A multi-scale heterogeneous log behavior analysis intranet penetration traceability method

Abstract

The application discloses a kind of intranet penetration tracing methods of multi-scale heterogeneous log behavior analysis, it is related to network security technical field, the method includes: the original log stream of heterogeneous log source is standardized, and uniform semantic event stream is generated;Unified semantic event stream is divided into multiple scale time windows, the event density characteristic index of each window is calculated, and short-time dense subsequence is identified based on event density characteristic index;The short-time dense subsequence identified is clustered based on semantic weighted entropy analysis, and attack dense section and normal high load section are distinguished;Based on the semantic correlation of event, long-time sparse clues are extracted from uniform semantic event stream;With long-time sparse clues as time anchor point, adjacent attack dense section in its extension time range is positioned, and intermediate interpolation event sequence is generated by conditional time sequence model, to reconstruct complete attack chain.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to an intranet penetration and tracing method based on multi-scale heterogeneous log behavior analysis. Background Technology

[0002] As enterprises deepen their digital transformation, network architectures are becoming increasingly complex. The widespread adoption of hybrid cloud, IoT devices, and remote access has significantly expanded the attack surface of internal network environments. Internal network penetration, as a key stage of advanced persistent threats (APPTs), often spans multiple phases from initial intrusion and lateral movement to data leakage. Therefore, accurate attribution of internal network penetration activities has become a crucial measure to ensure the security of core enterprise assets.

[0003] Currently, internal network penetration testing and tracing primarily relies on the analysis of various log data. However, in practical applications, existing analysis methods still face significant challenges. On the one hand, penetration behavior exhibits characteristics across multiple time scales. Internal network penetration activities occur at the second level (such as password guessing and port scanning), minute / hour level (lateral movement and credential abuse), and day / week level (slow persistence and covert data transmission). The granularity, retention period, and loss rate of log records vary, and existing methods struggle to reconcile these behavioral patterns with their vastly different frequency domain characteristics.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a method for intranet penetration and tracing based on multi-scale heterogeneous log behavior analysis to solve the aforementioned technical problems.

[0006] This application provides a method for intranet penetration and tracing based on multi-scale heterogeneous log behavior analysis, comprising: standardizing raw log streams from at least three heterogeneous log sources, including host system logs, application audit logs, directory service event logs, terminal detection logs, and cloud audit logs, to generate a unified semantic event stream; dividing the unified semantic event stream into multi-scale time windows, calculating the event density feature index for each window, and identifying short-term dense subsequences based on the event density feature index; performing cluster analysis on the identified short-term dense subsequences based on semantic weighted entropy to distinguish between attack-intensive dense segments and normal high-load segments; extracting long-term sparse clues from the unified semantic event stream based on the semantic correlation of events; using the long-term sparse clues as time anchors, locating attack-intensive dense segments adjacent to the time anchors within their extended time range, and generating intermediate interpolated event sequences through a conditional time series model to reconstruct a complete attack chain.

[0007] Based on the embodiments provided in this application, by constructing a unified semantic event stream and comprehensively analyzing the event density characteristics under multi-scale time windows, a unified capture and characterization of attack behaviors at different time scales, such as second-level, minute-level, and even day-level, is effectively achieved. This solves the problem of blind spots in attack chain observation caused by log heterogeneity and differences in behavioral time scales in traditional methods. By combining semantically weighted entropy clustering analysis with long-term clue extraction based on semantic correlation, attack fragments can be accurately screened from dense event streams, and semantically related low-frequency threat clues can be identified from sparse events. This significantly improves the sensitivity to detecting low-rate, long-cycle penetration activities in complex log environments and reduces the risk of key threat clues being overwhelmed. By using long-term sparse clues as time anchors to locate adjacent dense attack segments and using conditional temporal models for interpolation reconstruction, discretely detected attack fragments can be automatically spliced ​​into complete attack chains based on their semantic and temporal correlations. This effectively supports the overall review and source tracing analysis of cross-stage and cross-time period intranet penetration activities. Attached Figure Description

[0008] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0009] Figure 1 This is a flowchart of an optional multi-scale heterogeneous log behavior analysis method for internal network penetration and tracing according to an embodiment of this application;

[0010] Figure 2 This is a flowchart of another optional multi-scale heterogeneous log behavior analysis method for internal network penetration and tracing according to an embodiment of this application;

[0011] Figure 3 This is a schematic diagram of the structure of an optional electronic device according to an embodiment of this application.

[0012] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0014] According to one aspect of the embodiments of this application, such as Figure 1As shown, this application provides a method for internal network penetration and tracing based on multi-scale heterogeneous log behavior analysis, including:

[0015] S101, standardize the raw log streams from at least three heterogeneous log sources, including host system logs, application audit logs, directory service event logs, terminal detection logs, and cloud audit logs, to generate a unified semantic event stream;

[0016] S102, Divide the unified semantic event stream into multi-scale time windows, calculate the event density feature index of each window, and identify short-time dense subsequences based on the event density feature index;

[0017] It should be noted that different scale windows correspond to different types of attack behaviors. The multi-scale time window adopts a dual-track strategy combining predefined scales and adaptive scales. The adaptive window dynamically adjusts its length based on event density characteristics, with the window length adjustment range from 1 second to 24 hours.

[0018] S103, cluster analysis is performed on the identified short-time dense subsequences based on semantic weighted entropy to distinguish between aggressive dense segments and normal high-load segments;

[0019] S104, Based on the semantic relevance of events, extract long-term sparse cues from the unified semantic event stream;

[0020] S105 uses long-term sparse clues as time anchors, locates the offensive dense segments adjacent to the time anchors within their extended time range, and generates intermediate interpolated event sequences through conditional time series models to reconstruct the complete attack chain.

[0021] It should be explained that the Conditional Time Series Model is a neural network-based sequence generation model designed to reconstruct internal network penetration attack chains. Its core task is to probabilistically generate the most likely sequence of unlogged intermediate events that connect the known "attack origin" (sparse long-term clue anchor points) and "attack outbreak point" (attack-dense segment).

