A network attack tool relationship discovery method based on hierarchical restart random walk algorithm

Abstract

The present invention discloses a network attack tool relationship discovery method based on a hierarchical restart random walk algorithm, which extracts attack samples, attack patterns and IOCs from multi-source data, and constructs a relationship matrix, and mines potential network attack features by considering the relationship between code samples, attack processes and attributes, so that the extracted data is more comprehensive and specific, and the utilization rate of multi-source data is improved; the attack sample relationship matrix, the attack pattern relationship matrix and the IOC relationship matrix are iteratively calculated using the restart walk algorithm, so that the generated correlation score triples ensure the integrity of multi-source data, reduce data loss, and improve the accuracy of network attack tool identification. Potential network attack tools are discovered through the reasoning relationship between network attack tool pairs, and multiple potential network attack tools can be effectively processed, reducing labor costs and improving the comprehensiveness and accuracy of network attack tool detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack tool relationship discovery method based on a hierarchical restart random walk algorithm. Background Art

[0002] The Internet plays an increasingly important role in the economy, education, culture and other social aspects due to its fast and cheap information transmission, and its application is becoming more and more extensive. As a brand-new technological revolution, the Internet has had a huge impact on all areas of society. However, with the development of the Internet, the security threats and traditional security issues that come with it are intertwined, resulting in increasingly complex cyberspace security issues. We are facing increasing network security risks and endless cyber attacks.

[0003] The network attack tools used in network attack incidents can be distinguished from two levels: theoretical attack and technical attack. The so-called theoretical attack is an attack in the sense of cryptography, which only focuses on the attack concept or attack process and algorithm, without considering the specific technical implementation. Technical attacks are related to specific network protocols, operating systems and applications, and there are obvious and operable attack steps. Attackers can use certain analysis methods and attack tools to achieve specific attack goals. Generally speaking, theoretical attacks are the theoretical basis of technical attacks. Almost every technical attack can be ultimately attributed to a certain type of theoretical attack. For example, tampering with router routing tables and server domain name tables is a cryptographic integrity violation. Attacks and serial number guessing attacks can be classified as cryptographic counterfeit attacks, but theoretical attacks may not necessarily become practical technical attacks. For example, differential cryptanalysis is a relatively mature theoretical attack method for iterative block ciphers. However, to turn it into a technical attack method and actually decipher a specific ciphertext, there is still the difficulty of obtaining a large number of plaintext options and a large number of expert interventions, that is, there is data complexity and processing complexity. Similarly, theoretical attacks in the cryptographic sense, including attacks on certain encryption algorithms, attacks on signature algorithms, attacks on key exchange and authentication protocols, may not necessarily provide effective implementation methods. Therefore, so far, the classification of network attacks has mainly focused on the technical level, because at this level, the attack is related to a specific network system, and there are clear and actionable steps and predictable results.

[0004] Therefore, how to quickly identify network attack tools and then effectively prevent and deal with network attack incidents has become a key link in effectively reducing network security risks. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention aims to provide a network attack tool relationship discovery method based on a hierarchical restart random walk algorithm.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A network attack tool relationship discovery method based on hierarchical restart random walk algorithm, the specific process is as follows:

[0008] S1. Constructing a network attack tool relationship matrix: extracting data about attack samples, attack patterns and IOCs from multi-source data, and constructing an attack sample relationship matrix, an attack pattern relationship matrix and an IOC relationship matrix; an attack sample refers to a malicious code sample of a certain scale that can threaten the network; an attack pattern refers to an abstract attack action of executing malicious code, that is, the attack process of executing malicious code; and an IOC refers to an indicative value generated during the attack process;

[0009] S2. Calculate hierarchical reasoning probability: Use the obtained attack sample relationship matrix, attack pattern relationship matrix and IOC relationship matrix as the initial probability distribution matrix, and use the restarted random walk algorithm to walk the three matrices respectively to obtain the three-level correlation score matrices of attack sample relationship matrix, attack pattern relationship matrix and IOC relationship matrix;

[0010] S3. Calculate the probability of network attack tool relationship reasoning: Linearly fit the obtained three-level correlation score matrix to obtain the relationship reasoning probability Sr of the target network attack tool pair attack ;

[0011] S4, determine the relationship between network attack tool pairs: set the threshold to σ, and judge the inference relationship results of network attack tool pairs according to the threshold σ. attack >σ, it is considered that there is an inference relationship between the corresponding attack tool pairs.

