Network attack model training method and device, network attack model detection method and device, electronic equipment and medium

Abstract

The invention provides a network attack model training and detection method and device, electronic equipment and a medium, and relates to the technical field of network security. According to the specific implementation scheme, based on a preset causal relationship mechanism, a connection relationship between two nodes which are the same as any relationship in the causal relationship mechanism is searched in log data of a target network, and a plurality of connection relationships are obtained; based on the multiple connection relations, a first causal relation graph is constructed, and the first causal relation graph comprises multiple nodes and multiple edges formed by connecting every two nodes; deleting nodes and edges related to the non-attack chain in the first causal relationship graph to obtain a second causal relationship graph; based on the second causal relationship graph, multiple attack sequences are determined, the attack sequences comprise triple events arranged according to the time sequence, and each triple event comprises a source node, an edge and a destination node; and training to obtain a target network attack model based on the plurality of attack sequences.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a network attack model training and detection method, device, electronic device and medium. Background Art

[0002] Persistent threat attacks, due to their multi-stage and sustainable characteristics, have become the main form of network attacks at this stage. Among them, the detection and prediction research of this type of attack inevitably requires the support of relevant data sets. When constructing a data set, real network and host data are required.

[0003] However, due to privacy and security considerations, there are few open source datasets that meet the requirements. Existing datasets often only provide raw network flow and log data. Moreover, there is a lack of analysis of long-term attack context, which also makes it impractical to simply use neural networks to identify malicious network requests. Summary of the invention

[0004] The present disclosure provides a network attack model training and detection method, device, electronic device and medium, which can solve at least one of the above technical problems.

[0005] According to one aspect of the present disclosure, a network attack model training method is provided, comprising:

[0006] Based on a preset causal relationship mechanism, searching the log data of the target network for a connection relationship between two nodes that is the same as any relationship in the causal relationship mechanism, and obtaining multiple connection relationships;

[0007] Based on the multiple connection relationships, construct a first causal relationship graph, wherein the first causal relationship graph includes a plurality of nodes and a plurality of edges formed by connecting two of the nodes;

[0008] Deleting nodes and edges related to non-attack chains in the first causal relationship graph to obtain a second causal relationship graph;

[0009] Based on the second causal relationship graph, determining a plurality of attack sequences, wherein the attack sequences include triple events arranged in time order, and the triple events include a source node, an edge, and a destination node;

[0010] Based on the multiple attack sequences, a target network attack model is trained.

[0011] According to another aspect of the present disclosure, a network attack detection method is provided, comprising:

[0012] Acquire an event sequence of network behavior, wherein the event sequence includes a plurality of triple events sorted according to timestamps of event occurrence, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the third triple event in two adjacent triple events is the source node of the fourth triple event;

[0013] The event sequence is input into any target network attack model in the embodiments of the present disclosure to obtain a detection result of the network behavior output by the target network attack model, wherein the detection result is an attack behavior or a non-attack behavior.

[0014] According to another aspect of the present disclosure, a network attack model training device is provided, comprising:

[0015] A connection relationship determination module searches for a connection relationship between two nodes having the same relationship as any relationship in the causal relationship mechanism in the log data of the target network based on a preset causal relationship mechanism, and obtains a plurality of connection relationships;

[0016] A first causal graph determination module, configured to construct a first causal relationship graph based on the plurality of connection relationships, wherein the first causal relationship graph includes a plurality of nodes and a plurality of edges formed by connecting two of the nodes;

[0017] A second causal graph determination module, configured to delete nodes and edges related to non-attack chains in the first causal relationship graph to obtain a second causal relationship graph;

[0018] an attack sequence determination module, configured to determine a plurality of attack sequences based on the second causal relationship graph, wherein the attack sequence comprises triple events arranged in chronological order, and the triple events comprise a source node, an edge, and a destination node;

[0019] A model training module is used to train a target network attack model based on the multiple attack sequences.

[0020] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0021] at least one processor; and

[0022] a memory communicatively connected to the at least one processor; wherein,

[0023] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any network attack detection method in the embodiments of the present disclosure.

[0024] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any network attack detection method according to the embodiments of the present disclosure.

