APT attack detection method based on log traceability graph

Abstract

The invention discloses an APT attack detection method based on a log traceability graph, and belongs to the technical field of network security. In order to solve the problem of concealment of APT attacks at a system entity level in the prior art, the method mainly adopts the combination of a log traceability graph and a text sentiment analysis technology, and effectively enhances the predictive ability and mobility of an intrusion detection system by means of traceability graph construction, sentence representation, multi-task pre-training learning and the like. According to the invention, efficient and accurate detection of APT attacks at a system entity level can be realized, the precision and applicability of an intrusion detection system are improved, the method adapts to different system environments, and the identification capability of potential threats is enhanced.

Description

Technical Field

[0001] The invention relates to an APT attack detection method based on a log source tracing graph, and belongs to the technical field of network security. Background Art

[0002] Advanced persistent threats (APTs) pose a significant challenge to network security because they can remain undetected in target networks for months or even years. During the long existence of APTs, the system generates a large number of audit logs, which increases the complexity of detection. To combat APT attacks, some recent studies have proposed the use of provenance graphs, where nodes represent system entities (such as processes, files, sockets, etc.) and edges represent interactions between them. This method converts the original system audit logs into structured graph records, effectively captures large-scale system audit logs, and provides a comprehensive view of system behavior during the APT life cycle.

[0003] Existing provenance-based intrusion detection systems (PIDS) are mainly divided into two types: graph-granular and node-granular. Graph-granular PIDS, such as StreamSpot, UNICORN, and ProvDetector, usually split the graph into subgraphs, use various methods to extract subgraph features, and apply clustering algorithms to detect malicious graphs. However, due to the low-speed attack strategy of APTs and the insensitivity of graph features to low-density threat-related entities, these methods are not effective against APTs with higher concealment. To address these problems, node-granular methods, such as THREATRACE, MAGIC, KAIROS, and SIGL, focus on extracting features of single system entities to identify malicious entities.

[0004] Despite the progress, current PIDS still face some key challenges: (1) APTs often exhibit concealment at the system entity level. For example, malicious processes often perform normal activities while performing malicious operations. This strategy of mixing normal activities with malicious activities is common in APT attacks, but existing methods have difficulty detecting such behaviors. (2) Existing methods lack predictive capabilities, which are crucial for proactively defending against future attacks. (3) Existing methods are usually trained on specific systems, which limits their transferability across different environments.

[0005] Similar challenges have been addressed in the field of sentiment analysis. Sentiment analysis and intrusion detection have similar structures (see Figure 1). In sentiment analysis, reviewers may express different emotions about different aspects of the same target. Researchers revealed hidden emotions by shifting the focus of analysis from broader targets or aspects to target-aspect pairs. For intrusion detection, it is difficult to identify malicious entities participating in normal activities using the features of a single system entity (system entity-level concealment). To this end, the detection granularity should be further refined beyond the level of a single system entity. By considering both the subject (process) and the object (process, file, socket) at the same time, threat detection and prediction capabilities can be enhanced. Summary of the invention

[0006] The purpose of the present invention is to solve the problems existing in the prior art, introduce pre-training and sentiment analysis into the field of intrusion detection based on tracing graphs, and propose a new APT detection method based on log tracing graphs. This method combines log tracing graphs and text sentiment analysis technology, which can effectively deal with the concealment of APT attacks at the system entity level.

[0007] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0008] A method for detecting APT attacks based on log tracing graphs includes the following steps:

[0009] 1) Construct a traceability graph: Collect and analyze system audit logs, extract system entities and their interactions, and construct a traceability graph, with entities represented as nodes and interactions represented as undirected edges;

[0010] 2) Sentence construction and representation: Calculate the intimacy matrix between nodes in the traceability graph, extract related nodes according to the intimacy, construct sentences corresponding to the subject nodes and sentences corresponding to the object nodes, and then connect them into subject-object sentence pairs; extract the structural features (Simple-WL), time series features (TS-Id), position features (Position) and segment features (Segment) of each node in the subject-object sentence pair, and construct a feature embedding sequence;

[0011] 3) Pre-training: Construct two pre-training tasks: interaction or non-interaction prediction and node type reconstruction. Input the feature embedding sequence into the BERT model to perform these two pre-training tasks and predict the relationship between subject and object sentence pairs and the type of object node.

