Security detection method and system based on multi-source heterogeneous APT attack behavior analysis

Abstract

The invention relates to the field of APT attack detection, in particular to a security detection method and system based on multi-source heterogeneous APT attack behavior analysis. The method comprises the following steps: acquiring multi-source heterogeneous network monitoring data in a current network, performing heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and performing APT attack behavior feature mining to obtain APT attack behavior features; attack target identification is carried out based on the multi-source heterogeneous network monitoring data, and multi-stage attack rolling identification is carried out, so that APT attack time features are generated; according to the APT attack behavior characteristics and the APT attack time characteristics, attack path tracing is carried out, global attack chain reconstruction evolution is carried out, and an APT attack knowledge graph is constructed; attacker behavior intention prediction is carried out based on an APT attack knowledge graph, and then attack behavior path deduction is carried out, so that a multi-step APT attack behavior prediction path is generated. According to the APT attack detection method and device, accurate APT attack detection is realized, and the APT attack protection capability is improved.

Description

Technical Field

[0001] The present invention relates to the field of APT attack detection, and in particular to a security detection method and system based on multi-source heterogeneous APT attack behavior analysis. Background Art

[0002] With the rapid development of information technology and the widespread use of the internet, the cybersecurity landscape has become increasingly challenging. Advanced Persistent Threat (APT) attacks, as advanced persistent threats targeting specific targets, have become a major challenge in modern network security. APT attacks are often characterized by high stealth, sophisticated attack methods, and long duration. Traditional security technologies often struggle to effectively identify and prevent APT attacks, posing a significant threat to organizations, businesses, and national security.

[0003] The success of APT attacks relies not only on technological breakthroughs but also on exploiting vulnerabilities in various network resources, such as systems, applications, network devices, and terminals. Therefore, APT attacks often unfold in a multi-stage, multi-layered manner, with attackers gradually expanding their reach through lateral penetration and covert communications, ultimately achieving data leakage, system control, or other malicious objectives. Due to the complexity and persistence of APT attacks, traditional security defense systems are often unable to monitor and respond to them in real time.

[0004] Currently, APT attack detection primarily relies on traditional security tools such as firewalls, intrusion detection systems (IDS), and antivirus software. These tools rely on single data sources and rules for threat identification. However, with the continuous advancement of attack technologies, single data sources and detection methods are no longer sufficient to identify complex APT attacks. Therefore, a more intelligent and accurate APT attack detection method is needed to improve the security performance of APT attack protection. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention proposes a security detection method and system based on multi-source heterogeneous APT attack behavior analysis to solve at least one of the above technical problems.

[0006] To achieve the above objectives, the present invention provides a security detection method based on multi-source heterogeneous APT attack behavior analysis, comprising the following steps: Step S1: Acquire multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; Step S2: identifying attack targets based on the multi-source heterogeneous network monitoring data, and performing multi-stage attack rolling identification, thereby generating APT attack time characteristics; Step S3: Tracing the attack path based on the APT attack behavior characteristics and APT attack time characteristics, reconstructing and evolving the global attack chain, and constructing an APT attack knowledge graph; Step S4: Predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; Step S5: Identify key network nodes of the multi-step APT attack behavior prediction path, perform APT attack simulation, and conduct dynamic defense drills to obtain APT attack defense simulation response data; Step S6: Based on the APT attack defense simulation response data, collaborative protection decisions are made, dynamic iterative protection optimization is performed, and a dynamic APT attack protection optimization model is constructed.

[0007] In this specification, a security detection system based on multi-source heterogeneous APT attack behavior analysis is provided, which is used to execute the security detection method based on multi-source heterogeneous APT attack behavior analysis as described above, including: An attack behavior feature module is used to obtain multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; An attack time signature module, configured to identify attack targets based on the multi-source heterogeneous network monitoring data and perform multi-stage attack rolling identification, thereby generating APT attack time signatures; The attack chain reconstruction module is used to trace the attack path based on the APT attack behavior characteristics and APT attack time characteristics, and to reconstruct and evolve the global attack chain to build an APT attack knowledge graph; The behavior path prediction module is used to predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; The attack simulation module is used to identify key network nodes in the multi-step APT attack behavior prediction path, simulate APT attacks, and conduct dynamic defense drills to obtain APT attack defense simulation response data; The protection optimization module is used to make collaborative protection decisions based on APT attack defense simulation response data, perform dynamic iterative protection optimization, and build a dynamic APT attack protection optimization model.

[0008] The beneficial effects of the present invention are specifically as follows: through the acquisition of multi-source heterogeneous data (such as traffic data, log data, system behavior data, etc.), various activities in the network can be fully grasped, thereby effectively detecting APT attacks. APT attacks usually penetrate gradually through multiple stages and multiple paths. Multi-source data is used to enhance the coverage of attack detection. By performing APT attack behavior detection on monitoring data, combined with feature mining technology, unique behavior patterns of APT attacks are extracted, such as abnormal traffic, malicious code execution and other features. These features can help identify potential APT attack activities. APT attacks usually go through multiple stages, and attackers will gradually achieve their goals through different strategies (such as lateral penetration, privilege escalation, etc.). Attacks are carried out through multi-source heterogeneous data. Attack target identification helps to accurately locate the attacker's target and identify the key nodes of the attack. APT attacks are not completed in one go, but are characterized by long-term and covert nature. The multi-stage rolling identification method helps detect and identify each stage of the attack, thereby capturing the progress in the attack chain in real time, ensuring that attacks at each stage can be discovered and responded to in a timely manner. By tracing the attack path, restoring the attacker's intrusion trajectory, identifying each link in the attack path, and understanding the attacker's behavior and path are crucial to defense deployment, helping the security team better understand the attacker's strategy and intentions. Through global attack chain reconstruction, it is possible to identify the attacker's attack behaviors launched through multiple channels and means, and clearly present the full picture of the attack. This reconstruction not only helps to accurately Accurately identifying the attack stage can also provide a reliable basis for the formulation of subsequent defense measures. Constructing a knowledge graph can display information such as attack behavior, attack target, attack path, etc. in the form of a graph, which is convenient for analysis, tracing and prediction. The knowledge graph provides a systematic perspective for subsequent analysis, helping researchers to grasp the attack event from a global perspective. By analyzing the APT attack knowledge graph, the attacker's next move can be predicted. For example, the attacker will try to further penetrate or seize more system permissions. Accurately predicting the attacker's intentions helps the security team prepare for defense in advance. Through attack path deduction, the attacker's action trajectory is simulated, and the inferred attack path and attack steps are speculated. This helps to discover potential attack routes early, thereby strengthening defense efforts. By identifying the attack By analyzing the key network nodes in the attack path, we can find the weak links exploited by attackers and focus on protecting these nodes, which will help block the further expansion of the attack. By simulating attacks, we can test the effectiveness of the current defense system and check whether the security protection measures can effectively deal with different types of APT attacks. Through simulation exercises, we can identify the security vulnerabilities of the system in advance. By comprehensively analyzing the APT attack defense simulation response data, the security team can make more scientific collaborative protection decisions. For example, different security devices and protection strategies can be combined to form a more powerful defense system to avoid the blind spots of a single defense strategy. APT attacks are highly concealed and changeable, and traditional static defense measures are difficult to deal with effectively. Therefore, dynamic protection optimization can be based on real-time data feedback.Continuously adjust and improve defense strategies to enhance the system's defense capabilities against new APT attacks, build a dynamic APT attack protection optimization model, help systematically manage and adjust defense strategies, form an automated and intelligent APT protection system, and enhance the adaptability and responsiveness of the defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A schematic flow chart of the steps of a method of the present invention; Figure 2 Detailed implementation flow chart of step S1; Figure 3 Schematic diagram of the detailed implementation steps of step S2. DETAILED DESCRIPTION

