Intelligent construction and tracing method and device of attack graph

Abstract

The invention discloses an intelligent construction and tracing method and device for an attack graph, and relates to the technical field of network security. The method comprises the steps of performing semantic analysis and entity relationship extraction on a multi-source heterogeneous security log according to a predefined structured security data model, and generating a standardized security entity relationship triple set; based on the set, taking an entity in an initial alarm as a starting point, and adopting an iterative closed loop driven by a large language model to dynamically construct an attack graph; and carrying out attack technique and tactics mapping and threat attribution based on the final map, and generating a response strategy of priority ranking. According to the method, automatic and high-precision source tracing and response of the attack chain are realized, and the problems that the prior art depends on static rules and semantic segmentation and lacks dynamic reasoning capability are effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an intelligent construction and tracing method and device of an attack graph. BACKGROUND

[0002] Network security attack tracing analysis is a key link for coping with complex network attacks such as advanced persistent threats and ransomware, aiming to restore the intrusion path, tactics and technology process used by the attacker and attribute the attack source, so as to guide security personnel to carry out accurate emergency response and defense reinforcement. In the prior art, network attack tracing analysis mainly relies on two types of technical means: one is a security information and event management (SIEM) system or a security orchestration automation and response (SOAR) technology based on rule matching; and the other is a multi-source log correlation analysis relying on manual work of security experts.

[0003] However, the above prior art has significant defects in actual application: Firstly, the detection technology based on static rules is difficult to cope with unknown threats and complex attack chains. Existing SIEM and SOAR systems usually rely on pre-defined correlation rules, for example, more than N failed logins within a certain time window will be alarmed. This method is effective for known attacks with obvious characteristics, but when facing the attack tools frequently changed by APT organizations, zero-day exploits and hidden attacks using system tools, it is easy to cause false negatives due to the lack of corresponding feature fingerprints. In addition, static rules cannot capture the attack logic of long links, and attackers can bypass rule detection by fine-tuning tactics.

[0004] Secondly, the semantic fragmentation of multi-source heterogeneous data leads to data islands, hindering automated correlation analysis. In the enterprise network environment, security data is scattered in firewalls, intrusion detection systems, terminal detection and response systems, Web server logs and other different devices. Different manufacturers and different types of devices have different log formats and field definitions. The existing technology usually extracts specific fields by using regular expressions, lacks a unified semantic understanding layer, and cannot automatically map heterogeneous data to a unified security knowledge model, so that the analysis system cannot track the lateral movement path of the attacker across device boundaries.

[0005] Thirdly, the lack of intelligent analysis mechanism with dynamic reasoning and self-correction ability. Although some existing technologies begin to introduce artificial intelligence or large language model assisted analysis, most of them are still at the stage of shallow application of assisting in generating reports or code explanation. When facing complex attack tracing tasks, existing models often lack the closed-loop thinking ability like human experts. Specifically, existing systems often make linear inference based on a single alert. Once the initial alert is a false alarm or the model produces hallucinations, the system lacks effective backtracking and pruning mechanisms, resulting in attack graphs containing a large number of false nodes, which cannot form a logically self-consistent and evidence-based complete evidence chain, and ultimately still need to rely on senior security experts to spend a lot of time for manual research and judgment.

[0006] In summary, the existing technology has three core defects of excessive dependence on static rules, lack of semantic understanding ability and inability to conduct long-chain logical reasoning, which is difficult to meet the increasingly complex network attack and defense confrontation needs. SUMMARY

[0007] In view of the above defects or deficiencies in the prior art, the present application provides an intelligent construction and tracing method and device for attack graph, by constructing an intelligent agent with hypothesis-verification-mapping closed loop capability, using a large language model as the core reasoning engine, combining heterogeneous log semantic alignment technology and confidence evaluation algorithm, realizing automatic and high-precision construction and tracing of attack chain, and finally improving the efficiency and accuracy of network security incident emergency response In one aspect of the present application, an intelligent construction and tracing method for attack graph is provided, comprising the following steps: Entity relationship extraction step: according to a predefined structured security data model, performing semantic analysis and entity relationship extraction on security logs from multiple heterogeneous security data sources to generate a set of security entity relationship triples; Attack graph dynamic construction step: based on the set of security entity relationship triples, extracting at least one security entity from the initial alert as an initial node, constructing an attack graph based on the initial node; based on the state of the edge node adjacent to the unknown area of the current attack graph, generating at least one hypothesis about the subsequent behavior of the attacker using a large language model; according to the hypothesis, searching for related evidence in the set of security entity relationship triples, verifying each hypothesis based on the evidence, calculating its confidence score, and updating the current attack graph according to the confidence score; taking the newly added nodes in the updated attack graph as the edge nodes for the next round of iteration until the preset iteration termination condition is met, and obtaining the constructed attack graph; Response strategy generation step: based on the constructed attack graph, generating a priority-ordered security response action for malicious nodes.

