A network security monitoring system to deal with APT attacks

Abstract

The present invention belongs to the field of network attack detection, and specifically relates to a network security monitoring system for responding to APT attacks. The system comprises an industrial control network gateway security device, an industrial control network management system, and an industrial control network security operations center. The industrial control network gateway security device includes a behavioral data collection module for collecting network traffic and system activity data from various devices, including intrusion detection systems and flow probes, and providing the data to the industrial control network management system. The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavioral feature extraction module, and a model training and anomaly detection module. The module preprocesses raw data, generates traceability graphs and subgraphs, extracts behavioral features, and establishes a classification model for anomaly detection. The industrial control network security operations center includes a risk warning reporting module that visually reports detected risks to security operations personnel and generates detailed analysis reports.

Description

Technical Field

[0001] The present invention belongs to the field of network attack detection, and in particular relates to a network security monitoring system for responding to APT attacks. Background Art

[0002] In today's digital age, the widespread use of the internet and technological advancements have brought unprecedented convenience to people. However, cyberattacks have also evolved in both form and scale, becoming a serious threat to individuals, businesses, and even national security. Among them, Advanced Persistent Threat (APT) attacks have become one of the greatest threats to modern computing security. Their primary characteristics are their "low and slow" attack patterns and the frequent use of zero-day vulnerabilities.

[0003] APT attack patterns are more secretive and targeted than traditional network attacks.

[0004] Traditional APT attack detection methods primarily rely on static feature matching, such as specific signatures, patterns, or rules. This approach struggles to cope with the high variability and unknowns of APT attacks, and the cost of maintaining and updating the feature library is high. Furthermore, traditional methods use audit logs as their data source. The basic unit of data is the log entries, which exist only in temporal order. This approach cannot directly and effectively represent the interactions between entities in the system and lacks structural information, making it ineffective for detecting APT attacks. As an intuitive and efficient form of information representation, provenance graphs offer powerful semantic expression and the ability to correlate attack histories, offering unique advantages in APT detection. Provenance graphs visualize the system execution process by representing the interactions between system entities, facilitating causal analysis during detection. Furthermore, provenance graphs preserve the entire system execution history, making them suitable for addressing the long-lasting nature of APT attacks.

[0005] Disadvantages of existing technology:

[0006] The main problem facing current technology is that APT attack detection systems based on provenance graphs primarily focus on the interactions between system entities, using this as a basis for causal reasoning. Specifically, interactions between entities in a provenance graph are simply represented as edges. For example, process A accessing file B is represented in the provenance graph as an edge from A to B. However, in this process, critical behavioral information, such as the time of occurrence and the specific method of execution, is ignored or discarded. This simplified representation results in a loss of behavioral information, reducing detection accuracy and increasing false positives. Summary of the Invention

[0007] In order to solve the technical problems existing in the prior art, the present invention provides a network security monitoring system for responding to APT attacks.

[0008] Technical solution of the present invention:

[0009] A network security monitoring system to counter APT attacks is applied in actual industrial production environments, including industrial control network gateway security equipment, industrial control network management systems, and industrial control network security operation centers, including:

[0010] The industrial control network gateway security device includes a behavior data collection module for collecting network traffic and system activity data from various devices including intrusion detection systems (IDS) and traffic probes, forming an original system log database and providing it to the industrial control network management system;

[0011] The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavior feature extraction module, a model training and anomaly detection module; it completes the preprocessing of raw data, generates traceability graphs and subgraphs, extracts behavior features, establishes a classification model and uses it for anomaly detection.

[0012] The industrial control network security operation center includes a risk warning reporting module, which reports the detected risks to the security operation personnel in a visual manner and generates a detailed analysis report.

