a normal session, determine that the tracing chain is in the first stage. The and the first A break occurs between alarm events, generating a break location identifier; When calculating the spatiotemporal intersection of causal cones and searching for hidden intermediate observations, the input is a set of fracture location identifiers and a set of observation events, and the output is a set of hidden intermediate observations corresponding to each fracture location.

[0013] Furthermore, the observation events that meet all preset conditions are searched in the set of observation events and sorted in ascending order by timestamp to obtain the implicit intermediate observation set. When performing the stitching operation, for each break position identifier, the observation events in the corresponding implicit intermediate observation set are inserted into the initial attack tracing chain in chronological order. After performing the stitching operation on all break positions, the stitched complete attack tracing chain is obtained.

[0014] Compared to existing solutions, the beneficial effects achieved by this invention are: This invention uses anchor point identifiers generated by hardware clock-coupled fingerprints, which are unaffected by IP changes, fundamentally solving the identity tracking problem in dynamic IP environments. By assigning a unique ontology identifier to the same terminal at the data level, subsequent observation merging operations have a reliable identity foundation, eliminating the conditions for topological phantom generation at the source. By passively mirroring network traffic collection without sending any probe packets to the terminal, no proxy software needs to be installed on the terminal. The generated anchor point identifiers are resistant to forgery. Through causal cone constraints and hierarchical agglomerative clustering, multiple observation events from the same terminal are merged into a single ontology node, thus... It fundamentally eliminates topological phantoms, preventing maintenance personnel from performing incorrect isolation operations due to false nodes; through spatiotemporal intersection analysis of causal future cones and causal past cones, it accurately locates the hidden intermediate observations in the only possible spatiotemporal region, and searches within this region for observation events that satisfy identity constraints, thus achieving automatic stitching of the tracing chain, enabling maintenance personnel to reconstruct the complete attack path; through the introduced causal cone constraints, based on the causal principle of special relativity, it has clear physical interpretability. When two observation events are determined to be phantom edges by the causal cone constraints, maintenance personnel can intuitively understand the reason, enhancing the credibility and interpretability of the system. Attached Figure Description

[0015] The invention will now be further described with reference to the accompanying drawings.

[0016] Figure 1 This is a flowchart illustrating the operation of a hierarchical, visualized, full-domain terminal intelligent management and control system according to the present invention. Detailed Implementation

[0017] The technical solutions in this embodiment will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] like Figure 1 As shown, the present invention is a hierarchical, visualized, full-domain intelligent terminal control system, comprising: Multi-dimensional data acquisition, processing, and identifier generation module: Collects the TCP timestamp option field of all terminals, extracts the clock increment frequency and clock drift rate of each terminal, and simultaneously collects the TLS session ticket multiplexing interval sequence and ARP / NDP response timing jitter sequence of the terminal. It calculates the mutual information coupling coefficient between the clock drift rate and the TLS session ticket multiplexing interval sequence, as well as the mutual information coupling coefficient between the clock drift rate and the ARP / NDP response timing jitter sequence. The two mutual information coupling coefficients are weighted and fused with the corresponding clock increment frequency to generate a cross-network invariant device body anchor identifier. This module generates a unique identity identifier for each physical device in the global terminal network. This identifier remains unchanged regardless of network topology changes, such as IP address changes, network switching, or physical location migrations. Specifically, it generates an identity anchor point for the device itself, independent of any network layer identifier, such as an IP address or MAC address. Instead, it relies on the physical coupling between the terminal's hardware clock and the network protocol's behavioral rhythm. Specifically, the terminal's hardware crystal clock has a unique frequency deviation characteristic. This deviation simultaneously affects the TCP protocol stack's timestamp increment behavior, the TLS session management's timing rhythm, and the ARP / NDP protocol response's timing jitter pattern. These three factors are causally coupled, driven by the same physical clock source. By quantifying this coupling, a cross-network, cross-IP terminal identity anchor point can be constructed. When deploying passive mirroring probes and collecting raw network packets, the passive mirroring probes are deployed on the aggregation layer switches of the enterprise network or data center network; the specific deployment method is as follows: On the mirror port of the aggregation layer switch, such as the SPAN or RSPAN port, connect a server running a packet capture program. The packet capture program is implemented based on the libpcap / DPDK library and works in bypass listening mode. It does not inject any probe packets into the network, so it will not interfere with the normal communication behavior of the terminal. The passive mirroring probe continuously captures all network packets passing through the aggregation layer switch and records the following metadata for each captured packet: Message capture arrival timestamp Recorded by the probe server's local high-precision clock, in seconds; The message's five-tuple information includes: source IP address, destination IP address, source port number, destination port number, and transport layer protocol type. The original data of protocol fields related to this embodiment in the message payload include: timestamp options in the TCP options field, session ticket extension data in the TLS record layer, and the complete payload of ARP or NDP messages; The passive mirroring probe will sort the captured packets according to their source IP address and destination IP address, and group packets belonging to the same terminal into the packet queue corresponding to that terminal. This information is provided for subsequent sub-steps; the same terminal is identified by its source IP address. It should be noted that since the global terminal includes a large number of mobile devices, short-lived containers, and employee-owned devices, their IP addresses will change frequently. Therefore, when the passive image probe performs traffic splitting, it uses the source IP address within the current observation period as a temporary identifier for traffic splitting. In this embodiment, the current observation period is set to 5 minutes. When the terminal IP address changes, the packets corresponding to the new IP address will be temporarily assigned to a new packet queue. After the subsequent sub-steps complete the generation of the ontology anchor identifier, the packet queues corresponding to different IP addresses will be associated with the same terminal through the anchor identifier.

