Attack intention behavior identification method and device

Abstract

The invention relates to the technical field of network security, in particular to an attack intention behavior recognition method and device, and the method comprises the steps: obtaining a plurality of attack features of a plurality of historical attack gangs, and marking a preset state for each attack feature, so as to obtain a plurality of marked attack features; and training a pre-constructed deep neural network classification model by using the plurality of labeled attack features to obtain a gang attack intention-based recognition model, and recognizing the actual state of the target attack gang by using the gang attack intention-based recognition model. Therefore, the problems that most of existing security products are lack of deep analysis capability, so that comprehensive understanding of behaviors of attackers is insufficient, the real intentions of the attackers are difficult to accurately judge, response can only be performed based on the attacking behaviors, potential threats cannot be actively predicted and recognized and the like are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for identifying attack intention behavior. Background Art

[0002] Most existing security products primarily focus on detecting and blocking current attack behaviors. Based on predefined rules and signature libraries, they can quickly identify and block widely recognized attack patterns, making them quite effective in combating known and common threats. However, with the continuous evolution of cyberattack techniques, the increasing number of new and adaptive attack behaviors, these traditional security products are gradually revealing their limitations.

[0003] Specifically, existing security products have significant shortcomings in deeply analyzing attacker intent and predicting future attack behavior. They often only react to attacks that have already occurred, failing to proactively predict and identify potential threats. This "hindsight" approach to defense often leaves security teams in a passive defensive position when faced with new or unknown attacks, making it difficult to implement effective countermeasures in advance.

[0004] Attacker intent is a crucial aspect of cybersecurity analysis. Understanding attackers' motivations, goals, and potential attack methods is crucial for developing effective defense strategies. However, most existing security products lack this in-depth analysis capability, resulting in an inadequate understanding of attacker behavior. This makes it difficult for security teams to accurately determine the attacker's true intent and, consequently, develop targeted defenses.

[0005] Furthermore, the ability to predict future attack behavior is a major shortcoming of existing security products. With the continuous development and evolution of cyberattack techniques, new attack methods are constantly emerging. These new attacks are often highly concealed and complex, making it difficult for traditional security products to effectively identify and intercept them. While existing cybersecurity practices utilize extensive manual analysis to trace attack sources and identify attack intent, manual analysis is time-consuming and, in real-time or high-pressure attack scenarios, is susceptible to misjudgments or oversights, potentially leading to delayed responses and compromising both timeliness and security. Summary of the Invention

[0006] The present invention provides a method and device for identifying attack intention behavior to solve the problem that existing security products can only react based on attack behaviors that have already occurred and cannot actively predict and identify potential threats.

[0007] A first embodiment of the present invention provides a method for identifying attack intent behavior, comprising the following steps:

[0008] Acquire multiple attack features of multiple historical attack groups, and mark each attack feature with a preset state to obtain multiple marked attack features;

[0009] The pre-built deep neural network classification model is trained using the labeled multiple attack features to obtain a group attack intention recognition model, and the group attack intention recognition model is used to identify the actual status of the target attack group.

[0010] Optionally, the acquiring of multiple attack features of multiple historical attack groups and marking each attack feature with a preset state to obtain multiple marked attack features includes:

[0011] Analyzing the multiple historical attack groups to obtain attack characteristics of each historical attack group;

[0012] Matching the attack signatures with a pre-set intelligence database to obtain historical intelligence on each attack group;

[0013] The preset state is marked on each attack feature according to the historical information to obtain the marked multiple attack features.

[0014] Optionally, the preset state includes a process state and a file state, wherein the process state includes at least one of a first benign state, a first initial access state, a first execution state, a persistence state, an elevated privilege state, a credential access state, a discovery state, a lateral movement state, a command and control state, and a first compromise state, and the file state includes at least one of a second benign state, a second initial access state, a second execution state, and a second compromise state.

[0015] Optionally, the deep neural network classification model includes a first latent variable, a second latent variable, a third latent variable, a decoder and an encoder, wherein the decoder is a two-layer multi-layer perceptron and the encoder is a multi-layer graph attention network.