[0013] Beneficial effects

[0014] The edge feature extraction module in this invention maps the relationships between behavior attributes into the graph structure of a behavior structure graph (BSG), capturing hidden threat patterns and correlations within behaviors. By analyzing the behavior structure graph for each edge in the subgraph, the corresponding feature vector is constructed. The behavior structure graph consists of the individual behavior attributes of a single behavior and the connections between them. Each behavior attribute is mapped to a node in the behavior structure graph, and the connections between behavior attributes are mapped to edges between corresponding nodes in the behavior structure graph. Incorporating behavior attributes and their structural information into provenance graph modeling goes beyond the traditional focus on entity interactions. In addition to capturing basic interactions between entities, this invention also considers behavior attributes, namely, key characteristics such as the time and manner of behavior occurrence. Furthermore, this invention incorporates the relationships between behavior attributes to construct behavioral structural information. By examining the connections between different behavior attributes, this invention enhances understanding of the internal structure of the behavior and increases information density. This inclusion of information adds layers to the provenance graph and provides more detailed context for each behavior entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0015] The edge feature vector module of the present invention extracts the final edge feature vector from the behavior structure graph. The behavior structure graph is subjected to a pooling method based on multiple node discards. This pooling method is divided into multiple pooling steps, which gradually discards non-important nodes and aggregates the information of the remaining important nodes based on the graph structure to obtain the feature vector of the entire behavior structure graph. By introducing pooling methods and graph representation learning, the expressive power of the model is improved, enabling it to more effectively capture important information in the behavior structure and continuously optimize based on the initial structural information. The present invention uses the ER random graph model to initialize the behavior structure information. Ensuring that the initial behavior structure graph (BSG) is a connected graph ensures that each behavior attribute has a potential association path, avoiding the premature exclusion of certain attribute associations from the analysis in the initial stage.

[0016] The network security monitoring system of the present invention incorporates more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-layered, multi-dimensional information structure within the model, enriching and diversifying the information hierarchy of the traceability graph. During the learning process, the model can more meticulously distinguish between normal behavior and APT attack behavior, improving overall judgment accuracy.

[0017] The edge feature extraction module of the network security monitoring system of the present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack positioning shortens the time it takes for the industrial control network management system to detect and respond, can locate the specific location and time when the attack behavior occurs, and improves the real-time threat perception capability of the network security monitoring system.

[0018] When the industrial control network management system of the network security monitoring system of the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationship between them, and then explains the key behavior information for determining the APT attack behavior, so that the judgment criteria are easier for the industrial control network security operation center to understand. The APT attack behavior attributes and the relationship between them can also be displayed to the industrial control network security operation center in a graphical form. The risk warning reporting module of the industrial control network security operation center enables security analysts to understand abnormal behavior more intuitively in a visual way. By clearly presenting these key attributes, the network security monitoring system of the present invention provides security analysts with a more detailed description of APT attack activities, making the results more explainable. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Shows a schematic diagram of the system module division of the present invention;

[0020] Figure 2 Shown Figure 1The middle line is a schematic diagram of the division of feature extraction modules;

[0021] Figure 3 Shown Figure 1 The middle behavior is a schematic diagram of the working mechanism of the feature extraction module;

[0022] Figure 4 A schematic diagram of the processing flow of the industrial control network management system of the present invention is shown. DETAILED DESCRIPTION

[0023] The technical solution provided by this application will be further described below in conjunction with specific embodiments and accompanying drawings. The advantages and features of this application will become more apparent with reference to the following description.

[0024] A network security monitoring system to deal with APT attacks is applied to actual industrial production environments, including industrial control network gateway security equipment, industrial control network management systems, and industrial control network security operation centers, where: (e.g. Figure 1 )

[0025] The industrial control network gateway security device includes a behavior data collection module for collecting network traffic and system activity data from various devices including intrusion detection systems (IDS) and traffic probes, forming an original system log database and providing it to the industrial control network management system;

[0026] The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavior feature extraction module, a model training and anomaly detection module; it completes the preprocessing of raw data, generates traceability graphs and subgraphs, extracts behavior features, establishes a classification model and uses it for anomaly detection.

[0027] The industrial control network security operation center includes a risk warning reporting module, which reports the detected risks to the security operation personnel in a visual manner and generates a detailed analysis report.

[0028] Furthermore, the industrial control network management system modules are divided as follows:

[0029] 1. Data preprocessing module

[0030] It includes a data cleaning module and a traceability graph generation module, as follows:

[0031] 1.1 Data cleaning module

[0032] Considering that the raw system log data provided by the behavioral data collection module may come from multiple different data sources and that different systems may have different log formats, resulting in heterogeneity, to facilitate subsequent analysis and processing, the data cleaning module first identifies entities and events in the logs and records them using unified identifiers. Second, it standardizes all information fields, such as using a unified timestamp format and IP address representation, to ensure comparability of all data.

[0033] 1.2. Provenance graph generation module

[0034] By structuring the input data into a graph, the correlation of system behavior is presented.