[0012] Furthermore, the specific process of step S1 is:

[0013] S11. Construct attack sample relationship matrix R Sample : Extract data about attack samples from multi-source data and construct the relationship matrix R between attack samples and attack samples Sample , R Sample Each element in represents the correlation of each attack sample pair. The correlation of any attack sample pair is calculated by the similarity of the attack sample grayscale images.

[0014] S12. Construct attack mode relationship matrix R TTP : Extract data about attack patterns from multi-source data and construct the relationship matrix R between attack patterns and attack patterns TTP , R TTP Each element in represents the correlation of each attack pattern pair. The correlation of any attack pattern pair is calculated by attack pattern graph matching;

[0015] S13. Construct IOC relationship matrix R IOC : Extract data about IOC from multi-source data such as network attack tool analysis reports, APT analysis reports, and related forums, and construct the relationship matrix R between IOC and IOC IOC ; R IOC Each element in represents the relevance of each IOC pair. The relevance of any IOC pair is calculated by the edit distance;

[0016] S14, based on the attack sample relationship matrix R Sample , attack mode relationship matrix R TTP and IOC relationship matrix R IOC Generate a relation matrix triple: {R Sample , R TTP , R IOC}.

[0017] Furthermore, in step S11, the specific process of calculating the correlation of any attack sample pair according to the similarity of the attack sample grayscale image is as follows:

[0018] Extract malicious code samples from multi-source data; use the B2M algorithm to convert the malicious code samples into attack sample grayscale images; arbitrarily select two attack sample grayscale images, and adjust the sizes of the two attack sample grayscale images to the same size to generate two grayscale histograms; divide each grayscale histogram into a region of 4 grayscale levels, a total of 64 regions, sum the 4 values ​​of each region, and obtain 64 values, which are used as the vectors of the grayscale histogram, and the cosine similarity of the two vectors corresponding to the two grayscale histograms is calculated to generate the attack sample grayscale image similarity, and the attack sample grayscale image similarity is used as the correlation between the corresponding two attack samples; thereby, the correlation between each attack sample pair in all attack samples is calculated to obtain the attack sample relationship matrix R Sample And expressed as:

[0019]

[0020] Among them, the matrix element a ij Represents the grayscale image of the attack sample a i And the attack sample grayscale image a j The value of the correlation between .

[0021] Furthermore, the calculation steps of converting the malicious code sample into the attack sample grayscale image using the B2M algorithm are: reading the malicious code sample in the form of a binary stream to generate a binary data stream; taking 8 bits of binary as a unit, converting 8 bits of binary into an unsigned integer to form a numerical vector of a specified width, i.e., a width vector; constructing an array of the binary data stream according to the width vector; and making a one-to-one correspondence between the array values ​​0x00 to 0xFF and the image pixel values ​​0-255 to realize the mutual conversion between the array values ​​and the image pixel values ​​to generate an attack sample grayscale image.

[0022] Furthermore, in step S12, the specific process of generating the attack pattern graph based on the attack pattern related data is as follows:

[0023] 1) The log information in the extracted attack pattern related data is used as the input data for generating the attack pattern graph; the source data corresponding to the log information is grouped according to the IP address as the input cluster, the attack event is marked as a behavioral activity, the dependency relationship between each activity is mined, and the long-distance dependency and self-loop relationship between activities are found; the mining result is output, that is, the directed graph G containing all attack chains; then the complexity of the directed graph G is calculated. If the complexity of the directed graph G is greater than the specified threshold, the directed graph G is output; otherwise, the directed graph G is put into the queue Q s In the queue Q s Used to store directed graphs to be split, initially an empty queue;

[0024] 2) Traverse the queue Q s , for each directed graph G in the queue, find the branch point from top to bottom; use the branch point as the starting point for segmentation, remove the independent subgraphs in the directed graph G, and then add the remaining directed edges starting from the branch point to the queue Q e In the queue Q e Used to store the directed edges to be traversed starting from the branch point, initially an empty queue;

