Multivariate attack feature recognition method and system based on persistent threat attack

Abstract

The invention is suitable for the technical field of network security, and provides a multivariate attack feature recognition method and system based on persistent threat attacks, and the method comprises the steps: obtaining a real-time traffic data sequence in a target network environment; performing primary anomaly sensing processing on the real-time traffic data sequence to obtain a suspicious traffic fragment set; executing thinking chain reasoning analysis on the suspicious traffic fragment set, and generating an attack behavior reasoning path comprising multi-stage reasoning steps; performing matching verification on the attack behavior reasoning path and a pre-constructed threat intelligence knowledge base, and determining an attack stage and an attack intention of the persistent threat attack; and generating a multivariate attack feature recognition result according to a matching verification result. According to the method, analysis of advanced persistent threat attack multi-stage features is realized through a thinking chain reasoning mode, and the timeliness and reliability of detection are improved, so that the active protection capability of network security is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for identifying multi-faceted attack characteristics based on persistent threat attacks. Background Technology

[0002] In the field of cybersecurity, Advanced Persistent Threats (APTs) have become a key focus of current network security protection due to their high degree of stealth and complex attack chain characteristics. Current technologies primarily employ feature-matching-based detection methods, building a database of known attack characteristics to perform rule matching and anomaly identification on network traffic. Some methods incorporate machine learning algorithms, analyzing traffic statistics and protocol behavior patterns to discover potential threats. However, because APT attacks are characterized by long cycles and multiple stages, traditional detection methods are often limited to single-point anomaly identification, lacking the ability to perform correlation analysis across the entire attack chain; furthermore, the methods for judging attack intent and attack stages are difficult to adapt to the flexible evolution of attack methods. These factors result in low accuracy and untimely detection of APTs, failing to effectively address the continuously evolving network threats.

[0003] In view of this, a multi-faceted attack feature identification method and system based on persistent threat attacks is proposed. Summary of the Invention

[0004] This invention provides a multi-dimensional attack feature identification method based on persistent threat attacks, which addresses the problems of low attack detection accuracy and untimely detection of advanced persistent threat attacks, making it unable to effectively cope with continuously evolving network threats.

[0005] The first aspect of this invention provides a method for identifying multi-faceted attack features based on persistent threat attacks, comprising: Obtain real-time traffic data sequences in the target network environment; The real-time traffic data sequence is subjected to primary anomaly detection processing to obtain a set of suspicious traffic segments; The suspicious traffic fragment set is subjected to thought chain reasoning analysis to generate an attack behavior reasoning path containing multi-stage reasoning steps; The attack behavior reasoning path is matched and verified with a pre-built threat intelligence knowledge base to determine the attack stage and attack intent of persistent threat attacks. The multi-faceted attack feature identification results are generated based on the matching verification results.

[0006] Furthermore, the preliminary anomaly detection processing performed on the real-time traffic data sequence to obtain a set of suspicious traffic segments includes: Communication frequency features, protocol distribution features, and data packet size distribution features are extracted from the real-time traffic data sequence, and the communication frequency features, protocol distribution features, and data packet size distribution features are normalized and concatenated to generate a traffic behavior feature vector; The anomaly score of the traffic behavior feature vector is calculated based on the sliding window statistical method, resulting in an anomaly score sequence containing timestamps and anomaly scores; Set a first threshold and a second threshold, where the first threshold is greater than the second threshold; mark traffic segments with anomaly scores exceeding the first threshold as first suspicious level segments, mark traffic segments with anomaly scores between the second threshold and the first threshold as second suspicious level segments, and merge the first suspicious level segments and the second suspicious level segments to form a suspicious traffic segment set.