[0022] In practical implementation, conditional time series models can employ a conditional variational autoencoder (CVAE) based on a Transformer decoder architecture. This is because the Transformer's powerful attention mechanism effectively captures the complex dependencies between events in long sequences, making it ideal for modeling the logical order of attack steps (e.g., stealing credentials before lateral movement). Furthermore, since attack paths are often not unique and multiple possibilities exist, CVAEs, by introducing a latent variable z, can learn the data distribution and generate diverse and reasonable interpolation sequences, rather than a single output.

[0023] The specific components of the model input and output include:

[0024] Conditioning: This is the context upon which the model generation depends. Dense Segment Context Representation: This involves inputting the event embedding vectors of all located aggressive dense subsequences into a Transformer encoder, and taking the hidden state of the last layer as a generalized representation of the entire dense segment. It represents the attacker's "burst activity pattern" at a given moment. Sparse Anchor Representation: This represents a long-term, low-frequency "attack target or phase." The condition vector c is formed by concatenating the dense segment context representation and the sparse anchor representation.

[0025] Target: The sequence the model needs to generate. During training, the target is a sequence of real events Y=(y1,y2,...,ym) located between two anchor points in the real historical attack chain, where each y_i is a discrete label for the event action, subject, and object. During inference (generation), the target is unknown and needs to be generated autoregressively by the model.

[0026] For example, during the training phase, data preparation involves extracting a large number of triples (sparse anchor A, intermediate sequence Y, dense segment D) from historical, analyzed, and confirmed attack case logs as training samples.

[0027] Encoding conditions: For each sample, calculate its condition vector c.

[0028] Learning the distribution: The CVAE encoder maps the target sequence Y to a distribution of a latent variable z (usually a Gaussian distribution). The decoder then learns to reconstruct the target sequence Y from inputs of condition c and z sampled from that distribution. Through training, the model learns the distribution of all possible paths given the start and end points (c).

[0029] During the inference / generation phase, the input is a new pair of anchors (S_i, D_j) to be analyzed. The system computes their conditional vectors. Here, S_i (Source Anchor) represents a long-term sparse thread (time anchor) identified in an earlier stage of the attack chain. For example, this might be an anchor clustered from a series of failed login attempts (Logon_Failure) discovered on day 1, representing the initial intrusion attempt phase of the attack. D_j (Destination Anchor) represents another long-term sparse thread (time anchor) identified in a later stage of the same attack chain. For example, this might be an anchor clustered from low-frequency but continuous data transfers (Data_Transfer) to an external IP discovered on day 5, representing the data outflow target phase of the attack.

[0030] Sampling generation: A z-sample is taken from the latent variable distribution and input into the trained decoder. The decoder then... <start>Starting with an identifier, at each step, based on the currently generated sequence, conditions, and latent variable z, predict the next most likely event (action, subject, object).

[0031] Sequence formation: This process continues until sequence is generated. <end>The identifier or the maximum generation length is reached, thus obtaining a complete interpolation event sequence Y_generated.

[0032] Reconstructing the attack chain: Finally, S_i->Y_generated->D_j are concatenated to form a complete, speculative attack chain, which is then provided to security analysts for analysis.

[0033] In other words, the conditional time series model is a model based on deep sequence generation technology. It utilizes a large amount of historical attack data to learn the attacker's behavior patterns, thereby intelligently "filling in" gaps left by missing or infrequent logs.

[0034] Furthermore, such as Figure 2 As shown, the standardization process includes:

[0035] S201, use at least two of the following to parse the fields of each log type: regular expression parser, JSON parser, and Protobuf parser;

[0036] S202, based on a predefined lightweight ontology, maps the parsed fields to ontology concepts; wherein, the predefined lightweight ontology includes a set of action verbs, a set of entity categories, and an attribute hierarchy structure;

[0037] In some embodiments, the mapping from fields to ontology concepts employs collaborative logic, including processing matched fields through a rule table while combining hybrid embedding to handle ambiguous or polysemous fields.

[0038] S203 outputs a unified semantic event stream, where each record includes a standard timestamp, original evidence file information, original evidence file offset information, original record ID information, and the mapping result from fields to ontology concepts.

[0039] Based on the embodiments provided in this application, by employing a combination of regular expressions, JSON, and Protobuf parsers, the solution ensures coverage of various mainstream log formats, from structured to unstructured, solving the problem of highly heterogeneous log sources in intranet environments that cannot be directly processed. The rule table provides an efficient and accurate mapping path for clearly structured log fields, while the hybrid embedding model effectively handles the differences in expression and ambiguity in non-standard log text through semantic similarity calculation. This design enables the system to maintain processing efficiency while possessing good generalization capabilities, providing a high-quality, semantically unified standardized event stream for subsequent steps—a prerequisite for accurate behavioral analysis.

[0040] Furthermore, the multi-scale time window includes at least four scales among 1 second, 10 seconds, 1 minute, 10 minutes, 1 hour, and 1 day;

[0041] The correspondence between multi-scale time windows and attack behaviors is as follows:

[0042] 1-second and 10-second time windows correspond to password guessing, port scanning, and vulnerability scanning attack behaviors;

[0043] The 1-minute and 10-minute timeframes correspond to lateral movement, credential abuse, and burst connection attack behaviors.

[0044] The 1-hour and 1-day windows correspond to slow persistence and covert data outreach attacks.

[0045] Based on the embodiments provided in this application, the temporal characteristics of attack behaviors at different stages differ significantly: second-level windows accurately match the instantaneous nature of brute-force behaviors such as password guessing and scanning; minute / hour-level windows match the duration of tactical actions such as lateral movement and credential abuse; while day-level windows target slow persistence and data leakage common in advanced threats. This pre-defined correspondence makes the analysis process no longer a blind multi-scale statistical process, but a targeted detection with a clear purpose and closely related to the threat model, greatly improving the targeting and efficiency of the detection.

[0046] Furthermore, event density characteristic indicators include:

[0047] The number of events, expressed by the formula Calculate; where, Indicates the first A window in scale The number of events on Indicates the window time boundary, Indicates the first A window in scale The start time on Representing scale The corresponding window length, This indicates a counting operation. For a single event, For a set of events, For the event timestamp;

[0048] Action type distribution, through formula ;in, Indicates action The count in the window, Represents the probability distribution of actions. For the first A window in scale A subset of events on For the event Action semantic tags;

[0049] Behavioral entropy, expressed by the formula Calculate; where, It represents the window action distribution entropy, which measures the degree of disorder in network behavior within a window; A set of actions; This represents a multiplication operation. Low entropy implies concentrated behavior (potentially automated attacks); high entropy indicates diverse normal behavior or complex multitasking activities.