[0025] 3) Traverse the queue Q e , use the breadth-first algorithm to traverse the traversed directed edge e and generate the successor subgraph of e. For each successor subgraph G e , calculate G e Complexity, if G e is not a complex subgraph, G e Add to the output queue, otherwise G e Join the queue s ;

[0026] 4) Determine the queue Q s Is it empty? If Q s is not empty, return to step 2); if Q sIf it is empty, the directed graph G in the output queue is processed by the branch information completion algorithm to obtain the directed graph G', and the output G' is the attack pattern graph;

[0027] The branch information completion algorithm is as follows: remove the first element of the output queue from the queue, record it as G', obtain the starting point of G' as the vertex; check whether the predecessor vertex of the vertex exists, if so, add it to G'; traverse G' using the breadth-first algorithm, for all vertices v∈G', check the directed edge e with v as the end point and the predecessor vertex, if Then v pred And the directed edge e with v as the end point is added to G': Output attack pattern graph G'; Repeat the above steps until the output queue is empty.

[0028] Furthermore, in step S12, the specific process of calculating the correlation of any attack pattern pair by attack pattern graph matching is as follows:

[0029] (1) Extracting feature vectors from the attack pattern image: grayscale the attack pattern image and enhance the image using median filtering and morphological methods to ensure that the main texture features of the image are clear and discernible; use histogram equalization technology to process the image so that it meets the uniform mean and variance, thereby obtaining a standard image;

[0030] (2) Feature extraction: construct a Gaussian pyramid of the image obtained by step (1), divide the image into blocks, and make it present a hierarchical pyramid structure. Further count the features of each sub-structure separately until all structural features are counted and spliced ​​into complete features; use the PCA algorithm to reduce the dimension of the image and store it in the image library after processing; use the K-means clustering method to discretize the feature set and convert the discretized features into neighborhood features;

[0031] (3) Establishing an image feature index: using inverted indexing technology to quickly retrieve the image features obtained in step (2);

[0032] (4) Image feature matching: A search feature is set. After quantization, the index item Wi corresponding to the search feature is determined in the inverse search. A series of related index features corresponding to the index item Wi are further used as candidate matching results to generate a feature vector in the attack pattern graph.

[0033] (5) Based on the feature vector, the correlation between attack patterns is calculated using cosine similarity. The specific calculation formula is as follows:

[0034]

[0035] Among them, x i ,y iThey represent the components of the feature vector x and feature vector y corresponding to the two attack pattern graphs, and θ represents the angle between the two vectors;

[0036] (6) Collect the correlations between attack patterns and generate the relationship matrix R between attack patterns TTP , expressed as:

[0037]

[0038] Among them, the matrix element b ij Indicates attack mode b i With attack mode b j The value of the correlation between

[0039] Specifically, data about IOC, i.e., IOC files, are extracted from multiple source data such as network attack tool analysis reports, APT analysis reports, and related forums. The IOC files are disassembled to generate character strings. Based on the first character string and the second character string (i.e., the character strings corresponding to the two IOC files), the correlation between the IOCs is calculated using the edit distance.

[0040] Furthermore, in step S13, the specific process of calculating the correlation of any IOC pair using the edit distance is as follows: cutting the first string and the second string to obtain a first substring of the first string and a second substring of the second string; comparing the second substring with the first string and deleting the same part of the first string as the second substring to obtain a first difference string, comparing the first substring with the second string and deleting the same part of the second string as the first substring to obtain a second difference string; calculating the similarity between the first string and the second string according to the length of the first string, the length of the second string, the length of the first difference string, and the length of the second difference string, that is, the correlation between the IOC files, and the specific calculation formula is as follows:

[0041]

[0042] Wherein, L(S1) is the length of the first string, L(S2) ​​is the length of the second string, L(DS1) is the length of the first difference string, L(DS2) is the length of the second difference string, and A is the similarity;

[0043] IOC relationship matrix R IOC It is expressed as:

[0044]

[0045] Among them, the matrix element c ij Indicates IOC data c i With IOC datacj The value of the correlation between .