[0008] Another aspect of the present application also provides an intelligent construction and tracing device of attack graph, comprising: An entity relationship extraction module is configured to perform semantic analysis and entity relationship extraction on security logs from a plurality of heterogeneous security data sources according to a predefined structured security data model, and generate a set of security entity relationship triples; An attack graph dynamic construction module is configured to extract at least one security entity from an initial alarm as an initial node based on the set of security entity relationship triples, construct an attack graph based on the initial node, generate at least one hypothesis about the subsequent behavior of an attacker using a large language model based on the state of the edge node adjacent to the unknown area of the current attack graph, retrieve relevant evidence in the set of security entity relationship triples according to the hypothesis, verify each hypothesis based on the evidence, calculate a confidence score thereof, update the current attack graph according to the confidence score, and take the newly added node in the updated attack graph as an edge node for the next round of iteration until a preset iteration termination condition is met, and obtain a constructed attack graph. A response strategy generation module is configured to generate security response actions sorted by priority for malicious nodes based on the constructed attack graph.

[0009] The present application provides an intelligent construction and tracing method and device of attack graph, which has the following beneficial effects: (1) High accuracy of tracing. By introducing confidence evaluation and backtracking pruning mechanism, the problem of large model easily producing hallucinations and false positives is effectively solved. The system quantitatively verifies each reasoning step, only solidifies high-confidence evidence as graph nodes, and automatically prunes and retraces low-confidence paths, ensuring that each node in the graph has real evidence support, and the final attack chain is logically rigorous and evidence-based.

[0010] (2) Cross-platform semantic understanding and association ability. By constructing a predefined structured security data model and using a large language model for semantic analysis, the data barriers between different security manufacturers and different types of devices are broken. The system can understand heterogeneous logs described in natural language and map them to a unified knowledge model to generate standardized entity relationship triples, thereby realizing real global data correlation analysis and effectively tracking the lateral movement of attackers across hosts.

[0011] (3) Automation and dynamic adaptability. The present application models attack tracing as a state space search problem, and realizes a fully automated reasoning cycle driven by an agent, which can dynamically adjust the investigation direction according to the real-time actions of the attacker and the discovered evidence, propose new hypotheses and verify them. This dynamic adaptability enables it to deal with unknown and atypical attack methods, and has exploratory reasoning ability similar to human security experts.

[0012] (4) Improve the efficiency of emergency response. By automating the entire process from log correlation, attack chain reconstruction to attribution analysis and response suggestion generation, security experts are freed from the tedious low-level data sorting work, allowing them to focus on high-level strategic decision-making. At the same time, the system generates a prioritized list of response actions that can be directly guided or automatically executed through an API, significantly reducing the average time from discovering a threat to containing it. BRIEF DESCRIPTION OF DRAWINGS

[0013] Other features, objects, and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments, read in conjunction with the accompanying drawings: Figure 1 is a flowchart of an intelligent construction and tracing method of an attack graph provided by an embodiment of the present application; Figure 2 is a flowchart of a specific implementation process of entity relationship extraction provided by an embodiment of the present application; Figure 3 is a flowchart of a specific implementation process of dynamic construction of an attack graph provided by an embodiment of the present application; Figure 4 is a flowchart of a specific implementation process of response strategy generation provided by an embodiment of the present application; Figure 5 is a structural diagram of an intelligent construction and tracing device of an attack graph provided by an embodiment of the present application; Figure 6 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0015] Embodiment One This embodiment details an intelligent construction and tracing method of an attack graph. As shown in Figure 1 the method mainly includes the following steps: Step S101: Entity relationship extraction.

[0016] This step aims to solve the technical problem of semantic fragmentation of multi-source heterogeneous data mentioned in the background. The core principle is to build a unified structured security data model as a security semantic framework, and use the natural language understanding ability of large language model (LLM) to automatically parse and map different formats and different sources of original security logs to the framework, thereby generating a standardized, machine-readable set of security entity relationship triples.

[0017] It should be noted that the "entity" in the present application is also called a security entity, which refers to a unique identifiable key object extracted and standardized from network security data according to the types and attributes declared by the predefined structured security data model, such as processes, users, hosts or network addresses, which is the basic semantic unit of security knowledge graph (i.e. security entity relationship triple set) and attack graph.

[0018] As shown in Figure 2 , this step specifically includes the following sub-steps: Step S1011, defining a structured security data model.

[0019] Before system deployment, a structured security data model needs to be constructed in advance. The security data model is a formal specification that clearly defines the things, relationships and features that need to be focused on in network security analysis. The design of this security data model refers to the theory of knowledge graph and semantic web, and provides a comprehensible and computable semantic model for chaotic raw data by defining clear classes, attributes and relationships. In the field of network security, this ensures that log data from different manufacturers and different systems can be uniformly interpreted.

