Private cloud APT attack real-time detection method based on fusion traceability graph

Abstract

The invention discloses a private cloud APT attack real-time detection method based on a fusion traceability graph, and the method comprises the steps: generating a current fusion traceability graph through the current log data of a private cloud platform and a low-level behavior sequence pattern mined from historical log data, extracting the features of the current fusion traceability graph, and inputting the features into a GRU model of a time sequence dynamic threshold value, enhancing the output of the GRU model by adopting a multi-head attention mechanism to obtain enhanced feature expression; calculating an abnormal score based on the enhanced feature expression and a plurality of normal system behavior clusters of the private cloud platform, and determining whether a behavior corresponding to the enhanced feature expression is abnormal or not according to a size relationship between the abnormal score and a preset threshold value; the plurality of normal system behavior clusters are obtained by generating a historical fusion traceability graph by using historical log data, extracting enhanced feature expressions of the historical fusion traceability graph, and clustering the enhanced feature expressions of the historical fusion traceability graph. According to the method, APT attack detection can be efficiently and accurately realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and particularly relates to a real-time detection method for private cloud APT attacks based on a fusion traceability graph. Background Art

[0002] Advanced Persistent Threat (APT) attacks are a highly stealthy and complex form of cyber attack. Attackers usually gradually penetrate the target system through a carefully planned multi-stage attack chain. They are characterized by a long duration, strong concealment, and great destructiveness to the system. The process of APT attacks often includes multiple stages such as reconnaissance, penetration, lateral movement, and data theft. Each stage is closely linked to form a complete attack chain. Due to the stage nature and complexity of the attack chain, achieving effective detection in the early stage of the attack has become a major challenge, which makes the research on the behavioral characteristics of APT attacks the core content of current detection technologies. Research usually starts from system logs, traffic data, and task behavior analysis, and attempts to capture the characteristic patterns of APT attacks by mining and modeling these data.

[0003] To better cope with the multi-stage complexity of APT attacks, the traceability graph has been introduced as an important technical tool into the field of APT detection. The traceability graph can integrate multiple data sources (such as logs, traffic, system calls, etc.), and construct the APT attack path through an intuitive causal relationship graph. By restoring the stage behavior and causal chain of the attack, the traceability graph can not only help security analysts reproduce the attack process, but also reveal the associations between each stage, providing a scientific basis for attack traceability and security policy optimization. Its intuitiveness and correlation analysis ability have made the traceability graph widely used in APT detection and become an effective means for attack behavior modeling and analysis.

[0004] As an important form of cloud computing, the private cloud has become the first choice for enterprises and organizations due to its high control over data security and privacy. However, compared with the public cloud, the private cloud environment has the characteristics of relatively limited resources and strong data isolation, making APT attack detection face challenges in terms of resource constraints and insufficient adaptability of detection means. The concealment of APT attacks in the private cloud is stronger. For example, the lateral movement of attackers within the cloud may be difficult to capture by traditional traffic analysis tools. At the same time, many existing APT detection technologies are designed for the public cloud and rely on large-scale distributed resources and collaborative analysis capabilities, and have limited effects when directly applied to the private cloud scenario. Therefore, an APT detection scheme for the private cloud environment needs to find a balance between efficiency and resource utilization.

[0005] Currently, APT attack detection based on the traceability graph is generally based on two modes: rule-based and data-driven. The rule-driven detection scheme identifies APT attack paths by utilizing rules, feature templates (attack signatures), or behavior thresholds in the traceability graph. The data-driven detection scheme relies on machine learning techniques to learn potential attack patterns and behavior characteristics from the traceability graph and identify APT attacks.

[0006] The existing APT attack detection schemes based on the traceability graph still have the following problems:

[0007] (1) Low detection efficiency

[0008] The data-driven APT attack detection method has certain advantages in analyzing complex new attacks. However, its implementation often relies on powerful computing capabilities and the support of massive training data (such as data at the TB level), and is more suitable for resource-rich environments. However, private clouds are limited by hardware resources and it is difficult to bear the high computing and storage overhead brought by these methods. In addition, most of the data in private clouds is sensitive information and cannot be assisted by external data sources for analysis, further limiting the actual effect of the detection method. On the other hand, in the cloud platform scenario, the distributed architecture and virtualization characteristics lead to scattered and frequently changing data dynamically, making the construction and processing of the traceability graph more complex. The real-time improvement of many traditional detection schemes depends on specific components or centralized processing methods, but these methods are difficult to adapt in the dynamic and diverse cloud environment. For example, although the rule-driven detection method has a certain degree of real-time performance, due to the architectural differences between cloud service providers, the unique architectures, services, and management methods of different cloud platforms make these schemes lack generality and it is difficult to meet the needs of APT detection in the cloud environment.

[0009] (2) Poor detection reliability

[0010] The existing APT attack detection schemes have relatively large problems in terms of false alarm rate and misdetection rate. The rule-driven scheme takes matching specific attack characteristics as the core and it is difficult to conduct refined analysis on attack behaviors and their processes. Due to the relatively coarse detection granularity, these methods often cannot deeply mine and capture the subtle characteristics of attack behaviors, resulting in an increased risk of misjudging normal behaviors as abnormal, and at the same time, it is easy to miss real attack behaviors. At the same time, the APT attack chain is complex and unfolds in stages, with strong concealment, which further increases the difficulty of detection. The data-driven detection schemes generally have deficiencies in dynamic adaptability and are difficult to effectively cope with the concealed or variable behavior patterns in the attack chain, thus weakening the overall detection reliability.