[0016] The second aspect of the present invention provides an attack trend prediction method based on a gang attack intention identification model, including: obtaining the attack characteristics, attack tools and attack targets of the target attack gang; inputting the attack characteristics into the gang attack intention identification algorithm model to identify the actual status of the target attack gang; and predicting the future attack trend of the target attack gang based on the actual status, the attack tools and the attack targets.

[0017] A third embodiment of the present invention provides an attack intention behavior recognition device, comprising:

[0018] A labeling module is used to obtain multiple attack features of multiple historical attack groups and label each attack feature with a preset state to obtain multiple labeled attack features;

[0019] The training recognition module is used to train a pre-built group attack intention recognition algorithm model using the labeled multiple attack features to obtain a group attack intention recognition model, and use the group attack intention recognition model to identify the actual status of the target attack group.

[0020] A fourth embodiment of the present invention provides an attack trend prediction device based on a group attack intention recognition model, comprising:

[0021] The acquisition module is used to obtain the attack characteristics, attack tools and attack targets of the target attack group;

[0022] An identification module, configured to input the attack characteristics into the group attack intention identification algorithm model to identify the actual status of the target attack group;

[0023] A prediction module is used to predict the future attack trend of the target attack group fire according to the actual state, the attack tool and the attack target.

[0024] A fifth aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the attack intention behavior identification method as described in the above embodiment.

[0025] A sixth aspect of the present invention provides a computer program product, which implements the above-mentioned attack intention behavior identification method when the computer program / instructions are executed by a processor.

[0026] A seventh aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned attack intention behavior identification method.

[0027] The attack intention behavior identification method and device proposed in the embodiment of the present invention can accurately locate the attacker's true attack intention by identifying the attack target with the help of the group's historical alarm information and current attack behavior. At the same time, by establishing a group attack intention identification model, it solves the problem of the existing threat intelligence library being overly dependent on historical information, which helps to update the attack intention of new attack data or alarm information, and thus can also identify and respond to new attacks or adaptive attack behaviors in advance, improving the ability to respond to threats in advance, with high timeliness and high security; it can actively intercept, and can use ATT&CK and attack intention labels to predict the attack stage, classify the attack into the corresponding stage according to the attack feature vector, and predict the attacker's next attack in combination with the attack intention, such as privilege escalation, intranet lateral movement, etc., to identify and analyze potential threats and vulnerabilities before the actual attack incident occurs, so that preventive measures can be taken to reduce potential damage.

[0028] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0030] Figure 1 A flowchart of a method for identifying attack intent behavior provided by an embodiment of the present invention;

[0031] Figure 2 A flow chart of a semi-supervised training algorithm provided by an embodiment of the present invention;

[0032] Figure 3 A flow chart of a detection algorithm provided by an embodiment of the present invention;

[0033] Figure 4 A flowchart of an attack trend prediction method based on a group attack intention identification model provided by an embodiment of the present invention;

[0034] Figure 5 A block diagram of an attack intention behavior recognition device provided by an embodiment of the present invention;

[0035] Figure 6 A schematic block diagram of an attack trend prediction device based on a group attack intention recognition model provided by an embodiment of the present invention;

[0036] Figure 7 The present invention provides a schematic structural diagram of an electronic device. DETAILED DESCRIPTION

[0037] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0038] The following describes, with reference to the accompanying drawings, a method and apparatus for identifying attack intent and behavior according to an embodiment of the present invention. Most existing security products mentioned in the background technology center focus on detecting and intercepting current attack behaviors, but lack in-depth analysis of attacker intent and prediction of future attack behaviors. While they can address known attack patterns, they are unable to proactively identify and respond to new or adaptive attack behaviors. This results in a lack of comprehensive understanding of attacker behavior and limits the ability to proactively respond to threats. While existing network security practices employ extensive manual analysis of attack source tracing and attack intent, manual analysis is time-consuming and, in real-time or high-pressure attack scenarios, is susceptible to misjudgments or oversights, potentially leading to delayed responses and reducing timeliness and security. Therefore, the present invention provides a method for identifying attack intent and behavior. In this method, the attack data of an attack group is correlated and matched with historical alert information in a threat intelligence database to obtain historical intelligence about the attack group. By analyzing this historical intelligence, a preliminary assessment of the attack group's attack intent is made. A group-based attack intent identification model is then proposed to conduct a secondary assessment of the current attack behavior and its preliminary intent to determine the attack group's latest attack intent.