[0019] When extracting the TCP clock increment frequency and clock drift rate, the input is a packet queue of a certain terminal. The TCP packet sequence within; the output of this sub-step is the clock increment frequency for this terminal. and clock drift rate These two parameters will be used as a component in the sub-step for constructing the 3D feature vector. The specific implementation method is as follows: When parsing the TCP timestamp option field, from the packet queue In the process, all TCP packets carrying the TCP timestamp option field are filtered out. The structure of the TCP timestamp option field follows the RFC7323 specification and contains two 32-bit fields: TSval (TimestampValue, sender timestamp) and TSecr (TimestampEchoReply, echo timestamp). This embodiment only uses the TSval field. For message queues The Middle A TCP segment carrying a timestamp option, For TCP packet indexing, , Extract the total number of TCP packets carrying the timestamp option in the packet queue. , Two values; in, The TSval field value in the TCP timestamp option of this message is a 32-bit unsigned integer, representing the count value of the local TCP clock of the sending terminal when sending this message; This is the arrival timestamp when the message was captured by the passive mirror probe, recorded by the probe server's local high-precision clock, in seconds; This yields two sequences: the TSval sequence. and arrival time series ; When processing TSval wraparound, since TSval is a 32-bit unsigned integer, its maximum value is... When the terminal's TCP clock count exceeds this maximum value, wraparound will occur. In this embodiment, wraparound is detected and handled in the following way: For two adjacent TSval values and ,like and If so, it is determined that a loop has occurred, and and all subsequent TSval values ​​plus Make corrections; the corrected TSval sequence is denoted as ; When performing linear regression fitting to calculate the clock increment frequency and clock drift rate, in order to reach the time series... As the independent variable, the modified TSval sequence Using as the dependent variable, a least squares linear regression model was performed, and the fitted model is as follows: In the formula, For the first The TSval value of a TCP packet after wrap-around correction is a dimensionless count value; The slope of the linear regression is the increment frequency of the terminal TCP clock, expressed in counts per second, representing the number of counts incremented by the terminal TCP clock per second. For the first The arrival timestamp of each TCP packet captured by the probe, in seconds; The intercept of the linear regression is denoted as . The theoretical count value of the TCP clock at the time terminal is a dimensionless count value; For the first The regression residuals of each data point represent the deviation between the actual TSval value and the predicted value of the linear model, and are dimensionless count values. Solve using the least squares method and The corresponding expression is: ; In the formula, , is the arithmetic mean of the time series, in seconds; , where is the arithmetic mean of the corrected TSval sequence, and is the dimensionless count value.

[0020] When calculating the clock drift rate, after obtaining and Then, calculate the regression residual for each data point: ; Then calculate the clock drift rate. : In the formula, Clock drift rate, measured in counts per second. 2 This represents the drift rate of the terminal TCP clock relative to an ideal linear clock, reflecting the frequency instability of the terminal hardware crystal oscillator. The total number of TCP packets participating in the regression fitting is a dimensionless positive integer. For the first The regression residuals of each data point are dimensionless count values. The arrival timestamp of the last TCP segment, in seconds; The arrival timestamp of the first TCP packet, in seconds; For the observation time span; It needs to be explained that: dividing the root mean square value of the regression residuals (reflecting the degree to which the clock deviates from the linear model) by the observation time span (normalized) yields the clock drift per unit time; the clock drift rate... This is determined by the physical characteristics of the crystal oscillator in the terminal hardware. Different terminals use crystal oscillators with varying manufacturing processes. The value is unique and stable, and will not change due to changes in the network environment.

[0021] The final output is a pair of tuples. ,in, The typical value range is 100 to 1000, depending on the TCP clock configuration of the terminal operating system. The typical order of magnitude is to .

[0022] When extracting the TLS session ticket multiplexing time interval sequence, the input is the same terminal message queue. The sequence of TLS messages within the input is output as a sequence of TLS session ticket multiplexing time intervals. This sequence will be used as one of the inputs for subsequent sub-steps to calculate the mutual information coupling coefficient. The specific implementation method is as follows: When recognizing a TLS session ticket multiplexing event, from the message queue All TLS handshake messages are filtered out. The criteria for identifying TLS session ticket reuse are: if the TLSClientHello message contains a session_ticket extension (ExtensionType=35) and the extension data is not empty, then the TLS handshake is determined to be a session ticket reuse event. For message queues The Middle A session ticket reuse event. For session ticket reuse event index, , This represents the total number of session ticket multiplexing events that occurred on this terminal within the observation period, and records the arrival timestamp of the ClientHello message corresponding to each event captured by the probe. The unit is seconds; This yields the session ticket reuse timestamp sequence. ; When calculating the TLS session ticket multiplexing time interval sequence, an adjacent difference operation is performed on the session ticket multiplexing timestamp sequence to obtain the TLS session ticket multiplexing time interval sequence. : In the formula, For the first The and the first The time interval between session ticket reuse events, in seconds; For the first The arrival timestamp of the ClientHello message for each session ticket reuse event, in seconds; For the first The arrival timestamp of the ClientHello message for each session ticket reuse event, in seconds; The total number of session ticket reuse events during the observation period is a dimensionless positive integer.

[0023] The final output is a sequence of TLS session ticket multiplexing time intervals. ; The physical meaning of this sequence is that the timing rhythm of the TLS protocol stack's multiplexing behavior when performing session ticket multiplexing is driven by the terminal's local clock. Specifically, operations such as TLS session ticket validity checks and cache cleanup timer triggering all depend on the terminal's local system clock. Therefore, the multiplexing time interval sequence implicitly contains the frequency and drift characteristics of the terminal clock.

[0024] When extracting the ARP / NDP response timing jitter sequence, the input is the same terminal message queue. The sequence of ARP or NDP messages within the message is output as an ARP / NDP response timing jitter sequence. This sequence will serve as another input for calculating the mutual information coupling coefficient in subsequent sub-steps, as detailed below: When identifying ARP / NDP reply messages, from the message queue In the process, all ARP reply packets or NDP neighbor advertisement packets are filtered out; for IPv4 network environments, ARP reply packets are filtered out; for IPv6 network environments, NDP neighbor advertisement packets are filtered out; for dual-stack environments, both are filtered out. For message queues The Middle ARP / NDP reply message, For ARP / NDP response message index, , The total number of ARP / NDP response messages sent by the terminal during the observation period, and the arrival timestamp of each message captured by the probe. The unit is seconds; This yields the ARP / NDP response timestamp sequence. ; When calculating the ideal response interval, ARP / NDP response packets are typically responses to ARP requests or NDP neighbor requests. Under normal network conditions, after receiving a request, the terminal will send a response after a fixed protocol stack processing delay. In this embodiment, the time interval between two adjacent ARP / NDP response packets is considered as an observation sample. In the formula, For the first The and the first The actual time interval between ARP / NDP response messages, in seconds; For the first The arrival timestamp of each ARP / NDP response message, in seconds; For the first The arrival timestamp of each ARP / NDP response message, in seconds; The total number of ARP / NDP response messages within the observation period is a dimensionless positive integer.

[0025] When calculating the timing jitter sequence, the mean of all adjacent time intervals is calculated as an estimate of the ideal response interval: In the formula, This represents the average ARP / NDP response time interval, in seconds. Furthermore, the deviation of each time interval from the mean is calculated to obtain the ARP / NDP response timing jitter sequence. : In the formula, For the first The jitter value of each ARP / NDP response time interval, in seconds. A positive value indicates that the interval is greater than the average, and a negative value indicates that the interval is less than the average. For the first The and the first The actual time interval between ARP / NDP response messages, in seconds; This represents the average ARP / NDP response time interval, in seconds. The final output is the ARP / NDP response timing jitter sequence. .