[0007] Furthermore, the anomaly score calculated based on the sliding window statistical method for the traffic behavior feature vector yields an anomaly score sequence containing timestamps and anomaly scores, including: Set a dynamically adjustable sliding window size. When the network traffic load rate is higher than a preset load rate threshold, decrease the window duration. When the network traffic load rate is lower than or equal to the preset load rate threshold, increase the window duration. For the traffic behavior feature vector within each window, an online learning algorithm is used to update the normal behavior baseline model, and the baseline parameters are adjusted by calculating the weighted average of the current window feature vector and the historical window feature vector. Calculate the Mahalanobis distance between the current traffic behavior feature vector and the normal behavior baseline model, convert the Mahalanobis distance into a standardized anomaly score within a preset numerical range, and associate and store the standardized anomaly score with the corresponding timestamp.

[0008] Furthermore, the step of performing thought chain reasoning analysis on the set of suspicious traffic fragments to generate an attack behavior reasoning path containing multi-stage reasoning steps includes: Multi-dimensional feature extraction is performed on each suspicious traffic segment in the suspicious traffic segment set to obtain the traffic feature set of each suspicious traffic segment. All traffic feature sets are then standardized and concatenated to generate inference input data in a unified format. The inference input data is decomposed into attack intent based on a predefined attack pattern library to obtain a finite number of attack phase hypotheses, where each attack phase hypothesis corresponds to a possible attack phase. For each attack stage hypothesis, an inference chain generation operation is performed to generate a sequence of inference steps for each attack stage hypothesis based on evidence support and causal relationships; By logically linking and integrating the reasoning steps of each attack stage hypothesis, a complete attack behavior reasoning path is generated.

[0009] Furthermore, the attack intent decomposition of the inference input data based on a predefined attack pattern library yields a finite number of attack phase hypotheses, including: Retrieve known attack patterns from a predefined attack pattern library that match the features of the inference input data. The known attack patterns include attack phase sequences and inter-phase transition conditions. Calculate the matching degree between the inference input data and each known attack mode, sort them from high to low according to the matching degree, and select known attack modes with a matching degree higher than a preset matching threshold as candidate attack modes; Based on the attack phase sequence and inter-phase transition conditions for each candidate attack mode, a finite number of attack phase hypotheses are generated.

[0010] Furthermore, the limited number of attack phases is determined based on the number of candidate attack modes and does not exceed a preset upper limit for the number of attack phases.

[0011] Furthermore, the step of performing an inference chain generation operation for each attack stage hypothesis, generating a sequence of inference steps for each attack stage hypothesis based on evidence support and causal relationships, includes: For each attack phase hypothesis, evidence features related to the current attack phase hypothesis are extracted from the inference input data, and the correlation strength between each evidence feature and the current attack phase hypothesis is calculated. The causal reasoning steps are determined based on the strength of the association, where each causal reasoning step includes evidence features, reasoning logic, and output conclusion. Check each causal reasoning step for consistency with known attack patterns and eliminate inconsistent reasoning steps; The causal reasoning steps that have passed the inspection are arranged in chronological order to generate a sequence of reasoning steps.

[0012] Furthermore, the step of matching and verifying the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack stage and attack intent of the persistent threat attack includes: Attack stage features are extracted from the attack behavior reasoning path and matched with known attack stage patterns in the threat intelligence knowledge base; Calculate the matching degree between the attack phase features and each known attack phase pattern, and determine the attack phase corresponding to the known attack phase pattern with the highest matching degree as the current attack phase.

[0013] Furthermore, the step of matching and verifying the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack stage and attack intent of the persistent threat attack also includes: The attack target features and attack method features are extracted from the attack behavior reasoning path and matched with the known attack intent behavior patterns in the threat intelligence knowledge base; Based on the matching degree between the attack target characteristics and attack method characteristics and each known attack intent behavior pattern, the attack intent confidence is determined by weighted calculation, and the attack intent with the highest confidence is determined as the current attack intent.

[0014] A second aspect of the present invention provides a multi-faceted attack signature identification system based on persistent threat attacks, comprising: The real-time traffic data sequence acquisition unit is used to acquire real-time traffic data sequences in the target network environment. The suspicious traffic segment set determination unit is used to perform primary anomaly detection processing on the real-time traffic data sequence to obtain a suspicious traffic segment set. The attack behavior reasoning path generation unit is used to perform thought chain reasoning analysis on the suspicious traffic segment set and generate an attack behavior reasoning path containing multi-stage reasoning steps. The attack phase and attack intent determination unit is used to match and verify the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack phase and attack intent of the persistent threat attack. The multi-attack feature recognition result generation unit is used to generate multi-attack feature recognition results based on the matching verification results.

