Causal chain tracking method and system for cross-space APT attack behavior

Abstract

The invention discloses a causal chain tracking method and system for cross-space APT attack behaviors, and relates to the technical field of network security. The method comprises the following steps: collecting heterogeneous device logs crossing multiple network domains, extracting original attack data, performing spatial-temporal feature extraction, and generating a device behavior spatial-temporal vector; analyzing the original attack data to obtain attack tactical semantic features, fusing the equipment behavior space-time vector and the attack tactical semantic features, and constructing a three-dimensional association map; and performing attack path reasoning on the three-dimensional association map based on a causal discovery algorithm, identifying a causal dependency relationship, performing data tracking according to the causal dependency relationship, reconstructing an APT attack causal chain, and obtaining an attack logic path. The technical problem that in the prior art, comprehensive and accurate traceability analysis on cross-space APT attacks is difficult is solved, and the technical effects of efficient reconstruction of APT attack causal chains and accurate identification of attack paths are achieved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, in particular to a cause-and-effect chain tracking method and system for cross-space APT attack behavior. BACKGROUND

[0002] In network space security protection, APT (Advanced Persistent Threat) attack has become one of the main means to threaten the security of key infrastructure and important information system due to its strong concealment, long attack cycle and strong cross-domain penetration capability. The APT attack often forms a distributed and chain-like attack path through multiple hop nodes, different network domains and various attack means, so that the traditional detection method based on single-point monitoring and rule matching cannot effectively identify and track the entire attack process. Especially in the face of cross-space, multi-device and multi-stage attack behavior, the existing technology generally has problems such as data fragmentation, weak spatio-temporal correlation and difficulty in reconstructing the cause-and-effect chain, which seriously affects the accurate tracing and emergency response of APT attack. SUMMARY

[0003] The application provides a cause-and-effect chain tracking method and system for cross-space APT attack behavior, which solves the technical problem that it is difficult to comprehensively and accurately trace and analyze cross-space APT attack in the prior art.

[0004] In a first aspect, the application provides a cause-and-effect chain tracking method for cross-space APT attack behavior, which comprises: Collecting heterogeneous device logs across multiple network domains to extract original attack data for spatio-temporal feature extraction and generating device behavior spatio-temporal vectors; analyzing the original attack data to obtain attack tactic semantic features, fusing the device behavior spatio-temporal vectors and the attack tactic semantic features, and constructing a three-dimensional correlation graph; performing attack path reasoning on the three-dimensional correlation graph based on a cause-and-effect discovery algorithm, identifying cause-and-effect dependency relationships, tracking data according to the cause-and-effect dependency relationships, reconstructing the APT attack cause-and-effect chain, and obtaining an attack logic path.

[0005] In a second aspect, the application provides a cause-and-effect chain tracking system for cross-space APT attack behavior, which comprises: A feature extraction module for collecting heterogeneous device logs across multiple network domains to extract original attack data for spatio-temporal feature extraction and generating device behavior spatio-temporal vectors; a graph construction module for analyzing the original attack data to obtain attack tactic semantic features, fusing the device behavior spatio-temporal vectors and the attack tactic semantic features, and constructing a three-dimensional correlation graph; and an identification module for performing attack path reasoning on the three-dimensional correlation graph based on a cause-and-effect discovery algorithm, identifying cause-and-effect dependency relationships, tracking data according to the cause-and-effect dependency relationships, reconstructing the APT attack cause-and-effect chain, and obtaining an attack logic path.

[0006] The one or more technical solutions provided in the application have at least the following technical effects or advantages: First, the heterogeneous device logs across multiple network domains are collected to extract original attack data for spatio-temporal feature extraction, and device behavior spatio-temporal vectors are generated. Then, the original attack data is parsed to obtain attack tactic semantic features, the device behavior spatio-temporal vectors and the attack tactic semantic features are fused, and a three-dimensional correlation graph is constructed. Finally, the three-dimensional correlation graph is reasoned for attack path based on a causal discovery algorithm, the causal dependence relationship is identified, data tracking is performed according to the causal dependence relationship, the APT attack causal chain is reconstructed, and the attack logic path is obtained. The technical problem that it is difficult to comprehensively and accurately trace the cross-space APT attack in the prior art is solved, and the technical effects of efficient reconstruction of the APT attack causal chain and accurate identification of the attack path are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0008] Figure 1 The flowchart of the causal chain tracking method of the cross-space APT attack behavior provided by the embodiments of the present application is shown. Figure 2 The structural diagram of the causal chain tracking system of the cross-space APT attack behavior provided by the embodiments of the present application is shown.