[0035] First, the data output from the data cleaning module is mapped according to entities and events, with each entity being treated as a node in the graph and events as edges connecting the nodes. Once all entities are mapped to nodes, edges are added sequentially based on the causal relationships between events (for example, if entity A initiates an interaction with entity B, a directed edge from A to B is added). This creates a traceability graph that reflects the interactions and evolutionary paths of each entity within the system.

[0036] 2. Subgraph generation module

[0037] In practice, as the system runs, the size of the monitoring system's logs continues to grow, which means that the traceability graphs generated by the corresponding traceability graph generation module will also become increasingly large. To control the space overhead during practical application, the subgraph generation module divides the original traceability graph into several subgraphs of manageable size for subsequent steps.

[0038] Specifically, the subgraph generation module processes as follows:

[0039] The complete provenance graph generated by the provenance graph generation module is stored on the disk of the industrial control network management system server, while a cached graph is maintained in the industrial control network management system's memory. Each event in the complete provenance graph is retrieved sequentially in chronological order. If the subject and object of the retrieved event are not already in the cached graph in the system memory, they are added as new nodes in the cached graph, an edge is added between the new nodes, and the timestamp of the behavior is assigned to these new nodes. If the subject and object of the retrieved event are already in the cached graph, only their timestamps are updated to ensure that the timestamps are consistent with the time of the latest behavior.

[0040] Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, the cached graph at this time is saved as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the i-th cached graph reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S i Repeat until all the traceability graph data on disk is processed.

[0041] After the above processing for each traceability graph, we can get the subgraph set {S0, S1, ...S n During subsequent training, each subgraph is trained. In this way, during training, the present invention only needs to store a subgraph of a limited size in memory, thereby ensuring scalability.

[0042] 3. Behavioral Feature Extraction Module (Key Innovation of the Present Invention)

[0043] like Figure 2 ,The behavior feature extraction module includes a node feature extraction module and an edge ,feature extraction module, which is used to extract features from each ,subgraph.

[0044] 3.1 Node Feature Extraction Module

[0045] For the characteristics of nodes in the subgraph, first count the number of node types and edge types in the graph as N n and N e . Set the function X v and X e Each node and edge is mapped to its type as follows. Σ V and Σ E Represents a collection of node types and edge types respectively.

[0046] X v :V→Σ V

[0047] X e :E→Σ E

[0048]

[0049] where a i The calculation formula is as follows:

[0050]

[0051] To illustrate, a node's feature vector is divided equally into two parts: each dimension in the first half corresponds to the in-degree of a certain type of edge at the node, and each dimension in the second half corresponds to the out-degree of a certain type of edge at the node. It is believed that by using the node's degree distribution as a feature vector, we can statistically characterize the node's interactive behavior.

[0052] 3.2 Edge Feature Extraction Module

[0053] An edge in the subgraph represents an interaction between entities, also known as a behavior. Behaviors have four main attributes: the subject performing the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each of these main attributes can be further divided into more specific attributes, which together constitute the behavior attributes.

[0054] In previous APT attack detection work, behavioral attribute information is often ignored, or each behavioral attribute is analyzed independently. However, the present invention believes that there is an important correlation between behavioral attributes, and this correlation plays a key role in APT attack detection. For example, an abnormal process reads system files late at night. If only its runtime attributes (such as running late at night) or only its behavior type attributes (such as reading system files) are considered, important contextual information will be lost. Only by combining the time attributes with the behavior type attributes for comprehensive analysis can potential threat behaviors be accurately identified. This multi-dimensional correlation analysis helps to improve the accuracy and precision of detection, thereby more effectively responding to complex APT attacks.

[0055] Therefore, the present invention proposes a new concept of Behavior Structure Graph (BSG) for the first time. A Behavior Structure Graph (BSG) is composed of the various behavioral attributes of a single behavior and the connections between them, where each behavioral attribute is mapped to a node in the Behavior Structure Graph (BSG), and the connections between behavioral attributes are mapped to edges between corresponding nodes in the Behavior Structure Graph (BSG). By constructing a Behavior Structure Graph (BSG), the present invention can map the relationships between behavioral attributes into the graph structure information of the Behavior Structure Graph (BSG), and more effectively capture the hidden threat patterns and correlations in the behavior. By analyzing the Behavior Structure Graph (BSG) of each edge in the subgraph, the present invention constructs its corresponding feature vector. The process is as follows Figure 3 shown.