[0050] Main body switching frequency Through formula Calculate; where, This indicates the number of times the main identifier within the window has changed. This indicates the number of events for that window. This metric is used to quantify the intensity of lateral movement or scanning activity.

[0051] Based on the embodiments provided in this application, the essential characteristics of behavior within a window are characterized from different dimensions, providing a comprehensive and multi-dimensional basis for density determination. "Number of events" reflects the absolute volume; "Action type distribution" and the "behavioral entropy" calculated from it reveal the disorder and concentration of behavior (low entropy suggests automated attacks, while high entropy may indicate normal user behavior or complex attacks); "Subject switching frequency" directly quantifies the intensity of lateral movement. These indicators together constitute a multi-dimensional feature space, enabling subsequent algorithms to comprehensively judge whether a window is abnormal from multiple perspectives such as "activity intensity," "behavioral pattern," and "mobility," avoiding misjudgments easily caused by a single indicator.

[0052] Furthermore, the process for identifying short-term dense subsequences based on event density feature indicators includes:

[0053] Normalize each element in the window feature vector;

[0054] Calculate the normalized density score Through formula

[0055] calculate;

[0056] in, Indicates the event rate. Represents behavioral entropy. Indicates the main body switching frequency. This represents the normalized result of the event rate. This represents the result of normalization of behavioral entropy. This represents the normalized result of the switching frequency. , , These represent the mean values ​​of event rate, behavior entropy, and switching frequency in the window feature vector sequence, respectively. , , These represent the variances of the event rate, behavior entropy, and switching frequency in the window feature vector sequence, respectively. , , This represents the preset feature weights, for example, in this embodiment. The value is 0.5. The value is 0.3. The value is 0.2; Represents the sigmoid function; This indicates a multiplication operation.

[0057] The conditions for a window to be marked as a dense candidate include: the normalized density score of the window exceeds the score threshold; and at the scale where the window is located, within three consecutive adjacent time steps, at least two windows have normalized density scores higher than the score threshold.

[0058] For example, the score threshold can be, but is not limited to, 0.7, 0.6, etc.

[0059] Based on the embodiments provided in this application, multiple feature indicators are normalized and weighted by Z-score to generate a unified density score that can be compared across scales. Its advantages are: first, the normalization process eliminates numerical bias caused by differences in window length at different scales, making the density scores of a one-second window and an hourly window comparable; second, the weighted summation allows adjustment of the contribution of each feature according to the actual threat model (e.g., focusing more on behavioral entropy or switching frequency); third, the established continuity judgment condition (high density in multiple consecutive windows) effectively filters out transient, isolated log noise or false alarms, ensuring that the marked dense segments represent continuous suspicious activity and improving the credibility of alarms.

[0060] Furthermore, the cluster analysis employs the HDBSCAN algorithm, using semantically weighted entropy. Normalized density score and main body switching frequency Construct the window feature vector, which is represented as follows:

[0061] ;

[0062] In one example, ;

[0063] Where A is the action set, P(a) is the probability of action a appearing in the window, and w(a) is the semantic weight of action a. Based on the risk level setting of actions in the predefined ontology, the weight of the login failure action is greater than the weight of the file read action (e.g., Logon_Failure weight is 2.0, File_Read weight is 1.0, and Heartbeat weight is 0.5).

[0064] Based on the semantic relevance of events, long-term sparse cues are extracted from a unified semantic event stream, including:

[0065] Semantic signatures are constructed for events with frequencies below a preset frequency threshold. The semantic signatures are generated based on the combination pattern of the event's action semantic tags, subject identifiers, and object identifiers.

[0066] The preset frequency threshold is a critical value used to filter out analytically valuable, abnormally low-frequency patterns from a massive amount of low-frequency events. It is not a globally fixed value; its setting is usually related to the length of the observation window and the specific event type. Excessively high frequency may indicate normal business behavior, while excessively low and irregular frequency may indicate noise. However, a pattern that is "below the threshold" but forms a "recurring" pattern is highly likely to be a carefully planned low-and-slow attack by the attacker.

[0067] In practice, we assume that our observation window is one week (7 days).

[0068] Example 1: Abnormal external heartbeat

[0069] Event type: Network_Connect, and the target IP is a suspicious IP located overseas.

[0070] Normal frequency: Normal business hosts within the company almost never actively connect to this IP. Its normal frequency is 0 times / week.

[0071] For such high-risk events, the preset frequency threshold is set very low, for example, 2 times per week. Any connection exceeding 0 times will be immediately detected.

[0072] If a host (Host_X) is found to have one or two connections to that IP address within a week (i.e., frequency f < 2), this event will be extracted and clustered using DTW similarity with similar events from other weeks. If Host_X is found to have one to two connections per week, a valuable "long-term sparse clue" is formed, indicating the possible existence of a hidden C2 (command and control) channel.

[0073] Example 2: Attempts to abuse cross-period permissions

[0074] Event type: Logon_Failure (login failed), and the target subject is the domain administrator account.

[0075] Normal frequency: It's normal for administrators to occasionally mistype their passwords, perhaps once a day. However, it's highly unusual for ordinary users to attempt to log in to the administrator account.

[0076] For such failed login attempts from non-administrator hosts, the preset frequency threshold can be set to 3 times per week.

[0077] To circumvent account lockout policies, an attacker might attempt brute-force attacks only twice a day. This would result in approximately 14 failed login attempts per week. This frequency of 14 attempts per week is higher than 3 attempts per week, and therefore would not be detected by the "sparse clues" extraction mechanism. Instead, it would be detected by the short-term dense detection mechanism on a 10-minute or 1-hour timescale. Conversely, if the attacker only attempts twice a day, the frequency f = 2 attempts per week, which is below the threshold and would be detected by the "sparse clues" mechanism as evidence of a slow attack.

[0078] In other words, the preset frequency threshold is a configurable, dynamic parameter that is tied to the event type and observation period. Its core function is filtering, ensuring that subsequent expensive clustering and association analyses (such as DTW) are only applied to truly low-frequency and suspicious event patterns, thereby greatly reducing the system's computational overhead while ensuring detection effectiveness.