[0020] Specifically, the formal representation of the security data model can be denoted as O = {E, R, A}.

[0021] Entity type set E: defines the types of core security objects, such as IP addresses, processes, user accounts, etc. Each type is an important concept category in the field of network security.

[0022] Relationship type set R: defines the possible directed association types between entities, which usually represent security behaviors such as process spawning, network connection, etc. The relationship set defines the semantics of "edges" in the knowledge graph.

[0023] Attribute set A: defines the key attribute fields possessed by each entity type. For example, a process entity can have process ID, executable file path, etc. Attributes are used to describe the specific characteristics of entities. Step S1012, heterogeneous data preprocessing and context information enhancement.

[0024] The original security log set has great differences in format and context integrity. The system receives original logs from various sources such as terminals, networks, and applications. First, format normalization processing is performed, and various logs are uniformly converted into a structured intermediate representation format through a parser to eliminate differences at the syntax level. Then, context information is enhanced, and key metadata such as the core of the log generating device, the business department to which it belongs, and the network area label are automatically supplemented for each log record by associating with external knowledge sources such as asset databases and network topology information.

[0025] After this step, the original, heterogeneous, and information-poor log data is transformed into an enhanced log set that is uniform in format, rich in context, and easier to understand semantically, thereby improving the information density and readability of the data, overcoming the problem of information poverty and lack of business context in original logs, and avoiding subsequent analysis errors caused by format parsing failure or context loss.

[0026] Step S1013, semantic analysis and triple extraction based on a large language model.

[0027] This step is the core of semantic understanding and structured extraction. A large language model fine-tuned in the network security field is used as a parsing engine. The enhanced log text output in step S1012 and the structured security data model defined in step S1011 are jointly constructed as a specific prompt word input model. The prompt word instructs the large model to play the role of a security analyst, and according to the given structured security data model specification, it identifies entities and relationships between entities that meet the predefined types from each natural language description of the enhanced log. Based on its powerful semantic understanding ability, the model outputs standardized structured data, i.e., security entity relationship triples. Each triple accurately represents: who (subject entity) — to whom (object entity) — what (relationship). This process realizes the automatic conversion of unstructured text into standardized knowledge, completely replacing the traditional fragile method based on regular expressions or static parsing templates.

[0028] Step S1014, multi-source entity alignment and knowledge fusion.

[0029] This step solves the ambiguity and redundancy of entity reference and realizes knowledge fusion. Since the same real-world object may appear with different identifiers or aliases in different logs, direct extraction may result in multiple duplicate nodes in the security knowledge graph or attack graph.

[0030] To solve the above technical problems, a hybrid entity alignment strategy is adopted in this step: first, rule-based precise matching is applied, for example, merging the same IP address, completely consistent host name, etc.; second, for ambiguous references that cannot be determined by rules, the large language model is called again to determine the identity at the semantic level, to evaluate whether the two references point to the same entity; finally, the system merges multiple entity references that are determined to point to the same physical object, generates a globally unique entity identifier, and updates all related triples. Thus, a pure, non-redundant, and entity-unique standard security entity relationship triple set is obtained, laying the foundation for building a high-quality knowledge graph.

[0031] Step S102, attack graph dynamic construction.

[0032] This step aims to solve the problem of lack of dynamic reasoning and self-correction ability of the attack graph. The core principle is to model attack tracing as a heuristic-guided graph search process. The system takes the entity corresponding to the initial alarm as the starting point, uses LLM as a heuristic function to generate possible successor state hypotheses, verifies the possibility of state transition by querying the knowledge base for evidence, and dynamically decides the search path (i.e., expansion, pruning, backtracking) according to the verification result, thereby automatically exploring and constructing the most likely attack path graph.

[0033] As shown in Figure 3 This step is an iterative loop, specifically including the following sub-steps: Step S1021, based on the security entity relationship triple set, extracting at least one security entity from the initial alarm as the initial node, and constructing an attack graph based on the initial node.

[0034] The purpose of this step is to establish a logical starting point for dynamic reasoning. The system receives an initial security alarm that has been preliminarily judged as high credibility. First, the system analyzes the semantic content of the initial security alarm and matches it with the constructed security entity relationship triple set, accurately locating and extracting at least one core security entity directly related to the alarm, such as the suspicious process reported by the alarm, the attacked host, or the source IP address initiating the attack; then, the system takes the extracted one or more entities as the initial node, creates a new graph structure, and obtains the association between these nodes from the corresponding relationship entries in the triple set, together constituting the initial state of the attack graph. The constructed initial graph represents the confirmed attack starting fact, providing a unique and stable anchor point for subsequent exploratory reasoning.