[0046] Furthermore, the specific process of step S2 is:

[0047] S21, using the restarted random walk algorithm to calculate the attack sample relationship matrix R obtained in step S1 Sample Iterate, the calculation steps are as follows: The attack sample relationship matrix R Sample Split by column into m is the number of nodes; the formula for iteration using the restarted random walk algorithm is as follows:

[0048] G Sample =R Sample

[0049] Among them, "=" is the assignment symbol;

[0050]

[0051]

[0052]

[0053] In the above formula, Denotes the standardized G Sample ; represents the transition probability vector when the number of iterations is t, When the next step is to transfer to R Sample Target node x i probability; represents the initial vector of size [m, 1], when the target node x i When it is 1, the other elements are 0, m is the number of nodes; p means returning to the initial position x in each iteration. j The probability of attack sample relationship matrix R sample Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate the attack sample relationship matrix R Sample The correlation score matrix Sr Sample ;

[0054] S22, using the restart random walk algorithm to analyze the attack mode relationship matrix R TTP Iterate to generate the attack mode relationship matrix R TTP The correlation score matrix Sr TTP , the specific process is:

[0055] The attack pattern relationship matrix R TTP Split by column into m is the number of nodes; the formula for iteration using the restarted random walk algorithm is as follows:

[0056] G TTP =R TTP

[0057] Among them, "=" is the assignment symbol;

[0058]

[0059]

[0060]

[0061] In the above formula, Denotes the standardized G TTP ;

[0062] Then, the attack pattern relationship matrix R TTP Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate the attack mode relationship matrix R TTP The correlation score matrix Sr TTP ;

[0063] S23, using the restart random walk algorithm to calculate the IOC relationship matrix R IOC ] to iterate and generate the correlation score matrix Sr of the IOC relationship matrix IOC ; The specific process is:

[0064] The IOC relationship matrix R IOC Split by column into m is the number of nodes; the formula for iteration using the restarted random walk algorithm is as follows:

[0065] G IOC =R IOC

[0066] Among them, "=" is the assignment symbol;

[0067]

[0068]

[0069]

[0070] In the above formula, Denotes the standardized G IOC ;

[0071] Then, the IOC relationship matrix R IOCRestart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate a correlation score matrix of the IOC relationship matrix;

[0072] S24, correlation score matrix Sr based on attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Generate a correlation score matrix triple {Sr Sample , Sr. TTP , Sr. IOC}.

[0073] Furthermore, the specific process of step S3 is:

[0074] S31, correlation score matrix Sr based on attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC , use linear regression to calculate the bias value b, and pre-set the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Set the weight w Sample 、w TTP 、w IOC ;

[0075] S32, the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Perform linear fitting to generate the relationship inference probability Sr between network attack tools tool :

[0076] Sr tool =w Sample ×Sr Sample +w TTP ×Sr TTP +w IOC ×Sr IOC +b

[0077] Among them, w Sample 、w TTP 、w IOC represents the weight, and b represents the bias value.

[0078] Furthermore, the correlation score matrix Sr based on the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC , the specific process of calculating the bias value b using linear regression is:

[0079] The weight w Sample 、w TTP 、w IOC Combined with the bias value b, represented by δ, is expressed as δ = (w Sample , w TTP , w IOC , b), the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Rewrite separately Then the above correlation score matrix is ​​expressed as:

[0080]

[0081] Then the relational reasoning probability Sr tool Written as: Y = (y 1 ,y 2 ,y 3 ) T , and then, the relationship reasoning probability Sr between network attack tools tool It is expressed as: f(X) = Xδ;

[0082] Define the loss function, expressed as:

[0083]

[0084] Then, δ is derived, and the specific calculation process is:

[0085]

[0086] make We can get:

[0087] X T Xδ-X T Y=0

[0088] δ=(X T X) -1 X T Y

[0089] Furthermore, and Y=(y 1 ,y 2 ,y3 ) T Substitute into the above formula and solve for the specific value of δ. Since W Sample 、w TTP , W IOC The value of has been preset, and the bias value b is generated based on δ.

[0090] The beneficial effects of the present invention are:

[0091] (1) The present invention extracts attack samples, attack patterns and IOCs from multi-source data and constructs a relationship matrix. By considering the relationship between code samples, attack processes and attributes, potential network attack features are mined, making the extracted data more comprehensive and specific, and improving the utilization rate of multi-source data;

[0092] (2) The present invention utilizes a restarting walk algorithm to iteratively calculate the attack sample relationship matrix, the attack pattern relationship matrix, and the IOC relationship matrix, so that the generated correlation score triples ensure the integrity of multi-source data, reduce data loss, and improve the accuracy of network attack tool identification.