[0010] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0011] This application provides a security detection method and system based on multi-source heterogeneous APT attack behavior analysis. The execution entities of the multi-source heterogeneous APT attack behavior analysis and security detection method and system include, but are not limited to, the following: mechanical equipment, data processing platforms, cloud server nodes, network upload devices, etc. equipped with the system, which can be regarded as general computing nodes of this application. The data processing platform includes, but is not limited to, at least one of an audio and image management system, an information management system, and a cloud data management system.

[0012] See also Figures 1 to 3 The present invention provides a security detection method based on multi-source heterogeneous APT attack behavior analysis, which includes the following steps: Step S1: Acquire multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; Step S2: identifying attack targets based on the multi-source heterogeneous network monitoring data, and performing multi-stage attack rolling identification, thereby generating APT attack time characteristics; Step S3: Tracing the attack path based on the APT attack behavior characteristics and APT attack time characteristics, reconstructing and evolving the global attack chain, and constructing an APT attack knowledge graph; Step S4: Predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; Step S5: Identify key network nodes of the multi-step APT attack behavior prediction path, perform APT attack simulation, and conduct dynamic defense drills to obtain APT attack defense simulation response data; Step S6: Based on the APT attack defense simulation response data, collaborative protection decisions are made, dynamic iterative protection optimization is performed, and a dynamic APT attack protection optimization model is constructed.

[0013] In the embodiment of the present invention, see Figure 1 , is a schematic flow chart of the steps of a security detection method based on multi-source heterogeneous APT attack behavior analysis of the present invention. In this example, the steps of the security detection method based on multi-source heterogeneous APT attack behavior analysis include: Step S1: Acquire multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; In this embodiment, the sources of multi-source heterogeneous network monitoring data are determined, including network traffic monitoring, intrusion detection systems (IDS), firewall logs, terminal security events, application logs, etc. The format and content of each data source are different, so a unified definition is required. Appropriate data collection tools and technologies (such as ELK Stack, Splunk, or customized log collection tools) are selected for real-time data collection. These tools help centrally manage data from different sources and provide good query and analysis capabilities. The collected multi-source data is integrated and processed to ensure the consistency of the data structure. Data cleaning technology is used to eliminate duplicate records, missing values, and outliers to ensure the accuracy of subsequent analysis. Based on the definition and characteristics of APT attacks, a suitable detection model is constructed. Machine learning models (such as support vector machines and random forests) or rule-based detection systems are used to combine the characteristics of historical APT attacks for modeling. Features related to APT attacks are extracted from multi-source monitoring data, such as network traffic characteristics (traffic size, traffic direction, protocol type), user behavior characteristics (login time, access frequency, abnormal operations), system log characteristics (abnormal login, permission changes, progress). Process anomalies), use labeled APT attack sample data to train the detection model, and evaluate the model's accuracy and recall through methods such as cross-validation to ensure that the model can effectively identify APT attack behaviors. Select appropriate feature mining algorithms (such as cluster analysis and association rule learning) to extract potential attack features and patterns from detected APT attack behaviors. Clustering methods help identify similar attack behaviors, and association rule learning reveals the relationship between attack behaviors. Statistical analysis is performed on the extracted features, and the importance of each feature in the attack behavior is calculated to identify key features. For example, methods such as information gain or the Gini coefficient are used to evaluate the feature's ability to distinguish attack behaviors. The mined APT attack behavior features are compiled into a report that details the specific content of the features, the relationship between the features and attack behaviors, and the discovered attack patterns. This information is crucial for subsequent protection strategies and detection system optimization.

[0014] Step S2: identifying attack targets based on the multi-source heterogeneous network monitoring data, and performing multi-stage attack rolling identification, thereby generating APT attack time characteristics; In this embodiment, the definition of attack targets is clearly defined, including key assets in the network, such as databases, file servers, user terminals or other sensitive information storage. The characteristics of each target should include its importance, function, network location and other information. From the multi-source monitoring data extracted in step S1, information related to the attack target is integrated, including user login activities, access permission changes, traffic anomalies, etc., to ensure that the data format is unified for subsequent analysis and to determine the features used for attack target identification. These features include: network traffic features (source IP, destination IP, port number, traffic size), user behavior features (login time, access frequency, operation type), system log features (abnormal events, permission changes, system calls), and machine learning algorithms (such as decision trees, random forests, and K-nearest neighbor algorithms) are used to build an attack target identification model. The model should be trained based on the extracted features to ensure that it can accurately identify potential attack targets. The model is trained using labeled attack sample data, and the performance of the model is evaluated through methods such as cross-validation to ensure that the accuracy and recall rate of the model meet the expected standards to improve the effectiveness of target identification. The trained model is applied to real-time monitoring data to identify the current network. The attack target is identified and relevant information of the identified target is recorded, including target type, risk level, time window of attack, etc. The characteristics of multi-stage attacks are clarified, which usually include multiple stages of attack behaviors, such as infiltration, lateral movement, information collection, etc. The attack behaviors in each stage should have specific indicators and characteristics to facilitate identification. The appropriate algorithm is selected for rolling identification of multi-stage attacks. Methods based on time series analysis (such as sliding window technology) are used to monitor the changes in attack behaviors over time. Network activities are monitored in real time. The rolling identification algorithm is applied to analyze the attack behaviors within each time window and identify the attack activities in each stage. Statistical methods (such as variance analysis) are used to identify abnormal behaviors and determine whether they belong to a certain stage of the multi-stage attack. The identified multi-stage attack activities are organized into time feature data, including the start time, end time, duration of each stage, etc. The generated time features provide a basis for subsequent attack analysis and protection strategies.