[0009] Explanation of reference signs: feature extraction module 11, graph construction module 12, identification module 13. DETAILED DESCRIPTION

[0010] The present application provides a causal chain tracking method and system for cross-space APT attack behavior, which solves the technical problem that it is difficult to comprehensively and accurately trace the cross-space APT attack in the prior art.

[0011] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0012] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0013] Example 1, as Figure 1 As shown, this application provides a causal chain tracing method for cross-space APT attack behavior, wherein the method includes: Logs from heterogeneous devices across multiple network domains are collected to extract raw attack data, and spatiotemporal features are extracted to generate spatiotemporal vectors of device behavior.

[0014] Distributed data acquisition probes are deployed at the boundary nodes of various network security domains to capture initial raw log data generated by various heterogeneous devices (including firewalls, intrusion detection systems, host logs, switches, routers, etc.) in real time. The collected raw log data is then standardized, including unifying the time format, field names, and log structure, to construct a unified format for heterogeneous device log sets. Next, continuous log data is divided into multiple time windows according to preset time intervals. Key behavioral features, including communication behavior, access requests, permission changes, and process creation, are extracted from each time window to form the raw attack dataset for that time period. Based on this, a unified spatiotemporal coordinate system is constructed by combining the device's physical location (such as IP address, MAC address, and geographic location information) recorded in each log with the logical network topology of the device. The extracted raw attack data is then mapped to this coordinate system. Further, based on the mapped coordinate information and log behavior pattern analysis, behavioral anomaly and activity indicators for each device within a specified time window are calculated. These two indicators are then normalized and weighted, ultimately forming a behavioral profile of the device in its current spatiotemporal state, output as a device behavior spatiotemporal vector.

[0015] Furthermore, the method involves collecting logs from heterogeneous devices across multiple network domains to extract raw attack data, performing spatiotemporal feature extraction, and generating spatiotemporal vectors of device behavior. This includes: Distributed probes are deployed at the boundaries of different security domains to capture initial device logs from multiple network domains; the initial device logs from the multiple network domains are standardized to generate heterogeneous device logs from multiple network domains; continuous time windows are divided at preset time intervals, and features are extracted from the heterogeneous device logs from the multiple network domains according to the continuous time windows to obtain the original attack data; the original attack data is parsed in a spatiotemporal dimension to generate the spatiotemporal vector of device behavior.

[0016] Specifically, a distributed probe node with high concurrent data collection capability is deployed at the network boundary of different security domains, which is used to capture raw log data from various information systems such as firewalls, switches, servers, terminal devices, etc. in real time, covering network traffic logs, host system logs, cloud platform audit logs and other types. Then, the initial device logs collected from multiple network domains are standardized, including unified log format, log field analysis, synchronized timestamp, redundant information removal, and classified storage according to log source and type, forming a structured heterogeneous device log set. Next, a fixed time interval (e.g. 30 seconds or 1 minute) is set to divide the continuous time window, and the heterogeneous device logs in each time window are extracted for features, including but not limited to communication frequency, connection target, operation command, user behavior, identity change, resource access, and other key fields, to identify possible attack behavior characteristics and extract raw attack data. On this basis, the device network address, topology location and physical location information contained in the log are used to construct the corresponding spatial coordinate system, and the raw attack data is analyzed in time and space dimensions combined with the event occurrence time. Finally, the abnormal behavior performance, communication activity level, event frequency and other parameters of the device in the current time window are integrated, and multiple behavior feature indicators are extracted and normalized for weighted fusion to generate a device behavior spatio-temporal vector reflecting the current behavior pattern of the device.

