Dynamic network security risk assessment method, device, equipment, medium and product

Abstract

The application relates to the technical field of cyberspace security, and discloses a dynamic network security risk assessment method, device, equipment, medium and product.The method comprises the following steps: acquiring a dynamic security knowledge graph of a target network environment, wherein the dynamic security knowledge graph is used for representing the network security state of the target network environment; inputting the dynamic security knowledge graph as an initial environment state into a pre-constructed attack intelligent agent, so that the attack intelligent agent performs attack behavior simulation and obtains an attack path set; inputting the attack path set and the dynamic security knowledge graph into a pre-constructed defense intelligent agent, so that the defense intelligent agent generates a target defense strategy; issuing the target defense strategy and the attack path set to a pre-constructed network environment digital twin model, driving the network environment digital twin model to carry out multi-round attack-defense confrontation deduction, and obtaining a deduction result; and performing risk assessment on the target network based on the deduction result, and obtaining a risk assessment result of the target network.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to dynamic network security risk assessment methods, devices, equipment, media, and products. Background Technology

[0002] As cyber threats evolve, potential vulnerabilities and intrusion risks continue to threaten internal network operations. Conducting cybersecurity risk assessments quantifies system vulnerabilities and supports the development of protection solutions, making it an essential task for network operations and maintenance. Among related technologies, cybersecurity assessments are mainly divided into three categories: static assessments rely on rule feature comparisons, attack frequency statistics, and threat intelligence databases to determine threat levels, or combine asset value and vulnerability scanning to weighted risk calculations; automated assessments rely on statistical indicators to calculate anomalies, and even when integrated with large-scale intelligent models, assessment tasks are still linearly broken down and executed sequentially; scenario correlation analysis uses the ATT&CK framework to integrate logs and traffic data to identify attack behaviors. All of these technologies fall under the category of post-incident detection. Security risks are essentially the probability of the system's disordered entropy increase, which not only exhibits significant lag and requires continuous manual maintenance of the rule base, but also struggles to cope with zero-day vulnerabilities and complex, unknown attacks, and cannot predict the probability of system compromise before an attack takes shape. Therefore, the foresight and accuracy of risk assessments are insufficient. Summary of the Invention

[0003] This invention provides a dynamic network security risk assessment method, apparatus, equipment, medium, and product to address the problems of post-event network security assessment in related technologies, such as significant lag, the need for continuous manual maintenance of the rule base, difficulty in dealing with zero-day vulnerabilities and complex unknown attacks, inability to predict the probability of system failure before an attack takes shape, and insufficient foresight and accuracy of risk assessment.

[0004] In a first aspect, the present invention provides a dynamic network security risk assessment method, comprising: acquiring a dynamic security knowledge graph of a target network environment, wherein the dynamic security knowledge graph is used to characterize the network security status of the target network environment; inputting the dynamic security knowledge graph as an initial environment state into a pre-constructed attack agent, so that the attack agent simulates attack behavior to obtain an attack path set; inputting the attack path set and the dynamic security knowledge graph into a pre-constructed defense agent, so that the defense agent generates a target defense strategy; distributing the target defense strategy and the attack path set to a pre-constructed network environment digital twin model, driving the network environment digital twin model to conduct multiple rounds of attack and defense confrontation simulations to obtain simulation results; and performing a risk assessment on the target network based on the simulation results to obtain a risk assessment result for the target network.

[0005] The dynamic network security risk assessment method provided by this invention comprehensively depicts the real-time security situation of the target network based on a dynamic security knowledge graph. This serves as the initial foundation for attack and defense simulations. An attack agent autonomously simulates attacker intrusion intentions and various attack behaviors, generating a complete set of attack paths. A defense agent then adapts and generates corresponding targeted defense strategies. Subsequently, the content from both sides is imported into a digital twin model of the network environment to conduct multiple rounds of dynamic attack and defense simulations, fully recreating the real network attack and defense game process. Finally, the overall network risk is quantitatively assessed based on the simulation output. This method overcomes the limitations of traditional technologies' delayed detection, eliminates the need for long-term manual maintenance and rule updates, effectively adapts to unknown attack scenarios such as zero-day vulnerabilities and complex logic vulnerabilities, and can predict the probability of network system compromise before actual intrusion occurs. Through dynamic game simulations, it accurately captures the system's tendency towards disorder, significantly improving the foresight and computational accuracy of network security risk assessments. The protection schemes developed based on the simulation results are more aligned with real-world network operating scenarios, effectively enhancing the overall network security defense performance.

[0006] In one optional implementation, the simulation results include full-process attack-defense game simulation data and actual physical evidence of network hardware. The full-process attack-defense game simulation data includes intrusion path assumptions, hardware physical operating characteristics, the proportion of controlled assets owned by multiple users, and executed attack paths. The step of conducting a risk assessment of the target network based on the simulation results to obtain the assessment result of the target network includes: determining the basic risk parameters of each network asset node in the target network based on intrusion path assumptions, hardware physical operating characteristics, and actual physical evidence of network hardware; the basic risk parameters are used to characterize the probability that the network asset node is compromised by the attacker; determining the permission distribution entropy of the target network based on the proportion of controlled assets owned by each user; determining the intent convergence probability based on the executed attack paths and the optimal set of penetration paths to the core asset node; determining the dynamic risk index based on the basic risk parameters, permission distribution entropy, and intent convergence probability of each network node; and determining the risk assessment result of the target network based on the dynamic risk index.

[0007] The method provided by this optional implementation incorporates physical hardware test evidence and complete game data into the attack and defense simulation results. By comparing the intrusion path assumptions, the simulated hardware operating characteristics, and the actual hardware test evidence, it calibrates the basic attack probability of each asset node. Based on the proportion of controlled assets, it calculates the permission distribution entropy to quantify the disorder of the system. Combining the actual attack path and the optimal penetration path, it calculates the convergence probability of the attacker's intention. Finally, it generates a dynamic risk index by integrating three types of parameters to complete the overall assessment. This method not only uses physical test data to correct the deviations caused by pure simulation, which is in line with the entropy evolution law of the nature of risk, but also quantifies the probability of attackers penetrating towards core assets. It avoids the drawbacks of traditional assessment methods that have single parameters and are divorced from the actual operating state of hardware. This makes network risk measurement more in line with real attack and defense scenarios, and the risk assessment results are more objective and accurate, and can dynamically reflect the changing trend of the overall network security situation.

[0008] In one optional implementation, the step of obtaining a dynamic security knowledge graph of the target network environment includes: obtaining raw data streams of multiple asset nodes to be monitored, wherein the raw data streams are used to characterize the multi-dimensional security operation status of the asset nodes to be monitored and the network environment; performing semantic alignment and entity extraction processing on the raw data streams of each asset node to be monitored to construct a dynamic security knowledge graph.

[0009] The method provided by this optional implementation collects multi-dimensional raw operational data streams from all network asset nodes and constructs a dynamic security knowledge graph through semantic alignment and entity extraction processing. This method can completely and uniformly integrate various heterogeneous security data of the network, resolve the information fragmentation problem caused by different formats of operational data from different devices and types, accurately extract network entities, relationships, and real-time security status, and continuously map the overall security picture of the network. This provides a unified, complete, and real-time updated initial environment foundation for subsequent attack and defense intelligent agent simulation and digital twin inference, ensuring that subsequent attack and defense inferences are consistent with the actual operation of the network, and improving the authenticity and consistency of the overall risk assessment from the source.

[0010] In one optional implementation, the raw data streams of each monitored asset node are semantically aligned and entity extracted to construct a dynamic security knowledge graph. This includes: performing semantic parsing and entity extraction on the raw data streams to obtain a set of entity and action triples; filtering out corresponding abnormal external events and process creation events within each sliding window based on a preset sliding window; within the current sliding window, when the abnormal external event and the process creation event belong to the same monitored asset node, and the time difference between the abnormal external event and the process creation event is less than a preset threshold, determining the abnormal external event and the process creation event as a related event pair; when the abnormal external event and the process creation event belong to different monitored asset nodes, and / or the time difference between them is not less than a preset threshold, determining the abnormal external event and the process creation event within the current sliding window as independent events; and assigning each related event pair to a specific event pair. The process event host is abstracted as the target subject, and the target assets pointed to by the abnormal external events in the corresponding related event pairs are abstracted as target objects. The actions in each related event pair are semantically normalized to obtain the associated actions of the related event pair. The associated actions of each related event pair are matched with the pre-built threat tactical knowledge base to obtain the technical and tactical tags of the corresponding related event pair. Based on the technical and tactical tags of each related event pair and the initial value of the corresponding target object, the business impact attribute of the corresponding target object is determined. The target subject, target object, associated actions, technical and tactical tags, and business impact attributes of each related event pair are concatenated to obtain the multi-dimensional semantic tuple of the corresponding related event. The multi-dimensional semantic tuple and independent events are written into the pre-built underlying knowledge graph, and the risk entropy value of the related nodes is updated to obtain a dynamic security knowledge graph. The underlying knowledge graph contains the relationship between different monitored asset nodes.

[0011] The method provided by this optional implementation method is based on sliding window segmentation of time-series data. It distinguishes related events from independent events according to time conditions and their respective hosts, completes subject-object segmentation and verb semantic normalization, matches threat tactical tags, and combines asset value to define business impact attributes. It generates standardized multi-dimensional semantic tuples and loads them into the underlying graph, synchronously updating node risk entropy values ​​to form a dynamic security knowledge graph. This method can effectively sort out the inherent relationships of time-series security events, distinguish between event coupling relationships and isolated abnormal behaviors, unify the semantic specifications of various log data, assign security attributes to events based on the technical and tactical system, take into account the impact of network business value, and quantify the disordered evolution of the network with risk entropy values. It solves the problems of messy and scattered original network log data, ambiguous time-series relationships, and difficulty in labeling security attributes. It allows the knowledge graph to iteratively update the network security status in real time, providing a network environment foundation with coherent time sequence, clear relationships, and security weights for subsequent attack and defense simulations, further improving the realism and accuracy of subsequent attack and defense confrontation simulations and risk assessments.