[0035] Step S1022, based on the state of the edge node adjacent to the unknown region in the current attack graph, at least one hypothesis about the subsequent behavior of the attacker is generated using a large language model; according to the hypothesis, relevant evidence is retrieved in the set of security entity relationship triples; based on the evidence, each hypothesis is verified, and its confidence score is calculated; and the current attack graph is updated according to the confidence score.

[0036] This step is the core iteration unit of dynamically constructing the attack graph, and the purpose is to realize the closed loop of "speculation-verification-decision".

[0037] Firstly, the system analyzes the structure of the current attack graph, and identifies those nodes located at the boundary of the explored region and directly connected with the unknown region, i.e. edge nodes. These nodes represent the current front-line positions that the attacker has been confirmed to reach. Then, the system inputs the state of the current graph, especially the types, attributes and associated attack behaviors of the edge nodes, into the large language model as context, and instructs the model to combine its internalized attack tactics knowledge to infer and generate one or more behavior hypotheses that the attacker is most likely to take next. Each hypothesis is a natural language description of the subsequent attack step.

[0038] Then, for each generated hypothesis, the system automatically converts it into a standardized query statement that can be executed in the set of security entity relationship triples, and executes the query to retrieve all triples that may be related to the predicted behavior of the hypothesis in terms of entities, time and behavior characteristics, as the evidence set to be verified.

[0039] Next, the system starts the verification and evaluation process. Through a dedicated evaluation module, the features of each hypothesis are compared with the features of its corresponding evidence set in multiple dimensions, including the consistency of time logic, the consistency of involved entities and the matching degree of behavior patterns. Based on the comprehensive evaluation of these dimensions, the system calculates a quantitative confidence score for each hypothesis, which represents the likelihood of the hypothesis being true.

[0040] The calculation process of the confidence score is exemplified as follows: the scores of the correlation between the evidence and the hypothesis in time, the consistency of the entity involved in the evidence and the entity in the current attack graph, and the similarity of the attack behavior reflected by the evidence and the attack behavior of the hypothesis are weighted and summed to obtain the confidence score; if the confidence score is greater than or equal to a first preset threshold, the hypothesis and the evidence are added to the current attack graph as a new directed edge and a new node; if the confidence score is less than or equal to a second preset threshold, the hypothesis and the evidence are discarded, and the current attack graph is continuously updated according to the alternative hypothesis, wherein the second preset threshold is less than the first preset threshold; if the confidence score is between the first preset threshold and the second preset threshold, the hypothesis and the evidence are regarded as a pending edge and a pending node in the attack graph.

[0041] Finally, the system dynamically decides and updates the attack graph according to the preset confidence threshold strategy: for the hypothesis with a score higher than the first preset threshold, the attack steps and supporting evidence described by the hypothesis are formally incorporated into the current graph as new nodes and edges; for the hypothesis with a score lower than the second preset threshold, the hypothesis is regarded as an invalid speculation or a false alarm, and is directly pruned, and a backtracking mechanism is triggered to attempt other possible paths; for the hypothesis with a score in the middle, the hypothesis is marked as pending, and is determined again when subsequent evidence appears.

[0042] Step S1023, the newly added nodes in the updated attack graph are regarded as edge nodes for the next round of iteration.

[0043] After completing the current round of attack graph update, the system automatically refreshes the state. The nodes newly added to the graph in the current iteration through high-confidence hypothesis verification are identified as edge nodes for the next round of reasoning cycle. These new nodes represent the latest extension point of the attack path, thereby ensuring that the reasoning exploration can continuously proceed forward and deep along the confirmed attack direction, realizing automatic connection and progressive update of the state in the iteration process.

[0044] Step S1024, steps S1022 and S1023 are repeatedly executed until a preset iteration termination condition is met, and a completed attack graph is obtained.

[0045] The system repeats the above processes of hypothesis generation, evidence retrieval, validation scoring, graph updating and edge node refreshing in a loop manner. This loop will continue until one or more pre-defined termination conditions are met. These conditions usually include: the attack path has extended to a pre-defined critical target node (e.g. core data is accessed), no new high-confidence extensions are found in consecutive multiple rounds of iterations, the graph enters a stable state, or the maximum iteration depth or time limit set by the system to control resource consumption is reached. When the loop terminates, the final attack graph obtained is the final graph that reflects the complete attack chain and is automatically constructed by the system.

[0046] After the construction of the attack graph is completed, it is more preferable to further include: Step S1025, global optimization of the graph.

[0047] Global optimization one: traversing the directed edges in the attack graph after the iteration is completed, checking whether the end time of the start event of all directed edges is earlier than the start time of the end event, otherwise marking the directed edge as invalid and triggering a backtracking mechanism to re-find evidence.