[0012] 4) Fine-tuning and detection: Based on the pre-trained BERT model, use specific labeled log data for fine-tuning, and use the fine-tuned BERT model to detect malicious behavior.

[0013] Furthermore, in step 1), two strategies are used to simplify the traceability graph:

[0014] Ignore the directionality of the interactions and convert the graph into an undirected graph;

[0015] Focuses on the existence of interactions between entities, ignoring the type and frequency of interactions.

[0016] Furthermore, in step 2), the intimacy matrix of the nodes in the traceability graph is calculated by the PageRank algorithm.

[0017] Furthermore, the method of extracting related nodes and constructing sentences according to intimacy in step 2) is: for each node, extract a group of related nodes with high intimacy by sorting by intimacy; regard the nodes as words, and form a sentence with the current node and the extracted related nodes.

[0018] Furthermore, step 2) of extracting the structural features of each node includes:

[0019] Assign a color to each node based on its degree;

[0020] Traverse each node in the traceability graph, calculate the colors of the neighbors of the current node, and form the calculated colors into a set and arrange them in order; and add the color of the current node itself to the front of the set;

[0021] The color set is mapped to a structural feature index through a predefined dictionary to obtain the structural feature of each node.

[0022] Furthermore, when performing interactive or non-interactive prediction tasks in step 3), directly connected subject-object node pairs are selected 50% of the time, and non-directly connected subject-object node pairs are selected 50% of the time to predict whether there is malicious behavior between the subject node and the object node to learn sentence-level information.

[0023] Furthermore, when performing the node type reconstruction task in step 3), the [MASK] tag is used to mask the structural features and predict the type of the object node to learn the node-level information.

[0024] Furthermore, in step 3), the structural features are processed as follows:

[0025] 80% of the time, the [MASK] tag is used;

[0026] 10% of the time, a random structural feature index is used;

[0027] 10% of the time, keep the structural feature index unchanged.

[0028] Furthermore, in step 3), an interaction or non-interaction prediction loss function and a node type reconstruction loss function are constructed, and the sum of these two loss functions is used as the final pre-training loss function, and the model parameters are optimized with the goal of minimizing the final pre-training loss;

[0029] The loss function for interactive or non-interactive prediction is:

[0030]

[0031] Among them, sp represents the subject-object sentence pair; The real label indicating whether there is a direct connection between the subject and object node pairs in sp; D p represents the pre-training dataset; Represents the probability distribution vector of direct connection labels and indirect connection labels between subject and object node pairs; Represents the main node feature embedding sequence in the sentence corresponding to the main node, represents the object node feature embedding sequence in the sentence corresponding to the object node, W 1 and b 1 Represents trainable model parameters;

[0032] The node type reconstruction loss function is:

[0033]

[0034] Among them, sp represents the subject-object sentence pair; Represents the object node v in sp j The real node type; D p represents the pre-training dataset; Represents the probability distribution vector on node types; represents the object node feature embedding sequence in the sentence corresponding to the object node, W 2 and b 2 Represents trainable model parameters.

[0035] Furthermore, when fine-tuning the pre-trained BERT model in step 4), a subject-object sentence pair is input to predict whether malicious behavior exists between the subject node and the object node; a loss function is calculated, which is the same as the interaction or non-interaction prediction loss function, and the model parameters are optimized with the goal of minimizing the loss.

[0036] The beneficial effects achieved by the present invention are as follows:

[0037] 1. The present invention draws on the detection granularity of the target aspect in sentiment analysis technology - subject-object pair, effectively dealing with the concealment of APT attacks at the system entity level and enhancing the prediction capability.

[0038] 2. The present invention significantly improves the portability of the intrusion detection system by introducing pre-training and fine-tuning technology in natural language processing, enabling it to adapt to different system environments.

