Attack technique clustering and attribution method for attack mode

Abstract

The invention provides an attack technique clustering and attributing method for attack modes, and relates to the technical field of network security. The attack technique clustering and attributing method comprises the following steps: collecting threat intelligence original data and extracting data based on a large language model to obtain attack information; inputting the attack information into a retrieval enhancement generation framework to generate a triple, and fusing the triple with a network security knowledge graph to obtain TTPs data; clustering TTPs data based on a Gaussian mixture clustering model, and enhancing the Gaussian mixture clustering model based on the structure entropy of TTP nodes to obtain a soft clustering result; and constructing attack trees based on a soft clustering result, carrying out weight distribution based on an attention mechanism, and carrying out matching on the attack trees in the knowledge graph based on a similarity calculation method to obtain an attribution result. According to the method, a complete attack behavior attribution implementation framework is provided, the advantages of the frontier technology are combined, and efficient, accurate, reliable, extensible and high-interpretability attribution can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack technique clustering and attribution method for attack patterns. Background Art

[0002] In the field of network security, with the continuous evolution of existing attack methods, the attack methods of attack organizations are becoming more and more complex and difficult to judge. Traditional detection methods and systems are difficult to deal with complex attacks such as advanced persistent threats (APT). However, the attack mode defined by MITRE ATT&CK, namely tactics, techniques and procedures (TTPs), is a deep-level characterization of attack methods, highlighting the behavioral style and habitual characteristics of attackers. Therefore, how to more efficiently and accurately mine information related to attack activities from Cyber ​​Threat Intelligence (CTI) and cluster and attribute attack methods has become one of the core challenges in the current network security field. The efficient use of TTPs has become an important research direction for us when formulating security protection strategies.

[0003] In the field of TTPs extraction, existing methods are mainly divided into two categories: one is rule-based methods; the other is deep learning-based methods. However, rule-based methods cannot handle changing text patterns and rely on known attack patterns, rules or templates. Once the attack method changes, there is a high probability that recognition will fail; and deep learning-based extraction methods often require a large amount of labeled data for training. However, the acquisition cost of labeled data is high, and the data in many CTI reports may not be strictly standardized or cleaned, resulting in inconsistent training data quality and unstable model generalization ability. Therefore, it is difficult to obtain a deep learning model that can capture contextual relationships and perform well in task execution.

[0004] In addition, the main existing methods for attributing attack behaviors are malware sample-based attribution and threat analysis report-based attribution. In the malware sample-based attribution method, malware can be modified, shared, or sold, which makes it difficult to accurately locate the true source of a network attack, and relying on malware signatures may miss coordinated, multi-faceted attacks involving multiple attack vectors and tools; in the threat analysis report-based attribution method, only the vocabulary in the report is used for comparison, and it is impossible to identify the features that contribute to the attribution classification, so as to understand their impact and build a reliable attribution model.

[0005] Therefore, it is urgent to provide a solution to solve the above problems. Summary of the invention

[0006] The purpose of the present invention is to provide an attack technique clustering and attribution method for attack patterns, which improves the ability of existing technologies to extract important information from threat intelligence, as well as the accuracy and reliability of attribution.

[0007] The present invention provides an attack method clustering and attribution method for attack patterns using the following technical solutions:

[0008] Collect raw threat intelligence data and perform normalization processing to obtain experimental data. Formulate prompt words for a large language model based on the ontology definition specification of the open source network security knowledge graph and extract experimental data to obtain attack information.

[0009] Input the attack information into the retrieval enhancement generation framework to obtain entity attributes with added context information, generate entity attribute triples based on relationship connections, and fuse the triples with the network security knowledge graph to obtain TTPs data;

[0010] The deep feature representation of TTPs data is learned based on the autoencoder, the Gaussian mixture clustering model is trained based on the deep feature representation, and the soft clustering result is obtained by enhancing the Gaussian mixture clustering model based on the structural entropy of the TTP nodes;

[0011] The soft clustering result is used to generate an attack vector based on the life cycle stage, and an attack tree is constructed based on the attack vector as the main branch node and attribute information is added as a child node of the branch node. The nodes in the attack tree are weighted based on the attention mechanism to obtain a threat intelligence attack tree. The threat intelligence attack tree is matched with the attack tree in the knowledge graph based on a similarity calculation method to obtain the attack organization as the root node, thereby obtaining the attribution result.