[0012] In one optional implementation, the attacking agent simulates attack behavior to obtain an attack path set through the following steps: extracting an attack primitive set from a built-in adversarial tactical knowledge base; filtering the attack primitive set based on a dynamic security knowledge graph to obtain an effective action space; using the dynamic security knowledge graph as the initial environment state and the effective action space as the action space, inputting it into a pre-built reinforcement learning policy network so that the reinforcement learning policy network outputs an initial attack path set; and inputting the initial attack path set into a pre-built network environment digital twin sandbox model for nonlinear path planning so that the network environment digital twin sandbox model outputs an attack path set.

[0013] The method provided in this optional implementation involves the attacking agent first retrieving attack primitives from an adversarial tactical knowledge base, then combining this with a dynamic security knowledge graph to filter effective attack actions adapted to the current network environment, eliminating invalid attack behaviors that are detached from the actual network environment, and reducing redundant computational overhead. Based on the graph situation, an initial attack path is generated using a reinforcement learning policy network, and then nonlinear path optimization planning is completed through a digital twin sandbox, ultimately outputting a complete set of attack paths. This mode abandons fixed linear attack presets, aligning with the flexible and ever-changing penetration strategies of attackers. Reinforcement learning can autonomously iterate and optimize intrusion strategies, and the digital twin sandbox can recreate complex network interaction scenarios, improve multi-branch penetration links, and generate attack paths that are more closely aligned with real intrusion logic. This avoids the shortcomings of one-sided and rigid preset attack scenarios and provides comprehensive and realistic intrusion samples for subsequent attack and defense simulations, effectively improving the completeness and realism of risk simulations.

[0014] In one optional implementation, the defensive agent generates a target defense strategy through the following steps: mapping multiple attack paths from the attack path set onto a dynamic security graph to obtain a target graph; inputting the target graph into a pre-built graph neural network for feature extraction, so that the graph neural network outputs a graph feature vector; calculating the intent pointing probability corresponding to different core nodes in the target network based on the graph feature vector; determining the core target node to which the attack chain ultimately points based on the intent pointing probabilities corresponding to multiple core nodes; extracting corresponding defense action rules from a pre-built defense action knowledge base and an enterprise compliance database based on the attack tactical information contained in the attack path set to obtain an initial defense strategy set; performing multi-objective optimization on multiple defense action sets in the initial defense action set using a preset genetic algorithm to obtain a defense strategy set that satisfies the attack-defense Nash equilibrium; inputting the defense strategy set and the attack path set into a pre-built network environment digital twin model to drive the network environment digital twin model to conduct multiple rounds of attack-defense confrontation exercises to obtain the feasibility score of each defense strategy in the defense strategy set; and determining the target defense strategy based on the feasibility score of each defense strategy.

[0015] The method provided in this optional implementation involves a defensive intelligent agent mapping various attack paths to a dynamic security knowledge graph to form a target graph. By leveraging graph neural networks to deeply mine network topology and security features, it calculates the probability of attacker intent targeting each core node, accurately pinpointing the core assets the attacker intends to compromise. Subsequently, it combines attack tactics with a defense knowledge base and compliance database to generate an initial defense strategy. A genetic algorithm then optimizes this strategy through multi-objective optimization to find a strategy approaching an attack-defense Nash equilibrium. This strategy is then fed into a digital twin model for multiple rounds of attack-defense drills, and the feasibility of the strategy is evaluated based on the drill results. Finally, the optimal target defense strategy is selected. This approach fully leverages the graph structure to mine network correlation features, accurately assesses the core attack intent, and balances network security protection needs with enterprise compliance requirements. It optimizes the balance between the benefits of attack and defense through algorithms, and then verifies and eliminates inefficient defense schemes through virtual scenario practice. This overcomes the shortcomings of traditional defense strategies, such as rigid matching, poor coordination, lack of practical verification, and difficulty in balancing compliance and attack-defense. The generated defense strategy has stronger adaptability and higher feasibility for implementation, and also lays a reliable defense foundation for subsequent rounds of attack-defense simulations.

[0016] Secondly, the present invention provides a dynamic network security risk assessment device. The method includes: acquiring a dynamic security knowledge graph of a target network environment, wherein the dynamic security knowledge graph is used to characterize the network security status of the target network environment; inputting the dynamic security knowledge graph as an initial environment state into a pre-constructed attack agent, so that the attack agent can simulate attack behavior to obtain an attack path set; inputting the attack path set and the dynamic security knowledge graph into a pre-constructed defense agent, so that the defense agent can generate a target defense strategy; distributing the target defense strategy and the attack path set to a pre-constructed network environment digital twin model, driving the network environment digital twin model to conduct multiple rounds of attack and defense confrontation simulations to obtain simulation results; and performing a risk assessment on the target network based on the simulation results to obtain a risk assessment result for the target network.

[0017] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the dynamic network security risk assessment method of the first aspect or any corresponding embodiment described above.

[0018] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the dynamic network security risk assessment method of the first aspect or any corresponding embodiment described above.

[0019] Fifthly, the present invention provides a computer program product, including computer instructions, which are used to cause a computer to execute the dynamic network security risk assessment method described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of an application scenario according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the first process of the dynamic network security risk assessment method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the second process of the dynamic network security risk assessment method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the third process of the dynamic network security risk assessment method according to an embodiment of the present invention; Figure 5 This is a schematic diagram of a multi-agent architecture; Figure 6 This is a schematic diagram of the internal structure of the perception layer; Figure 7 This is a schematic diagram of the internal structure of the deduction layer; Figure 8 This is a schematic diagram of the internal structure of the adjudication layer; Figure 9 This is a structural block diagram of a dynamic network security risk assessment device according to an embodiment of the present invention; Figure 10 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0024] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0025] As an optional application scenario of this invention, considering the specific application environment architecture or specific hardware architecture upon which the execution of the dynamic network security risk assessment method depends, the specific application environment architecture or specific hardware architecture is described here. For example... Figure 1 As shown, the architecture system may include at least one terminal device and at least one server. Figure 1 The system is illustrated in the example, which includes a computer 101, a mobile terminal 102, and a server 103, and the terminal devices such as the computer 101 and the mobile terminal 102 are connected to the server 103 through a network 110.

[0026] Specifically, the terminal device can be a smartphone, tablet, laptop, PDA, desktop computer, game console, smart TV, smart wearable device, in-vehicle terminal, VR (Virtual Reality) device, AR (Augmented Reality) device, etc. Server 103 can be a standalone physical server, a server cluster, a distributed system, or a cloud server providing cloud services. Network 110 can be a wired or wireless network, examples of which include, but are not limited to, the Internet, corporate intranet, local area network, wide area network, mobile communication network, and combinations thereof.

[0027] In related technologies, cybersecurity assessment is mainly divided into three categories: static assessment relies on rule feature comparison, attack frequency statistics, and threat intelligence databases to determine the threat level, or combines asset value and vulnerability scanning to weighted risk calculation; automated assessment relies on statistical indicators to calculate the degree of anomaly, and even when integrated with large-scale intelligent models, the assessment task is still linearly broken down and executed sequentially; scenario correlation analysis uses the ATT&CK framework to integrate logs and traffic data to identify attack behavior. All of these technologies fall under the category of post-incident detection. Security risks are essentially the evolutionary probability of disordered entropy increase in a system. They not only exhibit significant lag and require continuous manual maintenance of the rule base, but also struggle to cope with zero-day vulnerabilities and complex, unknown attacks. Furthermore, they cannot predict the probability of system compromise before an attack takes shape, resulting in insufficient foresight and accuracy in risk assessment.

[0028] In view of this, embodiments of this application provide a dynamic network security risk assessment method, which can be applied to a server to achieve dynamic network security risk assessment. The method provided in this application comprehensively depicts the real-time security situation of the target network based on a dynamic security knowledge graph, using this as the initial basis for attack and defense simulations. It leverages an attack agent to autonomously simulate attacker intrusion intentions and various attack behaviors, generating a complete set of attack paths. A defense agent then adapts and generates corresponding targeted defense strategies. Subsequently, the content from both the attack and defense sides is imported into a digital twin model of the network environment to conduct multiple rounds of dynamic attack and defense simulations, fully recreating the real network attack and defense game process. Finally, based on the simulation output results, an overall quantitative assessment of network risk is completed. This method overcomes the limitations of traditional technologies in detecting outdated data, eliminates the need for long-term manual maintenance and rule updates, and effectively adapts to unknown attack scenarios such as zero-day vulnerabilities and complex logic vulnerabilities. It can predict the probability of network system compromise before an actual intrusion occurs, and accurately capture the evolutionary patterns of the system tending towards disorder through dynamic game theory. This significantly improves the foresight and accuracy of network security risk assessment, and the protection schemes developed based on the risk results obtained from the simulation are more in line with the real network operation scenarios, effectively enhancing the overall network security defense effectiveness.

[0029] According to an embodiment of the present invention, a dynamic network security risk assessment method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] This embodiment provides a dynamic network security risk assessment method, which can be used for the aforementioned server. Figure 2 This is a flowchart of a dynamic network security risk assessment method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain the dynamic security knowledge graph of the target network environment. The dynamic security knowledge graph is used to characterize the network security status of the target network environment.

[0031] For example, the target network environment refers to the network system that requires security risk assessment, including internal network servers, office terminals, routing and switching equipment, business systems, account and permission systems, hardware and software resources, and the overall scenario of network communication links; the dynamic security knowledge graph is a time-series structured knowledge carrier adapted to network security scenarios, with network elements such as terminals, servers, ports, accounts, and processes as entity nodes, and logical relationships such as communication connections, process calls, and permission transfers as edges. Security attributes are reflected in security-related parameters such as vulnerabilities, abnormal behaviors, asset value, risk entropy, and attack tactics tags attached to nodes and relationships.