[0017] Further, the method for spatio-temporal dimension analysis of the raw attack data and generation of the device behavior spatio-temporal vector comprises: Based on the device physical location and logical network topology, a spatial coordinate system is constructed to map the raw attack data to the spatial coordinate system for spatio-temporal feature extraction to obtain a spatio-temporal mapping coordinate. According to the spatio-temporal mapping coordinate, device anomaly analysis is performed to generate an abnormality index. According to the spatio-temporal mapping coordinate, behavior anomaly analysis is performed to generate a behavior activity index. The abnormality index and the behavior activity index are normalized and weighted fused to construct the device behavior spatio-temporal vector.

[0018] Based on the physical location of the device (such as the device IP address, MAC address, physical deployment location, etc.) and its structural level in the logical network topology (such as the subnet it belongs to, domain, virtual network segment, boundary node relationship, etc.), a unified spatial coordinate system is constructed; each event in the collected original attack data is mapped to the spatial coordinate system according to its corresponding device physical location and logical topology path, and the log event is time-labeled by combining the event occurrence time, thereby forming the corresponding space-time mapping coordinates; on this basis, based on the space-time mapping coordinates, the abnormal behavior of the device within a certain time period is analyzed, the degree of deviation from the historical baseline behavior is evaluated, and indicators such as clustering deviation and behavior pattern mutation rate are used to generate the abnormality index of the device; at the same time, based on the same space-time coordinate information, the operation frequency, communication frequency, and attack characteristic behavior number of the device within a unit time are counted, and the behavior activity index is calculated, which is used to reflect the behavior intensity and complexity of the device within the current time window; finally, the abnormality index and the behavior activity index are normalized, and the feature importance weight set in the attack recognition model is weighted and fused to construct a device behavior space-time vector that can reflect the space-time state and attack risk situation of the device.

[0019] The original attack data is analyzed to obtain attack tactic semantic features, and the device behavior space-time vector and the attack tactic semantic features are fused to construct a three-dimensional correlation graph.

[0020] The behavior description content in the original attack data is extracted, including operation commands, access paths, API calls, system response information, etc., which are used as input text for natural language processing. Specifically, through techniques such as word segmentation, part-of-speech tagging, and dependency relationship analysis, target behavior tuples reflecting attack intent and action are extracted, such as (attacker IP, access operation, target port) or (process, execution behavior, target path). Using a pre-constructed TTPs (Tactics, Techniques, and Procedures) knowledge graph, based on the tactic labels and technology numbers defined in the MITRE ATT&CK framework, the extracted behavior tuples are semantically matched with the standard attack patterns in the knowledge graph, and vector encoding, cosine similarity, and keyword alignment are used to determine the corresponding attack tactic semantic labels. The output attack tactic semantic features include the tactic phase, technology type, and number, etc. Then, the device behavior space-time vector and the corresponding attack tactic semantic features are fused to form multiple tactic space-time nodes, each node representing a certain attack tactic behavior occurring at a specific time and network space location. Finally, a three-dimensional coordinate system is constructed with the time axis as the horizontal axis, the network domain topology level as the vertical axis, and the attack tactic dimension as the vertical axis. The above tactic-space-time nodes are mapped to the three-dimensional coordinate system, and the correlation edges are established between the nodes based on the causal order, communication relationship, or attack phase continuity, forming a three-dimensional correlation graph that spans network domains, time periods, and attack stages.

[0021] Further, the original attack data is analyzed to obtain attack tactic semantic features, the device behavior space-time vector is fused with the attack tactic semantic features, and a three-dimensional correlation graph is constructed. The method comprises the following steps: The behavior description data of the original attack data is subjected to natural language word segmentation processing, and a target behavior tuple is extracted. A TTPs knowledge graph is constructed, the target behavior tuple is subjected to semantic matching with the ATT&CK tactic ID in the TTPs knowledge graph, and the matching result is marked to obtain the attack tactic semantic features. The device behavior space-time vector is fused with the attack tactic semantic features to generate a plurality of tactic space-time nodes. A three-dimensional coordinate system is constructed in combination with a time axis, a network domain topology layer and an attack tactic dimension, the plurality of tactic space-time nodes are mapped to the three-dimensional coordinate system, and the three-dimensional correlation graph is constructed.