[0015] Step S3: Tracing the attack path based on the APT attack behavior characteristics and APT attack time characteristics, reconstructing and evolving the global attack chain, and constructing an APT attack knowledge graph; In this embodiment, the standards for attack path tracing are clarified, including identifying the key features of each attack link, transfer conditions, and relationships between nodes. Path tracing not only needs to focus on the attacker's activities, but also consider changes in attack targets. Graph theory models (such as directed graphs) are used to represent nodes (attack targets) and edges (attack paths) in the network. Nodes represent attack targets or behaviors, and edges represent the paths of attackers moving from one target to another. Graph traversal algorithms (such as depth-first search or breadth-first search) are applied to analyze the constructed attack path graph to identify the attacker's activity path. Through path weight analysis, the key links and high-risk nodes of the attack path are determined. The tracing results are organized into documents, which describe each identified attack path in detail, including the role of each node in the path, transfer conditions, attack time, and other information. This information will provide a basis for subsequent attack chain reconstruction, and determine the components of the global attack chain, including the attacker's initial target, key steps in the attack process, and The ultimate goal is that the global attack chain should be able to reflect the attacker's overall strategy and behavior pattern. Based on the identified attack path, a model of the global attack chain should be constructed. A state machine or sequence model should be used to represent the various stages and state transitions of the attack. The reconstructed global attack chain should be subjected to evolutionary analysis, focusing on the temporal changes in attack behavior. For example, time series analysis methods should be used to identify patterns and trends in attack behavior and determine the attacker's strategy adjustments at different stages. The reconstructed global attack chain and path tracing results should be converted into a knowledge graph. The graph should contain nodes (attack targets), edges (attack paths), and attributes (behavioral characteristics, time characteristics, etc.). In the knowledge graph, the characteristic information of different nodes should be associated, including the attacker's behavior pattern, the risk level of the attack target, etc. The structured representation of the graph facilitates subsequent query and analysis. The knowledge graph should be updated regularly to incorporate new attack data and features to ensure the timeliness and accuracy of the graph and to ensure that the graph can reflect the latest APT attack dynamics.

[0016] Step S4: Predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; In this embodiment, the definition of the attacker's behavioral intention is determined, including the attacker's purpose (such as data theft, service interruption, etc.), attack method (such as phishing, malware propagation, etc.) and expected target. Clarifying these factors will help in subsequent intention prediction. A suitable machine learning or deep learning model is selected to predict the attacker's behavioral intention. Common models include long short-term memory networks (LSTM) and random forests. The model is trained based on historical attack data to ensure that it can identify the attacker's behavioral pattern. Important features are extracted from the knowledge graph as model input. These features include attack paths, time features, frequency of attack behaviors, etc. The model is trained using labeled data and its performance is evaluated through cross-validation. The trained model is used to monitor the attacker's behavior in the current network environment in real time to predict the attacker's behavioral intention. The generated intention prediction data should include the attack type, target node and its implementation time. Based on the knowledge graph and intention prediction results, the model is trained. Based on the results, an attack behavior path deduction model is constructed. Graph theory methods are used to deduce the attack path using graph traversal algorithms (such as the Dijkstra algorithm or the A* algorithm). The deduction logic is defined to clarify the steps taken by the attacker. For example, the attacker first collects information, then conducts initial penetration, and finally steals data. The success rate and potential risks of each step should be considered during the deduction process. The intention prediction results are analyzed using the deduction model to generate multi-step APT attack behavior prediction paths. These paths should include the attack steps, target nodes, time nodes, and their sequence in each stage. The generated multi-step APT attack behavior prediction paths are organized into a report, including a detailed description of each path, the attack steps, and their associated risk assessments. This information will provide a basis for the subsequent formulation of protection strategies. The generated attack behavior prediction paths are displayed using visualization tools (such as Graphviz and Neo4j), which can intuitively understand the attacker's potential behavior patterns and attack paths.

[0017] Step S5: Identify key network nodes of the multi-step APT attack behavior prediction path, perform APT attack simulation, and conduct dynamic defense drills to obtain APT attack defense simulation response data; In this embodiment, key network nodes are defined. These nodes are usually nodes in the attack path that are critical to the success of the attack, such as key servers, databases, gateways, intranet devices, etc. The identification of key nodes will help concentrate protection resources. Key node information is extracted from the multi-step APT attack behavior prediction path generated in step S4 to ensure that the information of each node is complete, including its role, network location, importance level, etc. The attack path is analyzed using centrality analysis (such as degree centrality, proximity centrality) or influence analysis methods in graph theory to identify key nodes. Python libraries (such as NetworkX) are used to implement these algorithms to quickly identify nodes in the path that are critical to the attacker's success. The identified key nodes are compiled into a report that describes in detail the characteristics of each node, its position in the attack path, and its importance. This information will provide a basis for subsequent APT attack simulations and defense drills. A safe simulation environment is created to facilitate APT attack simulations. Virtualization technologies (such as VMware and Docker) are used to build a test environment to simulate the real network architecture and operating environment. Appropriate attack simulation tools (such as Metasploit and Cobalt) are selected. Strike) to conduct APT attack simulations. These tools help simulate real-world attack behaviors and strategies, providing a realistic attack experience. Based on the multi-step APT attack behavior prediction path generated in step S4, the attack simulation is executed. During the simulation, the attacker will follow the predicted path, attempting to penetrate, move laterally, and steal data. Each step of the simulation is monitored to collect relevant data. The attack behavior and results during the simulation are recorded, including successful attack steps, attack behaviors detected by the defense system, and undetected attack attempts. This data will provide a basis for subsequent dynamic defense drills. The current network defense system, including firewalls, intrusion detection systems (IDS), and antivirus software, must be clarified, and the working principles and configurations of these systems must be understood to reasonably simulate the responses of defense measures. A dynamic defense drill plan should be developed, and the goals, scope, and steps of the drill should be determined. The drill should include real-time monitoring, attack response, and vulnerability remediation to evaluate the effectiveness of the defense system. During the simulated attack, dynamic defense drills should be conducted to monitor attack behavior in real time, evaluate the defense system's response capabilities to attacks, and record the startup time, response time, and effectiveness of each defense measure.

[0018] Step S6: Based on the APT attack defense simulation response data, collaborative protection decisions are made, dynamic iterative protection optimization is performed, and a dynamic APT attack protection optimization model is constructed.

