An event aggregation and attribution method based on attack chain homology analysis

Abstract

This invention discloses an event aggregation and attribution method based on attack chain homology analysis, comprising the following steps: Step 1, multi-source heterogeneous data fusion and standardization processing; Step 2, dynamic subject-object relationship modeling; Step 3, attack event homology analysis; Step 4, homology attack event aggregation; Step 5, attack path deduction and visualization; Step 6, dynamic threat adaptive optimization. This invention improves the completeness of attack path reconstruction and solves the defect of static modeling in failing to capture attack chain evolution by using a dynamic subject-object relationship model and homology analysis algorithm; it presents the attack process through visualization technology, shortening the analysis time and improving the efficiency of source tracing; it improves the robustness of homology determination and the accuracy of entity relationship identification by using a multi-feature weighted fusion hierarchical clustering mechanism combined with code string features and vulnerability exploitation methods for auxiliary verification; and it enhances the adaptability of dynamic threats and shortens the response window for new threats through a dynamic weight update mechanism.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to an event aggregation and attribution method based on attack chain homology analysis. Background Technology

[0002] With the deepening of global digital transformation, critical information infrastructure, cloud computing platforms, IoT devices, and industrial control systems have become core supports for socio-economic operations. However, the continuous evolution and increasing complexity of cyberattack methods have led to cybersecurity threats becoming more commonplace, diversified, and large-scale. In recent years, ransomware attacks, advanced persistent threats (APTs), and data breaches have occurred frequently, causing not only huge economic losses and intellectual property leaks for enterprises, but also posing serious threats to national security, public interests, and personal privacy. Cybersecurity has become a key cornerstone for ensuring the healthy development of the digital economy. Building an efficient and accurate cyberattack detection and tracing system is of great significance for timely detection of security threats, reconstruction of attack processes, and tracing of attack sources.

[0003] As a core component of cybersecurity protection, the main objective of cyberattack attribution is to determine the source, path, methods, and intent of an attack by analyzing attack traces and related data, thereby providing a basis for incident response, accountability, and optimization of defense strategies. However, existing network attack attribution technologies still have the following drawbacks: 1. Complex attack scenarios lead to fragmented attack chains: Attackers often employ multi-stage and multi-vector attack patterns, utilizing vulnerability chains and social engineering techniques to bypass traditional defense mechanisms, resulting in fragmented attack chains that are difficult to fully reconstruct; 2. Difficulty in integrating heterogeneous multi-source data to form data silos: Log data, traffic data, threat intelligence, and other data generated in the network environment come from diverse sources and have heterogeneous formats, making effective integration and correlation analysis difficult, forming data silos and hindering attribution analysis; 3. Existing methods lack in-depth mining of subject-object relationships: Traditional attribution methods often focus on single alarm events or isolated indicators, failing to deeply mine the relationships between attack subjects and objects, and thus unable to achieve a global reconstruction of the attack chain; 4. High false alarm rates from massive alarms lead to low attribution efficiency: Faced with massive alarm information, existing technologies have a high false alarm rate, making it difficult for security analysts to quickly locate the real threat and significantly reducing attribution efficiency. Summary of the Invention

[0004] The purpose of this invention is to provide an event aggregation and attribution method based on attack chain homology analysis to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an event aggregation and attribution method based on attack chain homology analysis, comprising the following steps: Step 1, multi-source heterogeneous data fusion and standardization processing; Step 2, dynamic subject-object relationship modeling; Step 3, attack event homology analysis; Step 4, homology attack event aggregation; Step 5, attack path deduction and visualization; Step 6, dynamic threat adaptive optimization.

[0006] In step one above, network security data from multiple sources is collected, the collected data is preprocessed, the preprocessed data is then standardized using OCSF, and the standardized data is then enriched.

[0007] In step two above, based on the data enriched in step one, a two-layer association mechanism consisting of a temporal association layer and a hierarchical association layer is constructed to establish the interaction relationship and attribution mapping between the attack subject and object, and the association weight is dynamically adjusted through the relationship weight update module.