[0039] 3. The present invention regards the interactive behaviors between system entities as similar to the information flow in natural language, and applies sentiment analysis technology to analyze the "text" extracted from the traceability graph to infer the "emotional" tendency of the subject towards the object, thereby identifying potential threats.

[0040] 4. During the pre-training stage of unlabeled data, the present invention designs two pre-training tasks for traceability graphs, which can capture rich contextual information at the system entity level and the subject-object pair level, providing a solid foundation for detection.

[0041] 5. The present invention proposes two new feature tag types - Simple-WL and TS-Id, which combine sentence structure to effectively encode traceability graph information and enrich the representation of text information.

[0042] 6. The present invention has been verified through experiments that the detection performance is better than the existing methods, and the overall accuracy, precision, recall rate and F1 value have been significantly improved. It can effectively combat the concealment of APT at the system entity level and has a certain predictive ability.

[0043] 7. The present invention uses the annotated data of a specific system for fine-tuning and generates a personalized detection model, effectively improving the accuracy and applicability of intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a structural comparison diagram between text sentiment analysis and intrusion detection.

[0045] Figure 2 It is an overall flow chart of the APT attack detection method based on the log tracing graph of the present invention.

[0046] Figure 3 It is a test result diagram of the transferability experiment of the present invention. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the purposes, features and advantages of the present invention more obvious and easy to understand, the technical core of the present invention is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0048] The embodiment of the present invention discloses an APT attack detection method based on a log traceability graph. The overall process is as follows: Figure 2 The specific steps are as follows:

[0049] 1. Construction of traceability graph

[0050] It analyzes audit logs collected from various logging infrastructures such as Windows ETW, Linux Audit, and CamFlow. It extracts system entities and their interactions to build a system-wide provenance graph, where entities are represented as nodes and interactions are represented as edges. In order to reduce the computational burden and improve detection efficiency without significantly affecting the intrusion detection effect, this paper adopts two strategies to simplify the provenance graph:

[0051] (i) Ignore the directionality of the interaction and convert the graph into an undirected graph;

[0052] (ii) Focus on the existence of interactions between entities, ignoring the type and frequency of these interactions.

[0053] 2. Sentence Construction and Representation

[0054] In order to extract sentences that reflect the current system status of each node, the nodes are regarded as words, a set of highly related nodes are identified for each node, and they are arranged into a sentence. When extracting related nodes for each node, in order to simultaneously consider direct and high-order connections in the graph, the present invention calculates the intimacy matrix through the PageRank algorithm, and the formula is:

[0055]

[0056] Among them, the factor α∈[0,1] is usually set to 0.15, I represents the identity matrix, and is the symmetric normalized adjacency matrix of the traceability graph G. Here, A is the adjacency matrix, D is a diagonal matrix, and its diagonal elements D(i,i) = ∑ j A(i,j). The element S(i,j) in the matrix represents the node v i and v j The higher the score, the higher the intimacy.

[0057] Based on the above calculated intimacy matrix S, with v i As the central node, a group of highly related nodes are extracted to form a sentence Sentence (v i ) to describe v i The formal definition of a sentence is as follows:

[0058] Definition: Given a traceability graph G, a node set V and its affinity matrix S, sorting S (excluding S(i,i)) in descending order will produce: Sort i ({S(i,j)|v j ∈V\{V i}})={S(i,i 1 ),S(i,i 2 ),...,S(i,i n)}, n=|V|-1. For node v i ∈V, its corresponding sentence is defined as:

[0059] The field of sentiment analysis proposes to construct auxiliary sentences with different goals and aspects, thereby transforming the sentiment analysis task into a sentence pair classification task. Sentences corresponding to the object node Form a subject-object pair (v i ,v j ) Therefore, this can effectively convert the intrusion detection task into a sentence pair classification task.