[0025] Using the technical solution of the present disclosure, based on a preset causal relationship mechanism, the connection relationship between two nodes that is the same as any relationship in the causal relationship mechanism is searched in the log data of the target network to obtain multiple connection relationships. Then, based on the multiple connection relationships, a first causal relationship graph is constructed, and the nodes and edges related to non-attack chains are deleted in the first causal relationship graph to obtain a second causal relationship graph, so that a causal relationship graph including only attack chains can be obtained. Then, based on the second causal relationship graph, multiple attack sequences are determined, wherein the attack sequence includes triple events arranged in chronological order, and the triple event includes a source node, an edge, and a destination node. Thus, based on the multiple attack sequences, a target network attack model can be trained to improve the detection accuracy of the target network attack model for attack behaviors.

[0026] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0028] Figure 1 is a flow chart of a network attack model training method according to an embodiment of the present disclosure;

[0029] Figure 2 is a schematic diagram of a network attack process according to an embodiment of the present disclosure;

[0030] Figure 3 is a flow chart of a network attack detection method according to an embodiment of the present disclosure;

[0031] Figure 4 is a structural block diagram of a network attack model training device according to an embodiment of the present disclosure;

[0032] Figure 5 is a structural block diagram of a network attack detection device according to an embodiment of the present disclosure;

[0033] Figure 6 The block diagram is a block diagram of an electronic device for implementing the method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0035] Figure 1 It is a flowchart of a network attack model training method according to an embodiment of the present disclosure.

[0036] like Figure 1 As shown, the network attack model training method may include:

[0037] S110, based on a preset causal relationship mechanism, searching in the log data of the target network for a connection relationship between two nodes that is the same as any relationship in the causal relationship mechanism, to obtain a plurality of connection relationships;

[0038] S120, constructing a first causal relationship graph based on the multiple connection relationships, wherein the first causal relationship graph includes a plurality of nodes and a plurality of edges formed by connecting two nodes;

[0039] S130, deleting nodes and edges related to the non-attack chain in the first causal relationship graph to obtain a second causal relationship graph;

[0040] S140, determining a plurality of attack sequences based on the second causal relationship graph, wherein the attack sequence comprises triple events arranged in chronological order, and the triple event comprises a source node, an edge, and a destination node;

[0041] S150, based on multiple attack sequences, a target network attack model is trained.

[0042] For example, by analyzing the log data in the target network, the attack process of the network attack behavior can be mined. The details are as follows:

[0043] Figure 2 It is a schematic diagram of a network attack process according to an embodiment of the present disclosure.

[0044] When analyzing the attack process, each step in the attack behavior can be mapped to ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) defined by MITRE, so as to understand the attack techniques used by the attacker during the attack process. Figure 2As shown in the figure, taking the specific attack process in the dataset as an example, the process is decomposed into 18 attack steps, completing the attack on virtual machines VM1, VM2 and VM3 in the target network, and using 8 attack techniques in ATT&CK, namely T1046, T1210, T11003.008, T1083, T1136, T1018, T1021.004, and T1110.001.

[0045] Among them, the behavior description of the attack technology of T1046 is to discover the network service on the target host, and the behavior is captured by the command execution of the operation log. The behavior description of the attack technology of T1210 is to use the remote service to move laterally to the target host, and the behavior is captured by the remote service of the service log. The behavior description of the attack technology of T1083 is to collect the target files, and its behavior is captured by the target file access of the operation log. The behavior description of T11003.008 is to crack the / etc / passwd and / etc / shadow files to obtain access credentials, and its behavior is captured by the sensitive file access of the operation log. The behavior description of T1136 is to create an account to ensure continuous access to the target host, and its behavior is captured by the command execution of the operation log. The behavior description of T1018 is to discover the host IP or host name that can be reached by lateral movement, and its behavior is captured by the command execution of the operation log. The behavior description of T1110.001 is to brute force the account password, and its behavior is captured by the authentication of the login log. The behavior description of T1021.004 is to log in to the target host through the SSH remote service, and its behavior is captured by the remote service of the service log.