[0008] In step three above, based on the data enriched in step one, a two-layer clustering algorithm consisting of attack payload hash clustering and C&C server topology clustering is adopted. Combined with multi-feature weighted fusion and auxiliary feature verification, the same-source attack events are determined and the same-source attack event cluster is output.

[0009] In step four above, for the cluster of output homogeneous attack events obtained in step three, a time-series weighting strategy is used to adjust the correlation strength of the aggregated homogeneous attack events according to the time dimension, and the fragmented attack behaviors at different time points are associated into a complete attack chain according to the time axis.

[0010] In step five above, the complete attack chain obtained in step four is divided into stages and steps are connected based on the four-stage deduction logic constructed by the ATT&CK model to restore the attack steps, and an attack chain graph that supports multi-dimensional interactive operation is generated using a graph visualization engine.

[0011] In step six above, entity relationship weights are adjusted by periodically executing weight update tasks, intelligence is imported and weights are calibrated using an external threat intelligence access API, and weight fluctuations are monitored by an anomaly detection thread. When the entity relationship weight fluctuation exceeds the threshold, the review process is triggered.

[0012] Preferably, in step one, the sources of the multi-source network security data specifically include core logs and alarm data from the cloud, network, host, and terminal side; data preprocessing includes data deduplication, anomaly filtering, and missing data completion.

[0013] Preferably, in step one, the standardization process involves mapping the original data to OCSF standard attributes, and then extracting the core entity features and interactive behaviors of the attacking subject and object based on the standardized format, storing them in the Starrocks library. The core entity features specifically include the attacker's IP, target asset ID, malicious code hash, vulnerability CVE number, process information, and file information.

[0014] Preferably, in step one, the enrichment process involves supplementing data dimension information by calling online threat intelligence and offline libraries. The offline libraries include IP address libraries, asset fingerprint libraries, threat intelligence libraries, and vulnerability libraries.

[0015] Preferably, in step two, the temporal association layer is based on sliding matching of entities and performance associations within a time window, and establishes the interaction relationship between the attack subject and object by combining timestamp sequences and behavioral feature vectors; the hierarchical association layer establishes affiliation mappings through cosine similarity clustering of entity attribute vectors.

[0016] Preferably, in step two, the relationship weight update module is equipped with a weight reduction and increase mechanism. The weight reduction adopts an exponential decay function, as shown in the following formula:

[0017]

[0018] in, This represents the current weight value indicating the relationship between the attacking subject and object. This represents the initial weight value indicating the relationship between the attacking subject and the attacking object. This represents the time interval from when the relationship was first established to the current moment;

[0019] New attack events will trigger a weighting adjustment mechanism, with the adjustment amount... The calculation formula is as follows:

[0020]

[0021] The severity level of the event ranges from 1 to 10.

[0022] Preferably, in step three, attack payload hash clustering calculates the hash similarity of attack payload files, C&C server topology clustering extracts the IP address, domain name registration WHOIS data, and ASN location features of the C&C server, converts them into topology feature vectors, calculates the cosine similarity of the topology feature vectors, and multi-feature weighted fusion weights and fuses the hash similarity of the attack payload files and the cosine similarity of the topology feature vectors to obtain a comprehensive score. If the comprehensive score exceeds a threshold, it is determined to be a same-origin attack event.

[0023] Preferably, in step three, the auxiliary feature verification includes code string feature verification and vulnerability exploitation method verification. Code string feature verification is to extract feature strings from the attack payload. If the payloads of different attack events contain the same signature string, they are determined to be attack events from the same source. Vulnerability exploitation method verification is to check whether the vulnerability types and exploitation processes used by different attack events are consistent. If they are consistent, they are determined to be attack events from the same source.

[0024] Preferably, in step five, the four-stage deduction logic includes four stages: reconnaissance, penetration, lateral movement, and data theft. The attack behaviors corresponding to each stage are port scanning, vulnerability exploitation, credential theft, and outbound traffic, respectively. The stage division is to divide the attack events in the complete attack chain into four stages by matching attack behaviors. The step connection is to connect the attack steps by entity association weights.

[0025] Preferably, in step five, the graph visualization engine is antvG6, and the entity type is distinguished by node color in the attack chain graph, and the behavior sequence is marked by the graph edge attributes.