[0026] It needs to be explained that the processing latency of the terminal's ARP / NDP protocol stack when processing requests and generating responses is affected by the terminal operating system's scheduling clock and hardware interrupt response timing. These timing characteristics are also driven by the terminal's hardware crystal oscillator clock. Therefore, the jitter sequence implicitly contains the terminal clock drift characteristics, and these characteristics are related to the extracted clock drift rate. There is a causal coupling relationship.

[0027] When calculating the mutual information coupling coefficient, the input is the clock drift rate. TLS session ticket multiplexing time interval sequence and ARP / NDP response timing jitter sequence The output is the first coupling coefficient. Second coupling coefficient These two parameters will serve as two components in the sub-step of constructing the 3D feature vector, specifically: When constructing a clock drift rate time series, the clock drift rate calculated in the preceding sequence... It is a global scalar value, in order to be consistent with and To perform mutual information calculation, it needs to be extended to a time series form. The specific method is as follows: observation period Divided into equal parts There are sliding time windows, each with a length of [missing information]. ,in, The value of is determined based on the number of messages within the observation period. In this embodiment, is taken as . This is to ensure that the lengths of the three sequences are aligned; For the A time window, Within this window, linear regression fitting is re-executed in the TCP packets to obtain the local clock drift rate within that window. This yields the clock drift rate time series. ; When performing sequence alignment and resampling, due to The length is , The length is , The length is The lengths of the three may be inconsistent; in this embodiment, the length of the three is taken as... As the reference length, for and Perform linear interpolation resampling to ensure that the lengths are all The resampled sequences are denoted as follows: Clock drift rate sequence , TLS multiplexing interval resampling sequence ARP / NDP jitter resampling sequence ; When calculating the first coupling coefficient, the first coupling coefficient Characterizing the clock drift rate sequence With TLS multiplexing interval resampling sequence The statistical dependence between them is calculated using the following formula: In the formula, The first coupling coefficient, in bits, represents the amount of information shared between the clock drift rate sequence and the TLS multiplexing interval sequence; The mutual information value between sequence X and sequence Y, in bits; The number of bins during discretization is taken in this embodiment. ; For sequence X to fall into the first The bins are bins, and sequence Y falls into the bin. The joint probability of each bin is a dimensionless probability value, ranging from 1 to 1. ; For sequence X to fall into the first The marginal probability of each bin is a dimensionless probability value. For sequence Y to fall into the first The marginal probability of each bin is a dimensionless probability value. For the binning index of sequence X, ; For the binning index of sequence Y, ; Before calculating mutual information, the continuous value sequence needs to be discretized. The specific method is as follows: The range of values ​​for sequence X Perform equal-width binning to obtain Bins; the range of values ​​for sequence Y Perform equal-width binning to obtain The sample size is divided into several bins. The number of samples in each bin is counted, and the probability value is obtained by dividing the number of samples by the total number of samples M.

[0028] It needs to be explained that mutual information The measure is the reduction in uncertainty of sequence Y after the value of sequence X is known. If there is a causal coupling relationship between the clock drift rate of the terminal and the TLS multiplexing interval driven by the same hardware clock, the mutual information value between the two will be significantly greater than zero. If there is no coupling relationship between the two, for example, data from different terminals are incorrectly associated, the mutual information value will approach zero.

[0029] When calculating the second coupling coefficient, the second coupling coefficient The statistical dependence between the clock drift rate sequence X and the ARP / NDP jitter resampling sequence Z is represented by the following formula: In the formula, The second coupling coefficient, in bits, represents the amount of information shared between the clock drift rate sequence and the ARP / NDP jitter sequence; The mutual information value between sequence X and sequence Z, in bits; For sequence X to fall into the first The bins are bins, and sequence Z falls into the bin. The joint probability of each bin is a dimensionless probability value. For sequence X to fall into the first The marginal probability of each bin is a dimensionless probability value. For sequence Z to fall into the first The marginal probability of each bin is a dimensionless probability value. For the binning index of sequence Z, ; The discretization method is the same as the previous steps, dividing the range of values ​​of sequence Z into equal-width bins; It needs to be explained that mutual information What is measured is the statistical dependence between clock drift rate and ARP / NDP response jitter. Since the response timing of the ARP / NDP protocol stack is also driven by the terminal hardware clock, the same terminal... The value will be significantly greater than zero.

[0030] To prevent excessive deviation in mutual information estimation due to insufficient sample size when validating the coupling coefficients, this embodiment sets the following validity verification conditions: when If the sample size for the current observation period is deemed insufficient, no device anchor point identifier is generated. Instead, the terminal is marked as awaiting supplementary observation, and the calculation is recalculated after more data is accumulated in the next observation period. The final output is then a binary tuple. .

[0031] When generating the device anchor point identifier through weighted fusion, the input is the clock increment frequency. First coupling coefficient Second coupling coefficient The output is a 128-bit device anchor point identifier. This identifier is the final output and will be passed to subsequent modules for constructing the observation merge graph. Specifically: because , , Since the three parameters have different dimensions and ranges, they need to be normalized to obtain the normalized clock increment frequency. The first coupling coefficient after normalization , The normalized second coupling coefficient, and the three-dimensional feature vector. This embodiment uses the Z-score normalization method based on global statistics, which is an existing conventional technical solution. The specific implementation steps are not described here. Weighted fusion of 3D feature vectors generates a fused feature scalar. : In the formula, The feature scalar after weighted fusion is a dimensionless value; The weight of the first coupling coefficient is taken in this embodiment. ; The weight of the second coupling coefficient is taken in this embodiment. ; As the weight of the clock increment frequency, in this embodiment, we take... .

[0032] The weights are set based on the coupling coefficient. and This directly reflects the strength of the causal coupling between the hardware clock and protocol behavior, and is a core feature that distinguishes different terminals, thus it is given high weight; clock increment frequency Although it also possesses terminal uniqueness, it is significantly affected by operating system configuration. For example, the TCP clock frequency of a Linux system can be configured to 250Hz or 1000Hz, thus assigning it a lower weight; the sum of the three weights is... .

[0033] When implementing locality-sensitive hashing to generate anchor identifiers, the three-dimensional feature vector will be used. It is mapped to a 128-bit device body anchor identifier through locality-sensitive hashing. The specific method is as follows: During the system initialization phase, 128 random hyperplanes are generated, each consisting of a three-dimensional normal vector. and a bias scalar definition, For random hyperplane index, ,in , , and All follow the standard normal distribution Independent sampling in the middle; for three-dimensional feature vectors Calculate its in the first Projection symbols on a hyperplane: In the formula, For the first The output value of each hash function can be either 0 or 1. For the first The three-dimensional normal vectors of a random hyperplane. ; The dot product of the normal vector and the eigenvector. ; For the first Bias scalars of random hyperplanes.