[0046] Analyze the attack techniques involved in the attack process. Once the attacker establishes a foothold in the target network, the subsequent attack process can be analyzed by analyzing different types of logs. Although the detailed attack process cannot be obtained by analyzing the log information of a target host in isolation, the detailed attack process can be mined by comprehensively analyzing the log information of each host attacked by the attacker after establishing a foothold in the target network. For example, the lateral movement process can be mined by combining the log information of the source and destination hosts of the lateral movement.

[0047] In a cyberattack, a "foothold" refers to the initial access or control an attacker gains in a target network. Once an attacker has established a foothold in a target network, they can use this as a springboard to further explore the network, escalate privileges, and move laterally to other systems to ultimately achieve their attack objectives, such as stealing data, destroying systems, or maintaining persistent access.

[0048] Comprehensive analysis includes log analysis, attack behavior correlation, attack process reconstruction, attack technology mapping, lateral movement analysis, threat intelligence integration, and attack trend prediction.

[0049] Lateral movement refers to an attacker's attempt to move from one system to another within a target network after successfully compromising one. This movement typically occurs after the attacker has established a foothold, using that foothold as a springboard to further explore the network, search for higher-value targets, or expand control over the network.

[0050] Exemplarily, the target network attack model can be a support vector machine (SVM), a random forest, a neural network, etc. According to the multiple attack sequences collected in the above steps S110 to S140, a training data set is constructed, and the model is trained using the training data set. Each attack sequence corresponds to a training sample, and the training sample is annotated with an attack or normal label. Alternatively, information such as the attack type can also be marked.

[0051] During model training, the performance of the model can be evaluated and optimized through cross-validation, parameter adjustment, etc., thereby improving the accuracy and generalization ability of the model.

[0052] Then, the trained model is deployed in the actual network environment and can be used for real-time or near real-time attack detection.

[0053] Exemplarily, the information of each edge in the above causal relationship graph includes edge ID, edge type (attack type), timestamp, etc. The information of each node includes host name, etc.

[0054] According to the above implementation, based on a preset causal relationship mechanism, a connection relationship between two nodes that is the same as any relationship in the causal relationship mechanism is searched in the log data of the target network to obtain multiple connection relationships. Then, based on the multiple connection relationships, a first causal relationship graph is constructed, and nodes and edges related to non-attack chains are deleted in the first causal relationship graph to obtain a second causal relationship graph, so that a causal relationship graph including only attack chains can be obtained. Then, based on the second causal relationship graph, multiple attack sequences are determined, wherein the attack sequence includes triple events arranged in chronological order, and the triple event includes a source node, an edge, and a destination node. Thus, based on the multiple attack sequences, a target network attack model can be trained to improve the detection accuracy of the target network attack model for attack behaviors.

[0055] In one embodiment, the causal relationship mechanism includes at least one of the following relationships:

[0056] A process creation relationship, wherein the source node of the process creation relationship is the process node and the destination node is the process node;

[0057] A process initiates a network connection relationship, wherein the source node of the process initiating the network connection relationship is the process node, and the destination node is the network connection node;

[0058] The process accepts a network connection relationship, wherein the source node of the process accepting the network connection relationship is the network connection node, and the destination node is the process node;

[0059] A process accesses a file relationship, wherein the source node of the process accesses a file relationship is the process node and the destination node is the file node;

[0060] A process accesses a registry relationship, wherein the source node of the process accesses the registry relationship is the process node and the destination node is the registry node;

[0061] Login creates a service process relationship, where the source node of the login creates a service process relationship is the login node and the destination node is the process node.

[0062] Understandably, process nodes include system processes, service processes, and user processes. Attackers use process vulnerabilities locally or remotely, and execute commands locally to implement various tactical operations, all of which involve processes. Extract process nodes from process-related logs and parse related operations. The node information of process nodes includes node ID, node type, process name, host name, process ID, parent process ID, command line, timestamp, etc.

[0063] It can be understood that the network connection node includes a network connection initiated or received by the host. Through this node, the cross-host attack process can be captured. The node information of the network connection node includes node ID, node type, IP address, port number, host name, timestamp, etc.

[0064] Understandably, file nodes include files, directories, etc. The access behavior to files can effectively characterize the attacker's tactical operations such as persistence, credential access, collection, and data leakage. The node information of the network connection node includes node ID, node type, file name, host name, timestamp, etc.