[0039] Specifically, Figure 1 A flowchart of a method for identifying attack intent behavior provided by an embodiment of the present invention.

[0040] like Figure 1 As shown, the attack intention behavior identification method includes the following steps:

[0041] In step S101, a plurality of attack features of a plurality of historical attack groups are obtained, and each attack feature is marked with a preset state to obtain a plurality of marked attack features.

[0042] In some embodiments, multiple attack features of multiple historical attack groups are obtained, and each attack feature is marked with a preset state to obtain multiple marked attack features, including:

[0043] Analyze multiple historical attack groups to obtain the attack characteristics of each historical attack group;

[0044] Match attack signatures with the pre-set intelligence database to obtain historical intelligence on each attack group;

[0045] Each attack feature is labeled with a preset state according to historical intelligence to obtain multiple labeled attack features.

[0046] During the actual implementation process, after pre-determining multiple attack groups, the attack groups are analyzed using an intelligence matching engine to obtain the attack characteristics and attack methods of each historical attack group. The intelligence matching engine can compare the characteristics and attack methods of the attack group with the relevant information in the intelligence database to obtain the historical intelligence of the attack group. This historical intelligence may include attacks that the group has launched, attack methods and attack purposes, etc.

[0047] Furthermore, based on historical intelligence, security experts can better understand the attack objectives and technical level of the attack group, as well as its potential attack methods and attack paths, and then label each attack feature with a preset state. Preset states include process states and file states. Process states include at least one of the following: a first benign state, a first initial access state, a first execution state, a persistent state, an elevated privilege state, a credential access state, a discovery state, a lateral movement state, a command and control state, and a first compromise state. File states include at least one of the following: a second benign state, a second initial access state, a second execution state, and a second compromise state. Only the benign category corresponds to normal processes or files, and all other categories are considered attacks.

[0048] For example, if historical intelligence indicates that the group has previously stolen sensitive data or conducted ransomware attacks, then the current attack may also be aimed at obtaining sensitive information or extorting money, and thus the group can be marked as a first-level threat. If historical intelligence indicates that the group has previously engaged in cryptocurrency mining activities, then the current attack may be aimed at mining cryptocurrency on the victim's computer, and thus the group can be marked as a first-level threat.

[0049] In step S102, a pre-built deep neural network classification model is trained using the labeled multiple attack features to obtain a group attack intention recognition model, and the group attack intention recognition model is used to identify the actual status of the target attack group.

[0050] In some embodiments, the deep neural network classification model includes a first latent variable, a second latent variable, a third latent variable, a decoder and an encoder, wherein the decoder is a two-layer multi-layer perceptron and the encoder is a multi-layer graph attention network.

[0051] In actual implementation, the annotated and extracted attack features can be divided into disjoint training and test sets in a 4:1 ratio. Based on semi-supervised learning, the training set is input into a pre-built deep neural network classification model to train the deep neural network classification model. The attack features can describe the historical behavior of a process or file from multiple dimensions. A neural network model can be used to classify the attack phases based on behavioral characteristics, resulting in a model for identifying group attack intent. The test set is used to evaluate the performance of the trained model for identifying group attack intent, using classification accuracy as the evaluation metric. Furthermore, this evaluation method can be used to fine-tune and enhance the algorithm's attack phase classification performance on known data.

[0052] Furthermore, this group attack intent recognition model encodes attack signatures into latent variables and can also recover attack signatures from these latent variables, ensuring interpretability. A special loss function is designed for classification. The classifier receives the encoded latent variables as input and outputs the weights for each category. The group attack intent recognition model outputs the highest-weighted category as the classification result, completing the attack phase classification.

[0053] It should be noted that the pre-built deep neural network classification model includes a first latent variable, a second latent variable, a third latent variable, a decoder and an encoder, wherein:

[0054] The first latent variable u satisfies u={u1,K,u d}, and p(u)=∏p(u i ), where each u i All obey the prior normal distribution N(0,1), that is, u i ~N(0,1).

[0055] The second latent variable Y satisfies Y={Y1,K,Y d}, and p(Y)=∏p(Y i ), where each Y is subject to the prior normal distribution Bern(π), that is, Y i ~Bern(π), π is a super parameter.