[0034] The output values ​​of the 128 hash functions are concatenated in order to obtain a 128-bit device anchor identifier: ;in, This represents the concatenation operation of binary bits.

[0035] It needs to be explained that Locality Sensitive Hashing (LSH), with its characteristic of mapping similar inputs to the same bucket, means that for the same physical terminal, even if its IP address, access network, and physical location change, its three-dimensional feature vector remains unchanged due to its hardware clock drift characteristics and protocol behavior coupling relationship. The position of the three-dimensional feature vector in the feature space remains basically unchanged. Therefore, after local sensitive hashing, the 128-bit anchor identifier obtained also remains unchanged. For different terminals, due to the physical differences of their hardware crystal oscillators, the position of the three-dimensional feature vector in the feature space is different, and the probability of mapping to the same anchor identifier is extremely low.

[0036] Generate device body anchor point identifier The temporary terminal identifier is associated with the currently observed terminal temporary identifier and stored. The terminal temporary identifier is the source IP address, forming a record in the ontology-observation mapping table. When the same terminal is assigned to a new message queue in a subsequent observation period due to a change in IP address, the preceding sub-steps are re-executed for the data in the new queue to generate a new anchor identifier. If the Hamming distance between the newly generated anchor identifier and the anchor identifier of the existing record is less than a preset Hamming distance threshold (in this embodiment, the Hamming distance threshold is 10, meaning that a maximum of 10 bits out of 128 are allowed to be different), it is determined to be the same terminal, and the new IP address is associated with the existing record; otherwise, a new record is created.

[0037] It should be noted that by exploring the physical coupling relationship between the terminal hardware clock and network protocol behavior, a cross-network immutable identity identifier is generated for each physical device in the global terminal. The generation of this identifier does not depend on network layer identifiers such as IP address and MAC address, but is based on the unique physical characteristics of the terminal hardware crystal oscillator. Therefore, it naturally possesses cross-network and cross-IP immutability.

[0038] Traditional solutions rely on IP addresses or MAC addresses for terminal identification. When a terminal frequently changes its IP address, such as when a mobile device roams between different Wi-Fi access points or when a short-lived container dynamically assigns an IP address, traditional solutions may misidentify the same terminal as multiple different devices. In this embodiment, the anchor identifier generated by coupling fingerprints with a hardware clock is unaffected by IP changes, fundamentally solving the identity tracking problem in dynamic IP environments. Furthermore, the root cause of topology phantoms lies in the fact that the same terminal is identified as different devices in different network areas, thus generating multiple false nodes in the visualized topology. By assigning a unique identity identifier to the same terminal at the data level, the observation and merging operations in subsequent steps have a reliable identity foundation, eliminating the conditions for topology phantoms from the source. By passively mirroring network traffic and collecting it without sending any probe packets to the terminal, no proxy software needs to be installed on the terminal. Since the clock drift rate is determined by the physical manufacturing deviation of the hardware crystal oscillator, attackers cannot forge or modify this feature through software means. Even if an attacker modifies the terminal's IP address, MAC address, or hostname, the physical characteristics of its hardware clock will not change, thus the generated anchor identifier has anti-forgery capabilities.

[0039] The observation merging graph and source chain construction optimization module: Based on the generated device ontology anchor point identifiers, an observation merging graph is constructed with each terminal observation event as a vertex. The similarity of the coupling fingerprint between the device ontology anchor points corresponding to two observation events is used as the edge weight. A causal cone constraint is applied to the observation merging graph, and hierarchical agglomerative clustering is performed to merge multiple observation events belonging to the same terminal into a single ontology cluster, eliminating topological phantoms. When a time gap is detected between adjacent events in the attack source chain, the spatiotemporal intersection region of the causal future cone of the preceding event and the causal past cone of the following event is calculated. Within the spatiotemporal intersection region, a hidden intermediate observation that satisfies the device ontology anchor point identifier matching condition is searched. The searched hidden intermediate observation is inserted into the source chain to complete the stitching.

[0040] This module, based on the generated device anchor point identifier, solves two key problems: First, it merges multiple observation events generated by the same physical terminal in different network areas, with different IP addresses, and at different times into a single logical entity, thereby eliminating the topology phantom phenomenon in topology visualization; Second, when the attack tracing chain is broken due to dynamic IP changes, short-term container destruction, or brief device offlineness, it searches within the gaps in the break through causal cone spatiotemporal intersection analysis and inserts hidden intermediate observation events to restore the complete attack causal path. Specifically: When defining observation events and constructing the vertex set of the observation merge graph, the input consists of all terminal observation data collected by the passive mirror probe in the global network, and the device body anchor point identifier generated for each terminal. The output is the set of observation events. and observation merged plot vertex set Specifically: In this embodiment, a single detection record of a passive mirroring probe on a terminal at a certain time and at a certain network location is defined as an observation event. Each observation event... It can be represented by the following quintuple: In the formula, For the first One observed event, , This represents the total number of observation events generated by all passive mirror probes in the global network within the observation period. This is the IP address of the terminal when the observed event occurred; it can be an IPv4 address or an IPv6 address. The coordinates of the physical location of the terminal at the time the observation event occurred are given by a three-dimensional vector. The unit is meters. Longitude coordinates Latitude coordinates The coordinates are the floor height coordinates; these coordinates are calculated by the signal angle of arrival measurement device deployed at each network access point, i.e., the supporting equipment of the passive mirror probe, through the triangulation method. This is the timestamp of the observed event, which is the moment when the passive mirror probe captured the first message from the terminal, in seconds, and is recorded by the probe server's local high-precision clock. The three-dimensional feature vector generated for this terminal. , which is a dimensionless normalized eigenvector; When constructing the set of observation events, all passive mirror probes in the global network will be included during the observation period. The observed events generated within are summarized into a set of observed events: In the formula, In this embodiment, the observation period is the total number of observed events. The duration is set to 24 hours, that is Second; When constructing the vertex set of the observation merge graph, each observation event in the set of observation events is used. As an observation merge map Given a vertex, construct a vertex set: Among them, vertex With observed events One-to-one correspondence; Observation merge plot Initialize as an undirected graph ,in, It is an edge set, initially an empty set. This is the set of edge weights, initially an empty set; When calculating edge weights, corresponding to the coupled fingerprint similarity, the input is the set of observed events and the set of vertices, and the output is a weighted observation merge graph. edge set and edge weight set It has been fully constructed, specifically: When determining the candidate edge set, due to the total number of observed events The number could be very large, reaching hundreds of thousands in large-scale enterprise networks. If edge weights are calculated for all vertex pairs, the computational complexity is O(n log n). This is unacceptable; therefore, this embodiment adopts an anchor point identification pre-screening strategy to reduce computational complexity. For any two vertices and , If and only if its corresponding device body anchor point identifier and Hamming distance between When the distance is less than the preset Hamming distance threshold, Add to candidate edge set ; The formula for calculating the Hamming distance is as follows: In the formula, The Hamming distance between the anchor points of the two device bodies is a dimensionless non-negative integer, with a value range of [value missing]. ; For the first The first device anchor point identifier corresponding to the observed event A binary value, which can be either 0 or 1; For the first The first device anchor point identifier corresponding to the 'observation event' A binary value, which can be either 0 or 1; This is an indicator function; it takes the value 1 when the condition inside the parentheses is true, and 0 otherwise. For bit index, .