[0065] It can be understood that the login node represents the user's login behavior, and can record the attacker's behavior of remotely logging into the target machine and associate various types of operations performed by the attacker after logging in. Its node information includes node ID, node type, account name, host name, etc.

[0066] Understandably, registry nodes can present various configuration information in the form of registry under Windows operating system, and access to registry can also effectively represent attackers' tactical operations such as persistence, credential access, collection, and data leakage. Its node information includes node ID, node type, registry name, host name, etc.

[0067] According to the above implementation, through the causal relationship mechanism between the above nodes, various types of logs of various hosts in the target network can be analyzed, and the text type logs can be parsed into a data format expressed by a causal relationship graph. In this way, the logical or interactive relationship between the various subjects in the log can be mined, and the graph can represent the detailed process of the host operation and being attacked.

[0068] In one embodiment, nodes and edges related to non-attack chains are deleted in the first causal relationship graph to obtain a second causal relationship graph, including: in the first causal relationship graph, free nodes that have no connecting edges with other nodes are deleted to obtain a third causal relationship graph; based on benign nodes in the whitelist, benign nodes and edges connected to benign nodes are deleted in the third causal relationship graph to obtain a fourth causal relationship graph; in the fourth causal relationship graph, a first subgraph that does not include an attack context is deleted to obtain a second causal relationship graph, wherein the first subgraph includes only two nodes and an edge connected by the two nodes, and the two nodes have no connecting edges with other nodes in the fourth causal relationship graph.

[0069] It can be understood that the first causal relationship graph constructed above covers the entire process of host operation recorded in various types of logs, including both benign normal operations and detailed processes of being attacked. The normal operation process of the host will generate a large number of logs, which will then be parsed into a large-scale causal relationship graph. Therefore, it is necessary to simplify the causal relationship graph to obtain a suitable causal relationship graph.

[0070] For example, in the method of deleting free nodes, there are a large number of free nodes in the first causal relationship graph that is parsed, that is, these nodes have no connection relationship with other nodes, or are only connected to one or two nodes to form isolated tiny node clusters. These nodes cannot be included in the operation context and attack context for analysis. By deleting these free nodes, the scale of the causal relationship graph can be reduced.

[0071] For example, in the method of deleting benign nodes according to the whitelist, there are a large number of operations on system files or databases by background service processes in the first causal relationship graph that is parsed, and it is impossible to distinguish whether it is caused by the normal service of the host or the attack process. Deleting these nodes and edges can reduce the scale of the causal relationship graph. In addition, the nodes and edges of benign operations can also be directly deleted according to the whitelist.

[0072] Exemplarily, the causal relationship graph includes a large number of mutually unconnected subgraphs. Each subgraph corresponds to an attack operation of the attacker, and the attack operation may include multiple attack steps. For the first subgraph that does not include the attack context, that is, the subgraph only includes two nodes and the edges connecting the two nodes, these first subgraphs may be deleted.

[0073] Exemplarily, after obtaining the above-mentioned second causal relationship graph, the malicious nodes in the second causal relationship graph can be marked according to the blacklist. For example, malicious network connection, process, login, file and other nodes are marked according to malicious IP, software, account, file, etc., and other nodes in the context are marked through causal relationships to form an attack chain.

[0074] According to the above implementation, the causal relationship graph can be simplified to facilitate the subsequent construction of an attack sequence to form a network attack training set.

[0075] In actual applications, after obtaining the above-mentioned second causal relationship diagram, the patent design combs and mines out the complete attack process with malicious IP, software, account, file, etc. as clues, including the complete attack chain to complete the attack target, as well as the attack process of exploration, attempt, and failure. Based on the data set, it is possible to study various types of attack detection algorithms as well as attack prediction algorithms.

[0076] The attack process is reconstructed and analyzed from the constructed causal relationship graph data. Using the access to the target file as a clue, a series of processes such as process creation, account login, and network connection are gradually sorted out in depth until the attacker's IP is detected. Then, using the attacker's IP, account, etc. as clues, the attacker's other attack processes in the target network are sorted out and reconstructed, thus obtaining a complete attack chain.

