An APT attack chain restoration system based on data traceability graph

Abstract

The present invention discloses an APT attack chain restoration system based on a data traceability graph, which relates to the field of computer network security, and includes a data traceability graph recording module, an input module, a data traceability graph compression module, an infection point positioning module and an attack chain mapping module; the data traceability graph recording module monitors the system activities in the target host and records them in the data traceability graph format; the input module obtains input data in the data traceability graph format or the system log format; the data traceability graph compression module compresses the data traceability graph; the infection point positioning module calibrates the position of the attack event in the data traceability graph; the attack chain mapping module maps the nodes and edges in the data traceability graph to each stage of the APT attack chain through mapping rules, and constructs a complete APT attack chain. The present invention enables analysts to have a clear understanding of the attack process, and improves system efficiency and reduces storage overhead by locating infection points and compressing data traceability graphs based on public threat intelligence.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to an APT attack chain restoration system based on a data provenance graph. Background Art

[0002] With the continuous development of the Internet, the threat of APT to enterprises and countries has become an increasingly prominent issue in information security protection. People inevitably need to access the Internet in all aspects of life. If there is no clear understanding of APT attack methods and lack of effective defense measures, it will not only cause huge economic losses, but also leak national security secrets, posing a huge threat to social stability.

[0003] APT, or Advanced Persistent Threat, is a new type of cyber attack that has emerged in recent years. The National Institute of Standards and Technology (NIST) of the United States has given an official definition of APT, which mentions the four major elements of APT, namely: (1) the attacker has advanced expertise and abundant resources; (2) the attack targets of APT are usually to destroy the key facilities of the target organization, steal confidential intelligence, or interfere with the normal execution of the mission; (3) APT uses a variety of attack methods to infiltrate the infrastructure of the target organization to establish and expand a foothold to achieve the attack purpose; (4) the APT attack process often lasts for a long time and uses covert means to counter security defense measures.

[0004] The APT attack chain is a standard model used to describe APT attack scenarios. Milagerdi et al. gave a detailed description of the APT attack chain in their work, dividing the APT attack into seven stages, namely:

[0005] (1) Initial reconnaissance: refers to the use of various attack methods (such as vulnerability scanning and social engineering) to search for vulnerabilities in the target system and carry out targeted attack activities; using the vulnerabilities of the target system to lurk inside the target system, such as using Web service vulnerabilities to upload malicious code.

[0006] (2) Establish a foothold: Use Trojans and other means to establish a connection between the control server and a terminal of the target system.

[0007] (3) Privilege escalation: Obtaining superuser privileges of the system by executing malicious code or other means.

[0008] (4) Internal reconnaissance: After gaining control of the terminal, the attacker searches for high-value targets in the target system's intranet through port scanning and other means.

[0009] (5) Lateral movement: Starting from a foothold, moving between intranet hosts with the goal of infiltrating facilities where high-value targets are located.

[0010] (6) Mission completion: Acquire high-value targets and transmit them back to the attacker (e.g., through a Trojan C&C server), or run malware to damage infrastructure.

[0011] (7) Clear traces: Clear attack traces by deleting system logs and other methods, leaving behind a backdoor.

[0012] Currently, most existing methods for APT attacks remain at the APT detection level and cannot provide a complete attack transmission process, that is, the attack chain. For complex and continuous attacks like APT, it is particularly important to provide an APT attack chain, which enables analysts to have a clear understanding of the full picture of APT attacks. However, the few methods that can provide attack chains also have the defect of low universality.

[0013] The data provenance graph used in the present invention is a graph structure that reflects the interaction relationship between entities in the system. The nodes in the data provenance graph represent entity objects, which can be processes, files, sockets, etc.; while the edges represent an interaction between two entities and the specific type of interaction (such as writing, creating a child process). In the APT attack chain restoration algorithm of the present invention, the data provenance graph is defined as a DAG (directed acyclic graph), because processing the data provenance graph into an acyclic graph is more conducive to subsequent analysis and designing a provenance graph compression algorithm.

[0014] Therefore, technical personnel in this field are committed to developing an APT attack chain restoration system based on a data provenance graph, which takes a data provenance graph or system log as input and a restored APT attack chain as output. It can provide security analysts with a clear attack transmission process and use public threat intelligence to improve the universality of the system. Summary of the invention

[0015] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to collect information on the attacked host and build a complete APT attack chain to provide analysts with a clear attack transmission process.

[0016] To achieve the above-mentioned purpose, the present invention provides an APT attack chain restoration system based on a data traceability graph, which is characterized by comprising a data traceability graph recording module, an input module, a data traceability graph compression module, an infection point positioning module and an attack chain mapping module;

[0017] The data traceability graph recording module is used to monitor system activities in the target host and record them in the data traceability graph format;

[0018] The input module is used to obtain input data in the data traceability diagram format or the system log format to obtain the original data traceability diagram;

[0019] The data traceability graph compression module is used to compress the original data traceability graph to obtain a data traceability graph;

[0020] The infection point positioning module is used to mark suspicious nodes and edges in the data traceability graph, calibrate the position of the attack event in the data traceability graph, and obtain a located data traceability graph;

[0021] The attack chain mapping module maps the nodes and edges in the located data provenance graph to various stages of the APT attack chain through mapping rules, and finally constructs a complete APT attack chain.