[0093] (3) The present invention discovers potential network attack tools through the inference relationship between pairs of network attack tools, and can effectively process multiple potential network attack tools, thereby reducing labor costs and improving the comprehensiveness and accuracy of network attack tool detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] Figure 1 It is a schematic diagram of the overall flow of the method of an embodiment of the present invention;

[0095] Figure 2 This is a specific flow chart of step S1 of the method according to an embodiment of the present invention;

[0096] Figure 3 This is a specific flow chart of step S2 of the method according to an embodiment of the present invention;

[0097] Figure 4 Schematic diagram of the specific flow of step S3 of the method according to the embodiment of the present invention. DETAILED DESCRIPTION

[0098] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0099] This embodiment provides a network attack tool relationship discovery method based on a hierarchical restart random walk algorithm. Figure 1 As shown, the specific process is:

[0100] S1. Construct a network attack tool relationship matrix: Extract and construct attack sample relationship matrix, attack mode relationship matrix and IOC relationship matrix from network attack tool analysis reports, APT (Advanced Persistent Threat, also known as targeted threat, which refers to the continuous and effective attack activities launched by an organization against a specific object) analysis reports, relevant forums and other multi-source data; among them, IOC refers to indicative values ​​such as IP addresses, domain names, files, etc. generated during the attack process.

[0101] Specifically, attack samples refer to malicious code samples of a certain scale that can pose a threat to the network, such as viruses, Trojans and other malicious code samples; attack modes refer to abstract attack actions of executing malicious codes, that is, the attack process of executing malicious codes, including: log information, memory data, network connection information, scheduled task information, etc.

[0102] S2. Calculate the hierarchical reasoning probability: Use the obtained attack sample relationship matrix, attack pattern relationship matrix and IOC relationship matrix as the initial probability distribution matrix, and use the restarted random walk algorithm to walk the three matrices respectively to obtain the three-level correlation score matrices of the attack sample relationship matrix, attack pattern relationship matrix and IOC relationship matrix.

[0103] S3. Calculate the probability of network attack tool relationship reasoning: Linearly fit the obtained three-level correlation score matrix to obtain the relationship reasoning probability Sr of the target network attack tool pair attack .

[0104] S4, determine the relationship between network attack tool pairs: set the threshold to σ, and judge the inference relationship results of network attack tool pairs according to the threshold σ. attack >σ, it is considered that there is an inference relationship between the corresponding attack tool pairs.

[0105] Specifically, the inference relationship means that based on the acquired network attack tools, potential network attack tools that are similar to or related to existing network attack tools can be detected, that is, the detected network attack tools have the same network threats as the acquired network attack tools.

[0106] Furthermore, if Figure 2 As shown, the specific process of step S1 is:

[0107] S11. Construct attack sample relationship matrix R Sample : Extract data about attack samples from multi-source data such as network attack tool analysis reports, APT analysis reports, and related forums, and construct the relationship matrix R between attack samples and attack samples Sample , R SampleEach element in represents the correlation of each attack sample pair. The correlation of any attack sample pair is calculated by the similarity of the attack sample grayscale images.

[0108] Specifically, the steps of calculating the correlation of any attack sample pair according to the similarity of the attack sample grayscale image are as follows: extract malicious code samples from multi-source data such as network attack tool analysis reports, APT analysis reports, and related forums; use the B2M algorithm to convert the malicious code samples into attack sample grayscale images; arbitrarily select two attack sample grayscale images, and adjust the sizes of the two attack sample grayscale images to the same size to generate two grayscale histograms; divide each grayscale histogram into a region with every 4 grayscale levels, for a total of 64 regions, sum the 4 values ​​of each region to obtain 64 values, and use them as the vectors of the grayscale histogram, calculate the cosine similarity of the two vectors corresponding to the two grayscale histograms, generate the attack sample grayscale image similarity, and use the attack sample grayscale image similarity as the correlation between the corresponding two attack samples; thereby calculate the correlation between each attack sample pair in all attack samples to obtain the attack sample relationship matrix R Sample And expressed as:

[0109]

[0110] Among them, the matrix element a ij Represents the grayscale image of the attack sample a i And the attack sample grayscale image a j The value of the correlation between .