[0032] Step S202: Input the dynamic security knowledge graph as the initial environment state into the pre-built attack agent so that the attack agent can simulate attack behavior and obtain a set of attack paths.

[0033] For example, in this embodiment of the application, the dynamic security knowledge graph is regarded as the initial network environment parameters at the beginning of the attack and defense simulation and is sent to the pre-built attack intelligence. The attack intelligence relies on the security information such as network topology, asset vulnerabilities, and permission distribution presented by the graph to carry out intrusion behavior simulation and simulation, simulate the entire penetration and intrusion process of the attacker, and finally generate multiple complete intrusion links, which are summarized to form an attack path set.

[0034] Step S203: Input the attack path set and dynamic security knowledge graph into the pre-built defense agent so that the defense agent can generate the target defense strategy.

[0035] For example, in this embodiment of the application, the attack path set and the dynamic security knowledge graph are fed into a pre-built defense agent. The defense agent combines the overall network security situation and various intrusion path information for calculation and analysis, deduces and adapts the protection scheme, and finally outputs the determined target defense strategy.

[0036] Step S204: The target defense strategy and attack path set are sent to the pre-built network environment digital twin model, driving the network environment digital twin model to carry out multiple rounds of attack and defense confrontation simulations to obtain simulation results.

[0037] For example, in this embodiment of the application, the selected target defense strategy and attack path set are input into the constructed network environment digital twin model, which drives the virtual replica network model to repeatedly carry out multi-round attack and defense game simulation calculations, and finally outputs complete attack and defense simulation results.

[0038] Step S205: Based on the simulation results, conduct a risk assessment of the target network to obtain the risk assessment results of the target network.

[0039] For example, in this embodiment of the application, based on the attack and defense simulation data generated by the digital twin model, the overall security risks and intrusion probability of the target network are calculated and evaluated, and finally the overall risk assessment conclusion of the network is output.

[0040] The dynamic network security risk assessment method provided in this embodiment comprehensively depicts the real-time security situation of the target network based on a dynamic security knowledge graph. This serves as the initial foundation for attack and defense simulations. An attack agent autonomously simulates attackers' intrusion intentions and various attack behaviors, generating a complete set of attack paths. A defense agent then adapts and generates corresponding targeted defense strategies. Subsequently, the content from both sides is imported into a digital twin model of the network environment to conduct multiple rounds of dynamic attack and defense simulations, fully recreating the real network attack and defense game process. Finally, based on the simulation output, an overall quantitative assessment of network risk is completed. This method overcomes the limitations of traditional technologies' delayed detection, eliminates the need for long-term manual maintenance and rule base updates, effectively adapts to unknown attack scenarios such as zero-day vulnerabilities and complex logic vulnerabilities, and can predict the probability of network system compromise before actual intrusion occurs. Through dynamic game simulations, it accurately captures the system's tendency towards disorder, significantly improving the foresight and computational accuracy of network security risk assessments. The protection schemes developed based on the risk results obtained from the simulations are more aligned with real network operating scenarios, effectively enhancing the overall network security defense performance.

[0041] This embodiment provides a dynamic network security risk assessment method, which can be used for the aforementioned server. Figure 3 This is a flowchart of a dynamic network security risk assessment method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps: Step S301: Input the dynamic security knowledge graph as the initial environment state into the pre-built attack agent so that the attack agent can simulate attack behavior and obtain a set of attack paths.

[0042] Specifically, step S301 above includes: Step S3011: Obtain the raw data streams of multiple asset nodes to be monitored. The raw data streams are used to characterize the multi-dimensional security operation status of the asset nodes to be monitored and the network environment.

[0043] For example, the asset nodes to be monitored refer to various device nodes under continuous security monitoring, including network hardware and software assets such as office terminals, servers, switches, and business hosts; raw data stream It is acquired in real time through a data-sensing intelligent agent, the raw data stream. This may include, but is not limited to, host logs. Network traffic summary Business system API call records and physical state data (CPU utilization, disk I / O frequency).

[0044] Step S3012: Semantic alignment and entity extraction are performed on the original data streams of each asset node to be monitored to construct a dynamic security knowledge graph.

[0045] In some optional implementations, step S3012 above includes: Step a1: Perform semantic parsing and entity extraction on the original data stream to obtain a set of entity and action triples.

[0046] For example, in this embodiment of the application, the original data stream is... The input is fed into a pre-trained semantic understanding module, which utilizes the natural language processing capabilities of a large language model for semantic parsing, including processing techniques. (Entity Recognition): Identify the action atom, subject (User), asset, and associated port in the original log, specifically: Incremental pre-training of a large language model is performed using a large-scale cybersecurity corpus (including CVE vulnerability databases, security audit logs, and private protocol messages). Instruction fine-tuning (SFT) technology is then used to construct... The high-quality dataset enables the model to accurately identify attack atoms in heterogeneous data; during the inference phase, the perceptual agent employs a Chain-of-Thought (CoT) cue word strategy. Input raw data At this time, the system automatically injects role-qualifying words (such as "senior security analysis expert") and Few-shot examples. For example, for abnormal printer I / O, the prompt word guides the model to not only focus on physical values, but also to combine historical TTPs to analyze whether it meets the logical characteristics of "hidden data leakage".

[0047] Step a2: Based on the preset sliding window, filter out the corresponding abnormal external events and process creation events in each sliding window from the entity and action triple set.

[0048] For example, in this embodiment of the application, the system maintains a sliding time window W=[t [Δt, t], where t is the current real-time observation time of the system, or the timestamp of the latest abnormal event (such as E2) that triggered the correlation analysis engine; it is the baseline probe point of the sliding window; Δt represents the time window span or time backtracking step, which indicates the length of historical time (such as 5 minutes, 1 hour, etc.) that the system needs to trace back to complete the behavior chain; the size of Δt usually depends on the typical interval of attacker penetration and infiltration learned by the large model agent in combination with historical ATT&CK attack cases. Using a pre-defined time interval as the sliding window, data content from the entity and action triplet sets is sequentially extracted. From the data within each window range, two types of security event data are selected and extracted: abnormal external events and process creation events.

[0049] Step a3: Within the current sliding window, when the abnormal external event and the process creation event belong to the same monitored asset node, and the time difference between the abnormal external event and the process creation event is less than a preset threshold, the abnormal external event and the process creation event are identified as a related event pair.

[0050] Step a4: When the abnormal external connection event and the process creation event belong to different monitored asset nodes, and / or the time difference between the two is not less than a preset threshold, the abnormal external connection event and the process creation event in the current sliding window are determined as independent events.

[0051] For example, in this embodiment of the application, for any sliding window from Process creation event E1 and from Abnormal external traffic E2, if ,and , If the synchronization threshold is used, then E1 and E2 are aggregated into a single semantic tuple. Otherwise, E1 and E2 are independent events and do not constitute a combined attack chain. The host ID for the process time. Indicates the source IP of abnormal outbound traffic. Indicates the time when the event occurred.

[0052] The processing logic for independent events is as follows: they are retained independently as "Primary Alerts". E1 and E2 will not be discarded, but will be stored as single, isolated "Primary Alert Information" in the Dynamic Security Knowledge Graph (DSKG). Triggering Single-Point Security Handling: If the threat score or certainty score of E1 or E2 has exceeded its single-point security threshold (e.g., a high level of certainty in a single attack), the system will still issue a single-point blocking command. Data Aging and Periodic Cleanup: As the sliding window W advances, when the timestamps of E1 and E2 exceed the maximum lifespan of all association rules, they will be downgraded to historical background data and periodically cleaned up when the system storage limit is reached.

[0053] Step a5: Abstract the process event host of each associated event pair as the target subject, and abstract the target asset pointed to by the abnormal external event in the corresponding associated event pair as the target object.

[0054] For example, in this embodiment of the application, the large model perception agent fuses and extracts the attributes of E1 and E2. The verified consistent attributes are then processed. and The attack source / victim entity (Actor) is uniformly abstracted in the graph; the overseas IP address pointed to by abnormal external traffic or the file read and written by the process at high frequency is abstracted as the target object (Object).

[0055] Step a6: Perform semantic normalization on the actions in each associated event pair to obtain the associated actions for the associated event pair.

[0056] For example, in this embodiment of the application, the semantic understanding capability and CoT reasoning of the large model agent are used to logically concatenate discrete actions at the physical level across time windows. For instance, the semantic normalization of E1's "unknown abnormal process creation and high CPU usage" and E2's "sending high-strength encrypted traffic to an unknown IP" is determined to be a higher-order related action of "packaging and transmitting sensitive data outwards".

[0057] Step a7: Match the associated actions of each associated event pair with the pre-built threat tactics knowledge base to obtain the technical and tactical tags of the corresponding associated event pair.

[0058] For example, in this embodiment of the application, the normalized Action is matched with a pre-set ATT&CK threat tactics knowledge base to obtain tactical tags for associated event pairs, such as mapping to T1486 data encryption and T1041 data leakage through the C2 channel. Based on the mapping results and the initial value of the asset, the degree of damage to the business system is calculated to form the Impact attribute, i.e., the tactical tag.

[0059] Step a8: Determine the business impact attributes of the corresponding target object based on the technical and tactical tags of each related event pair and the initial asset value of the corresponding target object.

[0060] For example, in this application embodiment, based on the technical and tactical tags of each associated event pair and the initial asset value of the corresponding target object, the two parameters are combined and assigned values ​​to calculate the degree of damage to the business system, forming the Impact attribute, i.e., the business impact attribute.

[0061] Step a9 involves concatenating the target subject, target object, associated actions, technical and tactical tags, and business impact attributes of each associated event pair to obtain the corresponding multidimensional semantic tuple of the associated event.