[0041] When calculating the coupling fingerprint similarity as edge weights, for the candidate edge set... Each candidate edge in Calculate its edge weights The edge weight is defined as the cosine similarity between the three-dimensional feature vectors corresponding to two observed events: In the formula, As vertex With vertex The edge weights between the fingerprints, i.e., the coupling fingerprint similarity, are dimensionless values, with a range of [value range missing]. The larger the value, the more likely the two observed events belong to the same terminal; For the first 'Three-dimensional feature vectors corresponding to each observed event, ; It is the dot product of two three-dimensional eigenvectors; For the first The L2 norm of a three-dimensional eigenvector; For the first The L2 norm of a three-dimensional eigenvector; For the first Normalized first coupling coefficients corresponding to each observed event; For the first Normalized second coupling coefficients corresponding to each observed event; For the first The normalized clock increment frequency corresponding to each observed event; For the first 'Normalized first coupling coefficients corresponding to each observed event; For the first Normalized second coupling coefficients corresponding to each observed event; For the first The normalized clock increment frequency corresponding to each observed event.

[0042] It should be explained that cosine similarity measures the degree of consistency between two feature vectors in direction. Since the three components of the three-dimensional feature vector in the preceding steps—the first coupling coefficient, the second coupling coefficient, and the clock increment frequency—all originate from the physical characteristics of the hardware clock of the same terminal, the feature vectors generated by the same terminal under different observation conditions are basically consistent in direction, and the cosine similarity is close to 1; while the feature vectors of different terminals have significant differences in direction, and the cosine similarity is close to 0 or negative.

[0043] When constructing a weighted observation merge graph, the candidate edge set is... All edge weights Add edges with a value greater than zero to the edge set. The corresponding edge weights are added to the weight set. The weighted observation merge map is obtained. .

[0044] When applying causal cone constraints, the input is a weighted observation merge graph. The output is the observation merge graph after applying the causal cone constraint. In this case, the weight of some edges is set to zero and marked as phantom edges; It needs to be explained that the causal cone constraint is based on the principle of causality in special relativity: any physical entity, including terminal devices, cannot move faster than the speed of light in space. Therefore, if the time difference between two observed events is less than the shortest time required for light signals to propagate between their physical locations, then these two observed events cannot physically be generated by the same terminal, because the terminal cannot move from one location to another in such a short time. Even if their device anchor points are the same, it may be due to a hash collision or measurement error, and should be judged as a topological phantom, with the weight of the corresponding edge reset to zero.

[0045] When calculating the lower bound of signal propagation delay, for weighted observation merge graphs Each edge in Calculate the Euclidean distance between the physical locations of two observed events: In the formula, For the first The observed event and the first Euclidean distance between the physical locations of the observed events; For the first The physical location coordinates of an observed event. ; For the first The physical location coordinates of an observed event. ; For the first The coordinate components of an observed event in the longitude direction; For the first The coordinate components of an observed event in the latitudinal direction; For the first The coordinate components of each observed event in the direction of floor height; For the first The coordinate components of an observed event in the longitude direction; For the first The latitudinal coordinate components of an observed event; For the first The coordinate components of each observed event along the floor height; the unit of each coordinate is meters. And, calculate the lower bound of the signal propagation delay: In the formula, For the first The observed event and the first The lower bound of the signal propagation delay between observed events, in seconds, represents the time required for any physical entity to travel from an observed event to a known event. Move to The shortest time required; The Euclidean distance between the physical locations of two observed events, in meters; is the speed of light in a vacuum, and is a physical constant.

[0046] It needs to be explained that the speed of light is the upper limit of the speed at which a physical entity can move, therefore From position Arrive at the location The theoretical lower bound of the required time: if the time difference between two observed events is less than this lower bound, then causality is violated and they cannot belong to the same terminal.

[0047] When performing the causal cone constraint test, for each edge Calculate the absolute time difference between two observed events: In the formula, For the first The observed event and the first The absolute time difference between observed events, in seconds; For the first The timestamps of each observed event, in seconds; For the first The timestamps of each observed event, in seconds; When performing the causal cone constraint test, For edges identified as phantom edges, perform the following operations: Reset its edge weights to zero: ; Mark it as a phantom edge and set the flag in the edge properties. ; Remove this edge from the set of valid edges Remove from the middle, that is ; For edges that are not identified as phantom edges, their original weights remain unchanged: And retain it in the valid edge set. middle; Finally, the observation merge graph with causal cone constraints is obtained. ; It should be noted that in a real enterprise network environment, the physical movement speed of a terminal is far lower than the speed of light, typically walking speed, about 1-2 meters per second. Therefore, in this embodiment, the speed of light as the upper limit of speed is an extremely lenient constraint. However, the core value of this constraint lies in handling the following scenario: when the anchor point of the same terminal is observed simultaneously in two network areas that are far apart due to measurement noise, for example, a laptop is detected almost simultaneously in building A and building B, the causal cone constraint can determine one of the observations as a phantom based on the physical impossibility that a person cannot move from building A to building B in a very short time, thereby avoiding the generation of false nodes in topology visualization.

[0048] Furthermore, in this embodiment, a more stringent speed limit can be set according to the actual scenario. ,For example meters per second, corresponding to vehicle speed, the lower bound of signal propagation delay is corrected to: ;in, The preset maximum moving speed limit for the terminal is in meters per second; this correction makes the causal cone constraint more stringent, and can filter out more phantom edges caused by measurement errors.

