Network space advanced long-term threat (APT) trapping method based on graph neural network, storage medium and device

Abstract

The invention discloses a cyberspace advanced long-term threat (APT) trapping method based on a graph neural network, a storage medium and a cyberspace advanced long-term threat trapping device, and relates to the technical field of computers, and the method comprises the steps: carrying out the dimension reduction of original encrypted traffic data based on a hierarchical clustering algorithm, retaining an abnormal traffic cluster, and removing normal traffic redundant data; designing an E-ResGAT model to perform encrypted semantic modeling, and introducing a residual connection technology to retain original traffic features; and a dynamic trapping-protocol inference closed-loop system is further constructed, and a honeypot environment is utilized to simulate attack sample interaction behaviors and capture traffic. According to the scheme, efficiency balance of encrypted traffic data reduction and semantic reasoning is realized through collaborative optimization of hierarchical clustering and a graph neural network, the capture capability of the model on a hidden attack mode is enhanced in combination with a residual attention mechanism, and a multi-dimensional analysis basis is provided for high-security scenes such as a military private network; and an innovative solution is provided for improving the security defense capability of a military information system.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular, to a method, a storage medium, and a device for cyber space advanced persistent threat (APT) entrapment based on a graph neural network. Background Art

[0002] Advanced Persistent Threat (APT), also known as advanced long-term threat, is a complex and continuous cyber attack, which includes three elements: advanced, long-term, and threat. Advanced means that executing an APT attack requires a higher degree of customization and complexity than traditional attacks, and it takes a lot of time and resources to study and identify vulnerabilities within the system; long-term means that in order to achieve a specific purpose, the process is "long-term", continuously monitoring the target and maintaining long-term access rights to the target; threat emphasizes an attack planned by humans, and the attack target is a high-value organization. Once the attack succeeds, it often causes huge economic losses to the attack target, and even a devastating blow. APT has the following characteristics:

[0003] 1. Diverse communication channels and strong escape capabilities;

[0004] 2. Long latency and complex functions;

[0005] 3. Complex technical system and advanced attack means;

[0006] 4. Tightly organized and strong self-protection capabilities.

[0007] In the context of the increasing advanced threats in cyber space confrontation, it has become an urgent problem to quickly improve the security capabilities of military information systems and detect potential advanced threats in military private networks. The key to solving the problem is to break through the technology research and development of cyber space advanced threat entrapment and identification.

[0008] To build a defense system against APT threats, it is necessary to break through the traditional ideas of static blocking and signature recognition, organically combine the entrapment principle with APT, infer communication protocols based on various APT unilateral samples, and then build deeply customized controlled terminals and master terminal simulators. By making the passive active through adaptive and highly controllable simulation linkage, make APT samples work for us and become the "bait" for entrapment and tracing, providing more clues and conditions for subsequent capture, so as to achieve the traceability and evidence collection of advanced threats. Based on this, the present invention is proposed. Summary of the Invention

[0009] The present invention aims to provide a method, storage medium, and device for identifying advanced persistent threats (APTs) in cyberspace based on graph neural networks and hierarchical traffic analysis algorithms, to meet the need for rapidly enhancing the security capabilities of military information systems and mining potential advanced threats in military private networks in the context of intensified cyber warfare against advanced threats, break through the key technologies for identifying advanced threats in cyberspace, and form a set of available APT identification prototype systems based on the key technology achievements.

[0010] To achieve the above object, the present invention provides the following technical solutions:

[0011] In the first aspect of the present invention, a method for trapping advanced persistent threats (APTs) in cyberspace based on graph neural networks is provided, including the following steps:

[0012] S1. Traffic preprocessing and redundancy reduction: Based on the hierarchical clustering algorithm, the dimensionality of the original encrypted traffic data is reduced, abnormal traffic clusters are retained, and normal traffic redundant data is removed;

[0013] S2. Encrypted traffic semantic modeling: The residual graph attention network (E-ResGAT) is used to extract topological features of the preprocessed traffic, dynamically learn the association weights between nodes, and retain the original encrypted features;

[0014] S3. Protocol dynamic trapping and parsing: By simulating protocol interaction behaviors in a honeypot environment, attack samples are triggered to generate encrypted traffic, and the protocol syntax format and semantic state transition logic are inferred by combining hierarchical clustering and E-ResGAT features;

[0015] S4. Advanced threat tracing: According to the protocol parsing results, an attack behavior baseline is constructed, abnormal state jumps are detected in real time, and an APT attack tracing path is generated.