[0019] In this embodiment, the APT attack defense simulation response data collected in step S5 are integrated. These data should include attack behavior, success or failure, response time, effectiveness of defense measures, etc., to ensure the integrity and consistency of the data for subsequent analysis and to determine key indicators for collaborative protection decision-making, including: attack detection rate: the ratio of the number of attacks successfully detected by the defense system to the total number of attacks, response time: the time required from detecting an attack to implementing defense measures, false negative rate: the ratio of the number of undetected attacks to the total number of attacks, and effectiveness of defense measures: the proportion of attacks successfully blocked by defense measures. Based on the integrated simulation response data, a collaborative protection decision model is constructed. Machine learning algorithms such as multivariate linear regression, decision tree, or random forest are used to analyze the impact of various indicators on the defense effect. The decision model is trained using historical data, and the performance of the model is evaluated through methods such as cross-validation to ensure that the model can accurately predict the defense effect in different attack scenarios, providing a basis for subsequent decision-making. The trained model is applied to make real-time collaborative protection decisions based on the current network environment and attack characteristics, ensuring that various protection components (such as firewalls, IDS, and terminal protection) can work together to form a joint force to deal with potential APT attacks. Analyze the shortcomings of the current protection system and identify areas that need optimization, such as low attack detection rates, long response times, and high false negative rates. Based on the results of collaborative protection decisions, clarify optimization directions and build a dynamic APT attack protection optimization model. Combined with real-time and historical data, and using techniques such as reinforcement learning, dynamically adjust protection strategies. The model should be able to self-optimize based on new attack patterns and defense effectiveness. Based on the output of the dynamic optimization model, adjust current protection strategies and measures, including strengthening monitoring of specific attack patterns, optimizing defense system configuration, and improving employee security awareness. After optimization is implemented, continue to monitor the performance of the defense system, collect new simulated response data, and evaluate the optimized protection effectiveness, including changes in indicators such as attack detection rate, response time, and false negative rate. Establish a feedback mechanism to feed the optimization evaluation results back to the dynamic optimization model to ensure that the model can continuously learn and adjust, continuously improve protection strategies based on new data, and generate a comprehensive report that details the collaborative protection decision-making and dynamic iterative optimization process, including a comparison of results before and after optimization, the decision-making basis, and the implemented optimization measures. This will provide important evidence for long-term adjustments to network security strategies.

[0020] In this embodiment, refer to Figure 2 , is a flowchart of the detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include: Step S11: Acquire multi-source heterogeneous network monitoring data in the current network, wherein the multi-source heterogeneous network monitoring data includes network traffic monitoring data, terminal behavior monitoring data, and system logs; Step S12: performing heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and extracting all APT attack behavior detection data; Step S13: performing abnormal data cleaning on all APT attack behavior detection data to obtain cleansed and optimized attack behavior data; Step S14: APT attack behavior feature mining is performed on the cleansed and optimized attack behavior data to obtain APT attack behavior features.

[0021] In this embodiment, multi-source heterogeneous network data that needs to be monitored is determined, including network traffic monitoring data, terminal behavior monitoring data, and system logs. Each data source must have a clear definition and acquisition method. Network traffic monitoring tools (such as Wireshark, NetFlow, or sFlow) are used to capture network traffic data in real time. The data includes information such as source IP, destination IP, protocol type, packet size, and transmission delay. Terminal monitoring agents are deployed to collect behavioral data of terminal devices, including user login information, application usage, file access records, etc. Security Information and Event Management (SIEM) systems are used to centrally manage this data. System logs, including operating system logs, application logs, and security logs, are collected from various devices and applications to ensure that log collection meets relevant compliance requirements. Log management tools (such as ELKStack) are used for centralized storage. Data from different sources are formatted to ensure that all collected data can be stored and queried in a unified database. JSON or CSV formats are used to standardize the data structure. The acquired multi-source heterogeneous monitoring data is stored in a centralized database (such as MySQL, PostgreSQL, or NoSQL). Databases provide a data foundation for subsequent analysis. Appropriate APT attack detection algorithms are selected based on data types and attack characteristics. Common methods include rule-based detection, machine learning methods (such as random forests and support vector machines), and deep learning methods (such as LSTM and CNN). Feature extraction is performed on network traffic monitoring data, terminal behavior monitoring data, and system logs to identify features related to APT attacks, such as abnormal traffic patterns, abnormal login frequencies, and abnormal file accesses. The selected detection algorithm is then applied to the integrated multi-source data for analysis. Potential APT attack behaviors are identified through real-time detection and comparison with historical data. Detected APT attack behaviors are recorded, including attack time, source, type, and impact range. This information will be used for subsequent cleaning and analysis. Outliers are identified in the detected APT attack behavior data. Statistical analysis methods (such as Z-score and IQR) or machine learning methods (such as isolation forest) are used to detect data that does not conform to normal patterns. Identified anomalous data is marked for subsequent processing, ensuring the transparency of the marking process for subsequent audit and traceability. Marked anomalous data is cleaned, and erroneous records are removed or corrected. Obvious noise data is directly deleted.Suspicious but uncertain data is manually reviewed. After cleaning, the attack behavior dataset is optimized to ensure data integrity and consistency. Operations during the cleaning process are recorded for subsequent audits and reviews. Feature selection algorithms (such as random forest feature importance and LASSO regression) are used to identify the most important features in the cleaned dataset. This ensures that the selected features are relevant to APT attack behavior and can effectively distinguish between normal and attack behaviors. The extracted features are standardized or normalized to facilitate subsequent model training and analysis. This ensures that the features are on the same scale to avoid model bias caused by scale differences. Based on the selected features, machine learning algorithms (such as decision trees, support vector machines, and neural networks) are used to model the cleaned and optimized attack behavior data. Model performance is evaluated through methods such as cross-validation to ensure good classification capabilities. Feature importance analysis is performed on the trained model to identify features that have a significant impact on APT attack behavior. This will help in the development of future attack detection and prevention strategies.

[0022] In this embodiment, the specific steps of step S14 are: Perform multi-time-point attack frequency statistics on the cleaning optimization attack behavior data to obtain the time series attack frequency; Calculate the peak intensity of the time series attack frequency to obtain the peak intensity of the attack frequency; Mark the cleaning and optimization attack behavior data with APT attack timestamps to obtain the timestamp of each APT attack; Calculate the attack duration based on the timestamp of each APT attack to obtain the APT attack duration parameter; Perform time interval analysis based on the timestamp of each APT attack to obtain the APT attack time interval; Perform attack cycle feature analysis based on APT attack duration parameters and APT attack time interval to obtain APT attack cycle features; Based on the timestamp of each APT attack, the attack frequency peak intensity is analyzed to generate the APT attack peak frequency change trend; The attack behavior characteristics are mined based on the APT attack cycle characteristics and the APT attack peak frequency change trend, thereby obtaining the APT attack behavior characteristics.