[0048] Specifically, the attack graph after iteration is completed is checked for temporal logic consistency to maintain the correctness of the causal relationship. The system first obtains the time stamp information of each node connected by each directed edge in the attack graph after iteration is completed, i.e. the end time of the security event represented by the start node and the start time of the security event represented by the end node. Subsequently, the system performs logical checking on each edge, and the core rule is to determine whether the end time of the start event is earlier than or equal to the start time of the end event (a configurable micro-clock deviation tolerance is allowed here). If this condition is met, the edge is determined to be reasonable in time sequence. If it is found that a certain edge violates this rule, i.e. a time sequence paradox of "result before cause" occurs, the system automatically marks the directed edge as an invalid edge. This marking means that the causal relationship is not accepted. Subsequently, the system triggers a backtracking mechanism linked with the dynamic construction module to place the attack path segment involved in the invalid edge in a state to be re-explored, and attempts to find other evidence that meets the time logic from the set of security entity relationship triples to replace or reconstruct the part of the attack chain, thereby ensuring the rigor and credibility of the final graph in the time dimension.

[0049] Global optimization two: identifying all weakly connected components in the attack graph after iteration is completed, determining whether the weakly connected component contains a pre-defined attack starting point or core asset node, and if so, retaining the weakly connected component in the current attack graph, otherwise discarding the weakly connected component.

[0050] The purpose of this optimization is to implement topological structure cleaning of the graph to remove irrelevant noise and focus on core attack chains.

[0051] Specifically, the system ignores the direction of all edges in the graph, and divides the graph into several independent sub-graphs that are internally connected but completely isolated from the outside. Each such sub-graph is called a weakly connected component. This step is an objective and automated segmentation of the graph structure. Subsequently, the system applies subjective filtering rules based on security semantics to each identified weakly connected component. The core of the rules is to check whether the component contains predefined key nodes: one is the initial intrusion point of this attack, and the other is the core asset nodes in the network environment, such as domain controllers, database servers, etc. If a weakly connected component contains at least one of the above key nodes, it is considered to be related to the main line of this attack and is retained. Conversely, if a weakly connected component does not contain either the initial intrusion point or any core asset node, it is determined to be isolated background activity or false positive noise, and is completely removed from the current attack graph. Through this step, the discrete event clusters unrelated to the core attack process in the graph are effectively removed, making the final presented attack path more concise, focused and reliable.

[0052] Step S103: Response policy generation This step aims to transform the analysis results of the attack graph into actionable defense instructions, realizing the closed loop from cognition to action.

[0053] Referring to Figure 4 The specific implementation process is as follows: Step S1031, execute attack technique abstraction and vectorization.

[0054] The system traverses the final attack graph and focuses on nodes that have been marked as malicious or strongly related to the attack chain. From each such node, its key technical features are extracted, including but not limited to: the process name involved, command line parameters, network protocols, ports, registry or file path operations, and association patterns with other nodes. Subsequently, the system maps these specific features into a standard, structured attack technique framework (such as the MITRE ATT&CK matrix), matching each technical action with one or more precise tactical and technical numbers. Finally, the sequence of technique and tactic numbers mapped out by all nodes on the entire attack chain is converted into a multi-dimensional attack feature vector. This vector digitally represents the overall behavior pattern of this attack activity.

[0055] Step S1032, threat intelligence comparison and attribution analysis.

[0056] The system accesses a built-in or externally connected threat intelligence database that stores a large number of technical and tactical fingerprint vectors of known attack organizations or malware families, which are derived from the feature abstraction of their historical attack behaviors. The system performs a similarity calculation between the feature vector of the current attack generated in the previous step and the set of fingerprint vectors in the intelligence database. The calculation is based on the spatial distance or angular measurement of the vectors to evaluate the matching degree of the current attack pattern with each known threat pattern. The system filters out the matching results with a similarity exceeding a preset threshold, and sorts them according to the matching degree, and outputs one or more most likely threat source pointing conclusions, such as: suspected of being a certain advanced persistent threat organization or a specific malware variant, thereby providing background and intent level intelligence context for the attack event.

[0057] Step S1033, generating and sorting the list of executable response actions.

[0058] The system queries a predefined response action knowledge base according to the specific type and technical characteristics of each malicious node in the attack graph. The knowledge base stores standardized disposal recommendations for various types of known attack techniques in the form of, for example, an association mapping table. For example: if the node is a persistent backdoor, then it is recommended to remove the corresponding scheduled tasks or services. At the same time, the system obtains the business value and importance score of the host, application or data affected by the node through the integration of the asset management system. On this basis, the system calculates a comprehensive priority score for each proposed response action. The score is determined by factors such as the inherent danger level of the attack technique itself, the criticality of the affected assets, and the urgency and expected effectiveness of the action execution. Finally, the system outputs a detailed response action list sorted in descending order of this priority score, providing security personnel with hierarchical operation guidelines from immediate containment to long-term reinforcement.