[0016] Further, the hierarchical clustering algorithm in step S1 adopts the following process:

[0017] The original traffic data is converted into a 7-tuple structured netflow format including source / destination IP, port, and protocol type; the distance between clusters is calculated based on the fully connected algorithm, and the formula is:

[0018]

[0019] where C1 and C2 represent clusters, P represents data objects, and |C1| and |C2| represent the number of data objects in the clusters.

[0020] Further, the structure of the residual graph attention network in step S2 includes:

[0021] S201. Bipartite graph mapping: Map the traffic into a bipartite graph of source / destination nodes and a line graph of edge-to-node conversion;

[0022] S202. Attention weight calculation: Dynamically allocate the association weights between nodes and edges through the multi-head attention mechanism, and retain the original encrypted traffic features by combining with residual connections. The formula is as follows:

[0023]

[0024] where z uv i.e., the final feature representation of edge uv, || represents vector concatenation, and respectively represent the embedding representations of node u and node v at the K-th layer, and e uv represents the original feature of edge uv, represents the set of edges of the bipartite graph.

[0025] Furthermore, the protocol dynamic entrapment and parsing described in step S3 include:

[0026] S301. Unilateral sample execution environment: Simulate the protocol interaction behavior of attack samples, trigger encrypted communication, and capture traffic;

[0027] S302. Protocol syntax inference: Based on the traffic data after hierarchical clustering, extract the protocol field boundaries and field types;

[0028] S303. Semantic state machine generation: Combine the topological features output by E-ResGAT to construct a protocol state transition graph and label the abnormal jump rules;

[0029] S304. Real-time entrapment feedback: When detecting that the protocol interaction timing deviates from the baseline, dynamically adjust the honeypot bait environment parameters to enhance the attack sample capture probability.

[0030] The second aspect of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, it implements a method for trapping advanced persistent threats (APTs) in cyberspace based on a graph neural network provided in an embodiment of the present application.

[0031] The third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements a method for trapping advanced persistent threats (APTs) in cyberspace based on a graph neural network provided in an embodiment of the present application. ·

[0032] The principle and beneficial effects of this technical solution are at least:

[0033] 1. The present invention provides a method for identifying advanced threats in cyberspace through collaborative analysis of hierarchical clustering and residual graph attention network (E-ResGAT). By constructing a trinity dynamic defense system of "active trapping - graph structure modeling - protocol reverse engineering", the accuracy and efficiency of encrypted traffic anomaly detection and advanced threat tracing are significantly improved. This method first uses the hierarchical clustering algorithm to intelligently reduce massive network traffic data, effectively reducing the computational load while ensuring the precision rate of anomaly detection. On this basis, the residual graph attention network is innovatively introduced to perform semantic modeling on encrypted traffic. Through bipartite graph mapping and residual connection techniques, both the original traffic features are retained and the learning ability of the topological structure is enhanced. The present invention combines the data reduction advantage of hierarchical clustering and the semantic reasoning ability of graph neural networks, and uses dynamic trapping technology to actively obtain attack samples, realizing the full-process automatic processing from traffic preprocessing to protocol reverse parsing.

[0034] 2. The present invention simulates attack interaction behaviors through a honeypot environment to trigger the generation of encrypted traffic by APT samples, and combines an improved E-ResGAT model to extract traffic topological features, realizing the automatic inference of the syntax format and semantic specifications of private encrypted protocols. Experiments show that the protocol format parsing accuracy of this framework in adversarial encrypted traffic is as high as 92.3%, and the F1-score for a few types of attacks such as DDoS and password brute force is more than 20% higher than that of the baseline model. By constructing a dynamic behavior baseline, this method can detect protocol interaction timing anomalies and state jumps in real time, providing a multi-dimensional analysis basis for APT attack tracing.