[0011] (3) Difficulty in locating APT attack behaviors in private cloud platforms

[0012] A large number of virtual machines, networks, and storage devices are included in the private cloud platform, and the problem of low-dimensional data redundancy is particularly prominent. This redundancy may cause the information of the attack path to be masked by similar or duplicate data, thereby increasing the difficulty of locating malicious behaviors, especially in multi-stage APT attacks. Existing rule-driven detection schemes usually lack generality and are also difficult to adapt to the unique architectures and dynamic changing environments of different private cloud platforms; while data-driven schemes generally use machine learning methods to process massive amounts of data, and this method lacks interpretability for detection results, making it difficult to deeply mine long-term behavior characteristics and accurately restore complex attack chains.

[0013] In the above problems, the complexity and dynamic nature of the private cloud platform environment further exacerbate the difficulty of APT attack detection. Factors such as distributed architectures, virtualization characteristics, and high-concurrency access not only make it difficult for traditional detection schemes to be directly applicable, but also pose higher requirements for the efficiency, accuracy, and behavior location of detection. Among them, the resource limitations and data sensitivity of the private cloud make it difficult to implement high-overhead detection schemes; data dispersion and dynamic changes challenge the real-time construction and feature capture capabilities of the traceability graph; while low-dimensional data redundancy and environmental differences significantly increase the difficulty of locating malicious behaviors, especially in multi-stage APT attack scenarios. Solving these three problems is crucial for improving the effectiveness and practicality of real-time APT attack detection based on the traceability graph. Summary of the Invention

[0014] In order to solve the above problems existing in the prior art, the present invention provides a real-time detection method for private cloud APT attacks based on a fused traceability graph.

[0015] The technical problems to be solved by the present invention are realized through the following technical solutions:

[0016] The present invention provides a real-time detection method for private cloud APT attacks based on a fused traceability graph, including:

[0017] Obtain the current low-dimensional structured audit log data and various low-level behavior sequence patterns of the private cloud platform; the various low-level behavior sequence patterns are generated by pattern mining of the historical low-dimensional structured audit log data of the private cloud platform;

[0018] Generate a current fused traceability graph according to the current low-dimensional structured audit log data and the various low-level behavior sequence patterns;

[0019] Extract the features of the current fused traceability graph using an improved WLIA algorithm to obtain a sequence of feature vectors, input the sequence of feature vectors into a GRU model introducing a time-series dynamic threshold to obtain an output, and then process the output using a multi-head attention mechanism to enhance the expression of the features, obtaining an enhanced feature expression x;

[0020] The CBLOF algorithm is used to calculate the anomaly score CBLOF(x) based on the enhanced feature representation x and multiple normal system behavior clusters of the private cloud platform obtained in advance. According to the magnitude relationship between the anomaly score CBLOF(x) and the preset threshold θ, it is determined whether the behavior corresponding to the enhanced feature representation x for the private cloud platform is abnormal. A normal system behavior cluster contains similar normal system behaviors; the multiple normal system behavior clusters are obtained by generating a historical fusion traceability graph using the historical low-dimensional structured audit log data, extracting the enhanced feature representation of the historical fusion traceability graph, and performing clustering processing on the enhanced feature representation of the historical fusion traceability graph.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0022] (1) High efficiency of APT detection: Aiming at the problems of resource limitation and data redundancy in the private cloud environment, the present invention relies on the modular architecture of the private cloud. By modeling and aggregating low-level operations of high-level behaviors, redundant data is significantly reduced, the scale of the traceability graph is reduced, and thus the requirements for computing and storage resources are effectively reduced. In the model design, the normal behavior learning stage and the attack detection stage of the system are separated, making the detection process more focused on the identification of abnormal behaviors and further optimizing resource consumption. In terms of feature extraction, the present invention adopts the WLIA algorithm to efficiently extract the features of complex graphs in linear time, significantly improving the efficiency of feature extraction. In the feature semantic enhancement stage, a multi-head attention mechanism is introduced to quickly transform complex graph structure information through parallel computing, making it more suitable for real-time processing. Through these, the present invention realizes the efficient utilization of resources in APT attack detection on the private cloud platform and simultaneously improves the real-time response ability to abnormal behaviors.

[0023] (2) Reliability of APT detection: The present invention performs sequence pattern mining and aggregation through the hierarchical association information in the private cloud to construct a traceability graph integrating hierarchical association information, accurately describing the association and interaction relationships of process entities within the system. In the feature extraction stage, an improved GRU model combined with a multi-head attention mechanism is adopted to further enhance the feature semantic expression, capable of accurately capturing the dynamic context information in the traceability graph, thereby more finely describing the dynamic changes of the system state and identifying abnormal attack behaviors. This method effectively reduces the false alarm rate and misdetection rate in detection, improves the detection ability for hidden or variable behavior patterns in the APT attack chain, and thus comprehensively improves the reliability of APT attack detection.

[0024] (3)Precise positioning of malicious behaviors in the private cloud platform: Aiming at the problem that it is difficult to precisely locate malicious behaviors due to low-dimensional data redundancy, the present invention utilizes the PrefixSpan sequence mining algorithm to associate low-dimensional behavior sequences with high-dimensional user operations, dynamically constructs a fusion traceability graph, finely depicts the operation behaviors within the cloud platform, and provides a comprehensive description of the dynamic state of the system. In the feature extraction stage, the present invention adopts the WLIA algorithm to quickly extract graph structure features, converting complex traceability graph information into clear feature representations. At the same time, by combining the improved GRU model with the multi-head attention mechanism, it can not only capture long-term global dynamic features but also refine the analysis of short-term local behaviors, thereby enhancing the semantic expression ability of feature representations. This solution can accurately locate the key nodes and operation paths in APT attacks. Through the above optimizations, the present invention provides a more fine-grained description of the system dynamic state, improves the positioning accuracy of malicious behaviors and the ability to detect APT attacks, and provides strong technical support for the security protection of private cloud platforms.