[0026] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention improves the completeness of attack path reconstruction by using a dynamic subject-object relationship model and a homology analysis algorithm, thus solving the defect that static modeling cannot capture the evolution of attack chains; it presents the attack process through visualization technology, shortening the analysis time and improving the efficiency of source tracing; it improves the robustness of homology determination and the accuracy of entity relationship identification by using a hierarchical clustering mechanism with multi-feature weighted fusion combined with code string features and vulnerability exploitation methods for auxiliary verification; and it enhances the adaptability to dynamic threats and shortens the response window for new threats through a dynamic weight update mechanism. Attached Figure Description

[0027] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Please see the appendix Figure 1The present invention provides an embodiment of an event aggregation and attribution method based on attack chain homology analysis, comprising the following steps: Step 1, multi-source heterogeneous data fusion and standardization processing; Step 2, dynamic subject-object relationship modeling; Step 3, attack event homology analysis; Step 4, homology attack event aggregation; Step 5, attack path deduction and visualization; Step 6, dynamic threat adaptive optimization.

[0030] In step one above, multi-source cybersecurity data is collected, preprocessed, and then standardized using OCSF (Open Cybersecurity Schema Framework). The standardized data is then enriched. The sources of this multi-source cybersecurity data include core logs and alerts from the cloud, network, host, and endpoint. Data preprocessing includes deduplication, anomaly filtering, and missing data completion. Standardization maps the raw data to OCSF standard attributes, and based on the standardized format, extracts the core entity characteristics and interaction behaviors of the attacking entity and stores them in the Starrocks library. Core entity characteristics include attacker IP, target asset ID, malware hash, vulnerability CVE number, process information, and file information. Enrichment involves supplementing data dimensions by accessing online threat intelligence and offline libraries, including IP address databases, asset fingerprint databases, threat intelligence databases, and vulnerability databases.

[0031] In step two above, based on the data enriched in step one, a two-layer association mechanism consisting of a temporal association layer and a hierarchical association layer is constructed to establish the interaction relationship and attribution mapping between the attack subject and object, and the association weights are dynamically adjusted through the relationship weight update module. The temporal association layer establishes the interaction relationship between the attack subject and object by sliding matching entities and performance associations based on time windows, combined with timestamp sequences and behavioral feature vectors. The hierarchical association layer establishes the attribution mapping through cosine similarity clustering of entity attribute vectors. The relationship weight update module has weight down and up mechanisms; the weight down adjustment uses an exponential decay function, as shown in the following formula:

[0032]

[0033] in, This represents the current weight value indicating the relationship between the attacking subject and object. This represents the initial weight value indicating the relationship between the attacking subject and the attacking object. This represents the time interval from when the relationship was first established to the current moment;

[0034] New attack events will trigger a weighting adjustment mechanism, with the adjustment amount... The calculation formula is as follows:

[0035]

[0036] The severity level of the event ranges from 1 to 10.

[0037] In step three above, based on the data enriched in step one, attack payload hashing and clustering with C&C (Command and Control) are employed. A two-layer clustering algorithm, consisting of server topology clustering (Server, Command & Control), is used to determine same-origin attack events by combining multi-feature weighted fusion and auxiliary feature verification, outputting clusters of same-origin attack events. Specifically, attack payload hash clustering calculates the hash similarity of attack payload files; C&C server topology clustering extracts the IP address, domain name registration WHOIS data, and ASN location features of the C&C server, converting them into topological feature vectors and calculating their cosine similarity; multi-feature weighted fusion weights and fuses the hash similarity of the attack payload files and the cosine similarity of the topological feature vectors to obtain a comprehensive score; if the comprehensive score exceeds a threshold, it is determined to be a same-origin attack event; auxiliary feature verification includes code string feature verification and vulnerability exploitation method verification. Code string feature verification extracts characteristic strings from the attack payload; if different attack events' payloads contain the same distinctive strings, they are determined to be same-origin attack events. Vulnerability exploitation method verification checks whether the vulnerability types and exploitation processes used by different attack events are consistent; if they are consistent, they are determined to be same-origin attack events.