[0035] 3. The method of the present invention fully considers the characteristics of advanced threats such as concealment, persistence, and complexity. Compared with traditional defense means based on feature matching and static analysis, it can capture attack behavior patterns more comprehensively, improve the real-time performance and accuracy of threat detection, and reduce the dependence on prior knowledge. The hierarchical clustering data reduction technology of the present invention can achieve a redundancy reduction rate of 47.58% for traffic data at the 500,000 level, while maintaining an anomaly detection precision rate of over 90%. The Macro F1-score of the residual graph attention network in the scenario of multi-protocol state jumps reaches 0.87, showing a significant improvement compared with traditional GAT and E-GraphSAGE. The present invention is applicable to high-security requirement scenarios such as military private networks and critical information infrastructure, can effectively identify advanced persistent threats, enhance the active defense ability, provide technical support for constructing a dynamic defense system, so as to assist security personnel in quickly locating the attack path and formulating precise defense strategies, thereby effectively preventing security risks such as data theft and system damage.

[0036] Additional advantages, objects, and features of the present invention will be partly set forth in the description which follows, and will partly become apparent to those of ordinary skill in the art upon examination of the following, or may be learned by practice of the present invention. The objects and other advantages of the present invention may be realized and attained by the structure particularly pointed out in the specification and the drawings.

[0037] Those skilled in the art will understand that the objects and advantages that can be achieved by the present invention are not limited to those specifically described above, and the above and other objects that the present invention can achieve will be more clearly understood from the following detailed description. Brief Description of the Drawings

[0038] Figure 1 It is a flowchart of a network space APT trap recognition method based on a graph neural network and a hierarchical traffic analysis algorithm. Detailed Embodiments

[0039] To make the objects, technical solutions, and advantages of the present invention more clear and understandable, the present invention will be further described in detail below in conjunction with the embodiments and the drawings. Herein, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but not to limit the present invention.

[0040] Here, it should also be noted that in order to avoid obscuring the present invention due to unnecessary details, only the structures and / or processing steps closely related to the solution of the present invention are shown in the drawings, while other details less related to the present invention are omitted.

[0041] It should be emphasized that the term "comprising / including" when used herein refers to the presence of features, elements, steps, or components, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0042] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0043] It should be emphasized here that the step labels mentioned hereinafter are not intended to limit the order of the steps. Instead, it should be understood that the steps can be executed in the order mentioned in the embodiments, or different from the order in the embodiments, or several steps can be executed simultaneously.

[0044] The present invention will be further described in detail below in conjunction with the drawings and the embodiments:

[0045] Referring to Figure 1 , a network space APT trap recognition technology based on a graph neural network and a hierarchical traffic analysis algorithm is proposed, including the following steps:

[0046] S1: Traffic Preprocessing and Redundancy Reduction Based on Hierarchical Clustering

[0047] Convert the original APT attack traffic (in pcap format) captured by the honeypot into structured netflow 7-tuple data through the softflowd tool, including source / destination IP, port, protocol type, number of bytes, and timestamp. Use the Agglomerative Nesting (AGNES) algorithm for abnormal traffic division and calculate the maximum distance between clusters:

[0048]

[0049] where C1 and C2 represent clusters, P represents data objects, and |C1| and |C2| represent the number of data objects in the clusters.

[0050] Through bottom-up clustering and merging, eliminate redundant clusters of normal traffic. Experiments show that on the DARPA dataset, a reduction rate of 47.58% is achieved for 500,000 traffic flows, and the accuracy of anomaly detection exceeds 90%, significantly reducing the computational load of subsequent protocol syntax parsing.

[0051] In addition, by optimizing the data slice size, provide high-purity and low-redundancy traffic input for encrypted protocol reverse analysis.

[0052] S2: Encrypted Traffic Semantic Modeling Based on E-ResGAT

[0053] Construct the preprocessed traffic into a bipartite graph (with source / destination IP as nodes) and a line graph topology of edge-to-node conversion. Use the improved Residual Graph Attention Network (E-ResGAT) to dynamically allocate node association weights through the multi-head attention mechanism:

[0054]

[0055] where z uv is the final feature representation of edge uv, || represents vector concatenation, and represent the embedding representations of node u and node v at the K-th layer respectively, e uv represents the original feature of edge uv, represents the set of edges of the bipartite graph.

[0056] The residual connection preserves the original encrypted features and prevents feature dilution caused by multi-layer aggregation. On the CIC-DarkNet dataset, the F1-score of the model for DDoS attacks is improved by 20% compared to the baseline, and the Macro-F1 in the multi-protocol hop scenario reaches 0.87.

[0057] In addition, E-ResGAT forms highly distinguishable clusters in the feature space, verifying its strong reasoning ability for encrypted traffic semantics.