[0025] The following will further elaborate on the present invention in conjunction with the accompanying drawings and specific implementation manners. Brief Description of the Drawings

[0026] Figure 1 is an overall architecture diagram of the real-time APT attack detection method for private clouds based on the fusion traceability graph provided by the embodiments of the present invention;

[0027] Figure 2 is a flowchart of the real-time APT attack detection method for private clouds based on the fusion traceability graph provided by the embodiments of the present invention. Specific Embodiment Manner

[0028] The following further elaborates on the present invention in conjunction with specific embodiments, but the implementation manners of the present invention are not limited thereto.

[0029] The present invention proposes a real-time APT attack detection scheme based on the fusion traceability graph. By optimizing and improving the key defects in APT attack detection, the present invention aims to achieve the following three goals:

[0030] (1) High efficiency of APT detection

[0031] Aiming at the problems of limited resources and data redundancy in the private cloud environment, the present invention focuses on optimizing the utilization rate of computing and storage resources. By mining and aggregating the patterns of system logs, it significantly compresses the scale of the traceability graph, thereby reducing resource consumption and improving detection efficiency. In the feature extraction stage, the present invention aims to extract complex node interaction relationships into fixed-length feature vectors within linear time to reduce computational complexity and analysis latency, enabling it to quickly respond to complex APT attacks in a limited hardware environment.

[0032] (2) Reliability of APT detection

[0033] To enhance the reliability of APT attack detection, the present invention emphasizes the in-depth understanding of system behavior patterns. Based on traditional feature extraction, temporality is added and feature semantics are strengthened to accurately capture dynamic features and behavioral anomalies. This method pays more attention to the fine-grained dynamic change description to identify the hidden and complex patterns in APT attacks and reduce the false alarm and missed alarm rates.

[0034] (3) Precise positioning of malicious behaviors in the private cloud platform

[0035] The present invention focuses on the precise positioning of APT attack paths. According to the modular architecture characteristics in the private cloud platform, the hierarchical relationship between sequences is mined to construct a hierarchical associated fusion traceability graph. At the same time, the present invention strengthens feature semantics to further improve the expression ability of attack path information. Through careful data fusion and hierarchical analysis, the specific location and influence range of malicious behaviors are accurately positioned.

[0036] By combining traceability graph construction, GRU model and resource optimization strategy, the present invention solves several main technical difficulties in existing APT attack detection from three core dimensions of efficiency, accuracy and behavior positioning, and provides a more efficient and accurate solution for the real-time detection of APT attacks in the private cloud environment.

[0037] Focusing on the detection requirements of advanced persistent threats (APT) in the private cloud environment, the present invention addresses the problems of log redundancy and insufficient correlation in the process of APT attack detection in view of the characteristics of resource limitation and data isolation in the private cloud platform. A large number of low-dimensional system audit logs and high-dimensional service logs generated in the private cloud platform, due to the large amount of redundant information and the lack of effective correlation analysis, make the construction of the traceability graph complex and inefficient, thus affecting the accuracy and real-time performance of APT attack detection. The present invention proposes a method for constructing a fusion traceability graph based on hierarchical information association, which can effectively reduce the redundant information in the logs, enhance the correlation between low-dimensional and high-dimensional log data, and construct a compact and efficient traceability graph to improve the real-time detection ability of APT attacks.

[0038] The present invention is applicable to the detection and protection of APT attacks in the private cloud environment, especially in scenarios involving multiple virtual machines, storage devices and network devices. Facing APT attacks lasting for weeks or months, the present invention can, through real-time collection and correlation analysis of private cloud platform logs, reduce redundant dependency relationships, accurately identify attack paths, and meet the requirements of the private cloud platform for rapid identification and response to advanced persistent threats.

[0039] Exemplarily, Figure 1 is an overall architecture diagram of the real-time detection method for private cloud APT attacks based on the fusion traceability graph provided by the present invention, as Figure 1As described above, the overall architecture sequentially includes three parts: construction of a fusion traceability graph, feature extraction and feature semantic enhancement, and APT attack detection. Figure 2 It is a schematic flowchart of a method for real-time detection of APT attacks in a private cloud based on a fusion traceability graph provided by an embodiment of the present invention. Among them, Figure 2 The described process belongs to Figure 1 the APT attack detection part in Figure 2 and there will also be some content related to the construction of the fusion traceability graph, as well as feature extraction and feature semantic enhancement in the APT attack detection part. Specifically, as

[0040] S101. Obtain the current low-dimensional structured audit log data and various low-level behavior sequence patterns of the private cloud platform; the various low-level behavior sequence patterns are generated by performing pattern mining on the historical low-dimensional structured audit log data of the private cloud platform.

[0041] S102. Generate the current fusion traceability graph according to the current low-dimensional structured audit log data and various low-level behavior sequence patterns.

[0042] S103. Extract the features of the current fusion traceability graph using an improved WLIA algorithm to obtain a sequence of feature vectors, input the sequence of feature vectors into a GRU model with a time-series dynamic threshold to obtain an output, and then use a multi-head attention mechanism to process the output to enhance the expression of the features, obtaining an enhanced feature expression x.

[0043] S104. Use the CBLOF algorithm to calculate the anomaly score CBLOF(x) according to the enhanced feature expression x and multiple normal system behavior clusters of the private cloud platform obtained in advance, and determine whether the behavior corresponding to the enhanced feature expression x for the private cloud platform is abnormal according to the magnitude relationship between the anomaly score CBLOF(x) and a preset threshold θ. A normal system behavior cluster contains similar normal system behaviors; among them, the multiple normal system behavior clusters are obtained by generating a historical fusion traceability graph using historical low-dimensional structured audit log data, extracting the enhanced feature expression of the historical fusion traceability graph, and performing clustering processing on the enhanced feature expression of the historical fusion traceability graph.