[0056] The third latent variable e, where e~N(0,δ -1 ), p(δ) obeys the Jeffrey prior.

[0057] Decoder p θ , the decoder is a two-layer multilayer perceptron parameterized by θ.

[0058] encoder The encoder is a parameterized Multi-layer graph attention network.

[0059] For a given input traceability graph G=(x,A), x={x1,K,x m}, the main goal of the encoder is to learn p(Y i |x), and will satisfy y during detection i = 0 is identified as the attack point.

[0060] To achieve this goal, the encoder needs to learn the exact posterior distribution p(u,Y,δ|x,A). However, due to the complexity of the posterior distribution, it is impossible to learn the distribution directly. Therefore, the encoder will learn a q(u,Y,δ|x,A) as an approximation of the posterior distribution. Specifically, q(u,Y,δ|x,A) can be decomposed into:

[0061]

[0062] And satisfy:

[0063]

[0064] q(γ i |x,A)=Bern(w i (x,A))

[0065]

[0066] Among them, the parameters of the variational q distribution are modeled by the underlying graph attention network (GAT), which provides sufficient flexibility and scalability for the encoder. In the encoder designed in the embodiment of the present invention, a two-layer GAT is first designed for common graph feature extraction, and then respectively input into three branches used to model u, Y, and δ parameters, where each branch is also a two-layer GAT structure, and the number of channels is consistent with the shared two-layer GAT for graph feature extraction. Among them, u and Y mainly encode node-level features, while δ encodes graph-level features to enhance the generalization ability of the network. Therefore, a pooling layer is included in the δ branch to generate graph-level features.

[0067] Given the latent variables u, Y output by the encoder and the adjacency matrix A of the graph, the main goal of the decoder Y is to reconstruct the variables so that the reconstructed x is as consistent as possible with the original input x of the encoder.

[0068] The encoder designed in the embodiment of the present invention is a two-layer multi-layer perceptron (MLP). Specifically, if the structural equation of x is linear, it can be written as x=A T Therefore, under the linear model, given u and A, x can be derived through the linear decoder:

[0069] x=(IAT ) -1 u

[0070] By introducing two nonlinear functions, this formula can be extended to nonlinear scenarios:

[0071] x=f2((IA T ) -1 f1(u))

[0072] Where f1 and f2 are nonlinear, component-learnable functions. In the method proposed in the embodiment of the present invention, f1 and f2 are fitted separately by two layers of MLP. Assuming f2 is reversible, the above decoder corresponds to a set of nonlinear structural equations:

[0073]

[0074] Therefore, u and x can be converted into a space through f1 and f2. The converted x is a linear model about u. At this time, given u and A, x can be derived through the linear decoder, thus completing the expansion from linear scenarios to nonlinear scenarios.

[0075] In general, the distribution learned by the decoder can be decomposed into:

[0076]

[0077] in,

[0078]

[0079] Here, π represents the probability of taking 1 in the Bernoulli distribution, and I is the identity matrix.

[0080] In intent detection, due to the complexity and variability of attack behavior information, it is often difficult to obtain sufficient labeled data for supervised learning in real scenarios. Therefore, the embodiment of the present invention is based on semi-supervised learning, which uses limited labeled data and a large amount of unlabeled data to train the model, thereby enhancing the detection capability and robustness of the model.

[0081] Specifically, if Figure 2 As shown, the input to the pre-built deep neural network classification model includes the adjacency matrix A of the traceability graph G, the graph data x, the label y and the labeled multiple attack features of the supervision mark T. During the training process, the encoder is optimized alternately. and decoder p θ Parameters are obtained to obtain a model based on group attack intention recognition. For the loss function, depending on whether there is a label, the embodiment of the present invention adopts two different calculation methods:

[0082] (1) For supervised samples, minimize the reconstruction loss ELBO and the label log-likelihood loss LOGMLE.

[0083] (2) For unsupervised samples, only the reconstruction loss ELBO is minimized. Here, u i is the latent variable representation sampled from the encoder’s Gaussian distribution, and y i It is a discrete variable representation obtained by gumbel-softmax sampling.