[0059] Embodiment Two The following is an example of an APT attack scenario, which is an individual embodiment, to demonstrate the specific application process of the method of the present application.

[0060] Scenario: A certain enterprise security operation center receives a high-confidence alert from the terminal detection and response system: a suspicious PowerShell script execution is detected on the host Workstation-01, and the script content contains internal network scanning features.

[0061] (1) Trigger and data input The system receives the alert and automatically pulls in heterogeneous data such as firewall logs, domain controller authentication logs, DNS query logs, etc. within the time window related to the Workstation-01 host. The entity relationship extraction module is started and runs. For example: from a Windows security log, the triple {User: j.smith, Spawn, Process: powershell.exe} is parsed; from the firewall log, {Host: Workstation-01, ConnectTo, IP_Address: 10.0.20.0 / 24:445} is parsed. All parsed and standardized triples are stored in the knowledge base.

[0062] (2) Dynamic graph construction first round From the triples associated with the alert, extract Host: Workstation-01 and Process: suspicious_ps_script as seed nodes to initialize the current attack graph.

[0063] Use LLM to analyze the edge node suspicious_ps_script of the current graph, combine with ATT&CK knowledge, generate hypothesis 1 "the attacker may be conducting internal host discovery" and hypothesis 2 "the attacker may be preparing for credential theft".

[0064] For hypothesis 1, the system automatically generates a query and searches in the knowledge base, and finds that Workstation-01 has intensive SYN request records for the 445 port of the 10.0.20.0 / 24 network segment after the script execution. For hypothesis 2, no typical credential theft tool activity is found.

[0065] Calculate the confidence, hypothesis 1 has sufficient evidence, time and behavior are highly matched, the confidence score of hypothesis 1 = 0.96. Hypothesis 2 lacks key evidence, the confidence score of hypothesis 2 = 0.15.

[0066] Hypothesis 1 and evidence (Action: Port_Scan, Target_Subnet: 10.0.20.0 / 24) are added to the current attack graph as verified nodes and edges. The path branch of hypothesis 2 is pruned due to low confidence.

[0067] (3) Dynamic graph construction second round Based on the new edge node "port scan", LLM generates a new hypothesis 3 "the attacker may attempt to use the SMB protocol for lateral movement".

[0068] Query found that after scanning, Workstation-01 initiated an SMB connection to FileServer-02 (IP belongs to 10.0.20.0 / 24) and successfully authenticated.

[0069] The confidence score of the calculation hypothesis 3 = 0.98, the graph is expanded, and a new node is added.

[0070] (4) Subsequent iteration The system continues to reason from FileServer-02 as the starting point, and may find that the attacker creates a scheduled task, accesses a sensitive shared directory, and the like, and after verification, the graph is added. Finally, when the graph is expanded to the node "initiate a large traffic encrypted connection from FileServer-02 to external IP 5.6.7.8", the preset key harm condition of "data exfiltration" is met, and the iteration is terminated.

[0071] (5) Global optimization The system performs timing verification to ensure that all edges are in reasonable time order. Run the weakly connected component algorithm to confirm that all nodes are connected to the initial intrusion point Workstation-01, and there is no isolated noise subgraph.

[0072] (6) Response generation The system outputs a complete attack graph, which clearly restores the attack chain.

[0073] The extracted attack TTP sequence (host discovery, SMB lateral movement, data exfiltration, etc.) is calculated to have a similarity of >0.85 with the fingerprint of a known ransomware gang.

[0074] Generate a list: 1) Highest priority: isolate Workstation-01 and FileServer-02; 2) High priority: block IP 5.6.7.8 on the network firewall; 3) Medium priority: scan the entire network to find the same script hash and reset the password of the relevant user.

[0075] Automatically generate a detailed analysis report containing all the above.

[0076] As can be seen from the embodiment, the method of the present application can automatically and intelligently complete the entire process from fragmented alerts to complete attack chain restoration, attribution, and response strategy generation.

[0077] Example Three Referring to Figure 5Another embodiment of the present application also provides an intelligent construction and tracing device 200 of an attack graph, comprising an entity relationship extraction module 201, an attack graph dynamic construction module 202 and a response strategy generation module 203. The intelligent construction and tracing device 200 of the attack graph can execute the intelligent construction and tracing method of the attack graph in the method embodiment.