[0022] Firstly, the behavior description field contained in the original attack data (such as command line information in system audit logs, protocol operation description in network traffic, etc.) is subjected to text analysis by using natural language processing technology, word segmentation processing, stop word removal, part-of-speech tagging and other operations are performed, and a target behavior tuple mainly in the form of “verb-object” is extracted, such as “write-registry”, “connect-remote port”, “load-dynamic library”, etc., which is used to express the core semantics of attack actions. Then, a TTPs knowledge graph containing the tactic ID and corresponding technical description in the MITRE ATT&CK framework is constructed, and a semantic matching algorithm (such as word vector similarity calculation, keyword mapping, pre-trained language model) is used to match the above target behavior tuple with the tactic nodes in the TTPs graph, and according to the matching result, each behavior tuple is marked with the attack tactic phase (such as initial access, privilege escalation, command and control, etc.) and the corresponding ATT&CK technology number to which it belongs, so as to obtain complete attack tactic semantic features. Subsequently, the device behavior space-time vector corresponding to each original attack data is jointly encoded with the attack tactic semantic features extracted therefrom to form a composite node with a clear space-time position and tactic attribute, which is denoted as a tactic space-time node. Finally, a three-dimensional coordinate system is constructed based on a time axis (horizontal axis), a network domain topology layer (vertical axis) and an attack tactic dimension (vertical axis), all tactic space-time nodes are mapped to three-dimensional coordinate points according to their time stamp, device network position and attack phase label, and connection edges are constructed according to device interaction relationship, attack chain context and time sequence between nodes, and finally a three-dimensional correlation graph is formed, which is cross-space, multi-dimensional.

[0023] Further, a three-dimensional coordinate system is constructed in combination with a time axis, a network domain topology layer and an attack tactic dimension, the plurality of tactic space-time nodes are mapped to the three-dimensional coordinate system, and the three-dimensional correlation graph is constructed. The method comprises the following steps: The time axis is defined as the horizontal axis, the network domain topology layer is defined as the vertical axis, and the attack tactic dimension is defined as the vertical axis to construct the three-dimensional coordinate system; the latest timestamp of the plurality of tactic space-time nodes is extracted, the time axis corresponding scale is matched, and the target time scale value is determined; the device attribute of the plurality of tactic space-time nodes is read, and the network domain coordinates of the network domain layer to which the plurality of tactic space-time nodes belong are analyzed; the highest order tactic code of the active tactic space-time nodes in the plurality of tactic space-time nodes is obtained, and the tactic dimension coordinates are determined; the three-dimensional coordinate values are output according to the target time scale value, the network domain coordinates and the tactic dimension coordinates, and are connected to construct the three-dimensional correlation graph.

[0024] A three-dimensional coordinate system is constructed, specifically: the time axis is set as the horizontal axis (X axis) for representing the time sequence of attack behaviors; the network domain topology layer is set as the vertical axis (Y axis) for representing the logical attribution and security boundary division (such as intranet, boundary network, cloud platform, DMZ, etc.) of each device in the cross-domain network environment; and the attack tactic dimension is set as the vertical axis (Z axis) for representing the tactic stage (such as “initial access”, “persistence”, “command and control”, etc.) of the attack behavior in the APT attack life cycle, thereby forming a three-dimensional reference framework of time-space-tactic.

[0025] Each tactic space-time node is traversed, the corresponding latest timestamp information is extracted, and the latest timestamp information is mapped to the discrete time scale on the time axis to determine the target time scale value of each node; the device identification information and network location metadata contained in each tactic space-time node are read, and the network domain level (such as the VLAN, virtual subnet, physical security zone, etc.) in which each node is located in the network topology structure is analyzed to determine the network domain coordinates of each node on the vertical axis; further, the attack tactic feature set corresponding to each node is identified, the highest priority tactic code currently active is extracted from the attack tactic feature set, and the tactic dimension coordinates of each node on the vertical axis are determined according to the pre-defined tactic level model.