[0077] The second causal relationship graph obtained above includes multiple second subgraphs. These causal graph data cannot be directly input into the model for training and learning, but require further preprocessing operations to convert the data into a suitable format. The preprocessing operation method mainly includes attack sequence extraction design and data mapping design. The details are as follows:

[0078] In one embodiment, based on the second causal relationship graph, multiple attack sequences are determined, including: based on the second causal relationship graph, multiple second subgraphs are determined, wherein the second subgraph includes at least three nodes, and any one of the nodes has at least one edge with other nodes in the second subgraph; for each second subgraph, triple events are extracted from the second subgraph respectively to obtain multiple triple events, and the multiple triple events are sorted according to the timestamps of the event occurrence to obtain the attack sequence corresponding to the second subgraph, wherein the triple event includes a source node, an edge and a destination node, and the destination node of the first triple event of two adjacent triple events is the source node of the second triple event; based on the attack sequences corresponding to each second subgraph, multiple attack sequences are determined.

[0079] It can be understood that the timestamp of the first triplet event is earlier than the timestamp of the second triplet event.

[0080] For example, after obtaining multiple attack sequences, an index value is assigned to each event in the attack sequence according to the event type, and the index value corresponds to the event type one by one. For example, the discrete numerical index can be mapped to the vector space through the Embedding operation to obtain an event vector sequence, which can be used as the input of the neural network for attack trend prediction.

[0081] According to the above embodiments, an attack sequence for training or predicting attack trends can be obtained.

[0082] Figure 3 It is a flow chart of a network attack detection method according to an embodiment of the present disclosure.

[0083] like Figure 3 As shown, the network attack detection method may include:

[0084] S310, obtaining an event sequence of network behavior, wherein the event sequence includes a plurality of triple events sorted according to timestamps of event occurrence, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the third triple event in two adjacent triple events is the source node of the fourth triple event;

[0085] S320, inputting the event sequence into the target network attack model described in any one of the embodiments of the present disclosure, and obtaining the detection result of the network behavior output by the target network attack model, wherein the detection result is an attack behavior or a non-attack behavior.

[0086] It can be understood that the event sequence can also be obtained by processing steps S110 to S140 of the above embodiment, that is, the above attack sequence.

[0087] It can be understood that the timestamp of the third triplet event is earlier than the timestamp of the fourth triplet event.

[0088] It is understandable that the detection result may also be normal or attack. Alternatively, the detection result may also include additional information such as attack type and confidence level.

[0089] According to the above implementation, the target network attack model trained based on the causal relationship diagram can be used to detect network events occurring in real time to determine whether the network event is an attack event.

[0090] Figure 4 It is a structural block diagram of a network attack model training device according to an embodiment of the present disclosure.

[0091] like Figure 4 As shown, the network attack model training device may include:

[0092] The connection relationship determination module 410 searches the log data of the target network for a connection relationship between two nodes that is the same as any relationship in the causal relationship mechanism based on a preset causal relationship mechanism, and obtains a plurality of connection relationships;

[0093] A first causal graph determining module 420, configured to construct a first causal relationship graph based on the plurality of connection relationships, wherein the first causal relationship graph includes a plurality of nodes and a plurality of edges formed by connecting two of the nodes;

[0094] A second causal graph determination module 430 is used to delete nodes and edges related to non-attack chains in the first causal relationship graph to obtain a second causal relationship graph;

[0095] An attack sequence determination module 440, configured to determine a plurality of attack sequences based on the second causal relationship graph, wherein the attack sequence comprises triple events arranged in chronological order, and the triple event comprises a source node, an edge, and a destination node;

[0096] The model training module 450 is used to train a target network attack model based on the multiple attack sequences.

[0097] In one embodiment, the causal relationship mechanism includes at least one of the following relationships:

[0098] A process creation relationship, wherein the source node of the process creation relationship is the process node and the destination node is the process node;

[0099] A process initiates a network connection relationship, wherein the source node of the process-initiated network connection relationship is the process node and the destination node is the network connection node;

[0100] The process accepts a network connection relationship, wherein the source node of the process accepting the network connection relationship is the network connection node, and the destination node is the process node;

[0101] A process accesses a file relationship, wherein the source node of the process accesses a file relationship is the process node and the destination node is the file node;

[0102] A process accesses a registry relationship, wherein the source node of the process accesses the registry relationship is the process node and the destination node is the registry node;

[0103] Login creates a service process relationship, where the source node of the login creates a service process relationship is the login node and the destination node is the process node.