[0078] Specifically, the intelligent construction and tracing device 200 of the attack graph comprises: The entity relationship extraction module 201 is configured to perform semantic analysis and entity relationship extraction on security logs from a plurality of heterogeneous security data sources according to a predefined structured security data model, and generate a set of security entity relationship triples. The attack graph dynamic construction module 202 is configured to extract at least one security entity as an initial node from an initial alarm based on the set of security entity relationship triples, construct an attack graph based on the initial node, generate at least one hypothesis about the subsequent behavior of an attacker using a large language model based on the state of the edge node adjacent to the unknown region of the current attack graph, retrieve relevant evidence in the set of security entity relationship triples according to the hypothesis, verify each of the hypotheses based on the evidence, calculate a confidence score thereof, update the current attack graph according to the confidence score, and take the newly added node in the updated attack graph as an edge node for the next round of iteration until a preset iteration termination condition is met, and obtain a constructed attack graph. The response strategy generation module 203 is configured to generate a security response action sorted by priority for a malicious node based on the constructed attack graph.

[0079] It should be noted that the intelligent construction and tracing device 200 of the attack graph provided in the embodiment corresponds to the technical solution that can be used to execute each method embodiment, and has similar implementation principles and technical effects to the method. Therefore, no further description is given here.

[0080] Embodiment Four Figure 6 A structural schematic diagram of an electronic device 300 is provided for another embodiment of the present application, which is used to implement the intelligent construction and tracing method of the attack graph in the method embodiment. The electronic device 300 in the embodiment of the present application can include but is not limited to a smart phone, a tablet computer, a PC, a notebook computer, a server, etc. Figure 6 The electronic device 300 shown is only an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0081] As Figure 6As shown, the electronic device 300 can include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301 that can perform various appropriate actions and processes to implement the methods of the embodiments as described in the present application according to programs stored in a read-only memory (ROM) 302 or loaded into a random access memory (RAM) 303 from a storage device 308. Various programs and data required for the operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other through a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0082] Generally, the following devices can be connected to the I / O interface 304: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 can allow the electronic device 300 to communicate wirelessly or wired with other devices to exchange data. Although Figure 6 The electronic device 300 is shown with various devices, but it should be understood that not all of the shown devices are required to be implemented or present. More or fewer devices can alternatively be implemented or present.

[0083] The above description is merely that of the preferred embodiments of the application. It is to be understood that the scope of the disclosure is not limited to the particular details described above but encompasses various alternatives and modifications. For example, the features described above and the features disclosed in the present application (but not limited to) having similar functions can be mutually substituted to form other technical solutions.

Claims

1. A method for intelligent construction and tracing of attack graphs, characterized in that, Includes the following steps: Entity relation extraction steps: Based on a predefined structured security data model, semantic parsing and entity relation extraction are performed on security logs from multiple heterogeneous security data sources to generate a set of security entity relation triples; Dynamic attack graph construction steps: Based on the set of security entity relationship triples, extract at least one security entity from the initial alarm as an initial node, and construct the attack graph based on the initial node; Based on the state of the edge nodes adjacent to the unknown region in the current attack graph, at least one hypothesis about the attacker's subsequent behavior is generated using a large language model; according to the hypothesis, relevant evidence is retrieved from the set of security entity relationship triples, and each hypothesis is verified based on the evidence, its confidence score is calculated, and the current attack graph is updated according to the confidence score; the newly added nodes in the updated attack graph are used as edge nodes for the next iteration until the preset iteration termination condition is met, and the completed attack graph is obtained; Response strategy generation steps: Based on the completed attack graph, generate security response actions for malicious nodes in order of priority.

2. The intelligent construction and tracing method for attack graphs according to claim 1, characterized in that, The entity relationship extraction step includes: Define a structured secure data model; Heterogeneous security logs from different formats and sources are preprocessed and enhanced with contextual information to form enhanced logs; The enhanced log and the structured security data model are input into the large language model. The large language model is guided by instructions to extract a set of security entity relation triples from the log. The set of security entity relation triples that point to the same physical object is deduplicated.

3. The intelligent construction and tracing method for attack graphs according to claim 1, characterized in that, The response strategy generation steps specifically include: The completed attack graph is traversed, and the technical features of each attack node in the attack graph are extracted and mapped to the standard attack tactics framework to obtain the attack vector. The similarity between the attack vector and the threat source tactics fingerprint is calculated, and the threat source that best matches the attack vector is output according to the calculation result. For the attack nodes in the completed attack graph, the response action knowledge base is queried and combined with the importance assessment of the affected assets to generate a priority-sorted list of response actions.

4. The intelligent construction and tracing method for attack graphs according to claim 1, characterized in that, The steps of verifying each hypothesis based on the evidence, calculating its confidence score, and updating the current attack graph based on the confidence score include: The confidence score is obtained by weighting and summing the scores of the temporal relevance of the evidence and the hypothesis, the consistency between the entities involved in the evidence and the entities in the current attack graph, and the similarity between the attack behavior reflected by the evidence and the attack behavior of the hypothesis. If the confidence score is greater than or equal to the first preset threshold, the hypothesis and evidence are added to the current attack graph as new directed edges and new nodes. If the confidence score is less than or equal to the second preset threshold, the hypothesis and evidence are discarded, and the current attack graph is updated based on alternative hypotheses; wherein the second preset threshold is less than the first preset threshold. If the confidence score is between the first preset threshold and the second preset threshold, the hypothesis and evidence will be treated as undetermined edges and undetermined nodes in the attack graph.