[0049] When performing hierarchical agglomerative clustering to generate ontology clusters, the input is the observation merge graph after applying causal cone constraints. The output is a set of ontology clusters. Each ontology cluster Representing a physical terminal, the cluster contains all observation events generated by that terminal at different times and in different network regions, specifically: When initializing clustering, each vertex Each cluster forms its own cluster, resulting in the initial cluster set: ; At this point, the number of clusters equals the total number of observed events. ; When defining inter-cluster distance, the average link criterion is used. The distance between two clusters is defined as follows: for any two clusters... and The inter-cluster distance Defined as: In the formula, For clusters with cluster The average link distance between them is a dimensionless value, and its range is [value missing]. The smaller the value, the more similar the two clusters are; For the first Each cluster is a subset of the vertices; For the first Each cluster is a subset of the vertices; For clusters The number of vertices contained therein is a dimensionless positive integer; For clusters The number of vertices contained therein is a dimensionless positive integer; After applying the causal cone constraint, the vertex With vertex The edge weights between them, i.e., the coupling fingerprint similarity, are dimensionless values; if and There is no edge between them, that is ,but ; For clusters A vertex in; For clusters A vertex in; It needs to be explained that the inter-cluster distance is equal to 1 minus the average weight of all vertex pairs between the two clusters. When the weight of all vertex pairs in the two clusters is close to 1, that is, they are highly similar, and the inter-cluster distance is close to 0. When all the weights are close to 0, that is, they are completely dissimilar, and the inter-cluster distance is close to 1. By subtracting the average similarity from 1, the similarity is converted into a distance, so that the smaller the distance value, the more similar they are, which meets the requirements of the clustering algorithm for distance measurement.

[0050] During iterative merging, perform the following operations in each iteration: Calculate the current cluster set Distance between all cluster pairs ; Find the cluster pair with the smallest distance : ; Determine if the minimum inter-cluster distance is lower than the merge threshold. : like Then and Merge into a new cluster Update cluster set Then proceed to the next iteration; like If the iteration stops, the current cluster set is the final clustering result.

[0051] In this embodiment, the merging threshold That is, when the average link distance between two clusters is less than 0.3, the corresponding average coupling fingerprint similarity is greater than 0.7, and the two clusters are determined to belong to the same terminal, and merging is performed.

[0052] After the iteration is complete, the final ontology cluster set is obtained. In the formula, The final number of clusters, i.e., the estimated number of physical terminals in the global network; each ontology cluster It includes all observed events belonging to the same physical terminal: In the formula, For the first The number of observation events contained in each ontology cluster; When implementing visualization mapping of ontology clusters to eliminate topological phantoms, for each ontology cluster... In topology visualization, only one node is rendered, namely the ontology node. The position of this node is the weighted centroid of the physical locations of all observed events within the cluster. In the formula, For the first The rendering position coordinates of each ontology cluster in topology visualization are given as three-dimensional vectors in meters. For the first The number of observation events contained in each ontology cluster is a dimensionless positive integer; For the first In the _th ontology cluster, the _th The time decay weight of each observed event is a dimensionless value. For the first In the _th ontology cluster, the _th The physical location coordinates of each observed event are given as a three-dimensional vector, with units of meters. An index for observed events within a cluster. ; Time decay weight The calculation formula is In the formula, For the first In the _th ontology cluster, the _th The time decay weight for each observed event is a dimensionless value, ranging from [value missing]. More recent observed events have greater weight; The time decay coefficient is taken as in this embodiment. That is, the time constant of 1 hour; This is the current system timestamp; For the first In the _th ontology cluster, the _th The timestamp of each observed event; It should be explained that by using the exponential decay function, more weight is given to recent observed events, so that the rendering position of the ontology node tends to reflect the terminal's most recent position rather than the average of all historical positions. This is especially important for mobile devices. When a laptop moves from building A to building B, its ontology node should gradually shift towards building B, rather than staying in the middle position between building A and building B.

[0053] Through the above processing, multiple observation events generated by the same physical terminal in different network areas are merged into a single ontology node, fundamentally eliminating the topological phantom phenomenon.

[0054] When detecting a broken attack attribution chain, the input is a set of ontology clusters. The alarm event sequence generated by the Safety Information and Event Management (SIEM) system is output as a set of fracture location identifiers. Each fracture location is marked. The locations in the traceability chain that need to be stitched together are marked, specifically: When constructing the initial attack attribution chain, extract data from the SIEM system during the observation period. Within this chain, all security alerts related to the same attack campaign are arranged chronologically to form the initial attack attribution chain: In the formula, This is the initial attack attribution chain, an ordered sequence of events; For the first in the traceability chain A security alert event, ; It is the total number of security alerts related to this attack campaign, a dimensionless positive integer; each security alert event Includes: Alarm timestamp Source IP address Destination IP address Alarm Types Severity level .

[0055] When mapping alarm events to ontology clusters, for each security alarm event in the tracing chain... Based on its source IP address In the ontology cluster set In the process, the ontology cluster containing the observed event corresponding to the IP address is located by traversing all ontology clusters. ,like There exists a certain observed event. IP address equal ,and The smallest, then Mapping to ontology cluster , recorded as ; After mapping, the source chain is transformed into an ontology cluster sequence: ; For two adjacent alarm events in the traceability chain and Calculate the time interval: In the formula, For the first in the traceability chain The and the first The time interval between alarm events; For the first The alarm timestamp for each alarm event; For the first The alarm timestamp for each alarm event; Set the upper limit threshold for normal session duration In this embodiment, we take Seconds, or 5 minutes, when At that time, the traceability chain was determined to be in the first stage. The and the first A break occurs between alarm events, generating a break location identifier: In the formula, For the first Each fracture location is marked. ; This is the index of the fracture location in the traceability chain, indicating that the fracture occurred at the [number]th [element / location]. The and the first Between individual alarm events; This is an alarm event preceding the fracture location; This is a subsequent alarm event following the fracture location; The time interval at the fracture location, in seconds; is the total number of break locations detected in the traceability chain, which is a dimensionless non-negative integer; All fracture location markers are aggregated into a fracture location marker set. ; When calculating the spatiotemporal intersection of causal cones and searching for hidden intermediate observations, the input is a set of fault location identifiers and a set of observation events, and the output is a set of hidden intermediate observations corresponding to each fault location. Specifically: For fracture location marking Get preceding alarm events Mapped onto the ontology cluster Get the rendering location of the ontology cluster. As a spatial reference point for preceding events, the timestamp of the preceding alarm event is taken. As a time reference point for preceding events; Preceding events Causal future cone Defined as In the formula, Preceding events The causal future cone is a four-dimensional spacetime region, namely three-dimensional space and one-dimensional time, representing the causal future cone from... Depart at a speed not exceeding the maximum speed. The set of all reachable points in spacetime; Let be the spatial coordinates of any point in spacetime within the causal future cone, which is a three-dimensional vector in meters. For any spacetime point within the causal future cone; The rendering position coordinates of the ontology cluster to which the preceding event is mapped are given by a 3D vector. The preset maximum moving speed limit of the terminal is taken in this embodiment. ; For preceding alarm events Alarm timestamp; Spatial coordinates Euclidean distance between the reference position of the preceding event and the reference position; It needs to be explained that the causal future cone is a... As vertices, with A four-dimensional cone with a half-cone angle; any spacetime point within the cone. Indicates: A terminal in Time is located , not exceeding Moving at a speed, in Time can arrive Location; Similarly, obtain subsequent alarm events. Mapped onto the ontology cluster Get the rendering location of the ontology cluster. As a spatial reference point for subsequent events, the timestamp of the subsequent alarm event is taken. , serving as a time reference point for subsequent events.