[0015] As can be seen from the above technical solutions, the present invention has the following advantages: This invention acquires real-time traffic data sequences from the target network environment, performs preliminary anomaly detection processing to filter out a set of suspicious traffic segments, and then performs thought chain reasoning analysis on these suspicious traffic segments to generate attack behavior reasoning paths containing multi-stage reasoning steps. These reasoning paths are then matched and verified against a pre-built threat intelligence knowledge base to determine the attack stage and intent. Finally, based on the verification results, a multi-dimensional attack feature identification result is output. This invention achieves the analysis of multi-stage features of advanced persistent threats (APS) through thought chain reasoning, and effectively improves the accuracy of attack stage and intent judgment through matching and verification with a threat intelligence knowledge base. It can adapt to the dynamic evolution characteristics of APS, improve the timeliness and reliability of detection, and thus enhance the proactive protection capabilities of network security. Attached Figure Description

[0016] Figure 1 This is a schematic flowchart of an embodiment of a multi-attack feature identification method based on persistent threat attacks in this invention; Figure 2 This is a schematic diagram of the process for performing primary anomaly detection processing on real-time traffic data sequences in this invention; Figure 3 This is a schematic diagram illustrating the process of performing thought chain reasoning analysis on a set of suspicious traffic segments in this invention. Detailed Implementation

[0017] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “corresponding to,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] Example 1 The implementation method in this embodiment can be implemented in a system, on a server, or on a terminal; no specific limitation is made. The method in this application will be described below from the perspective of system implementation. Please refer to... Figure 1 The method provided in this application includes the following steps: S1. Obtain the real-time traffic data sequence in the target network environment; Advanced persistent threat (APS) attacks refer to attacks where attackers use long-term, organized, multi-stage, and covert methods to continuously penetrate networks and steal data from specific targets. The target network environment includes, but is not limited to, enterprise intranets, cloud platforms, industrial control systems, and other computing environments containing network devices and hosts. Real-time traffic data sequences refer to continuous network communication data collected through network probes or traffic mirroring, arranged in chronological order. Specifically, this includes metadata information such as packet arrival timestamps, source / destination IP addresses, source / destination ports, transport layer protocol types, packet sizes, and load characteristics. These traffic data sequences completely record communication behavior within the network, providing fundamental data support for subsequent analysis.

[0019] S2. Perform preliminary anomaly detection processing on the real-time traffic data sequence to obtain a set of suspicious traffic segments; This step primarily uses lightweight real-time analysis methods to quickly filter out potentially threatening suspicious traffic segments from massive amounts of network traffic, providing high-quality data input for subsequent in-depth analysis. The initial anomaly detection processing employs a dynamic baseline detection method based on behavioral characteristics, which can effectively identify abnormal traffic deviating from normal communication patterns while ensuring detection efficiency. Please refer to [link / reference]. Figure 2 This includes the following sub-steps: 201. Extract communication frequency features, protocol distribution features, and data packet size distribution features from real-time traffic data sequences, and normalize and concatenate the communication frequency features, protocol distribution features, and data packet size distribution features to generate a traffic behavior feature vector; Communication frequency characteristics are obtained by statistically analyzing the number of connections between specific IP address pairs within a unit of time, reflecting the activity level of network communication; protocol distribution characteristics are obtained by calculating the proportion of various transport layer protocols within a time window, reflecting the diversity of communication protocols; packet size distribution characteristics are obtained by analyzing the mean, variance, and distribution histogram of packet lengths, characterizing the pattern characteristics of data transmission. After normalizing the above three types of characteristics, they are concatenated according to the feature dimensions to form a unified traffic behavior feature vector. This vector is an n-dimensional numerical vector, where n is the total number of feature dimensions, and each dimension represents a normalized value of a specific behavioral characteristic.