[0056] The edge feature extraction module includes: behavior structure graph (BSG) initialization module, behavior structure graph (BSG) semantic information and structural information module and edge feature vector module. As follows:

[0057] 3.2.1 Behavior Structure Graph (BSG) Initialization Module

[0058] For each edge in the subgraph, or in other words, each behavior, its behavior attribute information is identified and recorded. The behavior structure graph (BSG) is initially a zero-node zero-graph. Whenever a behavior attribute is identified, a new node corresponding to this behavior attribute is added to the BSG. Assuming a behavior has x behavior attributes, the corresponding behavior structure graph (BSG) is constructed as an undirected graph with x nodes and 0 edges.

[0059] 3.2.2 Semantic and Structural Information Modules of Behavior Structure Graph (BSG)

[0060] 3.2.2.1 Semantic Information Module

[0061] Traverse each node in the behavior structure graph (BSG) in turn, and convert the behavior attribute corresponding to the node into a sentence in a unified format. Specifically, the embodiment converts non-alphanumeric symbols of the behavior attribute text into spaces, for example: converting the file path " / etc / tmp / log.txt" into the sentence "etc tmp log txt". For each such sentence, use FastText to embed it into a numerical vector. Specifically, FastText is an open source word vector and text classification tool from Facebook, which can convert words into numerical vectors, that is, extract semantic information from the text. The present invention uses FastText to convert each word in the sentence into a numerical vector, and then adds and averages the numerical vectors of all words to obtain the feature vector of the sentence. The feature vector of this sentence is used as the feature vector of the corresponding node in the behavior structure graph (BSG).

[0062] 3.2.2.2 Structure Information Module

[0063] Considering the various uncertainties inherent in behavioral attributes in reality, and inspired by the practice of rGINs (graph isomorphism networks with random features) of adding random features to each node to enhance the expressive power of GNNs, this paper employs the ER random graph model to randomly initialize the structural information of the behavior structure graph (BSG). Specifically, by traversing each node pair in the BSG and generating edges with a random probability p, the structural information of the behavior structure graph (BSG) is ultimately obtained.

[0064] It is worth noting that here, p is set to a constant value greater than log(x) / x, which theoretically ensures that the behavior structure graph (BSG) is a connected graph. The connectivity between any two nodes in the connected graph ensures that the potential relationship between any two behavior attributes is not ignored during initialization.

[0065] 3.2.3 Edge Eigenvector Module

[0066] The final edge feature vector is extracted from the behavior structure graph (BSG).

[0067] In order to integrate the semantic information and structural information in the behavior structure graph (BSG) into the final edge feature vector, the present invention applies a pooling method based on multiple node discarding to the behavior structure graph (BSG). The pooling method is divided into multiple pooling steps. By gradually discarding non-important nodes and aggregating the information of the remaining important nodes based on the graph structure, the feature vector of the entire behavior structure graph (BSG) is obtained.

[0068] Specifically, the importance of the nodes is first evaluated in each pooling step. The weight of each node is calculated based on its position in the overall graph structure, its connectivity, and its attribute characteristics. Through this evaluation mechanism, unimportant nodes are gradually discarded. These nodes typically play a secondary role in the graph and have a smaller impact on the global characteristics of the graph. After discarding unimportant nodes, information is aggregated among the remaining nodes, allowing the remaining graph to maintain key structure and information while simplifying computational complexity. The pooling process is progressive, and as the steps proceed, the number of nodes in the graph gradually decreases, ultimately resulting in a feature vector for the entire graph. This feature vector is then used as the edge feature vector for its corresponding edge, thereby more comprehensively reflecting the semantic and structural information in the behavior structure graph (BSG).

[0069] 4. Model training and anomaly detection module

[0070] After the behavior feature extraction module outputs a subgraph with node features and edge features, the model training and anomaly detection module completes the training and testing of the classification model. The details are as follows:

[0071] 4.1 Design Model

[0072] The model design of this invention is based on GraphSAGE (existing technology) and incorporates Residual Gated Graph ConvNets (existing technology) to better address the challenges of APT attack detection. Specifically, by combining the efficiency of GraphSAGE with the deep modeling capabilities of Residual Gated Graph ConvNets, the model designed by this invention not only efficiently processes large-scale provenance graphs, but also more comprehensively captures the complex dependencies within the graph, improving overall representation capabilities and providing stronger support for APT attack detection.