[0026] According to the target time scale value (X), the network domain coordinates (Y) and the tactic dimension coordinates (Z), each tactic space-time node is mapped to a unique position point in the three-dimensional coordinate system, and edge connections are established according to the causal association between nodes, attack logic paths, device communication relationships or behavior time sequences to output a complete three-dimensional correlation graph.

[0027] Based on the causal discovery algorithm, the attack path of the three-dimensional correlation graph is inferred, the causal dependence relationship is identified, data tracking is performed according to the causal dependence relationship, the APT attack causal chain is reconstructed, and the attack logic path is obtained.

[0028] For the multiple tactical spatio-temporal nodes contained in the three-dimensional correlation graph, a causal discovery algorithm (such as PC algorithm, Fast Causal Inference (FCI), NOTEARS, etc.) is used for preprocessing to learn the structure of the nodes in the graph and generate the conditional candidate set of each node. The node pairs in the graph are traversed, and the conditional independence test is performed based on the conditional candidate set, for example, using conditional mutual information, Pearson residual test, etc. to determine whether there is a causal dependence relationship between the two nodes under certain conditions. If there is still significant correlation after controlling some intermediate nodes, it can be determined that there is a direct causal relationship between the two nodes, and the causal dependence edge between the nodes is constructed to output the attack causal graph with causal structure. According to the completed attack causal graph, the upstream causal node path of the final victim target node is tracked layer by layer, and all possible initial behaviors and their transmission chains that can lead to the attack result are identified. In this process, multiple possible attack path branches are extracted, each path is a causal chain segment, representing a certain type of attack intention or path variant. Based on the properties of the connecting edges in the three-dimensional correlation graph (such as edge weight, behavior confidence, node activity, etc.), the above causal chain paths are probabilistically scored and sorted, and the paths with higher credibility and complete logic are preferentially output as attack logic paths.

[0029] Further, based on the causal discovery algorithm, the attack path reasoning of the three-dimensional correlation graph is performed to identify the causal dependence relationship, and the method comprises: Based on the causal discovery algorithm, the device nodes in the three-dimensional correlation graph are preprocessed for causal discovery to generate a node condition set; the node pairs in the three-dimensional correlation graph are traversed according to the node condition set to perform conditional independence test to identify the causal dependence relationship between the nodes.

[0030] Preferably, for the completed three-dimensional correlation graph, all device nodes and their corresponding attribute features (including timestamp, network domain, tactical label, behavior activity, anomaly score, etc.) are extracted, and the graph is preprocessed for causal structure based on the selected causal discovery algorithm (such as PC algorithm, FCI algorithm, NOTEARS, etc.). Through statistical analysis and correlation modeling of node behavior data, candidate nodes that may have causal relationship with each device node are identified, and a node condition set corresponding to each target node is generated, i.e. a set of prior condition nodes that may affect the occurrence of the node behavior.

[0031] For any two device nodes A and B with an existing correlation edge in the three-dimensional correlation graph, conditional independence test is performed. Specifically, first, the joint behavior probability distribution of node A and node B is calculated, that is, the statistical correlation between the behavior characteristics (such as attack event frequency, time series pattern, abnormality index, etc.) of A and B is evaluated without introducing any conditional variable; then, each node C in the conditional set is introduced as a control variable one by one, and the joint behavior probability distribution of node A and node B under the control condition C is recalculated to observe the change of the probability distribution. If the joint behavior probability distribution of node A and node B shows statistical independence after introducing a certain conditional node C, that is, the two are no longer significantly correlated under the control of C, it is determined that node A and node B are conditionally independent with respect to condition C, which indicates that the correlation between A and B is indirectly affected by C and does not constitute a direct causal dependence relationship. On the contrary, if there is no conditional node C that can make node A and node B statistically independent, it is determined that there is a direct causal dependence relationship between node A and node B, and a to-be-determined causal edge representing the causal correlation is established.

[0032] Based on the results of the independence test, all node pairs that meet the causal dependence condition are retained, and the causal directionality (from the cause to the effect) is mapped as a directed edge. A graph subset containing an explicit causal structure is output, forming a causal dependence relationship network with attack behavior logical relationships.