[0022] Furthermore, the data provenance diagram recording module uses a cross-platform data provenance diagram recording tool SPADE.

[0023] Furthermore, the input module uses a conversion script to convert the input data of the system log into a data provenance diagram format to obtain an original data provenance diagram.

[0024] Furthermore, the data provenance graph compression module converts the original data provenance graph to make it an acyclic graph.

[0025] Furthermore, the data provenance graph compression module deletes redundant information from the original data provenance graph that becomes an acyclic graph through a compression algorithm to obtain a data provenance graph.

[0026] Furthermore, the compression algorithm includes an edge compression algorithm and a node compression algorithm.

[0027] Furthermore, the infection point location module uses public threat intelligence to mark the infection points in the data traceability graph and locate the nodes and edges related to the APT attack.

[0028] Furthermore, the attack chain mapping module uses attack chain mapping rules, takes the infection point located in the infection point positioning module as a base point, performs a depth-first search on the located data traceability graph, matches nodes and edges that satisfy the mapping rules, and maps them to various stages of the APT attack chain, ultimately obtaining a complete APT attack chain.

[0029] An APT attack chain restoration method based on an APT attack chain restoration system of a data traceability graph, characterized in that the method comprises the following steps:

[0030] Step 1: The user obtains the data traceability diagram of the system through the data traceability diagram recording module, or obtains the system log by using the system's own audit function;

[0031] Step 2: The user obtains the data provenance diagram or system log obtained in step 1 and inputs it into the system through the input module. For the system log, the input module converts it into a data provenance diagram format;

[0032] Step 3: The data traceability graph compression module compresses the data traceability graph input by the input module, retains key information and removes redundant information irrelevant to the APT attack;

[0033] Step 4: The infection point location module uses public threat intelligence information to mark the infection points in the data traceability graph, so that the system can accurately locate the nodes and edges related to the attack in the data traceability graph;

[0034] Step 5: The attack chain mapping module uses the attack chain mapping rules written by itself to perform a depth-first search on the data traceability graph based on the infection point located in step 4, and matches the nodes and edges that meet the mapping rules, maps them to the corresponding steps of the APT attack chain, and finally outputs a complete APT attack chain;

[0035] Step 6: Display the restored APT attack chain to the user, so that the user can understand the complete attack transmission process and take targeted defensive measures.

[0036] Furthermore, the step 3 also includes:

[0037] The data provenance graph compression module first creates versions of the nodes in the data provenance graph to satisfy the acyclic property, and then deletes redundant information in the data provenance graph through edge compression and node compression algorithms to achieve compression of the data provenance graph.

[0038] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0039] The present invention uses the data traceability graph recorded by the system log and SPADE tool as the original input, removes the redundant information by compressing the data traceability graph, and then calibrates the infection points in the graph. Finally, the attack chain mapping module gives a complete APT attack chain. Data traceability graph compression improves system efficiency and reduces storage overhead; infection point positioning based on public threat intelligence improves the universality of the system; the final APT attack chain can provide analysts with a complete attack transmission process, so that analysts have a clear understanding of the overall picture of APT attacks, and thus take effective defensive measures.

[0040] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a schematic diagram of the system composition of a preferred embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of the APT attack chain restoration process of a preferred embodiment of the present invention;

[0043] Figure 3 It is a schematic diagram of the APT attack chain restoration result of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0044] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0045] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is appropriately exaggerated in some places in the drawings.

[0046] like Figure 1 The figure shows a schematic diagram of the system composition of a preferred embodiment of the present invention, which is composed of a data traceability graph recording module, an input module, a data traceability graph compression module, an infection point positioning module based on public threat intelligence, and an attack chain mapping module. The system uses the data traceability graph recorded by the system log and the SPADE tool as the original input, removes the redundant information by compressing the data traceability graph, and then calibrates the infection points in the graph. Finally, the attack chain mapping module gives a complete APT attack chain.

[0047] Specifically:

[0048] 1) Data traceability graph recording module: monitors system activities in the target host and records them in the format of a data traceability graph;

[0049] 2) Input module: obtain input data in data traceability graph format or system log format;

[0050] 3) Data provenance graph compression module: First, the data provenance graph is transformed into an acyclic graph, and then the graph is compressed to delete nodes and edges that are not related to the attack;

[0051] 4) Infection point location module: Use public threat intelligence to match nodes and edges in the data traceability graph and locate nodes and edges related to APT attacks;

[0052] 5) Attack chain mapping module: Using the infection point located in the infection point location module as the base point, it matches the nodes and edges in the data traceability graph and maps them to the various stages of the APT attack chain, and finally obtains a complete APT attack chain.