[0079] The semantic signature is embedded into the vector space to obtain a vector representation;

[0080] Similarity clustering of vector representation sequences with a time span exceeding 24 hours is performed based on dynamic time warping distance;

[0081] The recurring clusters are output as long-term sparse clues, and for each long-term sparse clue, its time window range, list of main related subjects or objects, semantic signature summary and average occurrence interval are recorded.

[0082] Based on the embodiments provided in this application, semantic weighted entropy (H_sem) is used for clustering. By pre-setting weights, prior security knowledge (such as "login failure" being more risky than "file read") is introduced into the clustering features, enabling the algorithm to perceive not only the "concentration" of behavior but also its "risk level." This solves the problem that traditional information entropy cannot distinguish between "concentrated high-risk behaviors" and "busy ordinary business," significantly reducing false positives. When extracting long-term clues, DTW distance is used for similarity clustering. Its advantage lies in its ability to effectively handle sequence patterns that undergo scaling and distortion on the timeline. It is particularly suitable for aligning low-frequency attack behaviors (such as scheduled tasks and periodic external connections) that recur in a similar manner at different time points but with irregular intervals, thereby reliably uncovering hidden long-term threat clues.

[0083] Furthermore, the boundaries of the extended time range are represented as follows: ;in, Indicates the start time of the time anchor. Indicates the end time of the time anchor point; , Indicates an extended boundary (e.g., from 6h to 12h) to cover the context before and after the time anchor point;

[0084] In one example, the boundaries of the extended time range are represented as:

[0085] ;

[0086] in, Indicates the start time of the time anchor. Indicates the end time of the time anchor point. The value is in hours; this expression represents a time interval formed by extending forward by 6 hours and backward by 12 hours, based on the time range of the time anchor point.

[0087] The inputs to a conditional time series model include:

[0088] The contextual representation of the aggressive dense segment is obtained by using Transformer Encoder to perform contextual modeling on the event sequence within the aggressive dense segment;

[0089] Weighted average embedding representation of time anchors Calculated using the following formula:

[0090]

[0091] in, This represents a single event within a time anchor point. The set of events representing a time anchor point. Indicates an event The credibility of the data collection Indicates an event The time interval between adjacent events; This represents the harmonic parameter, with a value ranging from 0.1 to 0.5; Indicates an event Embedded vector, Represents an exponential function;

[0092] event Embedded vector Its composition is as follows: ;

[0093] in, Indicates an event Action semantic tags, Indicates an event The main logo, Indicates an event The object identifier, This represents the action semantic embedding function. Indicates the embedded function of the subject. Represents the object embedding function, This indicates a vector concatenation operation.

[0094] Based on the embodiments provided in this application, asymmetric extended time boundaries (e.g., 6 hours before and 12 hours after) are set for time anchors. This is based on the causal characteristics of attack chains: attackers need time for preparatory actions such as lateral movement and privilege escalation (forward extension), while actions such as data theft may take a longer time (backward extension). This design ensures sufficient coverage of the context before and after the anchor. When constructing the event embedding vector, the embeddings of actions, subjects, and objects are concatenated, so that the vector simultaneously contains behavioral semantics and entity relationship information. When calculating the anchor representation, a weighted average is used, with weights combining event credibility and temporal proximity. This emphasizes the evidentiary value of high-credibility logs while also reflecting the intuition that events closer in time are more likely to be associated with the anchor, making the generated anchor representation more accurate and representative.

[0095] Furthermore, the method also includes outputting candidate attack chains, each candidate attack chain including:

[0096] Aggressive dense segment sequences with temporal anchors and interpolation completion;

[0097] Semantic summary, describing the attack phase and attack type;

[0098] Key participating entities, including the hosts, accounts, and IP addresses involved;

[0099] The evidence pointer points to the original evidence file information, the original evidence file offset information, and the original record ID information.

[0100] Based on the embodiments provided in this application, the output is not a dry sequence of event IDs, but an interpretable and actionable analysis result. The "semantic digest" describes the attack phases in natural language, greatly reducing the understanding cost for security analysts and facilitating rapid decision-making. The "key participating entities" list directly identifies the hosts, accounts, and IP addresses that require focused attention and action, enabling precise targeting. The "evidence pointer" provides seamless traceability from the analysis results to the original log evidence, greatly facilitating in-depth investigations and evidence preservation for analysts, meeting the stringent requirements of penetration testing for a complete chain of evidence.

[0101] In one specific implementation, the intranet penetration and tracing method based on multi-scale heterogeneous log behavior analysis includes the following steps:

[0102] Step 1: Heterogeneous Log Standardization and Semantic Anchoring

[0103] Receive raw log streams from host systems (such as Windows EVT, Linux syslog), application auditing systems, directory services (such as Microsoft Active Directory), endpoint detection response (EDR) platforms, and cloud platforms (such as AWS CloudTrail, Azure Monitor).

[0104] First, a combination of parsers is used to parse the fields of each type of log: a regular expression parser is used to extract key fields for text-formatted syslog logs; a JSON parser is used for JSON-formatted audit logs; and a Protobuf parser is used for binary formats such as Protobuf EDR logs.

[0105] Then, based on a predefined lightweight ontology, the parsed raw fields are mapped to a unified ontology concept. This ontology includes:

[0106] The set of action verbs includes Logon_Failure, Process_Create, Network_Connect, File_Write, Registry_Modify, etc., covering the key behaviors at each stage of the attack chain.

[0107] Entity category set: Subject is further subdivided into User, Host, and Process; Object is further subdivided into File, IP_Address, Port, and Registry_Key.

[0108] Attribute hierarchy: For example, the isInternal (boolean value, indicating whether it is an internal network IP) attribute is defined for the IP_Address entity.

[0109] The mapping process employs a collaborative logic of "rule table + hybrid embedding": for well-structured logs (such as Windows events with event_id 4625), the logs are directly mapped to the Logon_Failure action by querying the pre-defined rule table; for unstructured log text summaries, a lightweight sentence embedding model (such as Sentence-BERT) is used to convert them into vectors, and the similarity between the vectors and the embedding vectors of the action descriptions in the ontology is calculated, with the most similar result used to complete the mapping.