[0012] Optionally, the process of collecting raw threat intelligence data and normalizing it to obtain experimental data includes: collecting raw threat intelligence data based on a threat intelligence data source, removing irrelevant content in the raw threat intelligence data, including advertisements, repeated information, and garbled characters, and dividing data with threat intelligence content greater than a first threshold into small semantic units, and normalizing similar semantic expressions to obtain experimental data; the threat intelligence data source includes threat intelligence reports, security logs, and forum blogs.

[0013] Optionally, the process of inputting the attack information into the retrieval enhancement generation framework to obtain entity attributes for adding context information includes: inputting the attack information into the retrieval enhancement generation framework, the retrieval enhancement generation framework performs real-time retrieval based on an external knowledge base, and inputs the retrieved relevant information as context into the generation model to obtain entity attributes for adding context information.

[0014] Optionally, the process of learning the deep feature representation of TTPs data based on the autoencoder includes: learning the TTPs data based on the autoencoder, and capturing the intrinsic structure and distribution of the data in the learning process to obtain the deep feature representation.

[0015] Optionally, the process of training a Gaussian mixture clustering model based on deep feature representation includes: describing 14 clustering types based on 14 Gaussian distributions, constructing a Gaussian mixture clustering model based on the 14 clustering types, and maximizing the likelihood of the deep feature representation by adjusting parameters of the Gaussian distribution, the 14 clustering types are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

[0016] Optionally, the process of obtaining a soft clustering result based on the structural entropy enhanced Gaussian mixture clustering model of the TTP node includes: calculating the degree distribution of the local k-hop subgraph of the TTP node, calculating the structural entropy of the TTP node based on the degree distribution, normalizing the deep feature representation and the structural entropy, adding a feature dimension to the deep feature representation, using the structural entropy value as an additional feature, and ignoring the data of the TTP node when the structural entropy value is greater than a second threshold, thereby improving the robustness of the clustering model.

[0017] Optionally, in the process of calculating the degree distribution of the local k-hop subgraph based on the TTP node, the following formula is used for calculation:

[0018]

[0019] Among them, p u is the degree distribution of the local k-hop subgraph of the target node v, d u is the degree of node u, u′ is the adjacent node of node u, v is the target node, V k (v) is a node set.

[0020] Optionally, in the process of calculating the structural entropy of the TTP node based on the degree distribution, the following formula is used for calculation:

[0021]

[0022] Among them, H k(v) is the structural entropy of the k-hop subgraph of the target node, p u is the degree distribution of the local k-hop subgraph of the target node v, V k (v) is a node set, and u is any node in the set.

[0023] Optionally, in the process of constructing an attack tree based on the attack vector as the main branch node, attribute information is added as a child node of the branch node, and the attribute information includes: malware, vulnerability, tool scale, activity duration, and number of campaigns launched.

[0024] Optionally, the process of matching the threat intelligence attack tree with the attack tree in the knowledge graph based on a similarity calculation method to obtain the attack organization as the root node includes: matching the threat intelligence attack tree with the attack tree in the knowledge graph based on a similarity calculation method, and taking the attack organization connected to the attack tree in the knowledge graph as the root node of the threat intelligence attack tree when and only when the similarity between the input threat intelligence attack tree and the attack tree in the knowledge graph is greater than a third threshold.