[0060] In order to better encode each word in a sentence (i.e., a node in a traceability graph), the present invention constructs two novel features: the structural feature Simple-WL and the temporal feature TS-Id. The present invention proposes a Simple-WL algorithm to extract the Simple-WL features of the traceability graph. The algorithm marks nodes according to their structural roles in the graph and assigns the same code to nodes with the same topological role. The calculation steps of the algorithm include:

[0061] (1) Input parameters: Input the provenance graph PG, which contains the node set V and the edge set E. The input color dictionary ColourDict and SimpleWL dictionary are used to determine the color and calculate the Simple-WL index according to the degree of the node, respectively.

[0062] (2) Node coloring: For each node v in the graph i , calculate its degree D i Then, by checking the node v i Whether the degree of falls within a certain degree interval in the color dictionary ColourDict is the node v i Assign a color. This process iterates over all color indexes (from 0 to the maximum color index MAX(ColourIndex)) and assigns a color value to the node.

[0063] (3) Calculate the Simple-WL index: For each node v i , first initialize an empty set S. Then, traverse v i All neighbor nodes v j , if v j The color of v is not in the set S, then j The color of v is added to the set S. Next, sort the set S and add v iThe color is added to the beginning of the set S.

[0064] (4) Mapping to Simple-WL index: Map the set S to the SimpleWL dictionary to obtain the node v i The corresponding Simple-WL index is returned as output.

[0065] The algorithm can be specifically expressed as the following process:

[0066]

[0067] While log provenance graphs enable IDS to correlate system behaviors over longer periods of time, they lack the temporal relationships inherent in sequential IDS. To address this limitation, the present invention designs a feature called TS-Id. Given the significant differences in system load over different time periods, the number of system entities may vary greatly, which makes it challenging to represent the temporal relationships between system entities based solely on time, so TS-Id is constructed based on the order in which the system entities (i.e., nodes in the provenance graph) are created. In order to limit the dictionary size and observe more log entries when slicing logs, the same TS-Id is assigned to n consecutively created system entities. Although increasing n allows more nodes to be observed simultaneously, it reduces the ability to accurately describe temporal relationships.

[0068] Then the present invention uses the embedding method of BERT to construct four layers of embedding, namely Simple-WL embedding, TS-Id embedding, position embedding and segment embedding. Among them, position embedding is used to represent the position of each node in the sentence, reflecting the degree of association between the node in the sentence and the central node (the beginning node of the sentence). The purpose of segment embedding is to serve as a marker to distinguish the sentences corresponding to the subject node and the object node in the sentence pair. The embedding vector of each node in the final sentence is the sum of these four embedding layers, and the sequence is obtained.

[0069] 3. Pre-training

[0070] In order to simultaneously learn node-level and sentence-level information, the present invention adopts a multi-task learning method and constructs two pre-training tasks: interaction or non-interaction prediction and node type reconstruction.

[0071] (1) Interactive or non-interactive prediction: Since the task is to predict the subject node v i and object node v j Is there any malicious behavior between the two nodes, that is, predict the relationship between the two sentences describing the two nodes, so an interactive or non-interactive pre-training task is designed to learn sentence-level information. In this task, predict the subject node v i and object node vj Whether there is an edge between the subject-object pairs (i.e., whether there is a direct interaction between the subject-object pairs in history). During training, 50% of the time, samples where the subject-object pairs are directly connected are selected and marked as "1", and 50% of the time, samples where the subject-object pairs are not directly connected are selected and marked as "0". and The summed vector is passed through a fully connected (FC) layer, an activation function, and a binary softmax classifier. More precisely, the probability distribution vector P on the “0 / 1” label 1 ∈R 2 It can be expressed as follows:

[0072]

[0073] Where W 1 ∈R H×2 and b 1 ∈R 2 is a trainable model parameter. The negative log-likelihood value is used as the loss function, which is defined as follows:

[0074]

[0075] Where sp represents a sentence pair, The true label describing whether there is a direct connection between the subject-object pair in sp, D p Represents the pre-training dataset.