[0062] For example, in the embodiments of this application, the target subject, target object, associated action, technical and tactical tags, and business impact attributes of each associated event pair are concatenated to formally generate a multidimensional semantic tuple T.

[0063] Step a10 involves writing multidimensional semantic tuples and independent events into a pre-built underlying knowledge graph and updating the risk entropy values ​​of associated nodes to obtain a dynamic security knowledge graph. The underlying knowledge graph contains the relationships between different monitored asset nodes.

[0064] For example, in this embodiment of the application, multidimensional semantic tuples are written into the dynamic security knowledge graph as "high-level alert" events, and the risk entropy values ​​between related nodes are updated, thereby driving the blue team agent to issue global network blocking or isolation policies.

[0065] The method provided in this application generates multi-dimensional semantic tuples based on associated events, eliminating the isolation of a single data source and increasing the confidence level of associating "high CPU usage" with "encrypted traffic" as "ransomware behavior" from 0.3 to 0.85. The extracted semantic features are normalized and mapped to standardized security semantic labels, such as mapping "non-working hours" + "high-frequency reading of printer ports" to "potential asset theft intent," outputting a dynamic security knowledge graph. This graph contains node attributes. Connection relationship and confidence weight The nodes in the graph mainly include attack and defense elements such as system vulnerabilities, device types, configuration items, password policies, and access control. Combining a multi-layered graph design (physical layer, logical layer, intent layer), the nodes in the graph can be further subdivided as follows: Actor Nodes: The source of network or system actions. This includes the user account, process, source host, and external IP address. Object Nodes: Target objects that are accessed or protected. These include core databases, sensitive files, hardware devices (such as printers and servers), network interfaces, etc. Vulnerability / Config Nodes: Security status nodes attached to assets, including system vulnerabilities (CVEs), misconfigured items, weak password flags, and open port status. Higher-order State / Intent Nodes: Virtual nodes generated by large model inference, representing the current risk status of the asset or the attacker's subjective intent, such as "already compromised" or "suspected data packaging".

[0066] Node attributes It will update the vulnerability tag of the victim asset (printer) to open and shared, and the asset value to 4; connection relationship. A directed edge will be generated from the operation account to the printer. The edge type is defined as the standard semantics of the large model output [TA0009 Information Collection / T1074 Data Temporary Storage]; confidence weight. It combines "non-working time triggering (increasing determinism)" and "large model inference probability (such as 0.88)" to assign a high-risk weight calculation value to the connection, thereby driving the downstream blue team agent to directly execute network blocking.

[0067] Step S302 involves inputting the dynamic security knowledge graph as the initial environment state into the pre-built attack agent, enabling the attack agent to simulate attack behavior and obtain a set of attack paths. For details, please refer to [link to relevant documentation]. Figure 2 Step S202 of the illustrated embodiment will not be described again here.

[0068] In some optional implementations, the attacking agent simulates attack behavior to obtain a set of attack paths through the following steps: Step b1: Extract the set of attack primitives from the built-in adversarial tactics and techniques knowledge base.

[0069] Step b2: Filter the set of attack primitives based on the dynamic security knowledge graph to obtain the effective action space.

[0070] Exemplary, in the embodiments of this application, through processing means Extract and process attack primitives. (Knowledge Retrieval RAG) is: The attacking agent retrieves the built-in ATT&CK knowledge base and filters out those related to the current... The set of matching attack primitives, TTPs, is the effective action space.

[0071] Step b3: The dynamic security knowledge graph is used as the initial environment state, and the effective action space is used as the action space. It is input into the pre-constructed reinforcement learning policy network so that the reinforcement learning policy network outputs the initial attack path set.

[0072] Exemplary, in the embodiments of this application, processing means are employed. (Mind Chain Reasoning, CoT) is used to determine the initial set of attack paths. Handling methods. A large model is used to deduce nonlinear penetration paths. If a low-risk vulnerability is detected... The agent deduces the feasibility of using it as a springboard for lateral movement and generates attack paths. .

[0073] Low-risk vulnerabilities The judgment statement is more like a series of inference prompts. For example: Reasoning logic: "Target A has been found to have an HTTP Options Method vulnerability."

[0074] Assessment: Although the vulnerability has a CVSS score of 0, it is classified as extremely low risk.

[0075] Hypothesis: However, the OPTIONS request confirms that the target supports the PUT or DELETE methods. Combined with the low version of WebDAV configuration of target B, it is possible to achieve remote file writing, thereby bypassing the firewall.

[0076] Conclusion: Mark this low-risk vulnerability as a 'critical node in the path'.

[0077] It contains data fields in the following four dimensions: (1) Global attribute data, including Name: the name or general description of the attack path (e.g., "brute force attack leads to device offline"); Kingdom or Tacti: the name of the most serious ATT&CK tactic involved in the attack path, such as "Credential Access"; Priority: the priority / severity estimated based on the attack motive, used for subsequent auxiliary risk assessment; (2) Attack stages and topology sequence, including stage: stage value, which describes the time progression of the attack path, such as stage: 1 port scan -> stage: 2 privilege escalation; From (Src_IP) and To (Dst_IP): characterize the source asset IP and target asset IP involved in each hop attack, used to build lateral movement topology connections in twin networks; (3) Technical actions and physical constraints, including Plugin_sid: a unique number that identifies the sub-rule category, which is mapped to the specific ATT&CK attack technique ID used in this step; Port_from / Port_to / Protocol: the source port, destination port and network protocol that this attack step is expected to use; Occurrence (number of events): the threshold of the number of pre-existing abnormal events required to trigger this attack technique, such as "3 abnormal logins occurred"; Timeout (timeout setting): the theoretical upper limit of the waiting time for executing this stage of the attack action (e.g., 100 seconds, if this time is exceeded, the path is considered to be interrupted).

[0078] (4) Destructive quantitative indicators, including Reliability: the level of damage to the system expected by the attack techniques used in this stage (the higher the value, the greater the damage). This data will be directly transmitted to the adjudication agent to calculate the entropy increase of the system.

[0079] The attacking agent does not employ traditional depth-first search (DFS), but instead uses a heuristic search based on LLM semantic embedding: State space defined as graph nodes V; Inference function: ,in, The cost of the attack already incurred. The semantic leap value evaluated by LLM; logical implementation: LLM identifies attributes of node v, such as "contains administrator backup files", and assigns them even if there is no direct privilege escalation vulnerability. The extremely high weight guides the collective intelligent agents to execute a non-linear path of "acquiring credentials, offline cracking, and cross-domain login".

[0080] The underlying driver of the large model agent relies on a multi-objective reward function (including attack success rate, resource consumption, and stealth). The system transforms the organizational preferences retrieved by RAG into reward adjustment factors. If the current candidate attack atomic action (such as preferring to exploit printer vulnerabilities rather than router vulnerabilities) matches the organization's preference characteristics, a preference bonus is added to the reward function of that action.

[0081] Referring to the logic of weighted calculation using factors (features) and factor contribution (weights) in the security risk level assessment model, the generation weight of the next-hop attack node is modified in the path generation algorithm of the attacking agent. The modification formula can be defined as:

[0082] in, These are the basic action weights learned by the graph neural network under the conventional network behavior model. This represents the feature vector of attack organization behavior retrieved from long-term memory; This is the similarity comparison value between the current action and organizational preferences, calculated using methods such as the cosine of the included angle. This is the preference adjustment coefficient.

[0083] After weight adjustment, the top-level policy network of the attacking agent will be biased with a very high probability in generating attack chains that conform to the style of a specific APT organization when selecting targets and when the bottom-level policy network selects attack atomic actions. Finally, through iterative optimization using deep reinforcement learning algorithms, the optimal attack path with the characteristic attributes of that organization is generated.

[0084] When an attacking agent encounters physical obstruction (such as a firewall's strict ACL policy isolating a network segment) during normal network path deduction, the system automatically triggers the "logical trust deduction mechanism," which includes the following five processing steps: Step 1: Physical Block Perception.

[0085] State observation: In the current network environment digital twin model, the red team agent attempts to penetrate laterally from the compromised terminal (node ​​A) to the target core database (node ​​C) (e.g., scanning specific ports). Blocking confirmation: The twin sandbox provides feedback on physical isolation at the network layer (e.g., the firewall policy completely blocks the connectivity from node A to node C). Action: The red team agent records the physical blockage state and temporarily freezes the regular state transition probability matrix based on "network connectivity" (stopping meaningless exhaustive scanning), and transfers the attention mechanism from the "network layer" to the "application layer and data layer".

[0086] Step 2: Semantic feature extraction.

[0087] Deep information gathering: the underlying policy network of the red team agents; Perform the "Information Gathering (TA0009)" action in the ATT&CK tactic to read local unstructured data in the compromised terminal (Node A), such as text files, browser cache, or memo information on the administrator's desktop; Large-scale model semantic parsing: The extracted unstructured text (such as "memo.txt") is input into the large-scale model Agent. The large-scale model uses natural language understanding capabilities to perform semantic parsing on it, identifying that it contains sensitive configuration data (such as "login credentials and URL of a cross-domain authentication system on the intranet").

[0088] Step 3: Logical Trust Deduction Based on the Chain of Trust (CoT). This is the core of the non-linear transition. Based on the extracted credentials, the large-scale agent uses the Chain of Trust (CoT) to perform multi-step logical deduction: Deduction Step 1 (Attribute Mapping): Identify that the extracted voucher belongs to a high-privilege "valid account (T1078)"; Step 2 of the deduction (dependency analysis): Although node A cannot directly reach node C on the physical network, the large model analysis shows that the security domain where node C is located trusts the cross-domain authentication ticket (SSO Token or VPN credential) of the "valid account". Step 3 of the deduction (leap value assessment): The big model determines that obtaining this credential satisfies the "data dependency" across physical isolation; Therefore, the current node A is given a very high "semantic leap value h(v)" and is determined to be a high-value stepping stone.