[0058] S3: Honeypot-driven Protocol Dynamic Trapping and Joint Parsing

[0059] S301. Unilateral Sample Execution Environment: Simulate the protocol interaction behavior of attack samples, trigger encrypted communication, and capture traffic;

[0060] S302. Protocol Syntax Inference: Based on the traffic data after hierarchical clustering, extract protocol field boundaries and field types;

[0061] S303. Semantic State Machine Generation: Combine the topological features output by E-ResGAT to construct a protocol state transition graph and label abnormal jump rules;

[0062] S304. Real-time Trapping Feedback: When detecting that the protocol interaction timing deviates from the baseline, dynamically adjust the honeypot bait environment parameters to enhance the probability of capturing attack samples.

[0063] Deploy a high-interaction honeypot to simulate the attack sample execution environment, trigger encrypted communication, and capture interaction traffic. Combine the results of hierarchical clustering with the topological features (node attention weights, edge residual features) extracted by E-ResGAT to infer protocol field boundaries and state transition logic. Construct a protocol state machine model with a parsing accuracy of 92.3%, supporting the automatic generation of a state transition graph containing abnormal jump rules.

[0064] S4: Dynamic Behavior Baseline Construction and APT Attack Tracing

[0065] Establish a protocol interaction timing baseline based on the protocol parsing results, and real-time detect abnormal state jumps (such as unauthorized instructions, abnormal heartbeat intervals) that deviate from the baseline. Experiments show that in adversarial encrypted traffic, it is possible to accurately identify attack phase transition nodes, and the coverage rate of the tracing path is increased by 35% compared with traditional methods.

[0066] For system implementation, integrate the bistream data flow engine to achieve real-time parsing of APT traffic. The data structure example is as follows:

[0067]

[0068]

[0069] The master / controlled end generates data blocks in real time through stream_chunk_new(), and each window independently calls g_list_append() to update the display queue.

[0070] For the implementation of the core business process, the HTTP service is dynamically loaded through the Python layer ServiceLoader:

[0071]

[0072] The DNS service is pre-loaded through dns_init() at the C layer.

[0073] For the communication simulation phase, the libev event loop is used to drive real-time data capture:

[0074]

[0075] The dual-column display of the interface achieves asynchronous rendering through g_thread_pool_push(), avoiding blocking the main event loop.

[0076] In addition, it should be mentioned that attack behavior visualization is carried out by implanting vulnerability triggers in the Python extension of the HTTP service, and DNS covert channel detection based on asynchronous parsing of the udns library. Part of the code is as follows:

[0077]

[0078]

[0079] Corresponding to the above method, the present invention also provides a device, which includes a computer device. The computer device includes a processor and a memory. Computer instructions are stored in the memory, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0080] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the foregoing edge computing server deployment method. The computer-readable storage medium may be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0081] The present invention provides a network space APT trap recognition technology based on graph neural network and hierarchical traffic analysis algorithm, which realizes the accurate capture and in-depth analysis of advanced persistent threats (APT). This method innovatively combines the hierarchical clustering algorithm with the residual graph attention network (E-ResGAT), and significantly improves the accuracy and efficiency of encrypted traffic anomaly detection and advanced threat traceability through three core modules: bidirectional communication data flow modeling, multi-protocol simulation, and dynamic behavior analysis.

[0082] At the technical implementation level, the present invention first uses the hierarchical clustering algorithm to intelligently reduce the massive network traffic data, achieving a redundancy reduction rate of 47.58% on the DARPA dataset, while maintaining an anomaly detection accuracy rate of over 90%, effectively reducing the computational load of subsequent protocol parsing. On this basis, the innovatively designed E-ResGAT model, through bipartite graph mapping and residual connection technologies, not only retains the original traffic characteristics but also enhances the learning ability of the topological structure. The F1-score for minority-class attacks such as DDoS on the CIC-DarkNet dataset is improved by over 20% compared to the baseline model. By actively trapping attack samples in the honeypot environment and combining with the improved semantic reasoning model, the protocol format parsing accuracy of this solution in adversarial encrypted traffic reaches 92.3%, and it can automatically generate a protocol state machine model.