[0110] The final output is a unified semantic event stream. Each event record includes: a standardized timestamp (UTC milliseconds), an action semantic tag, a subject identifier, an object identifier, and original evidence information for tracing the source (including the original log file path, file offset, and original record ID).

[0111] Step 2: Multi-scale dense subsequence identification and sparse cue extraction:

[0112] The unified semantic event stream output from step one is divided into multi-scale time windows. This embodiment uses a predefined set of scales [1s, 10s, 1min, 10min, 1h, 1d] to cover the full spectrum of attack behaviors from second-level to day-level outreach.

[0113] Within each sliding window at each scale, an event density feature index is calculated, and density is determined based on the calculated event density feature index. A normalized density score is calculated for each window. Windows with scores above a threshold of 0.7 and satisfying continuity conditions among adjacent windows are labeled as dense candidates.

[0114] Next, semantically weighted entropy is used to cluster dense candidates to distinguish between aggressive dense segments and normal high-load segments. The HDBSCAN clustering algorithm uses feature vectors... As input, it automatically identifies aggressive dense clusters.

[0115] Simultaneously, for low-frequency events that do not fall into any dense segment, long-term sparse cue extraction is performed. A semantic signature is constructed for each event (e.g.:

[0116] (Action:DNS_Query,Subject:Host_A,Object:Suspicious_Domain)) and embedded as vectors. Dynamic Temporal Warping (DTW) distance is used to perform cross-day (>24 hours) similarity clustering on these vector sequences, and the recurring patterns are output as long-term sparse cues (i.e., time anchors), and their time span, main entities and semantic summaries are recorded.

[0117] Step 3: Sparse-Dense Interpolation Semantic Reconstruction

[0118] Using the long-term sparse cues (time anchors) extracted in step two as the core, an extended time window is constructed to cover its context. All identified aggressive dense segments are located within this window.

[0119] Events in dense segments and sparse anchor points are uniformly encoded into embedding vectors. The event sequence in dense segments is encoded into a context representation using a TransformerEncoder. Events in sparse anchors are aggregated using a weighted average, with the weights determined by the event confidence and the time interval.

[0120] Conditional temporal models (a type of neural network based on Transformer-Decoder) take contextual and aggregate representations as conditional inputs and autoregressively generate the most probable sequence of intermediate interpolated events, thereby causally connecting sparse anchors with adjacent dense segments to reconstruct a complete attack chain.

[0121] Finally, candidate attack chains are output. Each attack chain includes a time anchor, a dense sequence of events completed by interpolation, a semantic summary describing the attack phase (e.g., "moved laterally to the financial server via RDP and initiated data outflow"), a list of key participating entities, and evidence pointers traceable back to the original logs.

[0122] In another specific implementation, the intranet penetration and tracing method based on multi-scale heterogeneous log behavior analysis includes the following steps:

[0123] Step 1: Adaptive multi-scale time window adjustment:

[0124] First, preliminary sliding window statistics are performed according to a predefined fixed scale ([1s, 10s, 1min, 10min, 1h, 1d]) to obtain the initial density score for each window.

[0125] Subsequently, adaptive window adjustment is performed: for suspected attack segments where the initial density score is consistently higher than the threshold but the duration is short (e.g., a window with continuous high density on a 10-second scale but not reaching a 1-minute scale), the system activates an adaptive algorithm. This algorithm dynamically attempts different window lengths in the vicinity of the region (e.g., within 30 seconds before and after) using a binary search method and calculates the rate of change of the density score for each attempted window. When the rate of change is lower than a preset sensitivity threshold, it is considered that the optimal window length (e.g., possibly 15 seconds or 45 seconds) has been found to best capture the current attack characteristics of that segment.

[0126] This strategy balances the interpretability and backtracking efficiency of a fixed scale with the sensitivity and accuracy of an adaptive scale. It effectively avoids false negatives (e.g., an attack lasting 45 seconds is diluted in a 1-minute window) or false positives (e.g., a 2-second log storm triggers an alarm on a 1-second scale, but is normal on a 10-second scale) caused by a mismatch between the fixed scale and the actual attack duration, thus enabling a more accurate characterization of penetration activities with variable attack durations.

[0127] Step 2: Interpolation reconstruction based on the improved conditional time series model:

[0128] The input to the conditional temporal model adds an importance-weighted mask to the dense segment context representation and the sparse anchor aggregation representation. This mask is calculated based on the relative distance between the interpolated time point and the known dense segment and anchor times, so the model pays more attention to the temporally closer context conditions.

[0129] The model's generation process employs a beam search strategy, which not only generates the single event sequence with the highest probability but also retains k optimal candidate sequences. For each candidate sequence, an overall reasonableness score is calculated, which is determined by the local probability of the interpolated sequence, its semantic consistency with the conditional context (calculated through a pre-trained discriminator), and the temporal smoothness of the sequence itself.

[0130] Ultimately, the output is a Top-k candidate attack chain and its reasonableness score, rather than a single chain.

[0131] Furthermore, the method also includes an attacker profiling step, specifically including:

[0132] Based on a unified semantic event stream and candidate attack chain, continuously evolving tactical identity profiles are generated for different attacker entities.

[0133] From historical candidate attack chains, atomic operation sequences with a frequency higher than a preset support threshold are extracted using a temporal pattern mining algorithm. Each sequence is then abstracted into a behavior primitive in the format of a quadruple, which includes initial context information, operation type, expected result, and tool information used. These are stored in a behavior primitive library.

[0134] Historical candidate attack chains refer to attack chains that have been analyzed and stored in the past. In time series pattern mining algorithms, support refers to the frequency of a specific sequence in the dataset. The preset support threshold is the minimum standard for judging whether a sequence is "frequent". Its specific value needs to be configured according to the size of the historical attack chain database and the granularity of analysis.

[0135] Example 1 (High Sensitivity Mode): In deep attribution scenarios targeting advanced persistent threats, the goal is to discover specific but rare tool sequences used by attackers. The support threshold can be set to a low value, such as 0.5%. This means that an action sequence is considered "frequent" and extracted as a behavioral primitive if it appears more than 50 times in a cumulative 10,000 historical attack chains.

[0136] Example 2 (General Mode): In general intranet penetration testing, the aim is to discover common techniques used by most attackers (such as common uses of PsExec). The support threshold can be set to a high value, such as 2%. This means that a sequence needs to appear more than 200 times in 10,000 historical attack chains to be extracted.