[0044] In the present invention, before performing the APT attack real-time detection method described in S101 to S104 above, as Figure 1As shown, it is necessary to first collect the low-dimensional structured audit log data of the private cloud platform during the normal behavior learning stage of the system, generate a historical fusion traceability graph using the low-dimensional structured audit log data collected during the normal behavior learning stage of the system, and perform sequence pattern mining on the low-dimensional structured audit log data collected during the normal behavior learning stage of the system to obtain various low-level behavior sequence patterns used in the above S101. Then, feature extraction and feature semantic enhancement are performed on the historical fusion traceability graph to obtain an enhanced feature expression of the historical fusion traceability graph. Next, cluster analysis is performed on the enhanced feature expression of the historical fusion traceability graph to obtain multiple normal system behavior clusters of the private cloud platform used in the above S101 for subsequent APT attack detection. Similar to most other APT attack detectors, the present invention assumes the integrity and correctness of the data collection framework and assumes that the system (i.e., the private cloud platform) engine, kernel, and traceability data are all complete and normal. It is assumed that the system operates normally and is not contaminated by attacks during the normal behavior learning stage of the system. Specifically, the steps of the present invention for generating various low-level behavior sequence patterns used in the above S101 and multiple normal system behavior clusters of the private cloud platform used in the above S101 are as follows:

[0045] S001. Extract information from the historical low-dimensional structured audit log data of the private cloud platform by means of regular matching and encode it to generate an initial traceability graph.

[0046] In the present invention, the nodes of the initial traceability graph are the actors (such as processes, programs, etc.) and action objects (such as files, sockets, etc.) in the system operation recorded in the log data. The edges of the initial traceability graph are extracted from the actions recorded in the log information, including various behaviors such as the tracking calls to programs, read and write operations on files, and access and disconnection of network sockets in the system. The edges represent the dependency relationships between the nodes. In the initial traceability graph, different types of nodes are distinguished by different shapes. For example, ovals represent processes and programs, rectangles represent files, and diamonds represent sockets and network connections. The edges in the initial traceability graph are defined by time, action, and a unique number. Thus, the low-dimensional log data extracted from a system event is defined in the form of a subject, an edge, and an object, that is, <Subject Name, TimeStamp, Uid, Action, Object Name>, where the actor corresponds to <Subject Name>, the edge corresponds to <TimeStamp, Uid, Action>, and the action object corresponds to <object name>. In the form of nodes and edges, the traceability graph shows the information flow and connections of data, networks, processes, etc. that represent system interactions.

[0047] S002. Generate a low-level behavior sequence corresponding to each high-level user operation included in the historical low-dimensional structured audit log data.

[0048] According to the modular architecture mode of the private cloud platform, low-level behaviors occur after their corresponding high-level behaviors. Based on this, the present invention obtains the specific time of each high-level user operation by recording the timestamps of high-level user operations in the private cloud. After recording these timestamps, low-level behaviors triggered within t' seconds are extracted, and their paths are extracted and transformed into low-level behavior sequences. Specifically, for each high-level user operation included in the historical low-dimensional structured audit log data, the timestamp of this operation is recorded, and low-level behaviors triggered by this operation within a preset time t' after this timestamp are recorded. The paths of the low-level behaviors triggered by this operation are extracted and transformed, and a low-level behavior sequence can be obtained. Among them, this low-level behavior sequence includes each low-level behavior triggered by this operation within the preset time t'. In some embodiments, the preset time t' corresponding to different high-level user operations is different, and the preset time t' is set according to actual needs.

[0049] S003. Use the PrefixSpan algorithm to perform pattern mining on the low-level behavior sequences corresponding to all high-level user operations included in the historical low-dimensional structured audit log data to obtain multiple low-level behavior sequence patterns M s , and each low-level behavior sequence pattern is a sequence containing low-level behaviors.

[0050] To reduce the interference of irrelevant low-level behaviors on modeling low-level behavior sequence patterns related to high-level operations, the present invention uses the lightweight sequence pattern mining algorithm PrefixSpan (Prefix-Projected Pattern Growth) for pattern mining. The PrefixSpan algorithm uses the prefix projection technique to start from shorter prefixes and gradually expand to generate longer frequent patterns. First, sequences of length 1 are checked for their frequencies in the entire sequence database. If the frequency exceeds the minimum support threshold, they are regarded as frequent patterns. Subsequently, a projected database is constructed, which only contains the suffixes after the current prefix. Then, the algorithm continues to expand the prefix in the projected database and recursively searches for longer frequent subsequences until no more patterns that meet the minimum support threshold can be found. Finally, PrefixSpan outputs a frequency list of all mined patterns that meet the conditions and determines the hierarchical association between high-level operations and low-level behavior sequences based on this.

[0051] Exemplarily, multiple low-level behavior sequence patterns M obtained by mining S = {M1, M2, …, M m}, that is, it means obtaining m low - level behavior sequence patterns.

[0052] S004. Adopt multiple low - level behavior sequence patterns and historical low - dimensional structured audit log data to fuse the initial traceability graph, and obtain a historical fused traceability graph.

[0053] Due to the internal modular architecture of the private cloud platform, when a user performs a high - level operation, the user operation will trigger a series of corresponding system behaviors. The system disassembles according to the function to the corresponding module and then calls the sub - module to complete the sub - task. The same high - level operation often has the same process, and this process will generate a fixed behavior sequence and be recorded in various system logs and service logs of the private cloud platform. Whenever the cloud platform creates a virtual machine, the same behavior sequence will be generated. Therefore, by utilizing the hierarchical characteristics of the cloud platform, the nodes in the traceability graph can be effectively fused, significantly reducing the dependency relationships in the traceability graph, thereby effectively reducing the computational overhead and processing latency of subsequent feature extraction and APT attack detection.