[0083] Verified by experiments, this solution shows significant advantages in the test environment simulating real APT attacks: the protocol simulation authenticity reaches 98.2%, and the attack capture rate is as high as 96.5%, which is more than 15 percentage points higher than traditional honeypot solutions (such as Honeyd, Cowrie, etc.). In the actual deployment scenario, this solution has successfully identified 12 new types of APT attack patterns, and the false alarm rate is reduced by 67.3% compared to the traditional solution, providing a reliable technical guarantee for high-security demand scenarios such as military private networks and critical information infrastructure, assisting security personnel to quickly locate the attack path, formulate precise defense strategies, effectively prevent security risks such as data theft and system damage, and has significant social benefits and application value.

[0084] Those of ordinary skill in the art should understand that the various exemplary components, systems, and methods described in combination with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Specifically, whether to execute in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave on a transmission medium or a communication link.

[0085] It should be clear that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present invention is not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications, and additions, or change the order between steps after understanding the spirit of the present invention.

[0086] In the present invention, features described and / or illustrated for one embodiment can be used in the same or similar manner in one or more other embodiments, and / or combined with the features of other embodiments or replace the features of other embodiments.

[0087] The above are only the preferred embodiments of the present invention and are not used to limit the present invention. For those skilled in the art, various changes and variations can be made to the embodiments of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

[0088] The scope of protection required by this application shall be subject to the content of its claims, and the specific embodiments described in the specification and the like can be used to interpret the content of the claims.

Claims

1. A network space advanced persistent threat (APT) trapping method based on graph neural network, characterized in that It includes the following steps: S1. Traffic preprocessing and redundancy reduction: Based on the hierarchical clustering algorithm, the dimensionality of the original encrypted traffic data is reduced, abnormal traffic clusters are retained, and normal traffic redundant data is removed; S2. Encrypted traffic semantic modeling: The residual graph attention network (E-ResGAT) is used to extract topological features of the preprocessed traffic, dynamically learn the association weights between nodes, and retain the original encrypted features; S3. Protocol dynamic trapping and parsing: By simulating protocol interaction behaviors in a honeypot environment, attack samples are triggered to generate encrypted traffic, and the protocol syntax format and semantic state transition logic are inferred by combining hierarchical clustering and E-ResGAT features; S4. Advanced threat tracing: According to the protocol parsing results, an attack behavior baseline is constructed, abnormal state jumps are detected in real time, and an APT attack tracing path is generated.

2. The method for trapping advanced persistent threat (APT) in cyberspace based on graph neural network according to claim 1, wherein The hierarchical clustering algorithm described in step S1 adopts the following process: The original traffic data is converted into a 7-tuple structured netflow format including source / destination IP, port, and protocol type; Based on the fully connected algorithm, the distance between clusters is calculated, and the formula is: where C1 and C2 represent clusters, P represents data objects, and |C1| and |C2| represent the number of data objects in the clusters.

3. A method for trapping advanced persistent threats (APTs) in cyberspace based on graph neural networks according to claim 1, characterized in that, The structure of the residual graph attention network described in step S2 includes: S201. Bipartite graph mapping: The traffic is mapped into a source / destination node bipartite graph and a line graph with edges converted into nodes; S202. Attention weight calculation: The association weights between nodes and edges are dynamically allocated through the multi-head attention mechanism, and the original encrypted traffic features are retained in combination with the residual connection. The formula is: where z uv is the final feature representation of edge uv, || represents vector concatenation, and represent the embedding representations of node u and node v at the K-th layer respectively, e uv represents the original feature of edge uv, represents the set of edges of the bipartite graph.

4. A method for trapping advanced persistent threats (APTs) in the cyber space based on a graph neural network according to claim 1, characterized in that The protocol dynamic trapping and parsing described in step S3 includes: S301. Unilateral sample execution environment: Simulate the protocol interaction behavior of the attack sample, trigger encrypted communication, and capture traffic; S302. Protocol syntax inference: Based on the traffic data after hierarchical clustering, the protocol field boundaries and field types are extracted; S303. Semantic state machine generation: Combine the topological features output by E-ResGAT to construct a protocol state transition graph and mark abnormal jump rules; S304. Real-time trapping feedback: When it is detected that the protocol interaction timing deviates from the baseline, the parameters of the honeypot bait environment are dynamically adjusted to enhance the probability of capturing attack samples.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the method described in any one of claims 1 to 4.

6. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the method described in any one of claims 1 to 4.

Images