[0033] Further, data tracking is performed according to the causal dependence relationship, and the APT attack causal chain is reconstructed to obtain an attack logical path, the method comprising: Data tracking is performed by backtracking the causal dependence relationship from the final attack target node, and multiple paths reaching the initial intrusion node are extracted. The APT attack causal chain is probabilistically sorted according to the edge weights in the three-dimensional correlation graph, and the attack logical path is output.

[0034] The final attack target node is taken as the tracking starting point, and backtracking is performed along the identified causal dependence relationship. Specifically, the causal edges between nodes in the three-dimensional correlation graph are relied on to track the nodes layer by layer from the target node to the upstream node, and each causal correlation node is continuously tracked. The system automatically extracts multiple possible attack paths, each of which starts from the initial intrusion node and covers the complete evolution process of the attack event. For the extracted multiple attack paths, the weights of the edges in the three-dimensional correlation graph (the weights can be calculated based on multiple-dimensional indicators such as node activity, behavior abnormality degree, time correlation, and attack confidence) are combined to probabilistically score each path. According to the path scoring results, the extracted attack paths are sorted in descending order, and the attack logical path with the highest credibility is preferentially output to clearly present the complete causal chain of the APT attack from the initial penetration to the final target.

[0035] In summary, the embodiments of the present application have at least the following technical effects: First, the heterogeneous device logs across multiple network domains are collected to extract original attack data for spatio-temporal feature extraction, and a device behavior spatio-temporal vector is generated. Then, the original attack data is parsed to obtain attack tactic semantic features, the device behavior spatio-temporal vector and the attack tactic semantic features are fused, and a three-dimensional correlation graph is constructed. Finally, the three-dimensional correlation graph is reasoned for attack path based on a causal discovery algorithm, the causal dependency relationship is identified, data tracking is performed according to the causal dependency relationship, the APT attack causal chain is reconstructed, and the attack logic path is obtained. The technical problem that it is difficult to comprehensively and accurately trace the cross-space APT attack in the prior art is solved, and the technical effects of efficient reconstruction of the APT attack causal chain and accurate identification of the attack path are achieved.

[0036] Embodiment two, based on the same inventive concept as the cross-space APT attack behavior causal chain tracking method in the foregoing embodiments, as shown in the following table, the present application provides a cross-space APT attack behavior causal chain tracking system, wherein the system comprises: Figure 2 The feature extraction module 11: collects the heterogeneous device logs across multiple network domains to extract original attack data for spatio-temporal feature extraction, and generates a device behavior spatio-temporal vector; the graph construction module 12: parses the original attack data to obtain attack tactic semantic features, fuses the device behavior spatio-temporal vector and the attack tactic semantic features, and constructs a three-dimensional correlation graph; the identification module 13: reasons for attack path based on a causal discovery algorithm on the three-dimensional correlation graph, identifies the causal dependency relationship, performs data tracking according to the causal dependency relationship, reconstructs the APT attack causal chain, and obtains the attack logic path. Further, the feature extraction module 11 is used to perform the following method:

[0037] Deploy distributed probes at different security domain boundaries to capture initial device logs of multiple network domains; standardize the initial device logs of the multiple network domains to generate heterogeneous device logs of the multiple network domains; divide continuous time windows at a preset time interval, and extract features from the heterogeneous device logs of the multiple network domains according to the continuous time windows to obtain the original attack data; and perform spatio-temporal dimension analysis on the original attack data to generate the device behavior spatio-temporal vector. Further, the feature extraction module 11 is used to perform the following method:

[0038] ​A spatial coordinate system is constructed based on a device physical position and a logical network topology, original attack data is mapped to the spatial coordinate system for space-time feature extraction to obtain space-time mapping coordinates, device anomaly analysis is performed according to the space-time mapping coordinates to generate an abnormality index, behavior anomaly analysis is performed according to the space-time mapping coordinates to generate a behavior activity index, and the abnormality index and the behavior activity index are normalized and weighted and fused to construct a device behavior space-time vector.