[0054] Specifically, for the i - th high - level user operation o i in the historical low - dimensional structured audit log data, determine the low - level behavior sequence pattern M i to which the operation o i belongs from multiple low - level behavior sequence patterns, record the timestamp of the operation o i , and record the low - level behaviors triggered by the operation o s within a preset time t i after this timestamp. Generate a low - level behavior sequence S i according to the low - level behaviors triggered by the operation o i ; i is a positive integer, and the value range of i is 1 to X, where X represents the total number of high - level user operations included in the historical low - dimensional structured audit log data; afterwards, match the low - level behavior sequence S i with the low - level behavior sequence pattern M i . If the match is successful, use the node corresponding to the operation o i in the initial traceability graph to represent the low - level behavior sequence S i . If the match fails, do not process the initial traceability graph; traverse in this way until after traversing the X - th high - level user operation in the historical low - dimensional structured audit log data, and obtain a historical fused traceability graph. Specifically, the principle of matching the low - level behavior sequence S i with the low - level behavior sequence pattern M i is: judge whether each low - level behavior in the low - level behavior sequence S i is in the low - level behavior sequence pattern M i . If so, it indicates that the low - level behavior sequence S i Matches the low-level behavior sequence pattern M i If the match is successful; otherwise, it indicates that the low-level behavior sequence S i Does not match the low-level behavior sequence pattern M i Is not successfully matched.

[0055] S005. Extract the enhanced feature representation of the historical fusion traceability graph.

[0056] Specifically, first use the improved WLIA algorithm to extract the features of the historical fusion traceability graph to obtain the feature vector sequence of the historical fusion traceability graph; then, input the feature vector sequence of the historical fusion traceability graph into the GRU model introducing the time series dynamic threshold to obtain the output of the GRU model, and then use the multi-head attention mechanism to perform weighted processing on the output of the GRU model, calculate the attention degrees of multiple attention heads on different parts of the sequence to enhance the feature representation, and obtain the enhanced feature representation of the historical fusion traceability graph.

[0057] To meet the requirements of real-time detection for fast learning of graph features, the present invention uses an improved Weisfeiler-Lehman Information Aggregation (WLIA, WL information aggregation) algorithm to extract the feature information of the fusion traceability graph. This method captures the graph structure features around each vertex based on the vertex histogram on the basis of the traditional WL subtree kernel algorithm, and at the same time fuses the node attribute information, further enriching the diversity of the node feature representation. By comprehensively describing the jumping R-neighborhood of the vertex and using the normalized Laplacian matrix, it is ensured that the local topological relationship between nodes is accurately reflected in each iteration, thereby constructing a more detailed augmented vertex label. These augmented labels are generated through an iterative label propagation process, and in each iteration, the Rectified Aggregate Element (ReAE) function is introduced to normalize the augmented labels to ensure that the feature values are within a reasonable range, improving the stability and consistency of the feature representation. To further improve the accuracy of feature extraction, this method adopts a multi-level proximity aggregation strategy, captures higher-order proximity information by setting multi-level R-neighborhood aggregation parameters, and enhances the ability to understand the global graph structure. At the same time, when dealing with missing attribute data, it is complemented by the average attribute value of the neighboring nodes to ensure the integrity and robustness of feature extraction.

[0058] After using the improved WLIA algorithm to extract the features of the historical fusion traceability graph, a vector sequence S = {x1, x2, x3... x N}, where N represents the length of the sequence. To effectively utilize the temporal relationship contained in this sequence, the present invention selects the GRU model for extracting temporal features. Compared with the gradient explosion or gradient disappearance problems that the RNN and LSTM models may encounter, and the computational overhead brought by the complex LSTM model, the GRU model can ensure real-time performance while effectively modeling the temporal features of the sequence. The core of this method lies in learning the deep feature representation of normal behaviors, and then being able to accurately identify and respond when abnormal behaviors occur. Its formal description is: Output, feature = GRU(S), where S is the sequence of feature vectors of the historical traceability graph. The GRU model accepts S as input and generates two outputs simultaneously. Output is the output at each time step, containing the local features of the input vector after each iteration. Feature is the hidden state at the last time step, which is a compressed representation of the entire input sequence S, integrating the information of the entire sequence and containing the long-term historical information of the sequence, so as to comprehensively reflect the overall characteristics of the sequence. This method of constructing feature vectors ensures that the model can capture and represent the key temporal dynamics in the sequence data.

[0059] Specifically, the GRU model realizes the fine regulation of the information flow through the gating mechanism of the update gate and the reset gate. The role of the update gate is to adjust the proportion of the information retained and discarded in the hidden state at each time point, thereby endowing the model with the ability to capture long-term dependencies. The reset gate is responsible for regulating the contribution degree of the previous hidden state to the current state, enabling the model to erase non-critical information in appropriate situations. To further cope with the sequence dependence characteristics at different times, a temporal dynamic threshold is introduced on the basis of the GRU model. For each time step t, a dynamic threshold θ t is calculated to control the outputs of the reset gate and the update gate. This threshold not only depends on the current input x t and its historical state h t-1 , but also is adaptively adjusted according to the mutual relationship between the temporal information and the historical information. The temporal threshold formula is:

[0060] θ t = sigmoid(W θ x t + b θ + γh t-1 );

[0061] where γ is the adjustment factor of the time step influence weight, W θ and b θ are model parameters, and h t-1 is the hidden state generated in the (t - 1)-th iteration.

[0062] In the update gate z t and the reset gate r t Add the time - series dynamic threshold θ to the formula t After the adjustment, the final reset gate and update gate formulas are as follows:

[0063] r t = sigmoid(W r x t + b r + W r h t-1 + b r )·θ t ;

[0064] z t = sigmoid(W z x t + b z + W z h t-1 + b z )·(1 - θ t ).