[0137] For any attacker entity identified in the unified semantic event stream, the event sequence generated within the observation window is mapped to the behavior primitive library to generate a corresponding behavior primitive sequence, and the behavior primitive sequence is encoded into a behavior pattern embedding vector using a temporal neural network model.

[0138] Calculate the similarity between the behavioral pattern embedding vectors of different attacker entities, cluster attacker entities with similarity higher than a preset similarity threshold into the same attacker entity, and generate a tactical identity profile for each attacker entity.

[0139] The preset similarity threshold is used to determine whether the behavioral pattern embedding vectors of two attacker entities are sufficiently similar, thus identifying them as the same attacker entity. This threshold is usually measured by cosine similarity, with a value range of [-1, 1], typically within the interval [0, 1].

[0140] Example 1 (High-Confidence Clustering): To ensure that the clustered attacker entities have highly consistent behavioral patterns and avoid false merging, a high similarity threshold can be set, such as 0.85. Only when the cosine similarity of the behavioral pattern vectors of two entities is greater than 0.85 will the system determine that they belong to the same attacker.

[0141] Example 2 (Exploratory Clustering): In the early stages of an attack campaign, when data is limited, a threshold can be appropriately lowered, for example, to more actively associate different entities that may belong to the same attacker but whose behavior has not yet been fully revealed. This helps to create attacker profiles earlier, but it needs to be verified and adjusted as more data becomes available.

[0142] The tactical identity profile includes the entity's preferred behavioral primitives, historical version evolution information of the toolchain used, and its tactical entropy value; the tactical entropy value is used to indicate the stability and evolution speed of the attacker entity's tactical style.

[0143] It should be explained that, in this embodiment, the tactical entropy value is an indicator used to quantify the disorder and variability of an attacker's behavioral patterns. Its value is calculated by statistically analyzing the distribution of all different attack methods (i.e., "behavioral primitives") used by an attacker entity within a specific observation period. A higher entropy value indicates that the attacker's behavior is more unpredictable and diverse; a lower entropy value indicates that its behavioral patterns are more fixed and repetitive.

[0144] A low tactical entropy value indicates that the attacker uses very consistent behavioral primitives and toolchains across multiple attack campaigns, resulting in stable and predictable patterns. For example, an attacker who consistently uses the same exploit tool and follows the same lateral movement path will have a tactical entropy value close to 0. This could correspond to a sophisticated automated attack script or an attack group with a fixed tactical style.

[0145] A high tactical entropy value indicates that the attacker is rapidly evolving their tactics. This may manifest as: frequently switching attack tools in a short period (e.g., switching from exploit tool A to tool B), trying different lateral movement methods, or diversifying the types of targets attacked. In the early stages of an attack, a high entropy value may indicate that the attacker is "trial and error" and "exploration"; if the high entropy value is maintained, it is highly likely that the attacker is technically skilled and adept at evading detection.

[0146] Monitoring the trend of tactical entropy over time is more important than its absolute value. A jump in an attacker's entropy from low to high indicates that they may have acquired new attack tools, are expanding their attack capabilities, or are responding to new defenses. A stable entropy from high to low suggests that their attack patterns are gradually solidifying, and they may have found an effective and stable attack path. A persistently high entropy oscillation strongly suggests that this is a technologically advanced and adaptable advanced persistent threat group.

[0147] Therefore, monitoring the tactical entropy changes of an attacker entity can determine whether it is in a tactical stable period or an evolutionary period, providing crucial intelligence for adjusting security defense strategies.

[0148] In one alternative implementation, the system retrieves all analyzed attack chain records from a stored historical attack chain database within the past year. A support threshold of 1% is set, and a sequence pattern mining algorithm is run to extract hundreds of frequently occurring operation sequences. For example, the algorithm extracts a sequence: <User privileges acquired, remote service creation using the PsExec tool, acquisition of System privileges, PsExecv2.2>, and abstracts it into a behavioral primitive named "Remote Service Execution Privilege Escalation," storing it in a behavioral primitive library.

[0149] For the unified semantic event stream within the current month to be analyzed, the system identifies a user named "zhangsan" and a host from IP "10.0.0.15" as suspicious attacker entities. The system maps all event sequences generated by "zhangsan" and "10.0.0.15" within this month to a behavioral primitive library, generating two behavioral primitive sequences respectively. A temporal neural network model is then used to encode these two sequences into two 256-dimensional behavioral pattern embedding vectors.

[0150] The cosine similarity between the two vectors was calculated to be 0.92, which is higher than the preset similarity threshold of 0.85. Therefore, the system clustered user "zhangsan" and host "10.0.0.15" into the same attacker entity and generated a tactical identity profile for this entity. The profile shows that this entity highly prefers to use primitives such as "remote service execution privilege escalation" and "registry persistence," and its toolchain has gradually evolved from the early PsExecv2.2 to using more covert WMI components. Calculations of its tactical entropy value over the past three months show a trend of first increasing and then decreasing, indicating that after a period of tactical exploration, it has now formed a stable and mature attack pattern.

[0151] Furthermore, the method also includes:

[0152] The tactical identity profile is fed back into the source tracing and analysis process to achieve dynamic optimization;

[0153] Analyze the internal network assets targeted by the currently active candidate attack chains. If the behavior targets critical assets, it is inferred that the attack intent is data theft or destruction, and the analysis priority of log streams associated with the attack chain is increased.

[0154] Here, "currently active" is a relative time concept. In this embodiment, the determination is made through the following logic: The system maintains a list of all candidate attack chains and the timestamps of their latest events. If a candidate attack chain has new related events continuously being added within the most recent preset time window (e.g., the last 24 hours), it is determined to be "currently active." Specifically, if a generated candidate attack chain is found to share key subjects, objects, or semantic features with new events in subsequent log stream processing, and the timestamps of these events are within the recent sliding time window, the system will mark the attack chain as "currently active" and trigger the subsequent analysis process.

[0155] Based on the tactical identity profile and the inferred attack intent, the semantic weights of predefined lightweight body action verbs are dynamically adjusted; if the attack intent is data theft, the weights of file reading and network sending actions are increased; and / or, the score thresholds in the short-time dense subsequence identification process are adjusted; if an event matching the behavioral primitive part in a certain tactical identity profile is detected, the score thresholds in the relevant network segment are decreased.