[0039] Further, the graph construction module 12 is configured to perform the following method: The behavior description data of the original attack data is subjected to natural language word segmentation processing to extract a target behavior tuple, a TTPs knowledge graph is constructed, the target behavior tuple is subjected to semantic matching with an ATT&CK tactic ID in the TTPs knowledge graph, and a semantic feature of the attack tactic is obtained according to a matching result, the device behavior space-time vector and the semantic feature of the attack tactic are subjected to feature fusion to generate a plurality of tactic space-time nodes, a three-dimensional coordinate system is constructed in combination of a time axis, a network domain topology layer and an attack tactic dimension, the plurality of tactic space-time nodes are mapped to the three-dimensional coordinate system, and a three-dimensional correlation graph is constructed.

[0040] Further, the graph construction module 12 is configured to perform the following method: The time axis is defined as a horizontal axis, the network domain topology layer is defined as a vertical axis, and the attack tactic dimension is defined as a vertical axis to construct the three-dimensional coordinate system, a latest time stamp of the plurality of tactic space-time nodes is extracted, a target time scale value is determined by matching a time axis corresponding scale, device attributes of the plurality of tactic space-time nodes are read, network domain coordinates of a network domain layer to which a plurality of tactic space-time nodes belong are analyzed, an active highest-order tactic code in the plurality of tactic space-time nodes is obtained to determine a tactic dimension coordinate, and a three-dimensional coordinate value is output according to the target time scale value, the network domain coordinate and the tactic dimension coordinate to connect and construct the three-dimensional correlation graph.

[0041] Further, the identification module 13 is configured to perform the following method: Based on the causal discovery algorithm, device nodes in the three-dimensional correlation graph are subjected to causal discovery preprocessing to generate a node condition set, and conditional independence tests are performed on node pairs in the three-dimensional correlation graph according to the node condition set to identify the causal dependency relationship between the nodes.

[0042] Further, the identification module 13 is configured to perform the following method: The causal dependency relationship is traced back from a final attack target node to extract a plurality of paths reaching an initial intrusion node, and the APT attack causal chain is probabilistically sorted according to an edge weight in the three-dimensional correlation graph to output the attack logic path.

[0043] It should be noted that the above-mentioned order of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And the above describes a specific embodiment of the present application. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or can be advantageous.

[0044] The above only describes the preferred embodiments of the present application, and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0045] The specification and drawings are merely exemplary of the present application, and any and all modifications, variations, combinations or equivalents that are within the scope of the present application should be included. Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the present application and its equivalents, the present application is intended to include these modifications and variations.

Claims

1. A causal chain tracing method for cross-space APT attack behavior, characterized in that, The method includes: Collect logs from heterogeneous devices across multiple network domains to extract raw attack data, perform spatiotemporal feature extraction, and generate spatiotemporal vectors of device behavior; The original attack data is analyzed to obtain attack tactical semantic features. The device behavior spatiotemporal vector is fused with the attack tactical semantic features to construct a three-dimensional correlation map. The attack path is inferred based on the causal discovery algorithm of the three-dimensional correlation graph, the causal dependency is identified, the data is tracked according to the causal dependency, the APT attack causal chain is reconstructed, and the attack logic path is obtained.

2. The causal chain tracing method for cross-space APT attack behavior as described in claim 1, characterized in that, The method involves collecting logs from heterogeneous devices across multiple network domains, extracting raw attack data, performing spatiotemporal feature extraction, and generating spatiotemporal vectors of device behavior. Deploy distributed probes at the boundaries of different security domains to capture initial device logs from multiple network domains; The initial device logs of the multiple network domains are standardized to generate heterogeneous device logs for multiple network domains; The system divides continuous time windows by a preset time interval, and extracts features from the logs of heterogeneous devices in the multiple network domains according to the continuous time windows to obtain the original attack data. The original attack data is analyzed in a spatiotemporal dimension to generate the spatiotemporal vector of the device behavior.