[0089] Step 4: Non-linear Path Synthesis.

[0090] The top-level policy network of the red team agent no longer selects "network vulnerability exploitation," but instead chooses the "credential access and cross-domain login" phase. The bottom-level policy network generates specific combinations of non-linear attack atomic actions: Action 1: On node A, use the stolen credentials to initiate a legitimate authentication request to a publicly accessible single sign-on (SSO) system or cross-domain gateway; Action 2: After obtaining a valid authentication token, the administrator can legally access the security domain where the target node C is located at the logical level, thus achieving "stepping stone penetration".

[0091] Step 5: Causal Graph Update and Output.

[0092] The derived "non-linear attack actions" are used as new directed edges in the causal subgraph to update the knowledge graph in the field of network attack and defense. The attack path is then output. In the graph, this path is represented as a dotted directed edge that "crosses physical faults and is connected by semantic trust relationships".

[0093] Step b4: Input the initial attack path set into the pre-built network environment digital twin sandbox model for nonlinear path planning, so that the network environment digital twin sandbox model outputs the attack path set.

[0094] For example, in this embodiment of the application, the attacking agent implements penetration based on the real-time state of the graph; the defending agent dynamically adjusts its deployment strategy or injects deceptive interference nodes (honeypots) based on the red team's intent convergence characteristics (by monitoring the state transition rate of graph nodes). State synchronization update: the result of each round of game action (such as privilege escalation, node compromise) is immediately fed back to the dynamic security knowledge graph, changing the observation benchmark for subsequent games.

[0095] Step S303 involves inputting the attack path set and dynamic security knowledge graph into a pre-built defense agent, enabling the defense agent to generate a target defense strategy. For details, please refer to [link to relevant documentation]. Figure 2 Step S203 of the illustrated embodiment will not be described again here.

[0096] In some alternative implementations, the defensive agent generates a target defense strategy through the following steps: Step c1 involves mapping multiple attack paths from the attack path set onto the dynamic security graph to obtain the target graph.

[0097] For example, in this embodiment of the application, each intrusion and penetration link in the attack path set is matched and labeled to the nodes and connecting edges of the dynamic security knowledge graph, and the intrusion trajectory is superimposed on the original network security graph. After superposition and integration, a target graph with attack trajectory information is generated.

[0098] Step c2 involves inputting the target graph into a pre-constructed graph neural network for feature extraction, so that the graph neural network outputs a graph feature vector.

[0099] For example, in this embodiment of the application, the target graph with the attack path superimposed is fed into a pre-built graph neural network. The network performs deep feature extraction operations on the node information, topological connection relationship, security attributes and other contents in the graph, and finally converts the comprehensive situation information of the entire graph into a standardized graph feature vector for output.

[0100] Step c3: Calculate the intent pointing probability corresponding to different core nodes in the target network based on the graph feature vector.

[0101] For example, in this embodiment of the application, based on the network topology, attack link and security situation information carried by the graph feature vector, the probability value of each core asset node being selected by the attacker as the final intrusion target is calculated by the model calculation, and the probability of the attacker's intent pointing to each core node is obtained.

[0102] Step c4: Determine the core target node that the attack chain ultimately points to based on the intent pointing probabilities corresponding to multiple core nodes.

[0103] For example, in this embodiment of the application, the graph feature vector integrating network topology, attack trajectory and security risk information is input into the calculation module. Based on the attack and defense rules learned by the model, the attack link trend and the association weight of risk nodes along the way are analyzed. The probability of each core asset node being finally locked and compromised by the attacker is calculated, and the probability value of the intent pointing to each core node is quantitatively output.

[0104] Step c5: Based on the attack tactical information contained in the attack path set, extract the corresponding defense action rules from the pre-built defense action knowledge base and the enterprise compliance database to obtain the initial defense strategy set.

[0105] For example, in this embodiment of the application, the defensive intelligent agent simultaneously attaches a defensive action knowledge base (pure security perspective) and an enterprise compliance base (business constraint perspective) to extract information related to the current... It includes defensive action rules (such as blocking IPs, isolating network segments, and limiting speed) that match the attack tactics (TTPs) contained therein.

[0106] Step c6: Use a preset genetic algorithm to perform multi-objective optimization on multiple defensive action sets in the initial defensive action set to obtain a set of defensive strategies that satisfy the Nash equilibrium of offense and defense.

[0107] For example, in the embodiments of this application, the defense agent takes defense effectiveness, resource consumption, false alarm rate and system performance (business continuity) as optimization objectives, and applies a multi-objective optimization algorithm (such as an improved non-dominated sorting genetic algorithm) to calculate the retrieved rules and generate a set of defense strategies that reach Nash equilibrium.

[0108] Step c7 involves inputting the set of defense strategies and the set of attack paths into a pre-built digital twin model of the network environment, driving the digital twin model of the network environment to conduct multiple rounds of attack and defense confrontation exercises, and obtaining the feasibility score of each defense strategy in the set of defense strategies.

[0109] For example, in the embodiments of this application, in the digital twin model of the network environment, multi-round simulated attack and defense simulations are conducted using Generative Adversarial Networks (GANs) or multi-stage defense game models. By monitoring the computing resources, storage space, and business network status of virtual nodes in the twin sandbox, the availability loss caused to business continuity, i.e., the side effect impact, is quantitatively assessed if the blocking / isolation action is executed. If a blocking strategy causes the interruption of core business flows, its feasibility score will be significantly reduced.

[0110] When simulation evaluation reveals that direct "blocking or isolation" has excessive side effects (such as the inability to distinguish between normal business traffic and attack traffic), or to further consume the red team's computing power and capture attack characteristics, the blue team agent will activate a dynamic inducement mechanism. The LLM inference engine, based on... The attack context is analyzed to understand the red team's attack preferences. For example, the attacking agent may favor exploiting specific port services (such as SSH port 22 brute-force attacks or specific web vulnerabilities). The defensive agent dynamically adjusts the deployment and status of defense components based on a scheduling algorithm. Specifically, in In the graph, on the path to the core database On the crucial path, one or more fake asset nodes (honeypots) are dynamically instantiated and synthesized. These fake nodes not only open vulnerability ports preferred by the red team but are also assigned high false value weights. Update The attack traffic of the red team is forcibly routed and redirected to the fake asset node, thereby achieving attack inducement without affecting the continuity of real business.

[0111] In this embodiment of the application, the defensive intelligent agent needs to calculate the Business Impact Index (BII) before executing the strategy:

[0112] in, For the affected service areas, This is the real-time weight for the service. The defensive agent only performs a hard block when Risk > BII.

[0113] When Risk ≤ BII, the system will perform the following specific data processing and defense flow steps: (1) The status is set to "Under Observation" and the alarm is distributed in a tiered manner (monitoring downgrade). According to the risk classification and handling logic in the existing technology, the system will not discard this abnormal data, but will continue to monitor it as a background threat: State change: The blue team agent downgrades the initial handling state of the event from "pending / blocked" and sets it to "under observation".

[0114] Tiered early warning data flow: The system extracts device matching data from high-level alarm information and executes early warnings based on specific risk values: If the risk is determined to be low, only in-system message early warning data is generated and sent to the administrator; if the risk is determined to be medium, both in-system message and email reminder data are generated and sent, without issuing network blocking commands.

[0115] (2) Triggering a “flexible” security strategy and increasing authentication steps (defense downgrade). Because hard blocking affects service coverage ( The blue team's intelligent agent will generate and issue "soft" security handling instructions that will not interrupt network connectivity by invoking the defense knowledge base. Dynamic policy updates: Instead of blocking the user's source IP, application-level restrictions are imposed on suspicious sessions. For example, forcing the current session to reset its password, reducing the frequency of API calls for that account (rate limiting), or dynamically issuing instructions to require the current session to enable multi-factor authentication (MFA). This ensures the business continuity of normal users (if it is a false alarm) while increasing the cost for real attackers to continue their penetration.

[0116] (3) Initiate intent-aware dynamic guidance (data flow redirection). Since the traffic cannot be "cut off," the blue team agent will choose to "transfer" the traffic: seamless redirection: the defensive agent in the dynamic security knowledge graph ( In this process, fake asset nodes (honeypots) are dynamically instantiated and synthesized on the front end of real business nodes.

[0117] Deceptive Data Interaction: This technique utilizes a large model engine to modify underlying routing rules, seamlessly redirecting suspicious network traffic (Risk ≤ BII) to a fake node. Attackers interact with this fake data, allowing the system to capture more detailed attack signatures (TTPs) during the process, while real, high-risk data is intercepted. The business interfaces related to weights are unaffected.

[0118] (4) Driving multi-objective optimization and alternative solution generation (delayed decision optimization). During the period when no hard blocking is performed, the agent is not inactive, but uses this time to find a better solution through algorithms: Multi-objective optimization: The blue team agent takes the current defense effect, resource consumption, false alarm rate and system performance (i.e. business continuity) as optimization objectives and applies multi-objective optimization algorithms (such as the improved non-dominated sorting genetic algorithm) for background calculation; Alternative solutions are in place: the system generates alternative solutions in advance to deal with further escalation of the attack. Simultaneously, the sensing intelligence closely monitors the rate of increase in system state entropy within the next time step Δt. If, due to a lack of blocking, the attacker successfully escalates privileges, causing the new Risk value to surge and exceed the current BII threshold, the system will immediately retrieve the pre-calculated alternative solutions and instantly switch the processing mode from "observation-induced" to "hard blocking."

[0119] Step c8: Determine the target defense strategy based on the feasibility score of each defense strategy.

[0120] For example, in this embodiment of the application, by combining the side effect evaluation results and the decoy deployment status, the defensive intelligent agent performs a quantitative analysis of security and feasibility using methods such as fuzzy comprehensive evaluation, and selects the option that has the least impact on business and can effectively cut off or transfer [the decoy]. The optimal defense strategy.