[0073] GraphSAGE is a well-known and simple graph neural network that aggregates and updates the representation of a target node by sampling features from neighboring nodes. Its local aggregation strategy enables GraphSAGE to effectively capture neighbor information and extract local structural features of nodes. It also reduces computational complexity through sampling, ensuring efficient performance when processing large-scale provenance graphs. However, in the provenance graph scenario of this problem, GraphSAGE itself has limitations in handling edge features and long-range dependencies.

[0074] To address this issue, this paper introduces Residual Gated Graph ConvNets. Through its gating mechanism, it effectively captures long-range dependencies in the provenance graph and accurately depicts the complex interactions between nodes. This is highly consistent with the long latency and complex attack methods of APT attacks. Furthermore, Residual Gated Graph ConvNets can process and integrate edge features, allowing the model to not only focus on node features during graph representation learning but also leverage edge information, further improving the accuracy and reliability of APT detection.

[0075] 4.2 Model Training

[0076] The above model is trained using the subgraph with node features and edge features output by the behavior feature extraction module.

[0077] Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels.

[0078] One training will generate vector representations of all nodes and edges. The vector representations of node v and edge e are Z v and Z e . Where Z v is an N v dimensional vector, Z e is an N e dimensional vector.

[0079] Combine the vector representations of all edges in the subgraph after one round of training to obtain a matrix Z. Assuming that there are N edges in the subgraph, the dimension of the matrix Z is N×N e Similarly, the one-hot encoding vector L of all edge labels in the subgraph can be e Put them together to get the matrix L.

[0080] The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows:

[0081]

[0082] Among them Lic represents the element in the i-th row and c-th column of the matrix L, Z ic Represents the element in the i-th row and c-th column of the matrix Z.

[0083] Then, the weight matrix and pooling parameters are adjusted using the loss value through the back-propagation algorithm.

[0084] For each round of training, the edge of the classification subgraph is used. Specifically, when the vector Z e With vector L e When the distance ds is lower than the threshold d, the classification is considered correct. ds takes the L2 distance, and the calculation formula is as follows:

[0085]

[0086] Correctly classified edges are removed from the detection edge set, and the corresponding edges in the subgraph are also removed. The resulting model is saved. A new model is trained again using the remaining data in the subgraph, and this process is repeated until the training subgraph is empty. In this way, the present invention can generate multiple models.

[0087] Note that at the beginning of subsequent subgraph training, the present invention first verifies the subgraph in the existing model and removes correctly classified edges from it.

[0088] This strategy is based on the assumption that the previous model has already learned the representations of the deleted edges, eliminating the need to retrain them. By applying this pre-filtering strategy, the present invention reduces the number of initial edges in the subgraph, further reducing the number of models. More broadly, the present invention only uses a subgraph for training when there are edges in the subgraph that none of the current models can correctly classify. This is an incremental process that prevents the generation of "redundant" models.

[0089] 4.3 Anomaly Detection Module

[0090] Use the model trained in 4.2 to classify the type of each edge in turn. If an edge cannot be correctly classified by any of the existing sub-models, it is considered an anomaly and its behavior structure graph (BSG) is output.

[0091] Figure 4 Manage processes for industrial control network management systems.

[0092] The key points, innovations and advantages of the above technical solutions are:

[0093] 1. Utilization of Behavioral Attributes and Their Structural Information

[0094] The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, going beyond the traditional focus on entity interactions. In addition to capturing the basic interactive relationships between entities, the present invention also takes into account behavioral attributes, namely key features such as the time and manner in which the behavior occurs. Furthermore, the present invention takes the relationship between behavioral attributes into consideration and constructs behavioral structural information. By examining the associations between different behavioral attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects a more detailed contextual background into each behavioral entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0095] 2. Optimized Behavior Structure of Pooling and Graph Representation Learning

[0096] This paper optimizes behavioral structure information by introducing pooling methods and graph representation learning. Pooling methods repeatedly discard nodes to generate feature vectors for the entire behavioral structure graph (BSG), retaining attributes and relationships that contribute significantly to the identification of normal or abnormal behavior. This step improves the model's expressive power, enabling it to more effectively capture important information in the behavioral structure and continuously optimize based on the initial structural information.