[0025] The present invention provides an attack method clustering and attribution method for attack patterns, which has the following beneficial effects:

[0026] 1. The present invention uses a large language model to efficiently and accurately extract important information from threat intelligence, breaking through the limitations of the existing technology, which is insufficient extraction flexibility, inability to process complex texts, and low accuracy;

[0027] 2. The present invention supplements the extracted information through the retrieval enhancement generation framework, solving the problem of scarcity of available information for general threat intelligence. The multi-source information enhancement model understands and analyzes attack behaviors, and prepares a richer and more comprehensive data source for attributing attack behaviors.

[0028] 3. The present invention uses structural entropy to enhance the deep clustering model and classify TTPs according to the life cycle stage, constructs an effective attack vector, and facilitates hierarchical mining of deep features in the attack mode. At the same time, it solves the problem that the traditional Gaussian mixture model is easily affected by noise values. This innovative clustering solution solves the problem that the artificial construction of clustering features is complicated and has low usability, automatically constructs high-quality data features, and combines statistical theory to build a reliable and efficient clustering model. The enhancement of structural entropy greatly increases the robustness of the model.

[0029] 4. The attribution strategy of the present invention combines the knowledge graph and the attack tree to construct a time series of attack behaviors with broader associated information and clearer hierarchical relationships. The attention mechanism is used to dynamically allocate weights, so that the model can focus on the role of key TTPs, thereby improving the accuracy and reliability of attribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A flow chart of the attack method clustering and attribution method provided by the present invention;

[0031] Figure 2 An example diagram of the attack method clustering and attribution method provided by the present invention;

[0032] Figure 3 A schematic diagram of the retrieval enhancement generation framework flow provided by the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0034] The embodiment of the present invention provides an attack method clustering and attribution method for attack patterns, see Figure 1 ,include:

[0035] S1. Collect the original threat intelligence data and perform normalization processing to obtain experimental data. Based on the ontology definition specification of the open source network security knowledge graph, formulate the prompt words of the large language model and extract the experimental data to obtain attack information.

[0036] S2. Input the attack information into the retrieval enhancement generation framework to obtain entity attributes with added context information, generate entity attribute triples based on relationship connections, and fuse the triples with the network security knowledge graph to obtain TTPs data;

[0037] S3, learn the deep feature representation of TTPs data based on the autoencoder, train the Gaussian mixture clustering model based on the deep feature representation, and obtain the soft clustering result based on the structural entropy enhancement of the Gaussian mixture clustering model of TTP nodes;

[0038] S4. Generate an attack vector based on the life cycle stage based on the soft clustering result, build an attack tree based on the attack vector as the main branch node and adding attribute information as the child node of the branch node, assign weights to the nodes in the attack tree based on the attention mechanism to obtain a threat intelligence attack tree, match the threat intelligence attack tree with the attack tree in the knowledge graph based on the similarity calculation method to obtain the attack organization as the root node, and thus obtain the attribution result.

[0039] In some embodiments, the process of executing step S1 includes:

[0040] S1.1. Collect raw threat intelligence data and perform normalized processing to obtain experimental data;

[0041] S1.2. Based on the ontology definition specification of the open source network security knowledge graph, formulate the prompt words of the large language model and extract experimental data to obtain attack information.

[0042] Specifically, the process of executing step collection S1.1 includes: collecting threat intelligence raw data based on a threat intelligence data source, removing irrelevant content in the threat intelligence raw data, including advertisements, repeated information, and garbled characters, and dividing data with threat intelligence content greater than a first threshold into small semantic units, and normalizing similar semantic expressions to obtain experimental data; the threat intelligence data source includes threat intelligence reports, security logs, and forum blogs.

[0043] Furthermore, in step S1.2, prompt words of the large language model are formulated based on the ontology definition specification of the open source network security knowledge graph to guide the large model to extract the information required in the graph from the threat intelligence data, especially focusing on the extraction of TTPs.

[0044] In some embodiments, the process of executing step S2 includes:

[0045] S2.1, input the attack information into the retrieval enhancement generation framework to obtain entity attributes with added context information;

[0046] S2.2. Generate entity attribute triples based on relationship connections, and fuse the triples with the network security knowledge graph to obtain TTPs data.