[0056] Subsequent events causal past cone Defined as: In the formula, For subsequent events The causal past cone, representing a four-dimensional spacetime region, indicates that in Time arrives The terminal is the set of all spacetime points that it may have passed through in the previous moments; Let be the spatial coordinates of any point in spacetime within the causal past cone, and be a three-dimensional vector. The rendering position coordinates of the ontology cluster to which the subsequent event is mapped are given by a three-dimensional vector. This is the preset maximum moving speed limit for the terminal; For subsequent alarm events Alarm timestamp; Spatial coordinates Euclidean distance between the reference position of the subsequent event and the reference position; It needs to be explained that the causal past cone is a... A four-dimensional cone with vertex at the top, unfolding in the direction of past time, where any spacetime point within the cone... This means: If a terminal is in Time is located Then in time, It may be located Position, provided that its movement speed does not exceed ; Calculate the causal future cone of preceding events Causal past cone with subsequent events The spatiotemporal intersection region: ;Right now: In the formula, For the first The spatiotemporal intersection region of the causal cones corresponding to each fracture location is a four-dimensional spatiotemporal region, representing the set of all spatiotemporal points that simultaneously satisfy the two causal constraints of being reachable from the preceding event and being reachable from the subsequent event. Let be the spatial coordinates of any point in spacetime within the intersection region, and be a three-dimensional vector. It needs to be explained that the spatiotemporal intersection region Each spacetime point in All satisfy the following causal consistency condition: a terminal in From time to time Departure, with no more than Moving at high speed, can Time arrives Position, then continue in no more than Moving at a speed, in Time arrives ;therefore, It is the only region in space and time where implicit intermediate observations may exist. like If the set is empty, meaning the two causal cones have no intersection, then it means that even at maximum speed... Mobile devices and terminals cannot operate in time gaps. Within the sequence, from the position of the preceding event to the position of the subsequent event, the fracture is determined to be an unsuturing fracture, marked as a permanent fracture, and an alarm is generated. When searching for hidden intermediate observations within the spatiotemporal intersection region, search for observation events in the set of observation events that satisfy all of the following conditions. Add it to the first The implicit intermediate observation set corresponding to each fracture location : Condition 1 (Spatiotemporal Constraint): Observed Event spacetime coordinates Falling into the spacetime intersection region Within, that is: ,and ,and ; Condition 2 (Identity Constraint): Observation Event Equipment body anchor point marking In the ontology cluster corresponding to either the preceding or following event, the Hamming distance of the anchor point identifier for any observed event is less than a preset Hamming distance threshold. ,Right now: ; Condition 3 (Non-Phantom Constraint): Observed Events Vertices not marked as phantom edges; All observations that simultaneously satisfy the above three conditions are sorted in ascending order of timestamps to obtain the implicit intermediate observation set: ;in, For the first The number of hidden intermediate observations found at each fracture location. For the first One implicit intermediate observation, arranged in ascending chronological order; When stitching the attribution chain, the input is the set of fracture location identifiers and the set of hidden intermediate observations corresponding to each fracture location, and the output is the stitched complete attack attribution chain. This output is the final output, which will be passed to subsequent steps for visualization rendering and confidence potential calculation. Specifically: During the suturing procedure, each tear location is marked. The corresponding implicit intermediate observation set The observed events are inserted into the initial attack attribution chain in chronological order. middle and Between them, the stitched traceability chain fragment is as follows: ; After performing suturing operations on all fracture sites, the complete attack attribution chain is obtained after suturing: In the formula, This represents the total number of events in the traceability chain after stitching. In the stitched source chain, adjacent event pairs formed by the insertion of implicit intermediate observations are marked as inferred causal edges during visualization rendering, distinguishing them from the original solid causal edges. The specific marking rules are as follows: If two adjacent events are both original alarm events, that is, both originate from... The causal edge labeling between them is a solid line causal edge, with the attribute... ; If at least one of two adjacent events is a hidden intermediate observation, i.e., from... Then the causal edges between them are labeled as inferred causal edges, with the attribute... ; When dealing with unsutureable fractures, for fractures determined to be unsutureable, i.e. For the breakpoint of the empty set, retain the breakpoint marker in the stitched source chain and set its attributes. And insert a virtual placeholder node at that position. Its attributes are: ; This virtual placeholder node is displayed in a special style in the existing visualization rendering, such as a red dashed outline, to alert maintenance personnel that there is a traceable break at this location that cannot be automatically patched.

[0057] It should be noted that by constructing the observation merge graph and hierarchical agglomerative clustering, multiple observation events generated by the same physical terminal in different network regions, different IP addresses, and different time points are merged into a single ontology cluster, eliminating the topology phantom phenomenon at the topology visualization level. At the same time, through causal cone spatiotemporal intersection analysis, hidden intermediate observation events are searched and inserted into the gaps in the attack tracing chain, restoring the attack causal path that was broken due to dynamic IP changes, short-term container destruction, or brief device offline.

[0058] Traditional hierarchical topology visualization relies on periodic scanning to build associations. When the same terminal appears in two geographical areas within a short period, two nodes appear on the visualization, creating a topological phantom. This can lead to operations personnel isolating the wrong target. In this embodiment, causal cone constraints (based on physical impossibility) and hierarchical agglomerative clustering (based on coupled fingerprint similarity) are used to merge multiple observation events of the same terminal into a single ontology node, fundamentally eliminating topological phantoms and preventing operations personnel from performing incorrect isolation operations due to false nodes. In traditional solutions, when attackers use dynamic IPs and short-lived key allocations for lateral movement, the attack path appears on the visualization graph. This approach avoids the common pitfalls of traditional methods that rely on causal future cones and causal past cones for precise location of hidden intermediate observations. By analyzing the spatiotemporal intersection of these cones, the unique spatiotemporal region where these observations exist is precisely located. Within this region, observations satisfying identity constraints are searched, enabling automatic stitching of the tracing chain and allowing maintenance personnel to reconstruct the complete attack path. Unlike traditional merging methods based on statistical correlation, the introduction of causal cone constraints, based on the principle of causality in special relativity, provides clear physical interpretability. When two observations are determined to be phantom edges by the causal cone constraint, maintenance personnel can intuitively understand the cause, enhancing the system's credibility and interpretability.