5. The intelligent construction and tracing method for attack graphs according to claim 4, characterized in that, The preset iteration termination conditions include: The current attack graph shows a node corresponding to a preset security entity. No new node with a confidence score higher than the first preset threshold is found in N consecutive iterations, or the preset maximum number of iterations or maximum running time is reached.

6. The intelligent construction and tracing method for attack graphs according to claim 1, characterized in that, The dynamic construction steps of the attack graph also include: After traversing the directed edges in the attack graph following the iteration, check if the end time of the starting event of all directed edges is earlier than the start time of the ending event; otherwise, mark the directed edge as invalid and trigger a backtracking mechanism to search for evidence again; and, Identify all weakly connected components in the attack graph after iteration, and determine whether the weakly connected component contains a predefined attack starting point or core asset node. If so, retain the weakly connected component in the current attack graph; otherwise, remove the weakly connected component.

7. An intelligent device for constructing and tracing attack graphs, characterized in that, include: The entity relationship extraction module is used to perform semantic parsing and entity relationship extraction on security logs from multiple heterogeneous security data sources based on a predefined structured security data model, and generate a set of security entity relationship triples. The attack graph dynamic construction module is used to extract at least one security entity as an initial node from the initial alarm based on the set of security entity relationship triples, and to construct the attack graph based on the initial node. Based on the state of the edge nodes adjacent to the unknown region in the current attack graph, at least one hypothesis about the attacker's subsequent behavior is generated using a large language model; according to the hypothesis, relevant evidence is retrieved from the set of security entity relationship triples, and each hypothesis is verified based on the evidence, its confidence score is calculated, and the current attack graph is updated according to the confidence score; the newly added nodes in the updated attack graph are used as edge nodes for the next iteration until the preset iteration termination condition is met, and the completed attack graph is obtained; The response strategy generation module is used to generate security response actions for malicious nodes in a priority order based on the constructed attack graph.

8. The intelligent construction and tracing device for attack graphs according to claim 7, characterized in that, The entity relationship extraction module is specifically used for: Define a structured secure data model; Heterogeneous security logs from different formats and sources are preprocessed and enhanced with contextual information to form enhanced logs; The enhanced log and the structured security data model are input into the large language model, and the large language model is guided by instructions to extract a set of security entity relation triples from the log; Perform deduplication on different entities in the set of secure entity relationship triples that point to the same physical object.

9. The intelligent construction and tracing device for attack graphs according to claim 7, characterized in that, The response strategy generation module is specifically used for: The completed attack graph is traversed, and the technical features of each attack node in the attack graph are extracted and mapped to the standard attack tactics framework to obtain the attack vector. The similarity between the attack vector and the threat source tactics fingerprint is calculated, and the threat source that best matches the attack vector is output according to the calculation result. For the attack nodes in the completed attack graph, the response action knowledge base is queried and combined with the importance assessment of the affected assets to generate a priority-sorted list of response actions.

10. The intelligent construction and tracing device for attack graphs according to claim 7, characterized in that, The attack graph dynamic construction module is further used for: The confidence score is obtained by weighting and summing the scores of the temporal relevance of the evidence and the hypothesis, the consistency between the entities involved in the evidence and the entities in the current attack graph, and the similarity between the attack behavior reflected by the evidence and the attack behavior of the hypothesis. If the confidence score is greater than or equal to the first preset threshold, the hypothesis and evidence are added to the current attack graph as new directed edges and new nodes. If the confidence score is less than or equal to the second preset threshold, the hypothesis and evidence are discarded, and the current attack graph is updated based on alternative hypotheses; wherein the second preset threshold is less than the first preset threshold. If the confidence score is between the first preset threshold and the second preset threshold, the hypothesis and evidence will be treated as undetermined edges and undetermined nodes in the attack graph. Traverse the directed edges in the attack graph after iteration, and verify whether the end time of the starting event of all directed edges is earlier than the start time of the ending event. Otherwise, mark the directed edge as invalid and trigger the backtracking mechanism to find evidence again. Also, identify all weak connected components in the attack graph after iteration, and determine whether the weak connected components contain predefined attack starting points or core asset nodes. If so, retain the weak connected components in the current attack graph; otherwise, remove the weak connected components. The preset iteration termination conditions include: a node corresponding to a preset security entity appears in the current attack graph; no new node with a confidence score higher than the first preset threshold is found in N consecutive iterations; or the preset maximum number of iterations or maximum running time is reached.

Images