[0047] Specifically, the process of executing step S2.1 includes: inputting the attack information into the retrieval enhancement generation framework, the retrieval enhancement generation framework performs real-time retrieval based on the external knowledge base, and inputting the retrieved relevant information as context into the generation model to obtain entity attributes with added context information.

[0048] Further, execute step S2.2 to generate entity attribute triples based on relationship connections, and fuse the generated "entity-relationship-entity" triples with the network security knowledge graph to obtain TTPs data.

[0049] In some embodiments, the process of executing step S3 includes:

[0050] S3.1, deep feature representation of TTPs data learned based on autoencoder;

[0051] S3.2, training Gaussian mixture clustering model based on deep feature representation;

[0052] S3.3, and obtain the soft clustering results based on the structural entropy enhanced Gaussian mixture clustering model of TTP nodes.

[0053] Specifically, the process of executing step S3.1 includes: learning TTPs data based on the autoencoder, and capturing the intrinsic structure and distribution of the data in the learning process to obtain deep feature representation.

[0054] Specifically, the process of executing step S3.2 includes: describing 14 clustering types based on 14 Gaussian distributions, each Gaussian distribution represents a cluster center, building a Gaussian mixture clustering model based on the 14 clustering types, and maximizing the likelihood of deep feature representation by adjusting the parameters of the Gaussian distribution. The 14 clustering types are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

[0055] In fact, Reconnaissance and Resource Development can be used to cluster the reconnaissance and resource development information in the attack preparation phase, Initial Access and Execution can be used to cluster the initial access and execution information in the initial intrusion phase, Persistence, Privilege Escalation, and Defense Evasion can be used to cluster the information in the access maintenance and privilege escalation phases, Credential Access, Discovery, and Lateral Movement can be used to cluster the information in the in-depth exploration and information collection phases, Collection, Command and Control can be used to cluster the information in the data collection and command and control phases, and Exfiltration and Impact can be used to cluster the information in the data exfiltration and impact phases. Based on the 14 clustering types, the complete life cycle of the attack behavior can be covered.

[0056] Specifically, the process of executing step S3.3 includes: calculating the degree distribution of the local k-hop subgraph of the TTP node, calculating the structural entropy of the TTP node based on the degree distribution, normalizing the deep feature representation and the structural entropy, adding a feature dimension to the deep feature representation, using the structural entropy value as an additional feature, and ignoring the data of the TTP node when the structural entropy value is greater than a second threshold, thereby improving the robustness of the clustering model.

[0057] Furthermore, in the process of calculating the degree distribution of the local k-hop subgraph based on the TTP node, the following formula is used for calculation:

[0058]

[0059] Among them, p u is the degree distribution of the local k-hop subgraph of the target node v, d u is the degree of node u, u′ is the adjacent node of node u, v is the target node, V k (v) is a node set.

[0060] Furthermore, in the process of calculating the structural entropy of the TTP node based on the degree distribution, the following formula is used for calculation:

[0061]

[0062] Among them, H k (v) is the structural entropy of the k-hop subgraph of the target node, p u is the degree distribution of the local k-hop subgraph of the target node v, V k (v) is a node set, and u is any node in the set.

[0063] In fact, the Gaussian mixture clustering model is sensitive to outliers or noise points, so the structural entropy is used to measure the local connection pattern and stability of the TTP node. The larger the structural entropy value, the more likely the noise information connected to the TTP is, which will lead to structural instability. Therefore, when the structural entropy value is greater than the second threshold, the data of the TTP node is ignored, which can improve the robustness of the clustering model.

[0064] In some embodiments, the process of executing step S4 includes:

[0065] S4.1. Construct an attack tree;

[0066] S4.2. Based on the attention mechanism, weights are assigned to nodes in the attack tree to obtain a threat intelligence attack tree.