[0038] In step four above, for the cluster of output homogeneous attack events obtained in step three, a time-series weighting strategy is used to adjust the correlation strength of the aggregated homogeneous attack events according to the time dimension, and the fragmented attack behaviors at different time points are associated into a complete attack chain according to the time axis.

[0039] In step five above, based on the complete attack chain obtained in step four, the four-stage deduction logic constructed using the ATT&CK model is used to divide the attack chain into stages and connect the steps, reconstructing the attack steps. The antvG6 graph visualization engine is then used to generate an attack chain graph that supports multi-dimensional interactive operations. In the attack chain graph, entity types are distinguished by node color, and the graph edge attributes indicate the sequence of actions. The four-stage deduction logic includes four stages: reconnaissance, penetration, lateral movement, and data theft. The corresponding attack behaviors for each stage are port scanning, vulnerability exploitation, credential theft, and outbound traffic, respectively. Stage division involves classifying attack events in the complete attack chain into four stages based on attack behavior matching. Step connection uses entity association weights to connect the attack steps.

[0040] In step six above, entity relationship weights are adjusted by periodically executing weight update tasks, intelligence is imported and weights are calibrated using an external threat intelligence access API (Application Programming Interface), and weight fluctuations are monitored through an anomaly detection thread. When the entity relationship weight fluctuation exceeds a threshold, the review process is triggered.

[0041] Based on the above, the advantages of this invention are as follows: When used, it constructs a complete technical system from single-event association to full-link serialization through the deep integration of a dynamic subject-object relationship model and a homology analysis algorithm. It combines temporal association algorithms with entity feature clustering, overcoming the shortcomings of traditional static modeling in capturing attack chain evolution and significantly improving the completeness of attack path reconstruction. Furthermore, by integrating visualization technology to construct an interactive attack chain topology map, it achieves an intuitive presentation of the attack process, significantly reducing the average analysis time for security analysts compared to traditional tabular listing methods, effectively reducing the cognitive burden of manual association analysis, and greatly improving tracing efficiency. It also employs a multi-feature weighted fusion hierarchical structure. Clustering mechanisms improve the accuracy of entity affiliation identification. Combined with code string features and vulnerability exploitation methods for auxiliary verification, it solves the misjudgment problem caused by the reliance on single features in traditional entity association methods, significantly improving the robustness of homology determination and the accuracy of entity relationship identification. A relationship weight update mechanism based on decay factors is introduced, and external threat intelligence API access is supported to calibrate entity relationship weights in real time. This effectively solves the shortcomings of long update cycles and dynamic evolution response delays in traditional static rule bases, significantly shortens the response window for new threats, and enables adaptive analysis of dynamic threats such as zero-day exploits and unknown malicious code, enhancing the ability to respond to rapidly iterative attack methods.

[0042] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. An attack chain homology analysis based method for incident aggregation and attribution, comprising the steps of: Step 1, multi-source heterogeneous data fusion standardization processing; Step 2, dynamic subject-object relationship modeling; Step 3, attack event homology analysis; Step 4, homologous attack event aggregation; Step 5, attack path deduction and visualization; Step 6, dynamic threat adaptive optimization; It is characterized in that: In the above Step 1, multi-source network security data is collected, the collected data is preprocessed, then the preprocessed data is standardized using OCSF, and then the standardized data is enriched; In the above Step 2, based on the data after enrichment in Step 1, a two-layer association mechanism composed of a time-series association layer and a hierarchical association layer is constructed, the interaction relationship and attribution mapping between attack subjects and objects are established, and the association weight is dynamically adjusted through a relationship weight update module; The time-series association layer is based on time-window sliding to match entities and performance associations, and combines the time-stamp sequence and behavior feature vectors to establish the interaction relationship between attack subjects and objects; The hierarchical association layer establishes the attribution mapping through the cosine similarity clustering of entity attribute vectors; In the above Step 3, based on the data after enrichment in Step 1, a two-layer clustering algorithm composed of attack payload hash clustering and C&C server topology clustering is adopted, and homologous attack events are determined by combining multi-feature weighted fusion and auxiliary feature verification, and a homologous attack event cluster is output; In the above Step 4, for the output homologous attack event cluster obtained in Step 3, a time-series weighted strategy is adopted to adjust the association strength of the aggregated homologous attack events in the time dimension, and the fragmented attack behaviors at different time points are associated into a complete attack chain along the time axis; In the above Step 5, for the complete attack chain obtained in Step 4, stage division and step concatenation are carried out based on the four-stage deduction logic constructed by the ATT&CK model, the attack steps are restored, and an attack link graph supporting multi-dimensional interactive operations is generated using a graph visualization engine; The four-stage deduction logic includes four stages: reconnaissance, penetration, lateral movement, and data theft, and the corresponding attack behaviors for each stage are port scanning, vulnerability exploitation, credential theft, and outbound traffic; The stage division is to divide the attack events in the complete attack chain into the four stages through attack behavior matching; The step concatenation is to concatenate the attack steps through the entity association weight; In the above Step 6, the entity relationship weight is adjusted by periodically executing a weight update task, intelligence is imported and the weight is calibrated by accessing the API of external threat intelligence, and at the same time, the weight fluctuation is monitored through an anomaly detection thread, and when the entity relationship weight fluctuation exceeds the threshold, an audit process is triggered.