[0023] In this embodiment, the cleansed and optimized attack behavior dataset obtained from the previous step is ensured to be complete and accurate. The data should contain detailed information about each APT attack, including timestamps, attack types, and impact ranges. The time window for statistical attack frequency (such as hourly, daily, or weekly) is determined. The selection of the time window should be adjusted according to the characteristics of the network environment and attack patterns to obtain meaningful statistical results. According to the defined time window, the APT attack events in each time period are counted. Data analysis tools (such as Python's Pandas library) are used to traverse and count, and attack frequency statistics within each time window are generated. The statistical results are stored in a database or data frame for subsequent analysis and visualization to ensure data accuracy. The format is consistent to facilitate subsequent processing. Use statistical methods (such as moving average or Z-score) to detect peaks in the attack frequency data, set a threshold, identify points exceeding the threshold as attack peaks, calculate the intensity of each peak by comparing the difference between the peak and the data points before and after it. For example, intensity is defined as the absolute value of the difference between the peak value and the previous value. Record the calculated attack frequency peak and its intensity for subsequent analysis and trend research. Extract the timestamp of each APT attack from the cleaned attack behavior dataset, ensure the standardization of the timestamp (such as unified UTC format) to avoid problems caused by time zone differences, and associate the timestamp of each APT attack with attack-related information (such as attack type, source IP, etc.). , forming a clear marked data set for subsequent analysis. According to the timestamp and the nature of the attack, the end time of each APT attack is determined. The end time is the time when the next attack event occurs, or according to the end condition defined by the attack feature, the duration of each APT attack is calculated. Duration = end time - start time. According to the timestamp data, the time interval between each APT attack is calculated. The time interval is defined as the start time of the current attack event minus the end time of the previous attack event. The calculated time interval information is stored in the data set for further analysis. According to the duration parameter and time interval data, the periodic characteristics of APT attacks are analyzed, for example, the average interval time and average duration of attack events are calculated. , use statistical analysis methods (such as time series analysis) to identify the periodic characteristics of attacks and determine whether there are regular attack patterns. Based on the timestamp data of the attack frequency peak, calculate the peak change trend in each time period, use linear regression or sliding window method to analyze the change of peak value over time, use data visualization tools (such as Matplotlib or Tableau) to display the peak change trend to facilitate the identification of attack patterns and potential risks, integrate the periodic characteristics and peak frequency change trends of APT attacks to form a complete attack behavior feature data set, use machine learning algorithms (such as cluster analysis, decision trees, etc.) to conduct in-depth analysis of the integrated feature data, and identify representative attack behavior patterns,The mined APT attack behavior characteristics are recorded to form a complete APT attack behavior characteristic database for subsequent detection and protection strategy formulation.

[0024] In this embodiment, refer to Figure 3 , is a flowchart of the detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include: Step S21: identifying attack targets on the cleansed and optimized attack behavior data, and extracting multiple APT attack target nodes; Step S22: performing attack latency analysis on the cleansing optimization attack behavior data to obtain attack latency parameters; Step S23: performing initial penetration identification on the cleaning optimization attack behavior data, thereby extracting the initial penetration attack node; Step S24: performing rolling identification of multi-stage attacks based on the initial penetration attack node, thereby extracting the multi-stage attack time nodes; Step S25: performing attack time feature analysis on the attack latency parameters and the multi-stage attack time nodes, thereby generating an APT attack time feature.

[0025] In this embodiment, the cleaned and optimized attack behavior dataset is ensured to be complete, including detailed information of all APT attack events, such as attack targets, attack time, and attack type. Based on the network architecture and attack behavior, the types of attack target nodes are defined, such as servers, workstations, databases, and network devices, and the attributes and characteristics of each type of node are clarified for subsequent analysis. Features related to the attack target, such as IP address, host name, service type, etc., are extracted from the cleaned dataset. The features should be able to reflect the attributes and attack characteristics of the target node. An appropriate classification algorithm (such as support vector machine, decision tree) is selected to identify the attack target. Based on the characteristics of the attack behavior, a model is trained to distinguish different types of attack targets, and the identified attack target nodes are classified. Record each point to form a list of attack target nodes for subsequent analysis and tracking, ensuring that the recorded information includes the type of target, number of attacks, and attack time. The attack latency is defined as the time period from the potential start of an APT attack (such as the attacker invading the network) to the actual attack behavior. Understanding the latency is crucial for identifying attack patterns. Extract the attack timestamps from the cleansed and optimized attack behavior dataset, identify the start time of each attack and the actual attack behavior time, and calculate the latency of each attack. Latency = actual attack time - potential start time. Perform statistical analysis on the latency of all attack events and generate a distribution diagram of the latency (such as a histogram) to identify common patterns and anomalies in the latency. Initial penetration refers to the attacker's first successful intrusion into the target network or system. Identifying the initial penetration node is an important part of understanding the attack chain. Features related to the initial penetration are extracted from the attack behavior dataset, such as the first access time, successful login records, and abnormal behavior signs. Anomaly detection algorithms (such as Isolation Forest and DBSCAN) are used to analyze the attack behavior and identify potential initial penetration events. This process should focus on the abnormality of the features and the attack mode. The identified initial penetration nodes are recorded to ensure that the information includes the node type, attack time, and attack method, etc., for subsequent analysis. Multi-stage attacks usually refer to attackers gradually achieving their attack goals through multiple steps. After the initial penetration, the attacker will move laterally, increase permissions, and Upgrade operations, based on the information of the initial penetration node, build an attack chain, identify subsequent attack behaviors, pay attention to the timestamps and attack characteristics of each stage to form a complete attack path, use state machine algorithms or graph algorithms (such as breadth-first search) to perform rolling identification of attack behaviors, identify attack time nodes in multiple stages, ensure that the time nodes of each stage can reflect the evolution of the attack, record the extracted multi-stage attack time nodes, including the start and end time of each stage, for subsequent analysis and reporting. Attack time characteristics include latent time, attack duration and stage interval, etc. Understanding these characteristics helps to identify attack patterns and formulate protection strategies, and perform statistical analysis on attack latent time parameters and multi-stage attack time nodes.Generate relevant charts (such as time series charts and box plots) to identify characteristic distributions and trends. Use correlation analysis methods (such as the Pearson correlation coefficient) to evaluate the relationship between incubation time and attack time nodes, identify potential influencing factors, and compile analysis results into reports that provide detailed information on APT attack time characteristics, including incubation time distribution and multi-stage attack patterns, to support subsequent decision-making and protection strategies.

[0026] In this embodiment, the detailed implementation steps of step S3 include: Step S31: Analyze the attack trajectory of the APT attack behavior characteristics to extract the APT attack trajectory; Step S32: Perform time series trajectory evolution analysis on the APT attack trajectory to obtain the APT time series evolution trajectory; Step S33: Tracing the attack path of multiple APT attack target nodes based on the APT time series evolution trajectory, thereby obtaining the APT attack tracing path; Step S34: reconstruct and evolve the global attack chain based on the APT attack tracing path to construct the APT global attack chain; Step S35: Deeply mine the attack behavior patterns of the APT attack time characteristics and the APT global attack chain to build an APT attack knowledge graph.