[0111] Furthermore, the calculation steps of converting the malicious code sample into the attack sample grayscale image using the B2M algorithm are as follows: read the malicious code sample through the binary stream (10001000000011010010111010010111......) to generate a binary data stream; take 8-bit binary as a unit, convert the 8-bit binary into an unsigned integer to form a numerical vector of a specified width, namely, a width vector; construct an array of the binary data stream according to the width vector; correspond the array values ​​0x00~0xFF to the image pixel values ​​0-255 one by one, realize the mutual conversion between the array values ​​and the image pixel values, and generate the attack sample grayscale image.

[0112] S12. Construct attack mode relationship matrix R TTP : Extract data about attack patterns from multi-source data such as network attack tool analysis reports, APT analysis reports, and related forums, and construct the relationship matrix R between attack patterns and attack patterns TTP , R TTP Each element in represents the correlation of each attack pattern pair. The correlation of any attack pattern pair is calculated by attack pattern graph matching.

[0113] Specifically, attack pattern related data (including log information, memory data, network connection information, scheduled task information, etc.) are extracted from multi-source data such as network attack tool analysis reports, APT analysis reports, and related forums, and an attack pattern graph is generated based on the attack pattern related data. The specific steps are as follows:

[0114] 1) The log information in the extracted attack pattern related data is used as the input data for generating the attack pattern graph; the source data corresponding to the log information is grouped according to the IP address as the input cluster, the attack event is marked as a behavioral activity, the dependency relationship between each activity is mined, and the long-distance dependency and self-loop relationship between activities are found; the mining result is output, that is, the directed graph G containing all attack chains; then the complexity of the directed graph G is calculated. If the complexity of the directed graph G is greater than the specified threshold, the directed graph G is output; otherwise, the directed graph G is put into the queue Q s (where queue Q s Used to store directed graphs to be split, initially an empty queue);

[0115] 2) Traverse the queue Q s , for each directed graph G in the queue, find the branch point from top to bottom; use the branch point as the starting point for segmentation, remove the independent subgraphs in the directed graph G, and then add the remaining directed edges starting from the branch point to the queue Q e (where queue Q e Used to store the directed edges to be traversed starting from the branch point, initially an empty queue);

[0116] 3) Traverse the queue Q e , use the breadth-first algorithm to traverse the traversed directed edge e and generate the successor subgraph of e. For each successor subgraph G e , calculate G e Complexity, if G e is not a complex subgraph, G e Add to the output queue, otherwise G e Join the queue s ;

[0117] 4) Determine the queue Q s Is it empty? If Q s is not empty, return to step 2); if Q s If it is empty, the directed graph G in the output queue is processed by the branch information completion algorithm to obtain the directed graph G', and the output G' is the attack pattern graph.

[0118] The branch information completion algorithm is as follows: remove the first element of the output queue from the queue, record it as G', obtain the starting point of G' as the vertex; check whether the predecessor vertex of the vertex exists, if so, add it to G'; traverse G' using the breadth-first algorithm, for all vertices v∈G', check the directed edge e with v as the end point and the predecessor vertex, if Then v pred And the directed edge e with v as the end point is added to G': Output attack pattern graph G'; Repeat the above steps until the output queue is empty.

[0119] The specific process of calculating the correlation of any attack pattern pair by attack pattern graph matching is as follows:

[0120] (1) Extracting feature vectors (including attack paths and network associations) from the attack pattern graph. The specific steps are as follows: graying the attack pattern graph and enhancing the image through median filtering and morphological methods to ensure that the main texture features of the image are clear and discernible; using histogram equalization technology to process the image so that it satisfies a uniform mean and variance, thereby obtaining a standard image;

[0121] (2) Feature extraction: construct a Gaussian pyramid of the image obtained by step (1), divide the image into blocks, and make it present a hierarchical pyramid structure. Further count the features of each sub-structure separately until all structural features are counted and spliced ​​into complete features; use the PCA algorithm to reduce the dimension of the image and store it in the image library after processing; use the K-means clustering method to discretize the feature set and convert the discretized features into neighborhood features;

[0122] (3) Establishing an image feature index: using inverted indexing technology to quickly retrieve the image features obtained in step (2);

[0123] (4) Image feature matching: A search feature is set. After quantization, the index item Wi corresponding to the search feature is determined in the inverse search. A series of related index features corresponding to the index item Wi are further used as candidate matching results to generate a feature vector in the attack pattern graph.