[0156] It's important to clarify that partial matching refers to events appearing in the real-time log stream whose semantic features match, but are not entirely identical to, some attributes of one or more behavioral primitives recorded in a tactical identity profile. For example, an attacker profile might record a preference for the tool "PsExec v2.2". If the real-time logs detect the use of "PsExecv1.96" or "PsExec" (version unspecified) for remote execution, this constitutes a "partial match." Although the version numbers differ, the core tool is the same. Similarly, different target IPs but the same attack method also constitute partial matching.

[0157] The relevant network segment refers to the IP network segment to which the network address involved in the "partial match" event belongs. For example, if an event partially matching a profile is detected on the host with IP address 192.168.1.100, then the "relevant network segment" refers to the Class C network segment 192.168.1.0 / 24. The system will temporarily lower the score threshold for analyzing logs from all hosts within this network segment because an attacker may be attempting lateral movement within this segment.

[0158] In the process of reconstructing the complete attack chain, the conditional temporal model uses the vectorized representation of the tactical identity profile as an additional conditional input to constrain the probability distribution of the generated intermediate interpolation event sequence, so that the probability of the generated intermediate interpolation event sequence belonging to the historical behavior pattern of the attacker entity corresponding to the tactical identity profile is higher than other possibilities.

[0159] In one alternative implementation, the system detects a currently active candidate attack chain whose behavior has consistently pointed to a core database server (marked as a critical asset) on the internal network for the past 6 hours, and infers that the attack chain's intent is data theft.

[0160] The system then initiated dynamic optimization. First, it increased the semantic weights of the File_Read and Network_Send actions in the semantic anchoring step, making them more sensitive to these behaviors in subsequent log parsing. Simultaneously, the system searched the tactical identity profile database and found that the current activity partially matched the profile of a known attacker entity, "Actor_A," which prefers to use "PsExec" (although the PsExec version used in the current attack chain was slightly different from the version number recorded in the profile).

[0161] Based on this "partial match," the system determined that "Actor_A" might be active in this area and immediately lowered the score threshold for the network segment 10.10.20.0 / 24, where the core database server is located, from the default 0.7 to 0.5. This means that within this network segment, less event accumulation is needed to trigger dense segment alerts, thus enabling earlier detection of potentially more covert lateral movement and data probing activities by attackers.

[0162] In the subsequent attack chain reconstruction, the conditional temporal model uses the tactical identity profile vector of "Actor_A" as conditional input. When generating the interpolated sequence between an initial access event and a database query event, the model significantly tends to generate a sequence of "using WMI to execute remote commands" rather than a sequence of "using SSH brute force," because the former is highly consistent with "Actor_A's" historical behavior patterns, while the latter never appears in its profile. This makes the final reconstructed attack chain more accurate and reliable.

[0163] According to another aspect of the embodiments of this application, an electronic device is also provided for implementing the above-described method for internal network penetration and tracing based on multi-scale heterogeneous log behavior analysis. This electronic device may be... Figure 3 The terminal device or server shown. This embodiment uses this electronic device as an example of a server. Figure 3 As shown, the electronic device includes a memory 302, a processor 304, and a transmission device 306. The memory 302 stores a computer program, and the processor 304 is configured to execute the steps of any of the above method embodiments through the computer program.

[0164] Optionally, in this embodiment, the aforementioned electronic device may be located in at least one of a plurality of network devices in a computer network.

[0165] Optionally, the transmission device 306 is used to receive or send data via a network. Specific examples of the network described above may include wired and wireless networks. In one example, the transmission device 306 includes a Network Interface Controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 306 is a radio frequency (RF) module used to communicate with the Internet wirelessly. Furthermore, the electronic device also includes a display 308 and a connection bus 310, which connects the various module components within the electronic device.

[0166] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.< / end> < / start>

Claims

1. An Intranet penetration traceability method for multi-scale heterogeneous log behavior analysis, characterized in that, include: Standardize the raw log streams from at least three heterogeneous log sources, including host system logs, application audit logs, directory service event logs, terminal detection logs, and cloud audit logs, to generate a unified semantic event stream; The unified semantic event stream is divided into multi-scale time windows, and the event density feature index of each window is calculated. Short-time dense subsequences are identified based on the event density feature index. Cluster analysis is performed on the identified short-time dense subsequences based on semantic weighted entropy to distinguish between aggressive dense segments and normal high-load segments; Based on the semantic relevance of events, long-term sparse clues are extracted from the unified semantic event stream; Using the long-term sparse clues as time anchors, the attack-intensive dense segments adjacent to the time anchors are located within their extended time range. Intermediate interpolation event sequences are generated through a conditional time series model to reconstruct the complete attack chain.

2. The method for in-network penetration tracing of multi-scale heterogeneous log behavioral analysis as claimed in claim 1, wherein, The standardization process includes: Use at least two of the following: regular expression parser, JSON parser, and Protobuf parser to parse the fields for each log type; Based on a predefined lightweight ontology, the parsed fields are mapped to ontology concepts; wherein, the predefined lightweight ontology includes a set of action verbs, a set of entity categories, and an attribute hierarchy structure; Output the unified semantic event stream, wherein each record includes a standard timestamp, original evidence file information, original evidence file offset information, original record ID information, and the mapping result from field to ontology concept.

3. The intranet penetration and tracing method based on multi-scale heterogeneous log behavior analysis according to claim 1, characterized in that, The multi-scale time window includes at least four scales: 1 second, 10 seconds, 1 minute, 10 minutes, 1 hour, and 1 day. The correspondence between multi-scale time windows and attack behaviors is as follows: 1-second and 10-second time windows correspond to password guessing, port scanning, and vulnerability scanning attack behaviors; The 1-minute and 10-minute timeframes correspond to lateral movement, credential abuse, and burst connection attack behaviors. The 1-hour and 1-day windows correspond to slow persistence and covert data outreach attacks.