[0076] (2) Node type reconstruction: Nodes in the provenance graph (i.e., system entities in the kernel) have different types, such as processes, files, sockets, etc. In order to learn node granularity information, a node type reconstruction task is designed to predict the object node v j Type (main node v i The type is relatively single). Since the Simple-WL feature may implicitly contain information about the node type, the tag [MASK] is used to mask it. In addition, since the [MASK] tag does not appear during fine-tuning, which will cause a mismatch between pre-training and fine-tuning, the present invention uses the following strategy for replacement:

[0077] (i) 80% of the time, the [MASK] tag was used;

[0078] (ii) 10% of the time, using a random Simple-WL index;

[0079] (iii) 10% of the time, keep the Simple-WL index unchanged.

[0080] Vector Through a fully connected (FC) layer, an activation function, and a softmax classifier. More precisely, the probability distribution vector P over node types 2 ∈R |type| It can be expressed as follows:

[0081]

[0082] Where W 2 ∈R H×|type| and b 2 ∈R |type| is a trainable model parameter, and |type| is the number of node types. The negative log-likelihood is used as the loss function, which is defined as follows:

[0083]

[0084] Among them, type Represents the object node v in sp j The actual node type.

[0085] In general, the final pre-training loss function is the sum of the above two losses, defined as follows:

[0086] L p =L 1 +L 2 Formula (8)

[0087] 4. Fine-tuning and testing

[0088] The present invention establishes a highly transferable general model through pre-training. On this basis, the model is adjusted using labeled log data from a specific terminal system to implement a customized intrusion detection system adapted to the specific system. Therefore, this method provides more accurate and effective protection for system security. In the fine-tuning and detection phases, the model uses the same input format as pre-training. For example, in predicting the input from the subject node v i To the object node v j When there is malicious behavior, use Sentence (v i ) and Sentence(v j ) is used as the model input. The BERT head used in the fine-tuning and detection stages is the same as the "interaction or no interaction prediction" pre-task, and the loss function is defined as follows:

[0089]

[0090] Where W 3 ∈R H×2 and b 3 ∈R 2 is the trainable model parameter, D fIndicates the fine-tuning dataset. label sp ∈{0,1} means that in sp=(Sentence(v i ),Sentence(v j )) described in the subject v i and object v j Specifically, “0” indicates that there is a true label of malicious behavior between v i to v j No malicious behavior, "1" means from v i to v j There is malicious behavior. According to the ratio of the number of malicious samples to benign samples in the training data, the training data of each class is allocated To alleviate the problem of data imbalance.

[0091] In addition, the present invention proposes two detection modes based on different subject-object pairs to be detected:

[0092] (i) General pattern: This pattern aims to detect potential threats between all interacting subject-object pairs within the system.

[0093] (ii) Targeted Protection Mode: This mode is designed specifically for systems with parts that should be protected (such as GPS signals in aviation management systems or financial databases in banking systems). It targets potential threats between all active subjects (processes) and highly sensitive objects (e.g., confidential files, high-security IP). This mode ensures the security of particularly weak areas within the system.

[0094] Experimental test:

[0095] The present invention conducts experiments on the full system log data set during several APT attacks, and uses the overall accuracy, precision, recall and F1 value to evaluate the detection performance. The present invention shows near-perfect detection performance on all data sets, which shows that it can effectively address the system entity-level concealment of APT. Table 1 shows the comparison results of the present invention method (hereinafter referred to as LOGSAID) and the existing state-of-the-art methods, and the results show that LOGSAID is always better than them in almost all scenarios.

[0096] Table 1: Performance comparison between the proposed method and the most advanced existing methods

[0097]

[0098] Figure 3The number of labeled samples required to transfer a pre-trained model to a specific system is shown, as well as the number of labeled samples required for pure supervised learning. The results show that fine-tuning a pre-trained model to a specific system requires significantly fewer labeled samples than pure supervised learning, demonstrating LOGSAID’s strong transferability and ability to reduce reliance on labeled data.