[0027] In this embodiment, the definition of attack trajectory is determined, which usually includes the attacker's behavior path, the change of attack target and the evolution of attack method. The key factors of analysis are clarified to guide subsequent analysis. The attack behavior characteristics are converted into attack trajectory graph using graph theory method or state machine model. The nodes in the graph represent attack events or targets, and the edges represent the attacker's transfer between different events. The APT attack trajectory is extracted from the constructed attack trajectory graph using graph algorithm (such as depth-first search or breadth-first search). Each path should reflect the attacker's activity sequence and target transfer. The extracted APT attack trajectory is recorded to form an attack trajectory database for subsequent evolution analysis and traceability research. The temporal evolution analysis of APT attack trajectory focuses on the attacker's Activity changes in the time dimension help identify attack patterns and behavioral characteristics, sort the extracted APT attack trajectory data in chronological order, generate time series data, ensure that the attack events corresponding to each time point are accurate, use time series analysis techniques (such as moving average, ARIMA model) to analyze the evolution trend of the attack trajectory, identify the attacker's behavior patterns and laws in time, visualize the evolution results of the time series trajectory, and display the changes in attack activities through line charts or heat maps to help analysts intuitively understand the evolution process of attack behavior. Attack path tracing refers to tracking the attacker from the initial infiltration to the final target, identifying each step and target transfer taken by the attacker, based on the previously extracted APT attack trajectory, using backtracking algorithms or graphs Traversal algorithms (such as Dijkstra algorithm) are used to identify the attacker's path from one target to another, and multiple APT attack target nodes are analyzed to record the attack path of each target node, determine the attacker's strategy and target selection logic, and organize the obtained APT attack tracing path into a document to ensure the integrity of the path information, including the timestamp and attack type of each node. The global attack chain refers to the entire process from the attacker's intrusion to the complete realization of the attack target. Reconstructing the global attack chain helps to understand the overall picture of the attack and its development process. A chain construction algorithm (such as Markov chain or state transition model) is used to construct a global attack chain based on the identified APT attack tracing path, and identify the relationship between each attack link. System, conduct evolutionary analysis on the reconstructed attack chain, pay attention to the dependencies and influencing factors between the steps in the attack chain, identify attack patterns and strategies, record the constructed global attack chain, and display the structure and characteristics of the attack chain in the form of graphs or documents to facilitate subsequent analysis and reporting. Deep mining of attack behavior patterns aims to extract potential attack patterns and strategies from attack time characteristics and global attack chains to provide a basis for future defense. Integrate APT attack time characteristics with global attack chain data to form a comprehensive data set to ensure data integrity and consistency. Use machine learning algorithms such as cluster analysis and anomaly detection to conduct in-depth mining of the integrated data to identify attack behavior patterns hidden in the data. Based on the mined attack behavior patterns,Construct an APT attack knowledge graph, which should include information such as attack patterns, attack paths, and attack time characteristics to facilitate subsequent query and analysis.

[0028] In this embodiment, step S4 includes the following steps: Step S41: Predicting attacker behavior intentions based on the APT attack knowledge graph to extract attacker behavior intention prediction data; Step S42: Analyze the final attack target based on the attacker's behavior intention prediction data and mark the final attack target node; Step S43: performing a future multi-step attack prediction on the final attack target node to generate APT attack multi-step prediction data; Step S44: performing attack behavior path deduction on the APT attack multi-step prediction data, thereby generating a multi-step APT attack behavior prediction path.

[0029] In this embodiment, the integrity of the APT attack knowledge graph is ensured. Its content should include information such as the attacker's behavior pattern, target node, attack path, and time characteristics. The graph is stored and managed using a graph database (such as Neo4j). Features related to the attacker's behavioral intentions are extracted from the knowledge graph, such as historical attack patterns, attack target types, and attack time patterns. These features will be used for subsequent intention prediction. Appropriate machine learning or deep learning models are selected to predict attacker behavior intentions. Commonly used models include decision trees, random forests, and long short-term memory networks (LSTMs), which can process time series data. The extracted features are used to train the prediction model, and the prediction model is trained through cross-validation. Verification and hyperparameter tuning are performed to optimize model performance to ensure accurate prediction of attackers' behavioral intentions. Based on the trained model, attackers' behavioral intentions are predicted to generate attackers' behavioral intention prediction data, including attack type, target node and attack time. The standard for determining the final attack target node usually includes key assets, sensitive data storage or high-value servers within the network. The attackers' behavioral intention prediction data is integrated with network asset information to form a comprehensive analysis data set to ensure the multi-dimensionality of the data. Classification algorithms (such as support vector machines or logistic regression) are used to analyze the comprehensive data set, mark the final attack target node, and determine the target nodes according to the predicted attack intentions. The node is attacked, and the marked final attack target node is organized into a report, including the type of target, the potential risk of attack and its importance score, so as to facilitate the subsequent formulation of protection strategies. Multi-step attack refers to the attacker's attack on the final target through multiple consecutive steps, including initial penetration, lateral movement, and authority escalation. Select a suitable prediction model (such as a sequence prediction model, a Markov chain model) to simulate the attacker's multi-step attack behavior, use historical attack data and marked final target nodes for model training, ensure that the model can capture the attacker's behavior pattern and path, and make future multi-step attack predictions on the final attack target node based on the trained model. Multi-step prediction data of APT attacks are generated, including future attack steps and time nodes. Attack behavior path deduction refers to inferring the specific paths and steps taken by the attacker based on the multi-step prediction data. Graph theory algorithms or Bayesian networks are used to analyze the multi-step prediction data and deduce the attack path to ensure that the algorithm can handle uncertainty and dynamic changes. The multi-step prediction data is converted into a graph structure and the attack path is identified using a graph traversal algorithm (such as breadth-first search). Each path should include attack steps, time nodes, and target nodes. The deduced multi-step APT attack behavior prediction path is recorded and displayed through visualization tools to help understand the attacker's potential behavior.

[0030] In this embodiment, step S5 includes the following steps: Step S51: Identify key network nodes on the multi-step APT attack behavior prediction path and extract all key nodes on the attack prediction path; Step S52: Perform security risk vulnerability analysis on all key nodes on the attack prediction path and mark the key vulnerability nodes; Step S53: performing adaptive vulnerability repair and enhancement on the key vulnerability nodes, thereby obtaining vulnerability repair and enhancement multi-path nodes; Step S54: Perform APT attack simulation on the vulnerability repair enhanced multi-path node according to the APT attack knowledge graph, and conduct dynamic defense drills to obtain APT attack defense simulation response data.