[0059] In the several embodiments provided by this invention, it should be understood that the disclosed system can be implemented in other ways. For example, the embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0060] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0061] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module described above can be implemented in hardware or in the form of hardware plus software functional modules.

[0062] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the essential characteristics of the present invention.

[0063] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A hierarchical, visualized, full-domain intelligent control system for terminals, characterized in that, include: Multi-dimensional data acquisition, processing, and identifier generation module: Collects the TCP timestamp option field of all terminals, extracts the clock increment frequency and clock drift rate of each terminal, and simultaneously collects the TLS session ticket multiplexing interval sequence and ARP / NDP response timing jitter sequence of the terminal. It calculates the mutual information coupling coefficient between the clock drift rate and the TLS session ticket multiplexing interval sequence, as well as the mutual information coupling coefficient between the clock drift rate and the ARP / NDP response timing jitter sequence. The two mutual information coupling coefficients are weighted and fused with the corresponding clock increment frequency to generate a cross-network invariant device body anchor identifier. The observation merging graph and source chain construction optimization module: Based on the generated device ontology anchor point identifiers, an observation merging graph is constructed with each terminal observation event as a vertex. The similarity of the coupling fingerprint between the device ontology anchor points corresponding to two observation events is used as the edge weight. A causal cone constraint is applied to the observation merging graph, and hierarchical agglomerative clustering is performed to merge multiple observation events belonging to the same terminal into a single ontology cluster, eliminating topological phantoms. When a time gap is detected between adjacent events in the attack source chain, the spatiotemporal intersection region of the causal future cone of the preceding event and the causal past cone of the following event is calculated. Within the spatiotemporal intersection region, a hidden intermediate observation that satisfies the device ontology anchor point identifier matching condition is searched. The searched hidden intermediate observation is inserted into the source chain to complete the stitching.

2. The hierarchical, visualized, full-domain terminal intelligent control system according to claim 1, characterized in that, When performing linear regression fitting to calculate the clock increment frequency and clock drift rate, the arrival time series is used as the independent variable and the corrected TSval series is used as the dependent variable. Least squares linear regression fitting is performed, and the slope and intercept of the linear regression are solved by the least squares method. Based on the slope and intercept of the solved linear regression, the regression residual for each data point is calculated, and the clock drift rate is calculated based on the regression residual for each data point.

3. The hierarchical, visualized, full-domain intelligent control system for terminals according to claim 2, characterized in that, When calculating the ideal response interval, the time interval between two adjacent ARP / NDP response messages is considered as an observation sample; when calculating the timing jitter sequence, the mean of all adjacent time intervals is calculated as an estimate of the ideal response interval; and the deviation of each time interval from the mean is calculated to obtain the ARP / NDP response timing jitter sequence.

4. The hierarchical, visualized, full-domain terminal intelligent control system according to claim 3, characterized in that, First coupling coefficient Characterizing the clock drift rate sequence With TLS multiplexing interval resampling sequence The statistical dependence between them is calculated using the following formula: In the formula, The first coupling coefficient; The mutual information value between sequence X and sequence Y; The number of bins during discretization; For sequence X to fall into the first The bins are bins, and sequence Y falls into the bin. The joint probability of the bins, with values ​​ranging from 1 to 2. ; For sequence X to fall into the first The marginal probability of each bin; For sequence Y to fall into the first The marginal probability of each bin; For the binning index of sequence X, ; For the binning index of sequence Y, .

5. The hierarchical, visualized, full-domain terminal intelligent control system according to claim 4, characterized in that, Second coupling coefficient The statistical dependence between the clock drift rate sequence X and the ARP / NDP jitter resampling sequence Z is represented by the following formula: In the formula, This is the second coupling coefficient; The mutual information value between sequence X and sequence Z; For sequence X to fall into the first The bins are bins, and sequence Z falls into the bin. The joint probability of each sub-bin; For sequence X to fall into the first The marginal probability of each bin; For sequence Z to fall into the first The marginal probability of each bin; For the binning index of sequence Z, .

6. The hierarchical, visualized, full-domain terminal intelligent control system according to claim 5, characterized in that, When implementing locality-sensitive hashing to generate anchor identifiers, the three-dimensional feature vector will be used. It is mapped to a 128-bit device body anchor identifier through locality-sensitive hashing. ; These are the normalized first coupling coefficient, second coupling coefficient, and clock increment frequency, respectively.

7. The hierarchical, visualized, full-domain terminal intelligent control system according to claim 6, characterized in that, When calculating the coupling fingerprint similarity as edge weight, for each candidate edge in the candidate edge set, its edge weight is calculated. The edge weight is defined as the cosine similarity between the three-dimensional feature vectors corresponding to two observation events. All edges with edge weights greater than zero in the candidate edge set are added to the edge set, and the corresponding edge weights are added to the weight set to obtain the weighted observation merge graph.

8. The hierarchical, visualized, full-domain terminal intelligent control system according to claim 7, characterized in that, When calculating the lower bound of signal propagation delay, for each edge in the weighted observation merge graph, calculate the Euclidean distance between the physical locations of the two observed events and calculate the lower bound of signal propagation delay. For each edge, calculate the absolute time difference between two observed events. If the absolute time difference is less than the lower bound of the signal propagation delay, the edge is determined to be a phantom edge.

9. A hierarchical, visualized, full-domain terminal intelligent control system according to claim 8, characterized in that, Construct an initial attack attribution chain, map alert events to ontology clusters, and for the first attack in the attribution chain... The and the first For two alarm events, calculate their time interval. If the time interval is greater than the set upper limit threshold for the duration of a normal session, determine that the tracing chain is between the first and second alarm events. A break occurs between alarm events, generating a break location identifier; When calculating the spatiotemporal intersection of causal cones and searching for hidden intermediate observations, the input is a set of fracture location identifiers and a set of observation events, and the output is a set of hidden intermediate observations corresponding to each fracture location.

10. A hierarchical, visualized, full-domain intelligent control system for terminals according to claim 9, characterized in that, Search the set of observed events for all preset conditions and sort them in ascending order by timestamp to obtain the implicit intermediate observation set. When performing the stitching operation, for each break position identifier, insert the corresponding observed events in the implicit intermediate observation set into the initial attack tracing chain in chronological order. After performing the stitching operation on all break positions, the stitched complete attack tracing chain is obtained.

Images