3. The causal chain tracing method for cross-space APT attack behavior as described in claim 2, characterized in that, The method involves performing spatiotemporal dimension analysis on the original attack data to generate the spatiotemporal vector of the device behavior, including: A spatial coordinate system is constructed based on the physical location of the device and the logical network topology. The original attack data is mapped to the spatial coordinate system to extract spatiotemporal features and obtain spatiotemporal mapped coordinates. Based on the spatiotemporal mapping coordinates, perform equipment anomaly analysis and generate an anomaly index; Based on the spatiotemporal mapping coordinates, perform behavioral anomaly analysis to generate behavioral activity indicators; The anomaly index and the behavior activity index are normalized and weighted and fused to construct the spatiotemporal vector of device behavior.

4. The causal chain tracing method for cross-space APT attack behavior as described in claim 1, characterized in that, The method involves parsing the raw attack data to obtain attack tactical semantic features, fusing the device behavior spatiotemporal vector with the attack tactical semantic features, and constructing a three-dimensional correlation map. The behavior description data of the original attack data is processed by natural language word segmentation to extract the target behavior tuple; Construct a TTPs knowledge graph, perform semantic matching between the target behavior tuple and the ATT&CK tactical ID in the TTPs knowledge graph, and label the results to obtain the semantic features of the attack tactics. The device behavior spatiotemporal vector is fused with the attack tactical semantic features to generate multiple tactical spatiotemporal nodes; A three-dimensional coordinate system is constructed by combining the time axis, network domain topology layer, and attack tactical dimension. The multiple tactical spatiotemporal nodes are mapped to the three-dimensional coordinate system to construct the three-dimensional correlation graph.

5. The causal chain tracing method for cross-space APT attack behavior as described in claim 4, characterized in that, A three-dimensional coordinate system is constructed by combining a timeline, network domain topology layer, and attack tactical dimensions. The multiple tactical spatiotemporal nodes are then mapped to this three-dimensional coordinate system to construct the three-dimensional correlation graph. The method includes: Define the time axis as the horizontal axis, the network domain topology layer as the vertical axis, and the attack tactic dimension as the vertical axis to construct the three-dimensional coordinate system; Extract the latest timestamps of the multiple tactical spatiotemporal nodes, match them with the corresponding scales of the timeline, and determine the target time scale value; Read the device attributes of the multiple tactical spatiotemporal nodes and parse the network domain coordinates of the network domain layer to which the multiple tactical spatiotemporal nodes belong; Obtain the highest-order tactical code active among the multiple tactical spatiotemporal nodes, and determine the tactical dimension coordinates; The three-dimensional correlation map is constructed by connecting the target time scale value, the network domain coordinates, and the tactical dimension coordinates to output three-dimensional coordinate values.

6. The causal chain tracing method for cross-space APT attack behavior as described in claim 1, characterized in that, The attack path inference and causal dependency identification methods for the three-dimensional correlation graph are based on causal discovery algorithms. The methods include: Based on the causal discovery algorithm, the device nodes in the three-dimensional correlation graph are preprocessed for causal discovery to generate a node condition set. Perform conditional independence checks on node pairs in the three-dimensional association graph according to the node condition set, and identify the causal dependencies between nodes.

7. The causal chain tracing method for cross-space APT attack behavior as described in claim 1, characterized in that, Based on the aforementioned causal dependencies, data tracing is performed to reconstruct the APT attack causal chain and obtain the attack logic path. The methods include: By tracing back the causal dependencies from the final target node, multiple paths leading to the initial intrusion node are extracted. The APT attack causal chain is probabilistically sorted based on the edge weights in the three-dimensional correlation graph, and the attack logic path is output.

8. A causal chain tracing system for cross-space APT attack behavior, characterized in that, A causal chain tracing method for implementing cross-space APT attack behavior as described in any one of claims 1-7, the system comprising: Feature extraction module: Collects logs from heterogeneous devices across multiple network domains, extracts raw attack data, performs spatiotemporal feature extraction, and generates spatiotemporal vectors of device behavior; Atlas construction module: parses the original attack data to obtain attack tactical semantic features, fuses the device behavior spatiotemporal vector with the attack tactical semantic features, and constructs a three-dimensional association atlas; Identification module: Based on the causal discovery algorithm, the attack path is inferred from the three-dimensional correlation graph, causal dependencies are identified, data is tracked according to the causal dependencies, the APT attack causal chain is reconstructed, and the attack logic path is obtained.

Images