[0020] 202. Based on the sliding window statistical method, calculate the anomaly score of the traffic behavior feature vector to obtain an anomaly score sequence containing timestamps and anomaly scores; The continuous traffic behavior feature vector is segmented using a sliding window mechanism, which includes the following sub-steps: 1. Set a dynamically adjustable sliding window size. When the network traffic load rate is higher than the preset load rate threshold, decrease the window duration; when the network traffic load rate is lower than or equal to the preset load rate threshold, increase the window duration. 2. For the traffic behavior feature vector within each window, an online learning algorithm is used to update the normal behavior baseline model, and the baseline parameters are adjusted by calculating the weighted average of the current window feature vector and the historical window feature vector; 3. Calculate the Mahalanobis distance between the current traffic behavior feature vector and the normal behavior baseline model, convert the Mahalanobis distance into a standardized anomaly score within a preset numerical range, and associate and store the standardized anomaly score with the corresponding timestamp.

[0021] Specifically, a preset load rate threshold of 70% is used. When the real-time monitored network traffic load rate exceeds this threshold, the window duration is set to 5 minutes; when the load rate is below or equal to this threshold, the window duration is set to 15 minutes. Baseline parameters are dynamically adjusted by calculating the weighted average of the current window feature vector and the historical window feature vectors, with higher weights for recent data and decreasing weights for historical data over time, thus achieving adaptive learning in response to changes in network behavior. Mahalanobis distance effectively measures the statistical deviation of the multidimensional feature space. The Mahalanobis distance is converted into a standardized anomaly score within the range of 0-100 using the sigmoid function, with higher scores indicating more severe anomalies. Finally, each anomaly score is associated with and stored with its corresponding traffic timestamp, forming a chronologically ordered sequence of anomaly scores.

[0022] 203. Set a first threshold and a second threshold, wherein the first threshold is greater than the second threshold; mark traffic segments with abnormal scores exceeding the first threshold as first suspicious level segments, mark traffic segments with abnormal scores between the second threshold and the first threshold as second suspicious level segments, and merge the first suspicious level segments and the second suspicious level segments to form a suspicious traffic segment set.

[0023] Specifically, a first threshold of 80 is set to identify highly abnormal traffic, and a second threshold of 60 is set to identify moderately abnormal traffic. These two thresholds are determined based on the statistical distribution characteristics of historical network traffic data and optimized using a grid search method. For anomaly score sequences, traffic time periods continuously exceeding the first threshold are marked as first-level suspicious segments, and traffic time periods continuously falling between the second and first thresholds are marked as second-level suspicious segments. Finally, the two types of suspicious segments are merged in chronological order to form a set of suspicious traffic segments containing the segment's start time, end time, maximum anomaly score, and suspicious level.

[0024] S3. Perform mind chain reasoning analysis on the suspicious traffic fragment set to generate an attack behavior reasoning path containing multi-stage reasoning steps; This step involves further in-depth analysis of the suspicious traffic segments identified in the initial detection phase. It utilizes a thought chain reasoning mechanism to simulate the reasoning process of cybersecurity experts, constructing a complete attack behavior evolution path. Thought chain reasoning analysis breaks down the complex attack detection task into multiple logically related reasoning steps, forming a causal reasoning chain. The attack behavior reasoning path is a complete description of the attack scenario, composed of multiple reasoning steps organized chronologically and logically. Each reasoning step includes specific attack behavior characteristics, reasoning basis, and stage conclusions. Please refer to [link / reference]. Figure 3 This includes the following sub-steps: 301. Perform multi-dimensional feature extraction on each suspicious traffic segment in the suspicious traffic segment set to obtain the traffic feature set of each suspicious traffic segment, and standardize and concatenate all traffic feature sets to generate inference input data in a unified format; The traffic feature set is a collection of deep behavioral features extracted from each suspicious traffic segment, including three dimensions: temporal features, statistical features, and semantic features. Temporal features are obtained by analyzing the periodicity, burstiness, and trend of traffic segments; statistical features include statistics such as the mean, variance, skewness, and kurtosis of traffic segments; semantic features are obtained by feature encoding of data packet payloads, reflecting the semantic information of the communication content. After standardizing all feature sets, they are aligned and weighted according to feature type and importance to form a unified and consistent inference input data matrix. The rows of this matrix correspond to different suspicious traffic segments, and the columns correspond to different feature dimensions.