[0065] In the feature extraction stage, although the GRU model has the ability to recognize long - term sequence dependencies, and the final high - dimensional representation can comprehensively reflect the overall characteristics of the sequence, the process of weighted combination of the current feature and historical features will inevitably lead to information loss. Therefore, compared with the original input sequence, the sequence reconstructed based on such high - dimensional representations has significant information loss, which may lead to the degradation of model performance. In addition, the information loss also increases the complexity of parameter configuration in the optimization process, thereby leading to a significant increase in the required number of iterations and a slowdown in the convergence speed.

[0066] To effectively address the above challenges, the present invention introduces a multi - head attention mechanism to optimize the model training process. This mechanism enables the model to learn multi - level features of the input sequence in different sub - spaces by parallelly calculating multiple attention weights, thereby more comprehensively capturing the global information of time - series data. Compared with the traditional attention mechanism, the parallel computing strategy of the multi - head attention mechanism is more suitable for resource - constrained environments such as private cloud platforms, which helps to improve the computing efficiency and reduce the time overhead of model training.

[0067] In the multi - head attention mechanism, the present invention first maps the hidden state h t at time step t and the output output t to n sub - spaces through different linear transformations. Each head uses an independent parameter matrix where i″ ∈ {1, 2, …, n}. It should be noted that the value of n can be set according to actual needs. For example, the value of n can be 4 or 8, so as to improve the model's expressive ability while maintaining a relatively low computational cost.

[0068]

[0069] For each attention head i″, the same calculation method as single-head attention is used to obtain the output of each head. The hidden state at time step t after subspace mapping and the output The similarity between them is transformed into weights through the softmax function to represent the importance of the k-th value vector in the current context. The formula is as follows:

[0070] k ranges from 1 to N;

[0071] where the similarity calculation function is:

[0072] T is the transpose symbol;

[0073] The weighted sum of the value vectors of the i″-th attention head is

[0074]

[0075] Finally, the results of n attention heads are concatenated and linearly transformed to obtain the feature-enhanced representation of the hidden state at time step t as the input for the next time step iteration:

[0076] where, W O is the linear transformation matrix of the output.

[0077] S006. Cluster the enhanced feature expressions of the historical fusion traceability graph to obtain multiple normal system behavior clusters of the private cloud platform.

[0078] Exemplarily, when the enhanced feature expression of the historical fusion traceability graph is represented as a set D, the set composed of multiple normal system behavior clusters is represented as where, C1, C2, …, C K are different clusters, K is a hyperparameter, and, |C1|≥|C2|≥…≥|C K |, |C1| represents the size of cluster C1, and the same applies to |C2|, |C K |.

[0079] The following continues to specifically describe each step in the above S102 to S104.

[0080] In the present invention, the above S102 is implemented through steps S1021 to S1022:

[0081] S1021. Extract information from the current low-dimensional structured audit log data by means of regular matching and encode it to generate the current initial traceability graph.

[0082] Specifically, the principle of S1021 is the same as that of S001 above, and will not be elaborated here.

[0083] S1022. Use multiple low-level behavior sequence patterns and the current low-dimensional structured audit log data to fuse the current initial traceability graph to obtain the current fused traceability graph.

[0084] Specifically, generate low-level behavior sequences corresponding to each high-level user operation included in the current low-dimensional structured audit log data to obtain at least one current low-level behavior sequence; then, for each current low-level behavior sequence, match the current low-level behavior sequence with each low-level behavior sequence pattern. If the current low-level behavior sequence successfully matches a low-level behavior sequence pattern, use a node corresponding to a high-level user operation belonging to the low-level behavior sequence pattern that successfully matches the current low-level behavior sequence in the current initial traceability graph to represent the current low-level behavior sequence. If the current low-level behavior sequence does not successfully match any low-level behavior sequence pattern, do not process the current initial traceability graph; thus, after matching at least one current low-level behavior sequence with multiple low-level behavior sequence patterns, the current fused traceability graph is obtained.

[0085] Specifically, the specific principle of generating low-level behavior sequences corresponding to each high-level user operation included in the current low-dimensional structured audit log data is the same as that of S002 above, and will not be elaborated here. Specifically, the specific principle of how to match the current low-level behavior sequence with the low-level behavior sequence pattern is the same as that of matching the low-level behavior sequence S i with the low-level behavior sequence pattern M i and will not be elaborated here.

[0086] In the present invention, "using the CBLOF algorithm to calculate the anomaly score CBLOF(x) according to the enhanced feature representation x and multiple normal system behavior clusters of the pre-obtained private cloud platform" in the above S104 is implemented through steps S1041 to S1043:

[0087] S1041. Use the CBLOF algorithm to determine whether each normal system behavior cluster of the private cloud platform is a large cluster or a small cluster, obtain a large cluster set including at least one large cluster and a small cluster set including at least one small cluster, and determine whether the enhanced feature representation x belongs to each large cluster or small cluster.

[0088] Detection is performed using the CBLOF algorithm (Clustering-based Local Outlier Factor algorithm), which can ensure detection real-time performance and handle data complexity. Specifically, two parameters α and β are defined. If b satisfies one of the following two conditions, then b is called the boundary between the large cluster and the small cluster, and is used to distinguish between the large and small clusters:

[0089] Then the large cluster LC = {C i′ | i′ ≤ b}, and the small cluster SC = {C j′ | j′ > b}.

[0090] S1042. When the enhanced feature expression x belongs to a small cluster, calculate the distance between the enhanced feature expression x and the center of each large cluster in the large cluster set. According to the minimum distance and the size of a small cluster to which the enhanced feature expression x belongs, determine the outlier score CBLOF(x) of the enhanced feature expression x.