[0053] like Figure 2 The following is the processing flow of the APT attack chain restoration system based on the data traceability diagram, including:

[0054] 1) The user collects the system log of the target host or uses the SPADE tool installed on the target host to collect data traceability diagrams;

[0055] 2) The input module receives user input and converts data in system log format into data traceability graph format;

[0056] 3) The data traceability graph compression module first creates versions of the nodes in the data traceability graph to satisfy the acyclic property, and then deletes the redundant information in the traceability graph through edge compression and node compression algorithms to achieve compression of the data traceability graph;

[0057] 4) The infection point location module uses public threat intelligence information to match nodes and edges in the data traceability graph and locate nodes and edges related to APT attacks;

[0058] 5) Finally, through the attack chain mapping module, the nodes and edges in the traceability graph that meet the mapping rules are matched, and they are mapped to the various stages of the APT attack chain, and finally the complete APT attack chain is obtained.

[0059] like Figure 3 As shown in the figure, the final restored result of the APT attack chain is given. From the figure, we can clearly understand the various stages of the APT attack and the attack events that occurred in each stage, which can provide great help to security analysts.

[0060] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. An APT attack chain restoration system based on data traceability graph, characterized in that: It includes data traceability graph recording module, input module, data traceability graph compression module, infection point positioning module and attack chain mapping module; The data traceability graph recording module is used to monitor system activities in the target host and record them in the data traceability graph format; The input module is used to obtain input data in the data traceability diagram format or the system log format to obtain the original data traceability diagram; The data traceability graph compression module is used to compress the original data traceability graph to obtain a data traceability graph; The infection point positioning module is used to mark suspicious nodes and edges in the data traceability graph, calibrate the position of the attack event in the data traceability graph, and obtain a located data traceability graph; The attack chain mapping module maps the nodes and edges in the located data provenance graph to various stages of the APT attack chain through mapping rules, and finally constructs a complete APT attack chain.

2. The APT attack chain restoration system based on data traceability graph according to claim 1, characterized in that: The data provenance diagram recording module uses the cross-platform data provenance diagram recording tool SPADE.

3. The APT attack chain restoration system based on data traceability graph as claimed in claim 1, characterized in that: The input module uses a conversion script to convert the input data of the system log into a data traceability diagram format to obtain the original data traceability diagram.

4. The APT attack chain restoration system based on data traceability graph as claimed in claim 1, characterized in that: The data provenance graph compression module converts the original data provenance graph to make it an acyclic graph.

5. The APT attack chain restoration system based on data traceability graph as claimed in claim 4, characterized in that: The data provenance graph compression module deletes redundant information from the original data provenance graph that becomes an acyclic graph through a compression algorithm to obtain a data provenance graph.

6. The APT attack chain restoration system based on data traceability graph as claimed in claim 5, characterized in that: The compression algorithm includes an edge compression algorithm and a node compression algorithm.

7. The APT attack chain restoration system based on data traceability graph as claimed in claim 1, characterized in that: The infection point location module uses public threat intelligence to mark the infection points in the data traceability graph and locate the nodes and edges related to the APT attack.

8. The APT attack chain restoration system based on data traceability graph as claimed in claim 7, characterized in that: The attack chain mapping module uses the attack chain mapping rules, takes the infection point located in the infection point positioning module as the base point, performs a depth-first search on the located data traceability graph, matches the nodes and edges that meet the mapping rules, and maps them to various stages of the APT attack chain, and finally obtains a complete APT attack chain.

9. An APT attack chain restoration method based on the APT attack chain restoration system based on a data provenance graph as claimed in any one of claims 1 to 7, characterized in that: The method comprises the following steps: Step 1: The user obtains the data traceability diagram of the system through the data traceability diagram recording module, or obtains the system log by using the system's own audit function; Step 2: The user obtains the data provenance diagram or system log obtained in step 1 and inputs it into the system through the input module. For the system log, the input module converts it into a data provenance diagram format; Step 3: The data traceability graph compression module compresses the data traceability graph input by the input module, retains key information and removes redundant information irrelevant to the APT attack; Step 4: The infection point location module uses public threat intelligence information to mark the infection points in the data traceability graph, so that the system can accurately locate the nodes and edges related to the attack in the data traceability graph; Step 5: The attack chain mapping module uses the attack chain mapping rules written by itself to perform a depth-first search on the data traceability graph based on the infection point located in step 4, and matches the nodes and edges that meet the mapping rules, maps them to the corresponding steps of the APT attack chain, and finally outputs a complete APT attack chain; Step 6: Display the restored APT attack chain to the user, so that the user can understand the complete attack transmission process and take targeted defensive measures.

10. The APT attack chain restoration method based on data traceability graph according to claim 9, characterized in that: The step 3 also includes: The data provenance graph compression module first creates versions of the nodes in the data provenance graph to satisfy the acyclic property, and then deletes redundant information in the data provenance graph through edge compression and node compression algorithms to achieve compression of the data provenance graph.

Images