[0025] 302. Based on a predefined attack pattern library, the inference input data is decomposed into attack intent to obtain a finite number of attack stage hypotheses, where each attack stage hypothesis corresponds to a possible attack stage; The predefined attack pattern library is a knowledge base built based on historical APT attack cases, containing complete descriptions of various known attack patterns, such as phishing attacks, lateral movement, and data leaks—typical APT attack phases. Attack intent decomposition is the process of inferring possible attack targets and methods by matching currently observed network behavior with attack patterns in the knowledge base. The specific implementation includes the following sub-steps: 1. Retrieve known attack patterns from a predefined attack pattern library that match the features of the inference input data. Known attack patterns include attack phase sequences and inter-phase transition conditions. 2. Calculate the matching degree between the inference input data and each known attack pattern, sort them from high to low according to the matching degree, and select known attack patterns with a matching degree higher than the preset matching threshold as candidate attack patterns; 3. Generate a finite number of attack phase hypotheses based on the attack phase sequence and inter-phase transition conditions for each candidate attack mode.

[0026] The limited number of attack phases is determined based on the number of candidate attack modes and does not exceed the preset upper limit of the number of attack phase assumptions.

[0027] Specifically, the attack phase sequence describes the complete process of an attack from initial intrusion to the achievement of its final goal, such as reconnaissance → weaponization → deployment → exploitation → installation → command and control → action. The inter-phase transition conditions define the network behavioral characteristics that an attack must satisfy to transition from one phase to the next. A cosine similarity algorithm combined with feature weights is used to calculate the matching degree between the inference input data and each known attack pattern, with a matching degree threshold set to 0.7. Based on the matching degree ranking from high to low, the top 5 known attack patterns with matching degrees higher than the threshold are selected as candidate attack patterns to ensure the quality and diversity of the candidate set. Attack phase hypotheses are speculative descriptions of the possible attack phases to which the current network behavior may belong, including phase type, confidence level, and supporting evidence. The maximum number of attack phase hypotheses is set to 10 to avoid hypothesis space explosion while ensuring comprehensive coverage.

[0028] 303. Perform an inference chain generation operation for each attack stage hypothesis, generating a sequence of inference steps for each attack stage hypothesis based on evidence support and causal relationships; The reasoning chain generation operation is the process of verifying the plausibility of hypotheses during the attack phase by constructing a logical reasoning chain from initial evidence to final conclusion. The specific implementation includes the following sub-steps: 1. For each attack stage hypothesis, extract evidence features related to the current attack stage hypothesis from the inference input data, and calculate the correlation strength between each evidence feature and the current attack stage hypothesis; 2. Determine the causal reasoning steps based on the strength of association, where each causal reasoning step includes evidence features, reasoning logic, and output conclusion; 3. Check whether each causal reasoning step is consistent with known attack patterns, and eliminate inconsistent reasoning steps; 4. Arrange the causal reasoning steps that have passed the inspection in chronological order to generate a sequence of reasoning steps.

[0029] For each attack phase hypothesis, evidence features related to the current attack phase hypothesis are extracted from the inference input data. A mutual information algorithm is used to calculate the correlation strength between each evidence feature and the attack phase hypothesis. This correlation strength quantifies the degree to which the evidence feature supports the hypothesis; the strength value ranges from 0 to 1, with a higher value indicating a stronger correlation between the evidence and the hypothesis. The evidence features support the specific network behavior characteristics of this step, the inference logic follows the derivation rules from evidence to conclusion, and the output conclusion is the inference result of this step. Evidence features with a correlation strength higher than 0.6 are used to construct strong inference steps, ensuring the reliability of the inference. Each causal inference step is checked for consistency with known attack patterns. Rule matching and logical verification ensure that the inference steps conform to known attack behavior patterns. Inference steps that clearly contradict known attack patterns, such as temporal logic errors or inconsistent behavioral features, are eliminated to ensure the logical consistency of the inference chain. The checked causal inference steps are arranged chronologically to generate an inference step sequence. This sequence fully reflects the entire inference process from the initial anomaly to the final attack determination, with each step including a timestamp, inference content, and confidence assessment.