[0067] S4.3. Based on the similarity calculation method, the threat intelligence attack tree is matched with the attack tree in the knowledge graph to obtain the attack organization as the root node.

[0068] Specifically, the process of executing step S4.1 includes: generating an attack vector based on the soft clustering result based on the life cycle stage, which represents the sequence of actions of the attacker during the attack process; further, based on the attack vector as the main branch node, adding attribute information as a child node of the branch node to construct an attack tree.

[0069] Furthermore, in the process of constructing an attack tree based on the attack vector as the main branch node, attribute information is added as a child node of the branch node, and the attribute information includes: malware, vulnerability, tool scale, activity duration, and number of campaigns launched.

[0070] Specifically, in the process of executing step S4.2, it includes: introducing an attention mechanism to give different degrees of attention to different parts of the attack tree. Specifically, under this mechanism, the weight of the main branch is higher than that of the side branch node, because the importance of different stages in the attack process may be different; in addition, the nodes on the main branch will also be given different weights according to their role and frequency in the attack process (such as the Reconnaissance stage is usually lower than the Impact stage). This weight distribution mechanism can more accurately reflect the criticality of the TTP sequence and effectively weaken the interference of noise data or secondary information.

[0071] Furthermore, the process of executing step S4.3 includes: matching the threat intelligence attack tree with the attack tree in the knowledge graph based on a similarity calculation method, and using the attack organization connected to the attack tree in the knowledge graph as the root node of the threat intelligence attack tree when and only when the similarity between the input threat intelligence attack tree and the attack tree in the knowledge graph is greater than a third threshold.

[0072] In other embodiments, see Figure 2 ,include:

[0073] Collect threat intelligence and perform data preprocessing. Formulate prompt words for the large language model based on the ontology definition specification of the network security knowledge graph. Transfer threat intelligence data into the large language model in batches. Add contextual content to the threat intelligence data based on retrieval enhancement generation. Extract triples and entity attributes and fuse them with the network security knowledge graph to obtain TTPs data. Build a GMM clustering model based on 14 clustering types of the life cycle, input TTPs data into the GMM clustering model, and enhance the structural stability of the GMM clustering model by extracting k-hop subgraphs to calculate the structural entropy of TTP nodes, and output the soft clustering results. Build an attack tree based on the soft clustering results, and match the threat intelligence attack tree with the attack tree in the knowledge graph based on the attention matching mechanism to obtain the attribution result.

[0074] For further information, see Figure 3 In the process of adding contextual content to threat intelligence data based on retrieval enhancement generation, the large language model LLM is first input with threat intelligence data text and prompts used to instruct and guide the model to produce specific outputs. Then, contextual content is added to the threat intelligence data based on the external knowledge base and returned to the large language model, and finally entity attribute triples based on relationship connections are output.

[0075] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A method for clustering and attributing attack methods for attack patterns, characterized in that: The following steps are involved: Collect raw threat intelligence data and perform normalization processing to obtain experimental data. Formulate prompt words for a large language model based on the ontology definition specification of the open source network security knowledge graph and extract experimental data to obtain attack information. Input the attack information into the retrieval enhancement generation framework to obtain entity attributes with added context information, generate entity attribute triples based on relationship connections, and fuse the triples with the network security knowledge graph to obtain TTPs data; The deep feature representation of TTPs data is learned based on the autoencoder, the Gaussian mixture clustering model is trained based on the deep feature representation, and the soft clustering result is obtained by enhancing the Gaussian mixture clustering model based on the structural entropy of the TTP nodes; The soft clustering result is used to generate an attack vector based on the life cycle stage, and an attack tree is constructed based on the attack vector as the main branch node and attribute information is added as a child node of the branch node. The nodes in the attack tree are weighted based on the attention mechanism to obtain a threat intelligence attack tree. The threat intelligence attack tree is matched with the attack tree in the knowledge graph based on a similarity calculation method to obtain the attack organization as the root node, thereby obtaining the attribution result.