4. The method for in-network penetration tracing of multi-scale heterogeneous log behavioral analysis as claimed in claim 1, wherein, The event density characteristic indicators include: The number of events, expressed by the formula Calculate; where, Indicates the first A window in scale The number of events on Indicates the window time boundary, Indicates the first A window in scale The start time on Representing scale The corresponding window length, This indicates a counting operation. For a single event, For a set of events, For the event timestamp; Action type distribution, through formula Calculate; where, Indicates action The count in the window, Represents the probability distribution of actions. For the first A window in scale A subset of events on For the event Action semantic tags; behavioral entropy, computed by the formula wherein, denotes the window action distribution entropy, is the set of actions; subject switching frequency , calculated by the formula ; where, represents the number of times the subject identification changes within the window, represents the number of events for that window.

5. The method for in-network penetration tracing of multi-scale heterogeneous log behavioral analysis as claimed in claim 4, wherein, The process of identifying short-time dense subsequences based on the event density feature index includes: Normalize each element in the window feature vector; Computing the normalized density score by the formula computing; in, Indicates the event rate. Represents behavioral entropy. Indicates the main body switching frequency. This represents the normalized result of the event rate. This represents the result of normalization of behavioral entropy. This represents the normalized result of the switching frequency. , , These represent the mean values ​​of event rate, behavior entropy, and switching frequency in the window feature vector sequence, respectively. , , These represent the variances of the event rate, behavior entropy, and switching frequency in the window feature vector sequence, respectively. , , This represents the preset feature weights. Represents the sigmoid function; The conditions for a window to be marked as a dense candidate include: the normalized density score of the window exceeds a score threshold; and at the scale where the window is located, within three consecutive adjacent time steps, at least two windows have normalized density scores higher than the score threshold.

6. The intranet penetration and tracing method based on multi-scale heterogeneous log behavior analysis according to claim 1, characterized in that, The clustering analysis employs the HDBSCAN algorithm, using semantically weighted entropy. Normalized density score and main body switching frequency Construct the window feature vector, which is represented as follows: ; The event-based semantic correlation, extracting long-term sparse cues from the unified semantic event stream, includes: Semantic signatures are constructed for events with frequencies below a preset frequency threshold. These semantic signatures are generated based on a combination pattern of the event's action semantic tags, subject identifiers, and object identifiers. The semantic signature is embedded into a vector space to obtain a vector representation; Similarity clustering of vector representation sequences with a time span exceeding 24 hours is performed based on dynamic time warping distance; The recurring clusters are output as the long-term sparse clues, and for each long-term sparse clue, its time window range, list of main related subjects or objects, semantic signature summary and average occurrence interval are recorded.

7. The intranet penetration and tracing method based on multi-scale heterogeneous log behavior analysis according to claim 1, characterized in that, The boundary of the extended time range is denoted as: ; wherein, denotes the start time of the time anchor point, denotes the end time of the time anchor point; , denotes an extension boundary to cover the context before and after the time anchor point; The inputs to the conditional time series model include: The contextual representation of the aggressive dense segment is obtained by using TransformerEncoder to perform contextual modeling on the event sequence within the aggressive dense segment; Weighted average embedding representation of temporal anchor points is calculated by the following equation: in, This represents a single event within a time anchor point. The set of events representing a time anchor point. Indicates an event The credibility of the data collection Indicates an event The time interval between adjacent events; This represents the harmonic parameter, with a value ranging from 0.1 to 0.5; Indicates an event Embedded vector, Represents an exponential function; event embedding vector comprises: ; wherein, represents an action semantic label of an event , represents a subject identifier of an event , represents an object identifier of an event , represents an action semantic embedding function, represents a subject embedding function, represents an object embedding function, represents a vector concatenation operation.

8. The method for in-network penetration tracing of multi-scale heterogeneous log behavioral analysis as claimed in claim 2, wherein, The method further includes outputting candidate attack chains, each candidate attack chain comprising: Aggressive dense segment sequences with temporal anchors and interpolation completion; Semantic summary, describing the attack phase and attack type; Key participating entities, including the hosts, accounts, and IP addresses involved; The evidence pointer points to the original evidence file information, the original evidence file offset information, and the original record ID information.

9. The method for intranet penetration forensics of multi-scale heterogeneous log behavioral analysis according to claim 8, characterized in that, The method further includes: Based on the unified semantic event stream and the candidate attack chain, continuously evolving tactical identity profiles are generated for different attacker entities. From historical candidate attack chains, atomic operation sequences with a frequency higher than a preset support threshold are extracted using a temporal pattern mining algorithm. Each sequence is then abstracted into a behavior primitive in the format of a quadruple, which includes initial context information, operation type, expected result, and tool information used. These are stored in a behavior primitive library. For any attacker entity identified in the unified semantic event stream, the event sequence generated by it within the observation window is mapped to the behavior primitive library to generate a corresponding behavior primitive sequence, and the behavior primitive sequence is encoded into a behavior pattern embedding vector using a temporal neural network model. Calculate the similarity between the behavioral pattern embedding vectors of different attacker entities, cluster attacker entities with similarity higher than a preset similarity threshold into the same attacker entity, and generate a tactical identity profile for each attacker entity. The tactical identity profile includes the entity's preferred behavioral primitives, historical version evolution information of the toolchain used, and its tactical entropy value; the tactical entropy value is used to indicate the stability and evolution speed of the attacker entity's tactical style.

10. The method of intranet penetration forensics for multi-scale heterogeneous log behavioral analysis as claimed in claim 9, wherein, The method further includes: The tactical identity profile is fed back into the source tracing analysis process to achieve dynamic optimization; Analyze the internal network assets targeted by the currently active candidate attack chains. If the behavior targets critical assets, it is inferred that the attack intent is data theft or destruction, and the analysis priority of log streams associated with the attack chain is increased. Based on the tactical identity profile and the inferred attack intent, the semantic weights of the predefined lightweight body action verbs are dynamically adjusted; wherein, if the attack intent is data theft, the weights of file reading and network sending actions are increased; and / or, the score threshold in the short-time dense subsequence identification process is adjusted; if an event matching a behavioral primitive in a certain tactical identity profile is detected, the score threshold is reduced in the relevant network segment. In the process of reconstructing the complete attack chain, the conditional temporal model takes the vectorized representation of the tactical identity portrait as an additional conditional input to constrain the probability distribution of generating the intermediate interpolated event sequences, such that the probability of the generated intermediate interpolated event sequences belonging to the historical behavior pattern of the attacker entity corresponding to the tactical identity portrait is higher than other possibilities.

Images