[0030] 304. Logically connect and integrate the reasoning steps of each attack stage hypothesis to generate a complete attack behavior reasoning path.

[0031] Logical correlation integration is the process of merging disparate inference steps into a unified attack scenario by analyzing the temporal, spatial, and logical dependencies between hypotheses at different attack stages. First, it establishes temporal alignment relationships between each inference step sequence to ensure the temporal continuity of the attack behavior. Second, it analyzes the causal dependencies between steps to construct a logical chain for attack stage transitions. Finally, through evidence fusion and conflict resolution, it eliminates inconsistencies in the reasoning between different hypotheses, forming a logically consistent and well-supported complete inference path for the attack behavior.

[0032] S4. Match and verify the attack behavior reasoning path with the pre-built threat intelligence knowledge base to determine the attack stage and attack intent of persistent threat attacks; The purpose of this step is to improve the accuracy and reliability of attack identification by cross-validating attack behavior reasoning paths generated through local analysis with authoritative external threat intelligence. This pre-built threat intelligence knowledge base integrates standardized data from multiple authoritative threat intelligence sources, including structured information such as behavioral characteristics of common attack organizations, attack tool fingerprints, and typical attack chain patterns.

[0033] 1. Extract attack stage features from the attack behavior reasoning path and match them with known attack stage patterns in the threat intelligence knowledge base; 2. Calculate the matching degree between the attack phase characteristics and each known attack phase pattern, and determine the attack phase corresponding to the known attack phase pattern with the highest matching degree as the current attack phase.

[0034] Attack phase features include time-series features of attack behavior, behavior sequence features, and resource access pattern features. These features are converted into a format compatible with the threat intelligence knowledge base using a feature encoder. A similarity-based matching algorithm is then used to search the knowledge base for known attack patterns with similar phase features. The matching score is a multi-dimensional weighted similarity, comprehensively considering temporal feature similarity, behavioral feature similarity, and contextual feature similarity. A matching score threshold of 0.75 is set, and the attack phase corresponding to the known attack phase pattern with the highest matching score is determined as the current attack phase. When the matching scores of multiple attack phase patterns are all above the threshold and the difference is less than 0.1, these phases are all considered candidate phases, and their respective matching score scores are recorded.

[0035] 1. Extract attack target features and attack method features from the attack behavior reasoning path, and match them with known attack intent behavior patterns in the threat intelligence knowledge base; 2. Based on the matching degree between the characteristics of the attack target and the characteristics of the attack method and each known attack intent behavior pattern, the confidence of the attack intent is determined by weighted calculation, and the attack intent with the highest confidence is determined as the current attack intent.

[0036] Attack target characteristics are obtained by analyzing the importance, data types, and user privileges of the accessed system; attack method characteristics include the types of vulnerabilities used, persistence methods, and covert techniques. These characteristics are compared with typical behavioral characteristics of known attack intentions in the knowledge base. Based on the matching degree between the attack target characteristics and attack method characteristics and the behavioral patterns of each known attack intention, the attack intention confidence is determined through weighted calculation. The target characteristic weight is set to 0.6, and the method characteristic weight is set to 0.4, reflecting the higher importance of the attack target in intent judgment. The confidence calculation adopts a normalized weighted summation method, and the attack intention with the highest confidence is determined as the current attack intention. When the highest confidence is below 0.7, it is marked as an unclear intent that requires further analysis.

[0037] S5. Generate multi-dimensional attack feature identification results based on the matching verification results.

[0038] Based on the analysis and verification results of the preceding steps, a structured multi-faceted attack signature identification report is generated. This report integrates all the analytical results from primary anomaly detection, thought chain reasoning, and threat intelligence verification, forming a comprehensive description of APT attacks.