[0121] Step S304 involves distributing the target defense strategy and attack path set to a pre-built digital twin model of the network environment, driving the model to conduct multiple rounds of attack and defense simulations to obtain the simulation results. For details, please refer to [link to relevant documentation]. Figure 2 Step S204 of the illustrated embodiment will not be described again here.

[0122] Step S305: Based on the simulation results, perform a risk assessment on the target network to obtain the risk assessment results for the target network. For details, please refer to [link to relevant documentation]. Figure 2 Step S205 of the illustrated embodiment will not be described again here.

[0123] This embodiment provides a dynamic network security risk assessment method, which can be used for the aforementioned server. Figure 4 This is a flowchart of a dynamic network security risk assessment method according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps: Step S401: Obtain the dynamic security knowledge graph of the target network environment. The dynamic security knowledge graph is used to characterize the network security status of the target network environment. For details, please refer to [link to relevant documentation]. Figure 3 Step S301 of the illustrated embodiment will not be described again here.

[0124] Step S402 involves inputting the dynamic security knowledge graph as the initial environment state into the pre-built attack agent, enabling the attack agent to simulate attack behavior and obtain a set of attack paths. For details, please refer to [link to relevant documentation]. Figure 3 Step S302 of the illustrated embodiment will not be described again here.

[0125] Step S403 involves inputting the attack path set and dynamic security knowledge graph into a pre-built defense agent, enabling the defense agent to generate a target defense strategy. For details, please refer to [link to relevant documentation]. Figure 3 Step S303 of the illustrated embodiment will not be described again here.

[0126] Step S404: The target defense strategy and attack path set are distributed to the pre-built network environment digital twin model, driving the model to conduct multiple rounds of attack and defense simulations to obtain the simulation results. For details, please refer to... Figure 3 Step S304 of the illustrated embodiment will not be described again here.

[0127] Step S405: Based on the simulation results, conduct a risk assessment of the target network to obtain the risk assessment results of the target network.

[0128] Specifically, the simulation results include data from the entire attack-defense game simulation and physical evidence from network hardware testing. The data from the entire attack-defense game simulation includes intrusion path assumptions, hardware physical operating characteristics, the proportion of controlled assets owned by multiple users, and executed attack paths. Step S405 above includes: Step S4051: Based on the intrusion path hypothesis, hardware physical operation characteristics, and actual physical evidence of network hardware, determine the basic risk parameters of each network asset node in the target network. The basic risk parameters are used to characterize the probability that the network asset node will be compromised by the attacker.

[0129] For example, in this embodiment of the application, the basic risk parameters of each network asset node are calculated by combining the intrusion path hypothesis, hardware operating status data, and real data obtained from actual hardware measurements. These parameters reflect the probability that a node will be compromised by an attacker. Specifically, the intrusion path hypothesis is compared with physical characteristics. If the attacking agent claims to have performed large-scale data encryption (ransomware simulation), but the physical characteristics... If disk I / O is displayed as being within the normal threshold, then the success rate score of that path is lowered by adjusting the correction operator.

[0130] Step S4052: Determine the permission distribution entropy of the target network based on the proportion of controlled assets owned by each user.

[0131] For example, in this embodiment of the application, the change in system permission distribution and configuration consistency before and after the calculation is shown in the following formula:

[0132] in, Represents the entropy of permission distribution. This represents the proportion of controlled assets owned by the i-th user.

[0133] If the attacking agent acquires multiple high-authority accounts through lateral movement during the simulation, resulting in... A rapid decline (i.e., a high concentration of permissions in the hands of attackers) indicates a collapse of system order.

[0134] Step S4053: Determine the intent convergence probability based on the set of optimal penetration paths that have been executed and reached the core asset nodes.

[0135] For example, in this embodiment of the application, the sequence of actions performed by the red team is calculated. With access to core assets Optimal path set Cosine similarity:

[0136] in, This represents the probability of convergence; the meanings of the other variables will not be elaborated further.

[0137] when IPP When the value is greater than 0.8, the system determines that the attacker has moved beyond the random probing phase and entered the targeted penetration phase.

[0138] Step S4054: Determine the dynamic risk index based on the basic risk parameters, permission distribution entropy, and intent convergence probability of each network node.

[0139] For example, in this embodiment of the application, the permission distribution entropy is used. The rate of increase of the system state entropy was calculated. As shown in the following formula:

[0140] in, It represents the rate of change of system security entropy over time, and the rate of increase or decrease of the degree of system security disorder. It intuitively reflects whether the system security situation is continuously deteriorating, tending to stabilize, or gradually converging towards improvement. This represents the total system security entropy at time t; This indicates the time interval and sampling step size, which is the time span between two consecutive data acquisitions to calculate the system's security entropy. Indicates the process The total security entropy of the system at the next sampling time after a certain period of time reflects the new level of security chaos of the system after a period of operation and attack probing.

[0141] It quantifies the "disorder" of the system's security architecture before it is subjected to new attack disturbances. Specifically, S(t) is a mathematical fusion value of the "current exposure distribution range of privileged accounts" and the "specific magnitude of the deviation of the current system configuration from the preset security baseline" collected by the sensing agent at time t. The smaller S(t) is, the more "orderly" and robust the system defense is at this time.

[0142] The changes in the system's state after the attack and defense game are quantified. If, during the Δt period, the red team agent successfully exploits the vulnerability to escalate privileges or steal credentials, resulting in an increase in the number of privileged accounts in the system (increased privilege distribution entropy); or if the red team agent successfully tampers with system settings, causing the actual system configuration to deviate further from the original secure baseline (increased configuration consistency entropy), then... This will increase significantly, indicating that the system is further collapsing into "disorder".

[0143] The dynamic risk index is calculated using the following formula:

[0144] in, This indicates a dynamic risk index. This indicates the success rate of the attacking agent. Indicates the weight of asset importance. Indicates the system's order entropy change weighting coefficient; This represents the growth rate of the entropy of the permission distribution, characterizing the risk of a network-wide chain reaction of collapse caused by horizontal penetration; This represents the weighting adjustment factor.

[0145] This is used to measure the weight of "potential threat intensity (the attacker's subjective intent certainty, IPP)" in the overall risk assessment of the system. In actual AI agent attack and defense game, if the simulation reveals that the target is a well-organized APT (Advanced Persistent Threat) attack, the adjudicator agent can adaptively increase this weighting coefficient λ, making the final risk score more sensitive to the attacker's "subjective malicious intent".

[0146] It is specifically designed to address "defense resilience loss (i.e., the rate of increase of system state entropy)". The sensitivity adjustment weight / penalty coefficient of ")" reflects the defense system's tolerance for "chaos and disordered evolution." If A high setting means the system is extremely sensitive to the failure of defense strategies or a deterioration trend away from the security baseline; even if no actual asset loss has occurred yet. (relatively small), as long as the system is in the process of rapid collapse ( (very large), multiplied by The overall risk will also spike instantly and trigger the highest level of circuit breaker.

[0147] Step S4055: Determine the risk assessment result of the target network based on the dynamic risk index.

[0148] For example, in this embodiment of the application, an assessment report is output based on a dynamic risk index, including risk level, probability distribution of vulnerability, and targeted handling suggestions. Specifically, based on the dynamic risk index, the values ​​are classified into the corresponding risk level ranges according to the pre-defined network risk level judgment standard ranges. Combining the disordered evolution trend of network security and the overall threat level reflected by the real-time changes of the dynamic risk index, a complete and standardized textual and quantitative conclusion is formed, and finally, a risk assessment result of the target network as a whole is generated, clearly reflecting the current risk level, distribution of hidden dangers, and overall security status of the network.

[0149] The dynamic network security risk assessment method provided in this application will be specifically described below through two specific embodiments.

[0150] Example 1: This application provides a dynamic evaluation method based on "red-blue adversarial agents." Its core lies in constructing a virtual game field between an attacking agent (red team) and a defending agent (blue team) instead of relying on static rules, and quantifying risk through the game outcome. The method includes the following steps: S1. Full-element semantic mapping: Utilizing perceptual intelligent agents to automatically extract multi-source heterogeneous data (including traffic packets, system logs, asset configuration tables, etc.), and transforming it into a unified asset state knowledge graph through semantic alignment and entity association. This graph not only includes the physical attributes of assets but also maps the logical trust relationships, permission dependencies, and potential attack paths between assets. S2, Intent-Driven Adversarial Simulation: Constructing a red team agent (simulating an attacker) and a blue team agent (simulating operations personnel) based on a Large Language Model (LLM). On the graph generated in S1, the red team conducts multiple rounds of simulation based on preset or self-generated attack motivations. The LLM is responsible for providing the agent with non-linear thinking logic, enabling it to simulate combined attacks beyond known vulnerability scripts, while the blue team agent executes hardening or inducement strategies in real time according to changes in the graph. S3. Two-dimensional dynamic risk assessment: By combining changes in system state with attacker behavior, a comprehensive dynamic risk score is output, which specifically includes: State entropy increment: Calculates the number of paths through which core assets are compromised and the rate of increase of the entropy of the system state during the game process, which is used to measure the overall defensive collapse of the system. Intent convergence analysis: LLM is used to semantically model the action sequences of the red team agents and calculate their intent pointing probability (IPP) on the knowledge graph. When the red team's behavior shows a rapid focus from "broad probing" to "specific core assets", an intent convergence warning is triggered.

[0151] Example 2: This application provides a multi-agent architecture, such as... Figure 5 As shown, it includes a perception layer, an inference layer, and a decision-making layer.

[0152] The physical perception layer comprises two units: a data processing module and a perception agent. First, the data processing module collects various types of raw operational data from the entire network and performs preprocessing tasks such as cleaning, semantic normalization, and entity extraction. The processed data is then sent to the perception agent. Based on the processed data, the perception agent constructs a dynamic security knowledge graph, which completes a unified depiction of the entire network's network topology, asset status, permission distribution, security vulnerabilities, and other aspects of the network security situation. The complete network environment situation information is then transmitted down to the inference layer.