2. The attack chain homology analysis based event aggregation and attribution method according to claim 1, characterized in that: In the above Step 1, the sources of multi-source network security data specifically include core log and alarm data from the cloud, network, host, and terminal side; The data preprocessing includes data deduplication, anomaly filtering, and missing value filling.

3. The attack chain homology analysis based event aggregation and attribution method of claim 1, wherein: In step one, the standardization process maps the raw data to OCSF standard attributes, and then extracts the core entity features and interactive behaviors of the attack subject and object based on the standardized format, and stores them in the Starrocks library. The core entity features specifically include attacker IP, target asset ID, malicious code hash, vulnerability CVE number, process information, and file information.

4. The event aggregation and attribution method based on attack chain homology analysis according to claim 1, characterized in that: In step one, the enrichment process involves supplementing data dimension information by calling online threat intelligence and offline libraries. The offline libraries include IP address libraries, asset fingerprint libraries, threat intelligence libraries, and vulnerability libraries.

5. The event aggregation and attribution method based on attack chain homology analysis according to claim 1, wherein: In the second step, the relationship weight update module is provided with a weight reduction and increase mechanism. The weight reduction adopts an exponential decay function, and the formula is as follows: Among them, represents the current weight value of the association relationship between the attacker and the target, represents the initial weight value of the association relationship between the attacker and the target, represents the time interval from the first establishment of the association relationship to the current moment; New attack events will trigger the weight increase mechanism, and the increase range is calculated as follows: The severity level of the event ranges from 1 to 10.

6. The event aggregation and attribution method based on attack chain homology analysis according to claim 1, characterized in that: In step three, attack payload hash clustering calculates the hash similarity of attack payload files, C&C server topology clustering extracts the IP address, domain name registration WHOIS data, and ASN location features of C&C servers, converts them into topology feature vectors, calculates the cosine similarity of the topology feature vectors, and multi-feature weighted fusion weights and fuses the hash similarity of attack payload files and the cosine similarity of topology feature vectors to obtain a comprehensive score. If the comprehensive score exceeds the threshold, it is determined to be a same-origin attack event.

7. The event aggregation and attribution method based on attack chain homology analysis according to claim 1, characterized in that: In step three, auxiliary feature verification includes code string feature verification and vulnerability exploitation method verification. Code string feature verification is to extract feature strings from the attack payload. If the payloads of different attack events contain the same signature string, they are determined to be attack events from the same source. Vulnerability exploitation method verification is to check whether the vulnerability types and exploitation processes used by different attack events are consistent. If they are consistent, they are determined to be attack events from the same source.

8. The event aggregation and attribution method based on attack chain homology analysis according to claim 1, characterized in that: In step five, the graph visualization engine uses antvG6. In the attack chain graph, the entity type is distinguished by the node color, and the behavior sequence is marked by the graph edge attributes.

Images