[0084] After obtaining a group attack intention recognition model based on semi-supervised training, the embodiment of the present invention can use its encoder to detect attack intentions. Figure 3 As shown, the input to the group attack intention recognition model includes the adjacency matrix A of the traceability graph G, the graph data x, and the previously trained encoder The goal of the algorithm is to output a set of suspicious attack intentions rc(v) detected by the target attack group, whose information is represented by an attack chain composed of nodes and edges. The main steps of the algorithm are as follows:

[0085] (1) From the input graph data x, take out each node x in turn i .

[0086] (2) Using the trained encoder For the current node x i and its adjacent nodes are encoded.

[0087] (3) Sampling is performed through the gumbel-softmax method to obtain a representation of each graph node, which is used as the probability that the graph node is a normal node.

[0088] (4) According to y i The node is added to the set of suspicious attack nodes rc(v) based on the minimum value among them.

[0089] (5) From y i Delete the current minimum value and continue processing the next node.

[0090] The algorithm loops through the above steps until all nodes have been processed. Finally, the algorithm returns the set of detected suspicious attack nodes rc(v), which is the actual status of the identified target attack group.

[0091] In summary, the attack intention behavior identification method proposed in the embodiment of the present invention can accurately locate the attacker's true attack intention by using the gang's historical alarm information and current attack behavior to identify the attack target. At the same time, by establishing a gang attack intention identification model, it solves the problem of the existing threat intelligence library being overly dependent on historical information, helps to update the attack intention of new attack data or alarm information, and thus can also identify and respond to new attacks or adaptive attack behaviors in advance, thereby improving the ability to respond to threats in advance, and has high timeliness and security.

[0092] Next, an attack trend prediction method based on a group attack intention recognition model proposed in an embodiment of the present invention will be described with reference to the accompanying drawings.

[0093] Figure 4 A flowchart of an attack trend prediction method based on a group attack intention identification model provided by an embodiment of the present invention.

[0094] like Figure 4 As shown, the attack trend prediction method based on the gang attack intention identification model includes the following steps:

[0095] In step S401, the attack characteristics, attack tools and attack targets of the target attack group are obtained.

[0096] In step S402, the attack features are input into a group attack intention identification algorithm model to identify the actual status of the target attack group.

[0097] In step S403, the future attack trend of the target attack group fire is predicted based on the actual status, attack tools and attack targets.

[0098] During the actual implementation process, after the actual status of the target attack group is identified, a machine learning regression algorithm can be used to predict the future attack frequency based on historical data, and a prediction chart can be formed to show the trend of the attack to intensify or slow down.

[0099] Specifically, machine learning regression algorithms can leverage historical data, including information such as attack frequency, attack methods, and attack objectives, as well as other relevant factors, to predict the probability of future attacks. During the prediction process, the algorithm considers multiple factors and generates a predictive model. This model can demonstrate the trends and likelihood of future attacks, providing security experts with a basis for predicting future attack trends and developing response strategies. Machine learning regression algorithms require sufficient historical data. Therefore, historical data must be continuously collected and organized to train the algorithm and improve prediction accuracy. Furthermore, machine learning regression algorithms require continuous optimization and adjustment to better adapt to different attack scenarios and response strategies, thereby enhancing network security defense capabilities.

[0100] In addition, embodiments of the present invention further include generating an attack classification report, which can help network security experts better understand and identify the types, targets, and trends of attacks, thereby taking more targeted and effective security measures.

[0101] The process of generating an attack classification report can be divided into the following steps: First, based on ATT&CK and the various technologies and methods described above, obtain and analyze data on attackers, attack stages, attack tools, and attack targets. Second, process and analyze the data through algorithms such as machine learning to derive attack trends and intentions. Finally, integrate the results into the attack classification report to provide a comprehensive, multi-dimensional classification and description of the attacks.

[0102] When generating attack classification reports, cybersecurity experts can categorize attack intent based on multiple dimensions, including attack targets, attack phases, attack methods, attacker behavior, and attack frequency. This allows for a better understanding and identification of attack types, allowing for the implementation of appropriate security measures.