[0039] The identification results are output in a standardized JSON format, including attack feature fingerprint (feature hash that uniquely identifies this attack), attack phase sequence (a complete list of attack phases sorted by time), attack intent analysis (main attack intent and hypotheses of alternative intents), confidence score (confidence assessment of each analysis step), time range (start and end time of the attack activity), scope of impact (list of affected systems and services), and response recommendations (priority recommendations for handling based on attack features).

[0040] The identification results can be directly input into security operation and maintenance platforms, situational awareness systems, or emergency response systems, providing complete and reliable technical basis for subsequent security decisions and response actions. Through standardized output formats, this invention ensures seamless integration with existing security toolchains, enhancing the effectiveness of the overall security protection system.

[0041] Example 2 An embodiment of the multi-attack signature identification system based on persistent threat attacks of the present invention includes: The real-time traffic data sequence acquisition unit is used to acquire real-time traffic data sequences in the target network environment. The suspicious traffic segment set determination unit is used to perform primary anomaly detection processing on real-time traffic data sequences to obtain a suspicious traffic segment set. The attack behavior reasoning path generation unit is used to perform mind chain reasoning analysis on a set of suspicious traffic segments and generate an attack behavior reasoning path containing multi-stage reasoning steps. The attack phase and attack intent determination unit is used to match and verify the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack phase and attack intent of persistent threat attacks. The multi-attack feature recognition result generation unit is used to generate multi-attack feature recognition results based on the matching verification results.

[0042] For specific limitations regarding the system, please refer to the method limitations described above, which will not be repeated here. Each module in the above system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0043] It is understood that those skilled in the art can combine various implementation methods in the above embodiments under the guidance of the above examples to obtain technical solutions with multiple implementation methods.

[0044] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for identifying multi-faceted attack features based on persistent threat attacks, characterized in that, include: Obtain real-time traffic data sequences in the target network environment; The real-time traffic data sequence is subjected to primary anomaly detection processing to obtain a set of suspicious traffic segments; The suspicious traffic fragment set is subjected to thought chain reasoning analysis to generate an attack behavior reasoning path containing multi-stage reasoning steps; The attack behavior reasoning path is matched and verified with a pre-built threat intelligence knowledge base to determine the attack stage and attack intent of persistent threat attacks. The multi-faceted attack feature identification results are generated based on the matching verification results.

2. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 1, characterized in that, The initial anomaly detection processing of the real-time traffic data sequence yields a set of suspicious traffic segments, including: Communication frequency features, protocol distribution features, and data packet size distribution features are extracted from the real-time traffic data sequence, and the communication frequency features, protocol distribution features, and data packet size distribution features are normalized and concatenated to generate a traffic behavior feature vector; The anomaly score of the traffic behavior feature vector is calculated based on the sliding window statistical method, resulting in an anomaly score sequence containing timestamps and anomaly scores; Set a first threshold and a second threshold, where the first threshold is greater than the second threshold; mark traffic segments with anomaly scores exceeding the first threshold as first suspicious level segments, mark traffic segments with anomaly scores between the second threshold and the first threshold as second suspicious level segments, and merge the first suspicious level segments and the second suspicious level segments to form a suspicious traffic segment set.

3. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 2, characterized in that, The anomaly score calculated based on the sliding window statistical method for the traffic behavior feature vector yields an anomaly score sequence containing timestamps and anomaly scores, including: Set a dynamically adjustable sliding window size. When the network traffic load rate is higher than a preset load rate threshold, decrease the window duration. When the network traffic load rate is lower than or equal to the preset load rate threshold, increase the window duration. For the traffic behavior feature vector within each window, an online learning algorithm is used to update the normal behavior baseline model, and the baseline parameters are adjusted by calculating the weighted average of the current window feature vector and the historical window feature vector. Calculate the Mahalanobis distance between the current traffic behavior feature vector and the normal behavior baseline model, convert the Mahalanobis distance into a standardized anomaly score within a preset numerical range, and associate and store the standardized anomaly score with the corresponding timestamp.

4. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 1, characterized in that, The step of performing thought chain reasoning analysis on the suspicious traffic fragment set to generate an attack behavior reasoning path containing multi-stage reasoning steps includes: Multi-dimensional feature extraction is performed on each suspicious traffic segment in the suspicious traffic segment set to obtain the traffic feature set of each suspicious traffic segment. All traffic feature sets are then standardized and concatenated to generate inference input data in a unified format. The inference input data is decomposed into attack intent based on a predefined attack pattern library to obtain a finite number of attack phase hypotheses, where each attack phase hypothesis corresponds to a possible attack phase. For each attack stage hypothesis, an inference chain generation operation is performed to generate a sequence of inference steps for each attack stage hypothesis based on evidence support and causal relationships; By logically linking and integrating the reasoning steps of each attack stage hypothesis, a complete attack behavior reasoning path is generated.

5. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 4, characterized in that, The predefined attack pattern library is used to decompose the inference input data into attack intent, resulting in a finite number of attack phase hypotheses, including: Retrieve known attack patterns from a predefined attack pattern library that match the features of the inference input data. The known attack patterns include attack phase sequences and inter-phase transition conditions. Calculate the matching degree between the inference input data and each known attack mode, sort them from high to low according to the matching degree, and select known attack modes with a matching degree higher than a preset matching threshold as candidate attack modes; Based on the attack phase sequence and inter-phase transition conditions for each candidate attack mode, a finite number of attack phase hypotheses are generated.

6. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 5, characterized in that, The limited number of attack phases is determined based on the number of candidate attack modes and does not exceed a preset upper limit for the number of attack phase assumptions.

7. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 4, characterized in that, The inference chain generation operation performed on each attack stage hypothesis generates a sequence of inference steps for each attack stage hypothesis based on evidence support and causal relationships, including: For each attack phase hypothesis, evidence features related to the current attack phase hypothesis are extracted from the inference input data, and the correlation strength between each evidence feature and the current attack phase hypothesis is calculated. The causal reasoning steps are determined based on the strength of the association, where each causal reasoning step includes evidence features, reasoning logic, and output conclusion. Check each causal reasoning step for consistency with known attack patterns and eliminate inconsistent reasoning steps; The causal reasoning steps that have passed the inspection are arranged in chronological order to generate a sequence of reasoning steps.

8. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 1, characterized in that, The step of matching and verifying the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack stage and attack intent of the persistent threat attack includes: Attack stage features are extracted from the attack behavior reasoning path and matched with known attack stage patterns in the threat intelligence knowledge base; Calculate the matching degree between the attack phase features and each known attack phase pattern, and determine the attack phase corresponding to the known attack phase pattern with the highest matching degree as the current attack phase.

9. The method for identifying multi-faceted attack features based on persistent threat attacks according to claim 1, characterized in that, The step of matching and verifying the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack stage and attack intent of the persistent threat attack also includes: The attack target features and attack method features are extracted from the attack behavior reasoning path and matched with the known attack intent behavior patterns in the threat intelligence knowledge base; Based on the matching degree between the attack target characteristics and attack method characteristics and each known attack intent behavior pattern, the attack intent confidence is determined by weighted calculation, and the attack intent with the highest confidence is determined as the current attack intent.

10. A multi-faceted attack signature identification system based on persistent threat attacks, characterized in that, The method according to any one of claims 1 to 9 comprises: The real-time traffic data sequence acquisition unit is used to acquire real-time traffic data sequences in the target network environment. The suspicious traffic segment set determination unit is used to perform primary anomaly detection processing on the real-time traffic data sequence to obtain a suspicious traffic segment set. The attack behavior reasoning path generation unit is used to perform thought chain reasoning analysis on the suspicious traffic segment set and generate an attack behavior reasoning path containing multi-stage reasoning steps. The attack phase and attack intent determination unit is used to match and verify the attack behavior reasoning path with a pre-built threat intelligence knowledge base to determine the attack phase and attack intent of the persistent threat attack. The multi-attack feature recognition result generation unit is used to generate multi-attack feature recognition results based on the matching verification results.

Images