[0031] In this embodiment, the multi-step APT attack prediction path extracted from step S44 should contain all attack steps and related node information to ensure data integrity. The standards for key nodes are determined, which usually include core devices in the network (such as servers, routers), important data storage and user terminals. These nodes are crucial to the success of the attacker in the attack path. The attack prediction path is analyzed using network analysis algorithms (such as PageRank and centrality analysis) to identify key nodes with greater influence. The centrality index helps to determine the most important nodes in the attack path. The predicted path is traversed, the information of each node is extracted and its importance is calculated, the identified key nodes are marked, and the attributes of each key node (such as IP address, role, importance evaluation) are ensured. All identified key nodes are recorded and compiled into a report, including detailed information about the nodes and their positions in the attack path, for subsequent risk analysis and defense strategy formulation. The key node information compiled in step S51 is used as the basis for vulnerability analysis to ensure that each node has complete context information, including its functions, services, and network environment. Automated security vulnerability scanning tools (such as Nessus and OpenVAS) are used to conduct security assessments on each key node to identify potential security risks and vulnerabilities. Combined with the results of the automated tools, network security experts conduct manual reviews to assess the risk level of each node, taking into account the vulnerabilities and attack paths exploited by attackers. Based on the results of the vulnerability analysis, vulnerabilities are marked. Key nodes, which are usually devices with known vulnerabilities, improper configurations or unpatched devices, organize the key vulnerability nodes and their corresponding vulnerability information into documents, including vulnerability descriptions, risk levels and attack paths, for subsequent repair and monitoring. For the marked key vulnerability nodes, formulate adaptive vulnerability repair strategies, including patching, configuration changes, network isolation, etc., to ensure that the strategy can effectively reduce risks. Use automated vulnerability repair tools (such as Ansible and Puppet) to implement the repair strategy, quickly update and repair the key vulnerability nodes, ensure that all repair processes are recorded for auditing, and conduct system testing and security assessments after the repair is implemented to ensure that the repair measures will not introduce new risks and verify whether the vulnerability is The vulnerability has been successfully eliminated. The repaired node information is updated to the attack prediction path to form a multi-path node with vulnerability repair and enhancement. Ensure that the repair status and enhancement effect of each node are recorded. Use the previously built APT attack knowledge graph to ensure that the attack model and path used in the simulation process are based on actual attack behavior and historical data. Select appropriate attack simulation tools (such as Metasploit, Cyborg) to perform APT attack simulation to ensure that the simulation process can truly reproduce the attacker's behavior. Based on the repaired and enhanced multi-path nodes, conduct dynamic defense drills to simulate the attacker's attack and monitor the defense system's response and effect to evaluate the effectiveness of the repair measures. Record the attack response data during the simulation process.Including the reaction time of the defense system, the number of attacks successfully blocked and the exploitation of vulnerabilities, generating APT attack defense simulation response data.

[0032] In this embodiment, step S6 includes the following steps: Step S61: performing defense response delay analysis on the APT attack defense simulation response data and extracting defense response delay data; Step S62: performing attack detection missed detection identification on the APT attack defense simulation response data, and extracting attack detection missed data; Step S63: Perform a comprehensive defense efficiency evaluation based on the attack detection missed data and the defense response delay data to obtain an APT attack defense evaluation result; Step S64: making collaborative protection decisions based on the APT attack defense assessment results and building an APT attack collaborative protection strategy; Step S65: Dynamically iteratively optimize the APT attack collaborative protection strategy and build a dynamic APT attack protection optimization model to perform APT attack behavior detection and protection operations.

[0033] In this embodiment, relevant data is extracted from previous APT attack defense simulation responses to ensure that key time information such as the timestamp of each attack attempt, the start time of the defense measures, and the attack detection time are included. A calculation method for the defense response delay is determined, which is usually defined as the time difference from the occurrence of the attack event to the response of the defense system. A clear definition facilitates subsequent data analysis. The collected defense response data is processed to ensure data accuracy and consistency, and irrelevant or duplicate data records are removed. A programming tool (such as Python) is used to calculate the response delay for each attack event to generate a delay data set. Response delay = defense start time - attack occurrence time. The distribution of response delays is statistically analyzed, and a delay histogram or box plot is generated to identify delays. Common patterns and potential problems in the defense system can help analyze the efficiency of the defense system. False negatives refer to the failure of the defense system to detect real attack events. First, clarify the false negative criteria to ensure that all undetected attack attempts are included. Integrate attack event records and defense response data to ensure that each attack event has a corresponding detection result (whether it is detected). Use conditional judgment and statistical analysis methods to identify false negatives. By comparing the detection results with the actual attack events, mark the undetected attacks. Organize the identified false negatives into a data set, record the type, time and impact of the false negatives for subsequent analysis and optimization, and determine the evaluation indicators of defense efficiency, which usually include false negative rate, response time, attack success rate, etc., to ensure that all indicators are quantified and helpful for comprehensive analysis. Evaluation: Use statistical analysis methods (such as weighted average) to combine missed report data and response delay data to calculate comprehensive evaluation results. For example, set weights for missed report rate and response delay, calculate comprehensive scores, and present the evaluation results in graphical form to facilitate identification of the strengths and weaknesses of the defense system, help decision makers understand the current defense status, generate comprehensive evaluation reports, and describe in detail the various indicators and specific data of defense efficiency to provide a basis for subsequent protection decisions. Based on the evaluation results, analyze the shortcomings of the current protection system and identify areas of protection that need to be enhanced, such as improving detection rates and reducing response times. Establish a framework for collaborative protection strategies to ensure that various protection components (such as firewalls, IDS, SIEM, etc.) can effectively collaborate and form a joint response. In response to APT attacks, we need to formulate specific protection strategies, including strengthening monitoring of specific areas, regularly scanning and repairing vulnerabilities, improving employee security training, etc., to ensure that strategies can be dynamically adjusted according to evaluation results, and to organize the formulated collaborative protection strategies into documents to ensure that all relevant personnel can understand and implement them. Dynamic iterative protection optimization means constantly adjusting and optimizing protection strategies based on new threat intelligence, attack patterns, and evaluation results to maintain the effectiveness of protection. We need to establish a monitoring system to track the execution effect of protection strategies in real time, collect new security incidents and attack information, provide data support for optimization, regularly evaluate protection strategies, and adjust protection measures based on the latest attack intelligence and evaluation results to ensure the foresight and effectiveness of protection strategies.Leveraging machine learning and automation technologies, we build a dynamic APT attack protection optimization model that analyzes attack behaviors in real time and automatically adjusts protection strategies to ensure that protection measures can quickly respond to new threats.

[0034] In this embodiment, a security detection system based on multi-source heterogeneous APT attack behavior analysis is provided, which is used to execute the security detection method based on multi-source heterogeneous APT attack behavior analysis as described above, including: An attack behavior feature module is used to obtain multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; An attack time signature module, configured to identify attack targets based on the multi-source heterogeneous network monitoring data and perform multi-stage attack rolling identification, thereby generating APT attack time signatures; The attack chain reconstruction module is used to trace the attack path based on the APT attack behavior characteristics and APT attack time characteristics, and to reconstruct and evolve the global attack chain to build an APT attack knowledge graph; The behavior path prediction module is used to predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; The attack simulation module is used to identify key network nodes in the multi-step APT attack behavior prediction path, simulate APT attacks, and conduct dynamic defense drills to obtain APT attack defense simulation response data; The protection optimization module is used to make collaborative protection decisions based on APT attack defense simulation response data, perform dynamic iterative protection optimization, and build a dynamic APT attack protection optimization model.

[0035] The present invention is therefore intended to be illustrative and non-restrictive in all respects, with the scope of the invention being defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the application documents are intended to be embraced therein.

[0036] The foregoing description is intended only to provide specific embodiments of the present invention, which are intended to enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be construed in the widest manner consistent with the principles and novel features disclosed herein.