[0103] According to the attack trend prediction method based on the group attack intention identification model proposed in the embodiment of the present invention, active interception can be carried out, and attack stage prediction can be carried out by combining ATT&CK and attack intention labels. The attack is classified into the corresponding stage according to the attack feature vector, and the attacker's next attack is predicted in combination with the attack intention, such as privilege escalation, intranet lateral movement, etc. Before the actual attack incident occurs, potential threats and vulnerabilities can be identified and analyzed, so that preventive measures can be taken to reduce potential damage.

[0104] Furthermore, an attack intention behavior recognition device proposed according to an embodiment of the present invention is described with reference to the accompanying drawings.

[0105] Figure 5 A block diagram of an attack intention behavior recognition device provided by an embodiment of the present invention.

[0106] like Figure 5 As shown, the attack intention behavior recognition device 50 includes: a labeling module 501 and a training recognition module 502.

[0107] The labeling module 501 is used to obtain multiple attack features of multiple historical attack groups and label each attack feature with a preset status to obtain multiple labeled attack features. The training and identification module 502 is used to train a pre-built algorithm model based on group attack intention identification using the labeled multiple attack features to obtain a group attack intention identification model, and use the group attack intention identification model to identify the actual status of the target attack group.

[0108] In some embodiments, the annotation module 501 includes:

[0109] An analysis unit, configured to analyze multiple historical attack groups to obtain attack characteristics of each historical attack group;

[0110] The matching unit is used to match the attack signature with the preset intelligence library to obtain the historical intelligence of each attack group;

[0111] The labeling unit is used to label each attack feature with a preset state according to historical intelligence to obtain multiple labeled attack features.

[0112] In some embodiments, the preset state includes a process state and a file state, wherein the process state includes at least one of a first benign state, a first initial access state, a first execution state, a persistence state, an elevated privilege state, a credential access state, a discovery state, a lateral movement state, a command and control state, and a first compromise state, and the file state includes at least one of a second benign state, a second initial access state, a second execution state, and a second compromise state.

[0113] In some embodiments, the algorithm model based on group attack intention discovery includes a first latent variable, a second latent variable, a third latent variable, a decoder and an encoder, wherein the decoder is a two-layer multi-layer perceptron and the encoder is a multi-layer graph attention network.

[0114] It should be noted that the aforementioned explanation of the embodiment of the attack intention behavior recognition method is also applicable to the attack intention behavior recognition device of this embodiment, and will not be repeated here.

[0115] The attack intention behavior identification device proposed in the embodiment of the present invention can accurately locate the attacker's true attack intention by identifying the attack target with the help of the gang's historical alarm information and current attack behavior. At the same time, by establishing a gang attack intention identification model, it solves the problem of the existing threat intelligence library being overly dependent on historical information, helps to update the attack intention of new attack data or alarm information, and thus can also identify and respond to new attacks or adaptive attack behaviors in advance, thereby improving the ability to respond to threats in advance, and has high timeliness and security.

[0116] Next, an attack trend prediction device based on a group attack intention recognition model proposed in an embodiment of the present invention will be described with reference to the accompanying drawings.

[0117] Figure 6 A block diagram of an attack trend prediction device based on a group attack intention recognition model provided by an embodiment of the present invention.

[0118] like Figure 6As shown, the attack trend prediction device 60 based on the gang attack intention recognition model includes: an acquisition module 601, an identification module 602 and a prediction module 603.

[0119] The acquisition module 601 is used to obtain the attack characteristics, attack tools, and attack targets of the target attack group. The identification module 602 is used to input the attack characteristics into the group attack intention identification algorithm model to identify the actual status of the target attack group. The prediction module 603 is used to predict the future attack trends of the target attack group based on the actual status, attack tools, and attack targets.

[0120] It should be noted that the aforementioned explanation of the embodiment of the attack trend prediction method based on the gang attack intention recognition model is also applicable to the attack trend prediction device based on the gang attack intention recognition model of this embodiment, and will not be repeated here.

[0121] According to the attack trend prediction device based on the gang attack intention identification model proposed in the embodiment of the present invention, active interception can be performed, and attack stage prediction can be performed by combining ATT&CK and attack intention labels. The attack is classified into the corresponding stage according to the attack feature vector, and the attacker's next attack is predicted in combination with the attack intention, such as privilege escalation, intranet lateral movement, etc. Before the actual attack incident occurs, potential threats and vulnerabilities can be identified and analyzed, so that preventive measures can be taken to reduce potential damage.