[0153] The simulation layer sets up two adversarial intelligent agents: a red team agent and a blue team agent. Both receive network security situation data from the perception agent. The red team agent simulates the role of a network attacker, autonomously generating multiple intrusion attack paths and simulating full-process penetration attack behavior based on the current network environment. The blue team agent represents the network defender, analyzing the attack intent of various attack links output by the red team, matching protection rules, and iteratively generating appropriate defense strategies. The red and blue teams continuously conduct virtual attack and defense adversarial games, and uniformly transmit the complete attack and defense adversarial process and adversarial results data down to the adjudication layer.

[0154] The adjudication layer first receives data from the entire attack and defense simulation process of both the red and blue teams. It then comprehensively evaluates the effectiveness of the attack and defense confrontation by combining multiple indicators such as changes in security entropy, probability of node compromise, feasibility of defense strategies, and degree of business impact, and quantifies the overall network security risk level. Finally, it outputs a final risk assessment report and corresponding security handling instructions, completing the entire closed loop of dynamic network security risk simulation, assessment, and security handling guidelines.

[0155] A schematic diagram of the internal structure of the perception layer is shown below. Figure 6 As shown, the data sources are divided into three categories: host and security logs, network traffic PCAP data packets, and print and burn logs. These three types of data are aggregated to form multi-source heterogeneous data, which is then uniformly input into the next stage. The multi-source heterogeneous data enters the cleaning and standardization module to complete preprocessing work such as redundant data removal, format unification, and invalid content filtering, thus resolving the problem of inconsistent data formats from different sources. The standardized data is then sent to the data perception intelligent agent, which uses a large language model to perform LLM semantic extraction, extracting key semantic information such as entities, events, interaction relationships, and security attributes. Finally, based on the extracted semantic information, a dynamic full-element knowledge graph is generated, which fully carries the real-time security situation of the entire domain, including network assets, communication behavior, security events, and permission associations. This completes the entire process of data collection, processing, semantic parsing, and situation modeling at the physical perception layer.

[0156] A schematic diagram of the internal structure of the deduction layer is shown below. Figure 7As shown, the system has three types of input data sources: the ATT&CK knowledge base on the left, the dynamic full-element knowledge graph output by the physical perception layer in the middle, and the defense rules and legal compliance database on the right. The dynamic full-element knowledge graph outputs current network state snapshots and current defense strategies to both sides, which are then used by the red and blue agents for computation. The red agent uses the ATT&CK knowledge base and the current network state snapshot to conduct attack simulations, replicating the attacker's penetration and intrusion strategies and generating various attack paths. The blue agent combines the defense rules and compliance database with existing defense strategies to complete defense simulations and match protection schemes to the attack links. The attack behaviors and defense strategies generated by the red and blue parties are jointly sent to the virtual sandbox simulation field for adversarial game. The simulation process involves multiple rounds of state transitions, constantly updating the network attack and defense situation. After repeated iterations of attack and defense exercises, the virtual sandbox simulation field finally outputs a complete simulation product, containing all adversarial data such as the entire attack and defense trajectory, attack and defense losses, and risk changes, which is then passed down to the adjudication layer for risk assessment.

[0157] A schematic diagram of the adjudication layer structure is shown below. Figure 8 As shown, the simulated adversarial state transition data generated by the inference layer is first input into the adjudication agent (adjudication layer). Based on the acquired attack and defense process data, the adjudication agent performs quantitative calculations along two paths: the first path calculates the growth rate of the system's security entropy to obtain a dynamic vulnerability index, which measures the rate of change in the overall network security risks and disorder; the second path maps and matches the attack and defense adversarial results with the value of each asset to complete the business loss prediction, calculating the potential negative impact and scale of losses on the business caused by the attack. After the dynamic vulnerability index and business loss prediction results are summarized and integrated, a final risk assessment report with a corresponding mitigation plan and security handling instructions are generated, completing the comprehensive judgment, quantitative assessment, and mitigation recommendations for network security risks.

[0158] Example 3 This application uses a simulated penetration test of a zero-day vulnerability on a financial enterprise's internal network as an example to illustrate the dynamic network security risk assessment method provided in this application, which includes the following stages: (1) Perception stage.

[0159] The data-sensing agent detected an abnormal CPU spike (15%) in the print spooler of machine A in the finance department, accompanied by an SMB protocol scan to the internal file server B. Semantic analysis identifies this behavior as "using printer vulnerabilities for intranet probing".

[0160] (2) Deduction stage.

[0161] The red team's intelligent agent passed... The thought process revealed that although server B's firewall was robust, the memory image of machine A contained past connection credentials (logical trust) pointing to server B. The red team abandoned a direct attack on B and instead executed a "memory capture to credential replay" operation.

[0162] The blue team's agent discovered through evaluation that directly disconnecting the financial network would lead to payroll failure (high BII), so it chose the "induction strategy": dynamically generating a fake file server C (honeypot) in the graph.

[0163] (3) Adjudication stage.

[0164] The adjudicating agent detected that the red team agent immediately switched to attacking server C.

[0165] Calculation results: The intention-directed probability (IPP) surged from 0.4 to 0.9 (intention highly convergent); the rate of increase in system state entropy... Positive (the permission boundaries are becoming blurred).

[0166] Final rating: Although no real assets have been stolen so far, the system still issued a "Critical" risk warning and recommended that the voucher management process of Financial Machine A be taken offline immediately.

[0167] The method provided in this embodiment constructs a full-element semantic graph, and through a perceptual agent, spatiotemporally aligns and semantically fuses traditional network features with terminal-endogenous physical data and unstructured leakage channel records. This multimodal association capability enables the system to accurately identify covert attacks without obvious log features (such as slow data breaches and memory-resident attacks), eliminating perceptual blind spots. The red team agent utilizes the thought chain (CoT) capability of LLM to possess autonomous "intent chain reasoning" functionality. When low-risk vulnerabilities are detected, it can deduce their potential as "lateral movement springboards" through logical association (such as using non-directly connected logical trust relationships to reach core assets), thereby discovering complex penetration paths that traditional attack graphs cannot identify.

[0168] This embodiment also provides a dynamic network security risk assessment device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0169] This embodiment provides a dynamic network security risk assessment device, such as... Figure 9 As shown, it includes: The acquisition module 901 is used to acquire the dynamic security knowledge graph of the target network environment, which is used to characterize the network security status of the target network environment. The first determining module 902 is used to input the dynamic security knowledge graph as the initial environment state into the pre-built attack agent, so that the attack agent can simulate attack behavior and obtain a set of attack paths. The second determining module 903 is used to input the attack path set and dynamic security knowledge graph into the pre-built defense agent so that the defense agent can generate the target defense strategy. The simulation module 904 is used to distribute the target defense strategy and attack path set to the pre-built network environment digital twin model, drive the network environment digital twin model to carry out multiple rounds of attack and defense confrontation simulation, and obtain simulation results; Evaluation module 905 is used to perform risk assessment on the target network based on the simulation results, and obtain the risk assessment results of the target network.

[0170] In some optional implementations, the simulation results include full-process attack and defense game simulation data and physical evidence of network hardware. The full-process attack and defense game simulation data includes intrusion path assumptions, hardware physical operating characteristics, the proportion of controlled assets owned by multiple users, and executed attack paths. The aforementioned evaluation module 905 includes: The first determination submodule is used to determine the basic risk parameters of each network asset node in the target network based on intrusion path assumptions, hardware physical operation characteristics and measured evidence of network hardware physical conditions. The basic risk parameters are used to characterize the probability that the network asset node is compromised by the attacker. The second determination submodule is used to determine the permission distribution entropy of the target network based on the proportion of controlled assets owned by each user; The third determination submodule is used to determine the probability of intent convergence based on the set of optimal penetration paths that have been executed and reach the core asset nodes. The fourth determination submodule is used to determine the dynamic risk index based on the basic risk parameters, permission distribution entropy, and intent convergence probability of each network node. The fifth determination submodule is used to determine the risk assessment results of the target network based on the dynamic risk index.

[0171] In some optional implementations, the acquisition module 901 includes: The acquisition submodule is used to acquire the raw data streams of multiple asset nodes to be monitored. The raw data streams are used to characterize the multi-dimensional security operation status of the asset nodes to be monitored and the network environment. The processing submodule is used to perform semantic alignment and entity extraction on the raw data streams of each asset node to be monitored, and to construct a dynamic security knowledge graph.

[0172] In some alternative implementations, the processing submodule includes: The first processing unit is used to perform semantic parsing and entity extraction on the original data stream to obtain a set of entity and action triples; The filtering unit is used to filter out the corresponding abnormal external events and process creation events in each sliding window from the set of entity and action triples based on a preset sliding window. The first determining unit is used to determine the abnormal external event and the process creation event as a related event pair when, within the current sliding window, the abnormal external event and the process creation event belong to the same monitored asset node and the time difference between the abnormal external event and the process creation event is less than a preset threshold. The second determining unit is used to determine the abnormal external event and the process creation event in the current sliding window as independent events when the abnormal external event and the process creation event belong to different monitored asset nodes and / or the time difference between the two is not less than a preset threshold. The third determining unit is used to abstract the process event host of each associated event pair into the target subject, and to abstract the target asset pointed to by the abnormal external event in the corresponding associated event pair into the target object; The second processing unit is used to perform semantic normalization processing on the actions in each pair of related events to obtain the associated actions of the pairs of related events. The matching unit is used to match the associated actions of each associated event pair with a pre-built threat tactical knowledge base to obtain the technical and tactical tags of the corresponding associated event pair. The fourth determining unit is used to determine the business impact attributes of the corresponding target object based on the technical and tactical tags of each related event pair and the initial asset value of the corresponding target object; The splicing module is used to splice the target subject, target object, related actions, technical and tactical tags, and business impact attributes of each pair of related events to obtain the multidimensional semantic tuples of the corresponding related events. The fifth determining unit is used to write multidimensional semantic tuples and independent events into a pre-built underlying knowledge graph and update the risk entropy value of associated nodes to obtain a dynamic security knowledge graph. The underlying knowledge graph contains the association relationships between different asset nodes to be monitored.