[0099] The above embodiments only express the implementation methods of the present invention, and the descriptions thereof are relatively specific, but they cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for detecting APT attacks based on log tracing graph, characterized in that: The following steps are involved: 1) Construct a traceability graph: Collect and analyze system audit logs, extract system entities and their interactions, and construct a traceability graph, with entities represented as nodes and interactions represented as undirected edges; 2) Sentence construction and representation: Calculate the intimacy matrix between nodes in the traceability graph, extract related nodes based on intimacy, construct sentences corresponding to subject nodes and sentences corresponding to object nodes, and then connect them into subject-object sentence pairs; extract the structural features, temporal features, position features, and segment features of each node in the subject-object sentence pair, and construct a feature embedding sequence; 3) Pre-training: Construct two pre-training tasks: interaction or non-interaction prediction and node type reconstruction. Input the feature embedding sequence into the BERT model to perform these two pre-training tasks and predict the relationship between subject and object sentence pairs and the type of object node. 4) Fine-tuning and detection: Based on the pre-trained BERT model, use specific labeled log data for fine-tuning, and use the fine-tuned BERT model to detect malicious behavior.

2. The method according to claim 1, characterized in that In step 1), the following two strategies are adopted to simplify the traceability graph: ignoring the directionality of the interaction and converting the graph into an undirected graph; Focuses on the existence of interactions between entities, ignoring the type and frequency of interactions.

3. The method according to claim 1, characterized in that In step 2), the intimacy matrix of the nodes in the traceability graph is calculated using the PageRank algorithm.

4. The method according to claim 1, characterized in that The method for extracting related nodes and constructing sentences according to intimacy in step 2) is as follows: for each node, extract a group of related nodes with high intimacy by sorting by intimacy; regard the nodes as words, and form a sentence with the current node and the extracted related nodes.

5. The method according to claim 1, characterized in that Step 2) extracting the structural features of each node includes: assigning a color to each node according to its degree; Traverse each node in the traceability graph, calculate the colors of the neighbors of the current node, and form the calculated colors into a set and arrange them in order; and add the color of the current node itself to the front of the set; The color set is mapped to a structural feature index through a predefined dictionary to obtain the structural feature of each node.

6. The method according to claim 1, characterized in that When performing interactive or non-interactive prediction tasks in step 3), directly connected subject-object node pairs are selected 50% of the time, and non-directly connected subject-object node pairs are selected 50% of the time to predict whether there is malicious behavior between the subject node and the object node to learn sentence-level information.

7. The method according to claim 1, characterized in that When performing the node type reconstruction task in step 3), the [MASK] tag is used to mask the structural features and predict the type of the object node to learn the node-level information.

8. The method according to claim 7, characterized in that In step 3), the structural features are processed as follows: 80% of the time, the [MASK] tag is used; 10% of the time, a random structural feature index is used; 10% of the time, keep the structural feature index unchanged.

9. The method according to claim 1, characterized in that In step 3), an interaction or non-interaction prediction loss function and a node type reconstruction loss function are constructed, and the sum of these two loss functions is used as the final pre-training loss function, and the model parameters are optimized with the goal of minimizing the final pre-training loss; The loss function for interactive or non-interactive prediction is: Among them, sp represents the subject-object sentence pair; The real label indicating whether there is a direct connection between the subject and object node pairs in sp; D p represents the pre-training dataset; Represents the probability distribution vector of direct connection labels and indirect connection labels between subject and object node pairs; Represents the main node feature embedding sequence in the sentence corresponding to the main node, represents the feature embedding sequence of the object node in the sentence corresponding to the object node, W1 and b1 represent the trainable model parameters; The node type reconstruction loss function is: Among them, sp represents the subject-object sentence pair; Represents the object node v in sp j The real node type; D p represents the pre-training dataset; Represents the probability distribution vector on node types; represents the object node feature embedding sequence in the sentence corresponding to the object node, and W2 and b2 represent trainable model parameters.

10. The method according to claim 1 or 9, characterized in that: When fine-tuning the pre-trained BERT model in step 4), input the subject-object sentence pair to predict whether there is malicious behavior between the subject node and the object node; calculate the loss function, which is the same as the interactive or non-interactive prediction loss function, and optimize the model parameters with the goal of minimizing the loss.

Images