[0122] Figure 7 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device may include:

[0123] A memory 701 , a processor 702 , and a computer program stored in the memory 701 and executable on the processor 702 .

[0124] When the processor 702 executes the program, the attack intention behavior identification method provided in the above embodiment is implemented.

[0125] Furthermore, the electronic device further includes:

[0126] The communication interface 703 is used for communication between the memory 701 and the processor 702 .

[0127] The memory 701 is used to store computer programs that can be run on the processor 702 .

[0128] The memory 701 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0129] If the memory 701, processor 702, and communication interface 703 are implemented independently, the communication interface 703, memory 701, and processor 702 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0130] Optionally, in a specific implementation, if the memory 701, the processor 702 and the communication interface 703 are integrated on a chip, the memory 701, the processor 702 and the communication interface 703 can communicate with each other through an internal interface.

[0131] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0132] An embodiment of the present invention further provides a computer program product, which implements the above attack intention behavior identification method when the computer program / instructions are executed by a processor.

[0133] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned attack intention behavior identification method when executed by a processor.

[0134] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0135] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "N" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0136] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or N executable instructions for implementing a custom logical function or step of a process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0137] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0138] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0139] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0140] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0141] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and are not to be construed as limiting the present invention. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for identifying attack intention behavior, characterized in that: The following steps are involved: Acquire multiple attack features of multiple historical attack groups, and mark each attack feature with a preset state to obtain multiple marked attack features; The pre-built deep neural network classification model is trained using the labeled multiple attack features to obtain a group attack intention recognition model, and the group attack intention recognition model is used to identify the actual status of the target attack group.

2. The attack intention behavior identification method according to claim 1 is characterized in that: The step of obtaining multiple attack features of multiple historical attack groups and marking each attack feature with a preset state to obtain multiple marked attack features includes: Analyzing the multiple historical attack groups to obtain attack characteristics of each historical attack group; Matching the attack signatures with a pre-set intelligence database to obtain historical intelligence on each attack group; The preset state is marked on each attack feature according to the historical information to obtain the marked multiple attack features.

3. The attack intention behavior identification method according to claim 1, characterized in that: The preset state includes a process state and a file state, wherein the process state includes at least one of a first benign state, a first initial access state, a first execution state, a persistence state, an elevated privilege state, a credential access state, a discovery state, a lateral movement state, a command and control state, and a first compromise state; and the file state includes at least one of a second benign state, a second initial access state, a second execution state, and a second compromise state.

4. The attack intention behavior identification method according to claim 1, characterized in that: The deep neural network classification model includes a first latent variable, a second latent variable, a third latent variable, a decoder and an encoder, wherein the decoder is a two-layer multi-layer perceptron and the encoder is a multi-layer graph attention network.

5. A method for predicting attack trends based on a group attack intention recognition model, characterized in that: The following steps are involved: Obtain the attack characteristics, attack tools, and attack targets of the target attack group; Inputting the attack characteristics into the group attack intention identification algorithm model to identify the actual status of the target attack group; The future attack trend of the target attack group fire is predicted according to the actual state, the attack tool and the attack target.

6. A device for identifying attack intention behavior, characterized in that: include: A labeling module is used to obtain multiple attack features of multiple historical attack groups and label each attack feature with a preset state to obtain multiple labeled attack features; The training recognition module is used to train a pre-built group attack intention recognition algorithm model using the labeled multiple attack features to obtain a group attack intention recognition model, and use the group attack intention recognition model to identify the actual status of the target attack group.

7. An attack trend prediction device based on a gang attack intention recognition model, characterized in that: include: The acquisition module is used to obtain the attack characteristics, attack tools and attack targets of the target attack group; An identification module, configured to input the attack characteristics into the group attack intention identification algorithm model to identify the actual status of the target attack group; A prediction module is used to predict the future attack trend of the target attack group fire according to the actual state, the attack tool and the attack target.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the attack intention behavior identification method according to any one of claims 1 to 4.

9. A computer program product, characterized in that When the computer program / instruction is executed by a processor, the attack intention behavior identification method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the attack intention behavior identification method according to any one of claims 1 to 4.

Images