2. According to claim 1, the attack method clustering and attribution method for attack patterns is characterized in that: The process of collecting raw threat intelligence data and normalizing it to obtain experimental data includes: Based on the threat intelligence data source, threat intelligence raw data is collected, and irrelevant content in the threat intelligence raw data is removed, including advertisements, repeated information, and garbled characters, and data with threat intelligence content greater than a first threshold is divided into small semantic units, and similar semantic expressions are normalized at the same time, so as to obtain experimental data; the threat intelligence data source includes threat intelligence reports, security logs, and forum blogs.

3. According to claim 1, the attack method clustering and attribution method for attack patterns is characterized in that: The process of inputting attack information into the retrieval enhancement generation framework to obtain entity attributes with added contextual information includes: The attack information is input into a retrieval enhancement generation framework, which performs real-time retrieval based on an external knowledge base, and inputs the retrieved relevant information into a generation model as context to obtain entity attributes with added context information.

4. According to claim 1, the attack method clustering and attribution method for attack patterns is characterized in that: The process of learning the deep feature representation of TTPs data based on the autoencoder includes: The TTPs data is learned based on the autoencoder, and the intrinsic structure and distribution of the data are captured during the learning process to obtain deep feature representation.

5. The attack method clustering and attribution method for attack patterns according to claim 1, characterized in that: The process of training a Gaussian mixture clustering model based on deep feature representation includes: Based on 14 Gaussian distributions, 14 clustering types are described. A Gaussian mixture clustering model is constructed based on the 14 clustering types. The likelihood of deep feature representation is maximized by adjusting the parameters of the Gaussian distribution. The 14 clustering types are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, CredentialAccess, Discovery, LateralMovement, Collection, Command and Control, Exfiltration, and Impact.

6. The attack method clustering and attribution method for attack patterns according to claim 1, characterized in that: The process of obtaining soft clustering results based on the structural entropy enhanced Gaussian mixture clustering model of TTP nodes includes: The degree distribution of the local k-hop subgraph of the TTP node is calculated, and the structural entropy of the TTP node is calculated based on the degree distribution. The deep feature representation and the structural entropy are normalized, a feature dimension is added to the deep feature representation, and the structural entropy value is used as an additional feature. When the structural entropy value is greater than a second threshold, the data of the TTP node is ignored, thereby improving the robustness of the clustering model.

7. The attack method clustering and attribution method for attack patterns according to claim 6, characterized in that: When calculating the degree distribution of a local k-hop subgraph based on a TTP node, the following formula is used: Among them, p u is the degree distribution of the local k-hop subgraph of the target node v, d u is the degree of node u, u′ is the adjacent node of node u, v is the target node, V k (v) is a node set.

8. The attack method clustering and attribution method for attack patterns according to claim 7, characterized in that: In the process of calculating the structural entropy of the TTP node based on the degree distribution, the following formula is used for calculation: Among them, H k (v) is the structural entropy of the k-hop subgraph of the target node, p u is the degree distribution of the local k-hop subgraph of the target node v, V k (v) is a node set, and u is any node in the set.

9. The attack method clustering and attribution method for attack patterns according to claim 1, characterized in that: In the process of constructing an attack tree based on the attack vector as the main branch node and adding attribute information as the child node of the branch node, the attribute information includes: malware, vulnerability, tool scale, activity duration, and number of campaigns launched.

10. The attack method clustering and attribution method for attack patterns according to claim 1, characterized in that: The process of matching the threat intelligence attack tree with the attack tree in the knowledge graph based on the similarity calculation method to obtain the attack organization as the root node includes: The threat intelligence attack tree is matched with the attack tree in the knowledge graph based on the similarity calculation method. If and only if the similarity between the input threat intelligence attack tree and the attack tree in the knowledge graph is greater than a third threshold, the attack organization connected to the attack tree in the knowledge graph is used as the root node of the threat intelligence attack tree.

Images