[0097] 3. Random method to initialize behavior structure information

[0098] This paper innovatively employs a randomized approach, specifically the ER random graph model, to initialize behavioral structure information. This design accounts for the various uncertainties inherent in real-world behavioral attributes, introducing a degree of probability into the relationship between each pair of behavioral attributes. From an information-theoretic perspective, this helps encompass a wider range of information space during the initial phase. Ensuring that the initial behavioral structure graph (BSG) is a connected graph ensures that each behavioral attribute has a potential path for association, preventing premature exclusion of certain attribute associations from analysis during the initial phase.

[0099] 4. Improved judgment accuracy

[0100] Traditional provenance graph modeling methods focus primarily on the basic interactions between entities, while this invention introduces more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-level, multi-dimensional information structure in the model, making the provenance graph's information level richer and more diverse.

[0101] Behavioral attributes include key characteristics such as the time and manner in which the behavior occurred, information often overlooked in traditional methods. By describing each behavioral attribute in detail, the system can more comprehensively understand the behavior between entities during the modeling and training phases. For example, it can not only determine that process A accessed file B, but also understand when and how this operation occurred, providing more detailed context.

[0102] The relationships between behavioral attributes form behavioral structural information. By considering the interrelationships between behavioral attributes, the model can capture more complex and in-depth behavioral patterns. This structural information not only provides insights into potential connections between behaviors but also enables the model to better understand the differences between normal and APT attack patterns during training.

[0103] The richness of the structural information directly affects the accuracy of the judgment.

[0104] By incorporating more behavioral attributes and structural information, the model can more precisely distinguish between normal behavior and APT attack behavior during learning. This detailed behavioral description enables the system to more accurately identify potential threats and APT attacks, improving overall judgment accuracy.

[0105] 5. Finer judgment granularity

[0106] Traditional traceability graph detection methods perform APT attack detection at the graph or node level. After detecting an APT attack, security analysts are still required to specifically locate the attack activity, which reduces processing efficiency. Edge-level determination, on the other hand, helps quickly discover APT attack activities. That is, when an APT attack activity occurs, the present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack location shortens the time from detection to response, can locate the specific location and time of the attack behavior, and improves the system's real-time perception of threats.

[0107] 6. Explainability

[0108] When the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationships between them. For example, the output result shows that the interaction between a specific process and a file may be an APT attack, and then explains the key behavior information for determining such an APT attack behavior, making the judgment criteria easier to understand. The APT attack behavior attributes and the relationships between them can also be displayed in graphical form, allowing security analysts to understand abnormal behavior more intuitively through visualization. By clearly presenting these key attributes, the system provides security analysts with a more detailed description of APT attack activities, making the results more explainable.

[0109] Explanation of terms in the text:

[0110] APT: Advanced Persistent Threat (APT) is a type of attack that uses advanced attack methods to launch long-term persistent network attacks on specific targets. It contains three elements: advanced, long-term, and threatening.

[0111] Behavior: refers to the operations between entities in the system, which can be expressed as a quad <subject,object,time, operation> Representation: the subject, object, time, and content of the action. Subject and object: A subject is an entity in the system that performs an action on another entity, called an object. Subject and object are relative; the subject of one action can be the object of another. A subject can be a process, thread, or other object; an object can be a file, socket, or other object. The types of subject and object may vary depending on the operating system.

[0112] Provenance Graph: The provenance graph is a collection of all subjects, objects, and behaviors, which can be represented by G=<S,O,E> In the provenance graph, S represents the set of subjects, O represents the set of objects, and E represents the set of actions. In the provenance graph, subjects and objects are represented as nodes, while actions are represented as edges. Multiple edges may exist between two nodes, with different times or operations.

[0113]

[0114] ●G np : An undirected graph with n nodes and edges (u,v) generated with independent and identically distributed probability p

[0115] ●G nm : An undirected graph with n nodes and m edges sampled from a uniform distribution.

[0116] GNN: Graph Neural Network (GNN) refers to a general term for algorithms that use neural networks to learn graph-structured data, extract and discover features and patterns in graph-structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0117] NLP: Natural Language Processing (NLP) is a key area of ​​research in computer science and artificial intelligence. It studies theories and methods that enable effective communication between humans and computers using natural language. For example, FastText is an example.