[0173] In some optional implementations, the attacking agent simulates attack behavior to obtain a set of attack paths through the following steps: Extract the set of attack primitives from the built-in adversarial tactics and techniques knowledge base; The effective action space is obtained by filtering the attack primitive set based on the dynamic security knowledge graph; The dynamic security knowledge graph is used as the initial environment state, and the effective action space is used as the action space. It is input into the pre-constructed reinforcement learning policy network so that the reinforcement learning policy network outputs the initial attack path set. The initial set of attack paths is input into a pre-built digital twin sandbox model of the network environment for nonlinear path planning, so that the digital twin sandbox model of the network environment outputs a set of attack paths.

[0174] In some alternative implementations, the defensive agent generates a target defense strategy through the following steps: Multiple attack paths from the attack path set are mapped onto a dynamic security graph to obtain the target graph; The target graph is input into a pre-constructed graph neural network for feature extraction, so that the graph neural network outputs a graph feature vector; Calculate the intent pointing probability corresponding to different core nodes in the target network based on graph feature vectors; The core target node that the attack chain ultimately points to is determined based on the intent pointing probability corresponding to multiple core nodes. Based on the attack tactical information contained in the attack path set, the corresponding defense action rules are extracted from the pre-built defense action knowledge base and the enterprise compliance base to obtain the initial defense strategy set. By using a pre-defined genetic algorithm to perform multi-objective optimization on multiple defensive action sets in the initial defensive action set, a set of defensive strategies that satisfy the Nash equilibrium of offense and defense is obtained. The set of defense strategies and the set of attack paths are input into a pre-built digital twin model of the network environment, which drives the digital twin model of the network environment to conduct multiple rounds of attack and defense confrontation exercises, and obtains the feasibility score of each defense strategy in the set of defense strategies. Based on the feasibility scores of each defense strategy, the target defense strategy is determined.

[0175] The dynamic network security risk assessment device provided in this embodiment of the invention can execute the dynamic network security risk assessment method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0176] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0177] The following is a detailed reference. Figure 10This diagram illustrates a suitable structural schematic for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from memory 1008 into random access memory (RAM) 1003. The RAM 1003 also stores various programs and data required for the operation of the electronic device. The processor 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0178] Typically, the following devices can be connected to the I / O interface 1005: input devices 1006 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 1007 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; memory devices 1008 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows electronic devices to exchange data via wireless or wired communication with other devices. Although Figure 10 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0179] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 1009, or installed from a memory 1008, or installed from a ROM 1002. When the computer program is executed by the processor 1001, it performs the functions defined in the dynamic network security risk assessment method of the embodiments of the present invention.

[0180] Figure 10 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0181] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium after being downloaded via a network. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the dynamic network security risk assessment method shown in the above embodiments is implemented.

[0182] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0183] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A dynamic network security risk assessment method, characterized in that, The method includes: Obtain a dynamic security knowledge graph of the target network environment, wherein the dynamic security knowledge graph is used to characterize the network security status of the target network environment; The dynamic security knowledge graph is used as the initial environment state input to the pre-constructed attack agent, so that the attack agent can simulate attack behavior and obtain a set of attack paths. The attack path set and dynamic security knowledge graph are input into a pre-built defense agent to enable the defense agent to generate a target defense strategy. The target defense strategy and the set of attack paths are distributed to a pre-built digital twin model of the network environment, driving the digital twin model of the network environment to carry out multiple rounds of attack and defense confrontation simulations to obtain simulation results; Based on the simulation results, a risk assessment is performed on the target network to obtain the risk assessment results of the target network.

2. The method according to claim 1, characterized in that, The simulation results include full-process attack and defense game simulation data and physical evidence of network hardware. The full-process attack and defense game simulation data includes intrusion path assumptions, hardware physical operating characteristics, the proportion of controlled assets owned by multiple users, and executed attack paths. The step of conducting a risk assessment of the target network based on the simulation results to obtain the assessment results of the target network includes: Based on the intrusion path hypothesis, hardware physical operation characteristics, and measured evidence of network hardware physical conditions, the basic risk parameters of each network asset node in the target network are determined. The basic risk parameters are used to characterize the probability that the network asset node is compromised by the attacker. The permission distribution entropy of the target network is determined based on the proportion of controlled assets owned by each user; The probability of intent convergence is determined based on the executed attack paths and the optimal set of penetration paths to reach core asset nodes. The dynamic risk index is determined based on the basic risk parameters of each network node, the permission distribution entropy, and the intent convergence probability. The risk assessment result of the target network is determined based on the dynamic risk index.

3. The method according to claim 1, characterized in that, The step of obtaining the dynamic security knowledge graph of the target network environment includes: Acquire raw data streams from multiple asset nodes to be monitored. These raw data streams are used to characterize the multi-dimensional security operation status of the asset nodes to be monitored and the network environment. The original data streams of each asset node to be monitored are semantically aligned and entity extracted to construct the dynamic security knowledge graph.

4. The method according to claim 3, characterized in that, The process of semantic alignment and entity extraction of the original data streams of each asset node to be monitored to construct the dynamic security knowledge graph includes: The original data stream is semantically parsed and entity extracted to obtain a set of entity and action triples; Based on a preset sliding window, the corresponding abnormal external events and process creation events in each sliding window are filtered out from the set of entity and action triples. Within the current sliding window, when an abnormal external event and a process creation event belong to the same monitored asset node, and the time difference between the abnormal external event and the process creation event is less than a preset threshold, the abnormal external event and the process creation event are identified as a related event pair. When abnormal external events and process creation events belong to different monitored asset nodes, and / or the time difference between the two is not less than a preset threshold, the abnormal external events and process creation events in the current sliding window will be determined as independent events. Abstract the process event host of each associated event pair as the target subject, and abstract the target asset pointed to by the abnormal external event in the corresponding associated event pair as the target object; The actions in each associated event pair are semantically normalized to obtain the associated actions for the associated event pair. Match the associated actions of each associated event pair with a pre-built threat tactics knowledge base to obtain the corresponding technical and tactical tags for the associated event pair. The business impact attributes of the corresponding target object are determined based on the technical and tactical tags of each related event pair and the initial asset value of the corresponding target object. The target subject, target object, related actions, technical and tactical tags, and business impact attributes of each related event pair are concatenated to obtain the corresponding multidimensional semantic tuple of the related event. The multidimensional semantic tuples and the independent events are written into a pre-built underlying knowledge graph, and the risk entropy values ​​of the associated nodes are updated to obtain a dynamic security knowledge graph. The underlying knowledge graph contains the association relationships between different asset nodes to be monitored.

5. The method according to any one of claims 1 to 4, characterized in that, The attack agent simulates attack behavior through the following steps to obtain a set of attack paths: Extract the set of attack primitives from the built-in adversarial tactics and techniques knowledge base; The set of attack primitives is filtered based on the dynamic security knowledge graph to obtain an effective action space; The dynamic security knowledge graph is used as the initial environment state, and the effective action space is used as the action space. It is input into the pre-constructed reinforcement learning policy network so that the reinforcement learning policy network outputs the initial attack path set. The initial set of attack paths is input into a pre-built network environment digital twin sandbox model for nonlinear path planning, so that the network environment digital twin sandbox model outputs the set of attack paths.

6. The method according to any one of claims 1 to 4, characterized in that, The defensive agent generates the target defense strategy through the following steps: Multiple attack paths from the attack path set are mapped onto the dynamic security graph to obtain the target graph; The target graph is input into a pre-constructed graph neural network for feature extraction, so that the graph neural network outputs a graph feature vector; Based on the graph feature vectors, calculate the intent pointing probability corresponding to different core nodes in the target network; The core target node that the attack chain ultimately points to is determined based on the intent pointing probability corresponding to multiple core nodes. Based on the attack tactical information contained in the attack path set, corresponding defense action rules are extracted from the pre-built defense action knowledge base and the enterprise compliance base to obtain an initial defense strategy set. By using a pre-defined genetic algorithm to perform multi-objective optimization on multiple defensive action sets in the initial defensive action set, a set of defensive strategies that satisfy the Nash equilibrium of offense and defense is obtained. The set of defense strategies and the set of attack paths are input into a pre-built digital twin model of the network environment, driving the digital twin model of the network environment to conduct multiple rounds of attack and defense confrontation exercises, and obtaining the feasibility score of each defense strategy in the set of defense strategies; Based on the feasibility scores of each defense strategy, the target defense strategy is determined.

7. A dynamic network security risk assessment device, characterized in that, The device includes: The acquisition module is used to acquire a dynamic security knowledge graph of the target network environment, wherein the dynamic security knowledge graph is used to characterize the network security status of the target network environment; The first determining module is used to input the dynamic security knowledge graph as the initial environment state into the pre-constructed attack agent, so that the attack agent can simulate attack behavior and obtain a set of attack paths. The first determining module is used to input the attack path set and the dynamic security knowledge graph into a pre-built defense agent, so that the defense agent generates a target defense strategy. The simulation module is used to distribute the target defense strategy and the set of attack paths to a pre-built digital twin model of the network environment, drive the digital twin model of the network environment to carry out multiple rounds of attack and defense confrontation simulations, and obtain simulation results; The evaluation module is used to perform a risk assessment on the target network based on the inference results, and obtain the risk assessment results of the target network.

8. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the dynamic network security risk assessment method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the dynamic network security risk assessment method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions for causing a computer to execute the dynamic network security risk assessment method according to any one of claims 1 to 6.

Images