Claims

1. A security detection method based on multi-source heterogeneous APT attack behavior analysis, characterized in that: The following steps are involved: Step S1: Acquire multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; Step S2: identifying attack targets based on the multi-source heterogeneous network monitoring data, and performing multi-stage attack rolling identification, thereby generating APT attack time characteristics; Step S3: Tracing the attack path based on the APT attack behavior characteristics and APT attack time characteristics, reconstructing and evolving the global attack chain, and constructing an APT attack knowledge graph; Step S4: Predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; Step S5: Identify key network nodes of the multi-step APT attack behavior prediction path, perform APT attack simulation, and conduct dynamic defense drills to obtain APT attack defense simulation response data; Step S6: Make collaborative protection decisions based on the APT attack defense simulation response data, perform dynamic iterative protection optimization, and build a dynamic APT attack protection optimization model.

2. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 1 is characterized in that: The specific steps of step S1 are: Step S11: Acquire multi-source heterogeneous network monitoring data in the current network, wherein the multi-source heterogeneous network monitoring data includes network traffic monitoring data, terminal behavior monitoring data, and system logs; Step S12: performing heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and extracting all APT attack behavior detection data; Step S13: performing abnormal data cleaning on all APT attack behavior detection data to obtain cleansed and optimized attack behavior data; Step S14: APT attack behavior feature mining is performed on the cleansed and optimized attack behavior data to obtain APT attack behavior features.

3. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 2 is characterized in that: The specific steps of step S14 are: Perform multi-time-point attack frequency statistics on the cleaning optimization attack behavior data to obtain the time series attack frequency; Calculate the peak intensity of the time series attack frequency to obtain the peak intensity of the attack frequency; Mark the cleaning and optimization attack behavior data with APT attack timestamps to obtain the timestamp of each APT attack; Calculate the attack duration based on the timestamp of each APT attack to obtain the APT attack duration parameter; Perform time interval analysis based on the timestamp of each APT attack to obtain the APT attack time interval; Perform attack cycle feature analysis based on APT attack duration parameters and APT attack time interval to obtain APT attack cycle features; Based on the timestamp of each APT attack, the attack frequency peak intensity is analyzed to generate the APT attack peak frequency change trend; The attack behavior characteristics are mined based on the APT attack cycle characteristics and the APT attack peak frequency change trend, thereby obtaining the APT attack behavior characteristics.

4. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 1 is characterized in that: The specific steps of step S2 are: Step S21: identifying attack targets on the cleansed and optimized attack behavior data, and extracting multiple APT attack target nodes; Step S22: performing attack latency analysis on the cleansing optimization attack behavior data to obtain attack latency parameters; Step S23: performing initial penetration identification on the cleaning optimization attack behavior data, thereby extracting the initial penetration attack node; Step S24: performing rolling identification of multi-stage attacks based on the initial penetration attack node, thereby extracting the multi-stage attack time nodes; Step S25: performing attack time feature analysis on the attack latency parameters and the multi-stage attack time nodes, thereby generating an APT attack time feature.

5. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 1 is characterized in that: The specific steps of step S3 are: Step S31: Analyze the attack trajectory of the APT attack behavior characteristics to extract the APT attack trajectory; Step S32: Perform time series trajectory evolution analysis on the APT attack trajectory to obtain the APT time series evolution trajectory; Step S33: Tracing the attack path of multiple APT attack target nodes based on the APT time series evolution trajectory, thereby obtaining the APT attack tracing path; Step S34: reconstruct and evolve the global attack chain based on the APT attack tracing path to construct the APT global attack chain; Step S35: Deeply mine the attack behavior patterns of the APT attack time characteristics and the APT global attack chain to build an APT attack knowledge graph.

6. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 1 is characterized in that: The specific steps of step S4 are: Step S41: Predicting attacker behavior intentions based on the APT attack knowledge graph to extract attacker behavior intention prediction data; Step S42: Analyze the final attack target based on the attacker's behavior intention prediction data and mark the final attack target node; Step S43: performing a future multi-step attack prediction on the final attack target node to generate APT attack multi-step prediction data; Step S44: performing attack behavior path deduction on the APT attack multi-step prediction data, thereby generating a multi-step APT attack behavior prediction path.

7. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 1 is characterized in that: The specific steps of step S5 are: Step S51: Identify key network nodes on the multi-step APT attack behavior prediction path and extract all key nodes on the attack prediction path; Step S52: Perform security risk vulnerability analysis on all key nodes on the attack prediction path and mark the key vulnerability nodes; Step S53: performing adaptive vulnerability repair and enhancement on the key vulnerability nodes, thereby obtaining vulnerability repair and enhancement multi-path nodes; Step S54: Perform APT attack simulation on the vulnerability repair enhanced multi-path node according to the APT attack knowledge graph, and conduct dynamic defense drills to obtain APT attack defense simulation response data.

8. The security detection method based on multi-source heterogeneous APT attack behavior analysis according to claim 1 is characterized in that: The specific steps of step S6 are: Step S61: performing defense response delay analysis on the APT attack defense simulation response data and extracting defense response delay data; Step S62: performing attack detection missed detection identification on the APT attack defense simulation response data, and extracting attack detection missed data; Step S63: Perform a comprehensive defense efficiency evaluation based on the attack detection missed data and the defense response delay data to obtain an APT attack defense evaluation result; Step S64: making collaborative protection decisions based on the APT attack defense assessment results and building an APT attack collaborative protection strategy; Step S65: Dynamically iteratively optimize the APT attack collaborative protection strategy and build a dynamic APT attack protection optimization model to perform APT attack behavior detection and protection operations.

9. A security detection system based on multi-source heterogeneous APT attack behavior analysis, characterized in that: Used to perform the security detection method based on multi-source heterogeneous APT attack behavior analysis as claimed in claim 1, comprising: An attack behavior feature module is used to obtain multi-source heterogeneous network monitoring data in the current network, perform heterogeneous APT attack behavior detection on the multi-source heterogeneous network monitoring data, and perform APT attack behavior feature mining to obtain APT attack behavior features; An attack time signature module, configured to identify attack targets based on the multi-source heterogeneous network monitoring data and perform multi-stage attack rolling identification, thereby generating APT attack time signatures; The attack chain reconstruction module is used to trace the attack path based on the APT attack behavior characteristics and APT attack time characteristics, and to reconstruct and evolve the global attack chain to build an APT attack knowledge graph; The behavior path prediction module is used to predict the attacker's behavior intention based on the APT attack knowledge graph, and then deduce the attack behavior path to generate a multi-step APT attack behavior prediction path; The attack simulation module is used to identify key network nodes in the multi-step APT attack behavior prediction path, simulate APT attacks, and conduct dynamic defense drills to obtain APT attack defense simulation response data; The protection optimization module is used to make collaborative protection decisions based on APT attack defense simulation response data, perform dynamic iterative protection optimization, and build a dynamic APT attack protection optimization model.

Images