[0118] One-hot encoding: One-hot encoding, also known as one-bit effective encoding, uses an N-bit state register to encode N states. Each state has its own independent register bit, and at any time, only one of them is valid.

Claims

1. A network security monitoring system for responding to APT attacks, applied in actual industrial production environments, characterized by: Including industrial control network gateway security equipment, industrial control network management system, industrial control network security operation center, including: The industrial control network gateway security device includes a behavior data collection module for collecting network traffic and system activity data from various devices including intrusion detection systems and flow probes, forming an original system log database and providing it to the industrial control network management system; The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavior feature extraction module, a model training and anomaly detection module; it completes the preprocessing of raw data, generates traceability graphs and subgraphs, extracts behavior features, establishes a classification model and uses it for anomaly detection; The industrial control network security operation center includes a risk warning reporting module, which reports detected risks to security operations personnel in a visual manner and generates a detailed analysis report; The industrial control network management system, wherein the behavior feature extraction module is used to extract features from each subgraph, including a node feature extraction module and an edge feature extraction module, wherein: For the features of the nodes in the subgraph, the node feature extraction module is used to count the number of node types and edge types in the graph as N n and N e , set the function X v and X e , mapping each node and edge to its type, Σ V and Σ E Represents a set of node types and edge types respectively; X v :V→Σ V X e :E→Σ E Used to set the mapping function M v and M e Map node types and edge types to 0 to N respectively n -1 and 0~N e Integer between -1; M v :S V →N M e :S E →N Nodes in the subgraph The eigenvectors of are set as: [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a Ne*2-1 ] where a i The calculation formula is as follows: The node's eigenvector is evenly divided into two parts, the first half of which corresponds to the in-degree of a certain type of edge on the node, and the second half of which corresponds to the out-degree of a certain type of edge on the node. The degree distribution of the node is used as the eigenvector to statistically represent the interaction behavior characteristics of the node. For edge features in a subgraph, the edge feature extraction module: an edge in the subgraph represents an interaction event between entities, that is, a behavior. A behavior has four main attributes: the subject performing the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each main attribute is further divided into more specific attributes, and these attribute information constitutes the behavior attributes. The edge feature extraction module is used to map the relationship between behavior attributes into the graph structure information of the behavior structure graph, capturing the threat patterns and correlations hidden in the behavior; by analyzing the behavior structure graph of each edge in the subgraph, the corresponding feature vector is constructed; the behavior structure graph is composed of the various behavior attributes of a single behavior and the connections between them, where each behavior attribute is mapped to a node in the behavior structure graph, and the connections between behavior attributes are mapped to edges between corresponding nodes in the behavior structure graph; The edge feature extraction module includes: a behavior structure graph initialization module, a behavior structure graph semantic information and structure information module and an edge feature vector module; wherein: In the behavior structure graph initialization module: for each edge in the subgraph, that is, each behavior, its behavior attribute information is identified and recorded; the behavior structure graph is initially a zero-node zero-graph, and each time a behavior attribute of the behavior is identified, a new node is added to the behavior structure graph, and the node corresponds to the behavior attribute; assuming that a behavior has x behavior attributes, then the corresponding behavior structure graph is constructed as an undirected graph with x nodes and 0 edges; The semantic information and structural information modules of the behavior structure graph include a semantic information module and a structural information module. The semantic information module sequentially traverses each node in the behavior structure graph and converts the behavior attributes corresponding to the node into sentences in a unified format. The structural information module uses the ER random graph model to randomly initialize the structural information of the behavior structure graph. Specifically, by traversing each node pair in the behavior structure graph and generating edges with a random probability p, the structural information of the behavior structure graph is finally obtained. The edge feature vector module extracts the final edge feature vector from the behavior structure graph; a pooling method based on multiple node discarding is applied to the behavior structure graph. The pooling method is divided into multiple pooling steps, which gradually discards non-important nodes and aggregates the information of the remaining important nodes based on the graph structure to obtain the feature vector of the entire behavior structure graph.

2. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: The industrial control network management system, wherein the data preprocessing module includes a data cleaning module and a traceability diagram generation module, wherein: The data cleaning module is used to identify entities and events in the log and record unified identifiers; it is used to standardize all information fields, and the information fields have a unified timestamp format and IP address representation to ensure that all data are comparable; The traceability graph generation module is used to structure the input data into a graph and present the correlation of system behavior: the data output by the data cleaning module is mapped according to entities and events, each entity is regarded as a node in the graph, and the event is the edge connecting the nodes; after all entities are mapped to nodes, edges are added in sequence according to the causal relationship between events to construct a traceability graph reflecting the interaction between each entity in the system and its evolution path. The traceability graph is completely stored on the disk of the industrial control network management system server.

3. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: Under the condition that the traceability graph is completely stored on the disk of the industrial control network management system server and a cache graph is maintained in the memory of the industrial control network management system server, the subgraph generation module is used to: Retrieve each event in the complete traceability graph in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, add them as new nodes to the cache graph, add an edge between the new nodes, and assign the timestamp of the behavior to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only the timestamp is updated to ensure that the timestamp is consistent with the latest behavior time; Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, save the cached graph at this time as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the i-th cached graph reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S. i Repeat until all traceability graph data on disk is processed; For each traceability graph, after being processed by the subgraph generation module according to the above process, a subgraph set {S0, S1, ... S n }.

4. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: The edge feature vector module is used to extract the final edge feature vector from the behavior structure graph: In each pooling step, the importance of the node is evaluated, and the weight value of each node is calculated based on the node's position in the entire graph structure, the connection relationship and the attribute characteristics of the node. Unimportant nodes will be gradually discarded; after discarding unimportant nodes, information is aggregated between the remaining nodes so that the remaining graph maintains key structure and information; the pooling process is progressive, and the feature vector of the entire graph is obtained; the feature vector is then used as the edge feature vector of its corresponding edge, reflecting the semantic and structural information in the behavioral structure graph.

5. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: The industrial control network management system, wherein the model training and anomaly detection module includes a classification model, a model training module, and an anomaly detection module: The model training and anomaly detection module inputs the subgraph with node features and edge features output by the behavior feature extraction module: The classification model is based on GraphSAGE and incorporates Residual Gated Graph ConvNets. A local aggregation strategy is employed to enable GraphSAGE to capture neighbor information and extract local structural features of nodes. Sampling is also used to reduce computational complexity for efficient performance when processing large-scale provenance graphs. The Residual Gated Graph ConvNets are introduced to capture long-range dependencies in provenance graphs through their gating mechanism, characterizing complex interactions between nodes and aligning with APT attacks. By processing and integrating edge features through the Residual Gated Graph ConvNets, the model considers both node features and edge information during graph representation learning, thereby improving APT detection accuracy and reliability. The model training module trains each subgraph during training and only needs to store a subgraph of limited size in memory, thus ensuring scalability. Specifically, the subgraph with node features and edge features output by the behavior feature extraction module is used to train the above model: Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels; One training will generate vector representations of all nodes and edges; the vector representations of node v and edge e are Z v and Z e ; where Z v is an N v dimensional vector, Z e is an N e dimensional vector; Combine the vector representations of all edges in the subgraph after one round of training to obtain a matrix Z; assuming there are N edges in the subgraph, the dimension of the matrix Z is N×N e ; One-hot encoding vector L of all edge labels in the subgraph e Collect them together to get the matrix L; The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows: Among them L ic represents the element in the i-th row and c-th column of the matrix L, Z ic represents the element in the i-th row and c-th column of the matrix Z; Then, through the back-propagation algorithm, the loss value is used to adjust the weight matrix and pooling parameters; For each round of training, the edge of the classification subgraph is used; specifically, when the vector Z e With vector L e When the distance ds is lower than the threshold d, the classification is considered correct; ds takes the L2 distance, and the calculation formula is as follows: ds=||Z e -L e ||2 Remove the correctly classified edges from the detection edge set, and simultaneously eliminate the corresponding edges in the subgraph; save the current model; use the remaining data in the subgraph to train a new model again, and repeat this process until the training subgraph is empty, thus obtaining multiple models; At the beginning of subsequent subgraph training, the subgraph is first verified in the existing model and the correctly classified edges are removed from it; by applying this pre-filtering strategy, the number of initial edges in the subgraph is reduced, thereby further reducing the number of models; The anomaly detection module uses the trained model to classify the type of each edge in turn; when an edge cannot be correctly classified by any existing sub-model, it is determined to be an anomaly and its behavior structure diagram is output.

Images