[0104] In one implementation, the second causal graph determination module 430 includes:

[0105] A free node deletion unit, used to delete free nodes that have no connection edges with other nodes in the first causal relationship graph, to obtain a third causal relationship graph;

[0106] A benign node deletion unit, configured to delete the benign nodes and edges connected to the benign nodes in the third causal relationship graph based on the benign nodes in the whitelist, to obtain a fourth causal relationship graph;

[0107] A subgraph deletion unit is used to delete a first subgraph that does not include an attack context in the fourth causal relationship graph to obtain the second causal relationship graph, wherein the first subgraph includes only two nodes and an edge connected by the two nodes, and there is no connecting edge between the two nodes and other nodes in the fourth causal relationship graph.

[0108] In one implementation, the attack sequence determination module 440 includes:

[0109] A relationship graph segmentation unit, used for segmenting the second causal relationship graph into a plurality of second subgraphs, wherein any node in the second subgraph has at least one edge with any other node in the second subgraph;

[0110] An event extraction unit is used to extract triple events from each of the second subgraphs to obtain a plurality of triple events, and sort the plurality of triple events according to the timestamps of event occurrence to obtain an attack sequence corresponding to the second subgraph, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the first triple event of two adjacent triple events is the source node of the second triple event;

[0111] A sequence determination unit is used to determine the multiple attack sequences based on the attack sequences corresponding to the second subgraphs.

[0112] Figure 5 It is a structural block diagram of a network attack detection device according to an embodiment of the present disclosure.

[0113] like Figure 5 As shown, the network attack detection device may include:

[0114] An event sequence acquisition module 510 is used to acquire an event sequence of network behavior, wherein the event sequence includes a plurality of triple events sorted according to timestamps of event occurrence, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the third triple event in two adjacent triple events is the source node of the fourth triple event;

[0115] The attack behavior prediction module 520 is used to input the event sequence into the target network attack model described in any of the embodiments of the present disclosure, and obtain the detection result of the network behavior output by the target network attack model, wherein the detection result is an attack behavior or a non-attack behavior.

[0116] For the description of specific functions and examples of each module and sub-module of the system in the embodiment of the present disclosure, please refer to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0117] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0118] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0119] Figure 6 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0120] like Figure 6 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0121] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0122] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as a network attack model training method or a network attack detection method. For example, in some embodiments, the network attack model training method or the network attack detection method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the network attack model training method or the network attack detection method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute the network attack model training method or the network attack detection method in any other appropriate manner (for example, by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0128] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A network attack model training method, characterized in that: include: Based on a preset causal relationship mechanism, searching the log data of the target network for a connection relationship between two nodes that is the same as any relationship in the causal relationship mechanism, and obtaining multiple connection relationships; Based on the multiple connection relationships, construct a first causal relationship graph, wherein the first causal relationship graph includes a plurality of nodes and a plurality of edges formed by connecting two of the nodes; Deleting nodes and edges related to non-attack chains in the first causal relationship graph to obtain a second causal relationship graph; Based on the second causal relationship graph, determining a plurality of attack sequences, wherein the attack sequences include triple events arranged in time order, and the triple events include a source node, an edge, and a destination node; Based on the multiple attack sequences, a target network attack model is trained.

2. The method according to claim 1, characterized in that The causal relationship mechanism includes at least one of the following relationships: A process creation relationship, wherein the source node of the process creation relationship is the process node and the destination node is the process node; A process initiates a network connection relationship, wherein the source node of the process initiates the network connection relationship is the process node and the destination node is the network connection node; The process accepts a network connection relationship, wherein the source node of the process accepting the network connection relationship is the network connection node, and the destination node is the process node; A process accesses a file relationship, wherein the source node of the process accesses the file relationship is the process node and the destination node is the file node; A process access registry relationship, wherein the source node of the process access registry relationship is the process node and the destination node is the registry node; Login creates a service process relationship, wherein the source node of the login creates a service process relationship is the login node and the destination node is the process node.