[0091] S1043. When the enhanced feature expression x belongs to a large cluster, calculate the distance between the enhanced feature expression x and the center of this large cluster, and obtain the outlier score CBLOF(x) of the enhanced feature expression x.

[0092] Based on the principle that vectors in the same cluster have similar system behavior characteristics, which makes them closer in the feature space, in the attack detection stage, the outlier score is obtained by calculating the distance between the behavior and different clusters for outlier judgment, meeting the real-time performance requirements. Specifically,

[0093] In the present invention, the "determine whether the behavior corresponding to the enhanced feature expression x for the private cloud platform is abnormal according to the magnitude relationship between the outlier score CBLOF(x) and the preset threshold θ" in the above S104 is implemented through step S1044 or S1045:

[0094] S1044. When the outlier score CBLOF(x) is greater than or equal to the preset threshold θ, it indicates that the behavior corresponding to the enhanced feature expression x for the private cloud platform is abnormal.

[0095] S1045. When the outlier score CBLOF(x) is less than the preset threshold θ, it indicates that the behavior corresponding to the enhanced feature expression x for the private cloud platform is normal.

[0096] Specifically, compare the outlier score CBLOF(x) with the preset threshold θ to determine the value of result x value, When result x is 1, the behavior corresponding to x is determined to be abnormal. When result x is 0, the behavior corresponding to x is determined to be normal.

[0097] The present invention shows certain advantages in terms of both efficiency and reliability. In terms of efficiency, the PrefixSpan algorithm is adopted in the sequence pattern mining stage of the present invention. Compared with the BIDE algorithm, it further reduces the memory occupation and computational overhead required for hierarchical association information mining. In addition, compared with the traditional attention mechanism, the present invention introduces a multi-head attention mechanism and optimizes the feature extraction process through a parallel computing strategy. While ensuring the semantic expression ability, it effectively reduces the processing delay. In terms of reliability, the WLIA subtree graph kernel algorithm is adopted for feature extraction in the present invention. Compared with the WL subtree kernel algorithm, it can more completely retain the local topological characteristics of nodes. At the same time, based on the GRU model, a dynamic time threshold is introduced, which not only improves the ability to accurately capture temporal relationships but also enhances the grasp of the dynamic global features of the system, thus significantly improving the reliability of APT attack detection. Therefore, this solution not only solves the applicability problem of traditional methods in complex private cloud platforms but also ensures the accurate positioning and real-time detection of APT attacks in complex environments by strengthening feature extraction and real-time detection capabilities, significantly outperforming the prior art and being irreplaceable.

[0098] It should be noted that the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more features. In the description of the present invention, "a plurality" means two or more unless otherwise specifically defined.

[0099] In the description of this specification, the description referring to terms such as "an embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification.

[0100] In the specification, the term "including" does not exclude other components or steps, and "a" or "one" does not exclude a plurality. Certain measures are described in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0101] The above content is a further detailed description of the present invention in combination with specific preferred embodiments. It cannot be determined that the specific implementation of the present invention is only limited to these descriptions. For those of ordinary skill in the technical field to which the present invention pertains, without departing from the concept of the present invention, several simple deductions or substitutions can still be made, and all should be regarded as belonging to the protection scope of the present invention.< / object>

Claims

1. A real-time detection method for private cloud APT attacks based on fusion traceability graph, characterized in that: include: Obtain the current low-dimensional structured audit log data and multiple low-level behavior sequence patterns of the private cloud platform; The multiple low-level behavior sequence patterns are generated by pattern mining of historical low-dimensional structured audit log data of the private cloud platform; Generate a current fusion traceability graph according to the current number of low-dimensional structured audit logs and the multiple low-level behavior sequence patterns; The improved WLIA algorithm is used to extract the features of the current fusion traceability graph to obtain a feature vector sequence, the feature vector sequence is input into the GRU model of the time series dynamic threshold to obtain an output, and then the multi-head attention mechanism is used to process the output to enhance the expression of the features, thereby obtaining an enhanced feature expression x; The CBLOF algorithm is used to calculate the anomaly score CBLOF(x) according to the enhanced feature expression x and the multiple normal system behavior clusters of the private cloud platform obtained in advance. According to the size relationship between the anomaly score CBLOF(x) and the preset threshold θ, it is determined whether there is an anomaly in the behavior of the private cloud platform corresponding to the enhanced feature expression x. A normal system behavior cluster contains similar normal system behaviors; the multiple normal system behavior clusters are obtained by generating a historical fusion traceability graph using the historical low-dimensional structured audit log data, extracting the enhanced feature expression of the historical fusion traceability graph, and clustering the enhanced feature expression of the historical fusion traceability graph.

2. According to claim 1, the real-time detection method for private cloud APT attacks based on fusion traceability graph is characterized in that: The generating a current fusion traceability graph according to the current number of low-dimensional structured audit logs and the multiple low-level behavior sequence patterns includes: The current low-dimensional structured audit log data is extracted by regular matching, and the current initial traceability graph is generated by encoding, wherein the initial traceability graph is composed of nodes and edges, the nodes are the behavior subjects and behavior objects in the system operation recorded in the log data, and the edges are the actions recorded in the log data, representing the dependency relationship between the nodes; The current initial traceability graph is fused using the multiple low-level behavior sequence patterns and the current low-dimensional structured audit log data to obtain the current fused traceability graph.

3. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 2 is characterized in that: The adopting of the multiple low-level behavior sequence patterns and the current low-dimensional structured audit log data to fuse the current initial traceability graph to obtain the current fused traceability graph includes: Generate a low-level behavior sequence corresponding to each high-level user operation contained in the current low-dimensional structured audit log data to obtain at least one current low-level behavior sequence; For each current low-level behavior sequence, the current low-level behavior sequence is matched with each low-level behavior sequence pattern. If the current low-level behavior sequence successfully matches a low-level behavior sequence pattern, a node corresponding to a high-level user operation belonging to the low-level behavior sequence pattern that successfully matches the current low-level behavior sequence in the current initial traceability graph is used to represent the current low-level behavior sequence. If the current low-level behavior sequence does not successfully match any low-level behavior sequence pattern, the current initial traceability graph is not processed. After the at least one current low-level behavior sequence is matched with the multiple low-level behavior sequence patterns, the current fusion traceability graph is obtained.

4. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 1 is characterized in that: The method of generating a historical fusion traceability graph using the historical low-dimensional structured audit log data includes: Using a regular matching method to extract information from the historical low-dimensional structured audit log data, and encoding to generate an initial traceability graph; Generate a low-level behavior sequence corresponding to each high-level user operation contained in the historical low-dimensional structured audit log data; Using the PrefixSpan algorithm to perform pattern mining on low-level behavior sequences corresponding to all high-level user operations contained in the historical low-dimensional structured audit log data, to obtain the plurality of low-level behavior sequence patterns, each low-level behavior sequence pattern being a sequence containing low-level behaviors; The multiple low-level behavior sequence patterns and the historical low-dimensional structured audit log data are used to fuse the initial traceability graph to obtain the historical fused traceability graph.

5. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 4 is characterized in that: The low-level behavior sequence corresponding to each high-level user operation contained in the low-dimensional structured audit log data used to generate the history includes: For each high-level user operation contained in the historical low-dimensional structured audit log data, the timestamp of the operation is recorded, and the low-level behavior triggered by the operation within a preset time t′ after the timestamp is recorded, and a low-level behavior sequence is generated based on the low-level behavior triggered by the operation, wherein the low-level behavior sequence includes each low-level behavior triggered by the operation within the preset time t.

6. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 4 is characterized in that: The method of using the multiple low-level behavior sequence patterns and the historical low-dimensional structured audit log data to fuse the initial traceability graph to obtain the historical fused traceability graph includes: For the i-th high-level user operation o in the historical low-dimensional structured audit log data i , from the plurality of low-level behavior sequence patterns, determining the operation o i The low-level behavior sequence pattern M i , record the operation o i timestamp, and records the preset time t after the timestamp s The operation is performed by i The low-level behavior triggered by the operation o i The triggered low-level behaviors generate a low-level behavior sequence S i ; i is a positive integer, the value of i ranges from 1 to X, and X represents the total number of high-level user operations contained in the historical low-dimensional structured audit log data; The low-level behavior sequence S i With the low-level behavior sequence pattern M i Perform a match. If the match is successful, use the operation o in the initial traceability graph. i The corresponding nodes represent the low-level behavior sequence S i If the match fails, the initial traceability graph is not processed; After traversing the X-th high-level user operation in the historical low-dimensional structured audit log data, the historical fusion traceability graph is obtained.

7. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 6 is characterized in that: The low-level behavior sequence S i With the low-level behavior sequence pattern M i Matching includes: Determine the low-level behavior sequence S i Is each low-level behavior in the low-level behavior sequence pattern M i If so, it indicates that the low-level behavior sequence S i With the low-level behavior sequence pattern M i The match is successful, otherwise, it indicates that the low-level behavior sequence S i With the low-level behavior sequence pattern M i No match was successful.

8. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 1 is characterized in that: The step of extracting the enhanced feature expression of the historical fusion traceability graph includes: The improved WLIA algorithm is used to extract the features of the historical fusion traceability graph, and a feature vector sequence of the historical fusion traceability graph is obtained; The feature vector sequence input of the historical fusion traceability graph is introduced into the GRU model of the time series dynamic threshold to obtain the output of the GRU model, and then the output of the GRU model is weighted by using a multi-head attention mechanism, and the attention of multiple attention heads to different parts of the sequence is calculated to enhance the expression of features, thereby obtaining the enhanced feature expression of the historical fusion traceability graph.

9. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 1 is characterized in that: The CBLOF algorithm is used to calculate the abnormality score CBLOF(x) according to the enhanced feature expression x and the pre-obtained multiple normal system behavior clusters of the private cloud platform, including: Using the CBLOF algorithm, determine whether each normal system behavior cluster of the private cloud platform is a large cluster or a small cluster, obtain a large cluster set including at least one large cluster and a small cluster set including at least one small cluster, and judge whether the enhanced feature expression x belongs to each large cluster or small cluster; When the enhanced feature expression x belongs to a small cluster, the distance between the enhanced feature expression x and the center of each large cluster in the large cluster set is calculated, and the abnormal score CBLOF(x) of the enhanced feature expression x is determined according to the minimum distance and the size of a small cluster to which the enhanced feature expression x belongs; When the enhanced feature expression x belongs to a large cluster, the distance between the enhanced feature expression x and the center of the large cluster is calculated to obtain the abnormal score CBLOF(x) of the enhanced feature expression x.

10. The method for real-time detection of private cloud APT attacks based on fusion traceability graph according to claim 1 is characterized in that: The determining, based on the magnitude relationship between the abnormality score CBLOF(x) and a preset threshold value θ, whether the behavior corresponding to the enhanced feature expression x for the private cloud platform is abnormal includes: When the abnormal score CBLOF(x) is greater than or equal to the preset threshold θ, it indicates that the behavior corresponding to the enhanced feature expression x for the private cloud platform is abnormal; When the abnormal score CBLOF(x) is less than the preset threshold θ, it indicates that the behavior corresponding to the enhanced feature expression x for the private cloud platform is normal.

Images