3. The method according to claim 1, characterized in that The deleting nodes and edges related to the non-attack chain in the first causal relationship graph to obtain a second causal relationship graph includes: In the first causal relationship graph, free nodes that have no connection edges with other nodes are deleted to obtain a third causal relationship graph; Based on the benign nodes in the whitelist, deleting the benign nodes and the edges connected to the benign nodes in the third causal relationship graph to obtain a fourth causal relationship graph; The first subgraph that does not include the attack context is deleted from the fourth causal relationship graph to obtain the second causal relationship graph, wherein the first subgraph includes only two nodes and an edge connected by the two nodes, and there is no connecting edge between the two nodes and other nodes in the fourth causal relationship graph.

4. The method according to claim 1, characterized in that: The determining of a plurality of attack sequences based on the second causal relationship graph comprises: Based on the second causal relationship graph, determine a plurality of second subgraphs, wherein the second subgraph includes at least three nodes, and any node has at least one edge with other nodes in the second subgraph; For each of the second subgraphs, extract triple events from the second subgraph respectively to obtain multiple triple events, and sort the multiple triple events according to the timestamps of event occurrence to obtain an attack sequence corresponding to the second subgraph, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the first triple event of two adjacent triple events is the source node of the second triple event; The plurality of attack sequences are determined based on the attack sequences corresponding to the second subgraphs.

5. A network attack detection method, characterized in that: include: Acquire an event sequence of network behavior, wherein the event sequence includes a plurality of triple events sorted according to timestamps of event occurrence, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the third triple event in two adjacent triple events is the source node of the fourth triple event; The event sequence is input into the target network attack model described in any one of claims 1 to 4 to obtain the detection result of the network behavior output by the target network attack model, wherein the detection result is an attack behavior or a non-attack behavior.

6. A network attack model training device, characterized in that: include: A connection relationship determination module searches for a connection relationship between two nodes having the same relationship as any relationship in the causal relationship mechanism in the log data of the target network based on a preset causal relationship mechanism, and obtains a plurality of connection relationships; A first causal graph determination module, configured to construct a first causal relationship graph based on the plurality of connection relationships, wherein the first causal relationship graph includes a plurality of nodes and a plurality of edges formed by connecting two of the nodes; A second causal graph determination module, configured to delete nodes and edges related to non-attack chains in the first causal relationship graph to obtain a second causal relationship graph; an attack sequence determination module, configured to determine a plurality of attack sequences based on the second causal relationship graph, wherein the attack sequence comprises triple events arranged in chronological order, and the triple events comprise a source node, an edge, and a destination node; The model training module is used to train a target network attack model based on the multiple attack sequences.

7. The system according to claim 6, characterized in that The second causal graph determination module includes: A free node deletion unit, used to delete free nodes that have no connection edges with other nodes in the first causal relationship graph, so as to obtain a third causal relationship graph; A benign node deletion unit, configured to delete the benign nodes and edges connected to the benign nodes in the third causal relationship graph based on the benign nodes in the whitelist, to obtain a fourth causal relationship graph; A subgraph deletion unit is used to delete a first subgraph that does not include an attack context in the fourth causal relationship graph to obtain the second causal relationship graph, wherein the first subgraph includes only two nodes and an edge connected by the two nodes, and there is no connecting edge between the two nodes and other nodes in the fourth causal relationship graph.

8. The system according to claim 6, characterized in that The attack sequence determination module includes: A subgraph determining unit, configured to determine a plurality of second subgraphs based on the second causal relationship graph, wherein the second subgraphs include at least three nodes, and any one of the nodes has at least one edge with other nodes in the second subgraph; An event extraction unit is used to extract triple events from each of the second subgraphs to obtain a plurality of triple events, and sort the plurality of triple events according to the timestamps of event occurrence to obtain an attack sequence corresponding to the second subgraph, wherein the triple event includes a source node, an edge, and a destination node, and the destination node of the first triple event of two adjacent triple events is the source node of the second triple event; A sequence determination unit is used to determine the multiple attack sequences based on the attack sequences corresponding to the second subgraphs.

9. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5.

Images