[0124] Furthermore, in step (2), the specific steps of using the PCA algorithm to reduce the dimensionality of the image are as follows: for the feature set P = (P1, P2...Pn) of the original image, the formula Calculate the average value; subtract the average value from the original data to get Pi′=Pi-M, and then use the formula Calculate the covariance matrix; calculate the eigenvalues E1, E2,..., Em and eigenvectors EV1, EV2,..., EVm of the covariance matrix. Further, sort the eigenvalues in descending order to obtain E1′, E2′,..., Em′ and the corresponding eigenvectors EV1′, EV2′,..., EVm′; select the top 32 according to the magnitudes of the eigenvalues, reducing the image from the original 128 dimensions to the new 32 dimensions to complete the dimensionality reduction process for the image;

[0125] Furthermore, in step (2), the specific process of using the K-means clustering method for feature set discretization is as follows: A1. Extract the feature set from the image library and perform discretization on it using K-means clustering. The clustering label is the index value of the image, and the feature set is divided into K discrete clusters; use an iterative method to divide each feature into the cluster closest to it. Among them, the single-linkage method is used for the inter-class distance metric. For any two clusters Ci and Cj, the calculation formula of the single-linkage method is:

[0126] dist(Ci,Cj)=min{dist(xi,xj)丨xi∈Ci,xj∈Cj}

[0127] (5) Calculate the correlation degree between attack patterns based on the eigenvectors using the cosine similarity. The specific calculation formula is as follows:

[0128]

[0129] where, x i , y i represent the components of the eigenvectors x and y corresponding to two attack pattern graphs respectively, and θ represents the included angle between the two vectors.

[0130] (6) Aggregate the correlation degrees between attack patterns to generate the relationship matrix R TTP between attack patterns, which is expressed as:

[0131]

[0132] where, the matrix element b ij represents the value of the correlation degree between attack pattern b i and attack pattern b j .

[0133] S13. Construct the IOC relationship matrix R IOC : Extract the data about IOC from multi-source data such as network attack tool analysis reports, APT analysis reports, and relevant forums, and construct the relationship matrix R IOC between IOC and IOC; IOC Each element in R represents the correlation degree of each IOC pair, and the correlation degree of any IOC pair is calculated by the edit distance.

[0134] Specifically, data about IOC, i.e., IOC files, are extracted from multiple source data such as network attack tool analysis reports, APT analysis reports, and related forums. The IOC files are disassembled to generate character strings. Based on the first character string and the second character string (i.e., the character strings corresponding to the two IOC files), the correlation between the IOCs is calculated using the edit distance.

[0135] Furthermore, the specific process of calculating the correlation of any IOC pair using the edit distance is as follows: cutting the first string and the second string to obtain a first substring of the first string and a second substring of the second string; comparing the second substring with the first string and deleting the same part of the first string as the second substring to obtain a first difference string; comparing the first substring with the second string and deleting the same part of the second string as the first substring to obtain a second difference string; calculating the similarity between the first string and the second string according to the length of the first string, the length of the second string, the length of the first difference string, and the length of the second difference string, that is, the correlation between the IOC files. The specific calculation formula is as follows:

[0136]

[0137] Among them, L(S1) is the length of the first string, L(S2) ​​is the length of the second string, L(DS1) is the length of the first difference string, L(DS2) is the length of the second difference string, and A is the similarity.

[0138] Furthermore, the IOC relationship matrix R IOC It is expressed as:

[0139]

[0140] Among them, the matrix element c ij Indicates IOC data c i With IOC datac j The value of the correlation between them is the value of A calculated by the above process.

[0141] S14, based on the attack sample relationship matrix R Sample , attack mode relationship matrix R TTP and IOC relationship matrix R IOC Generate a relation matrix triple: {R Sample , R TTP , R IOC}.

[0142] It should be noted that the central idea of ​​random walk is: the initial position of random walk is x j, iteratively transfers to the adjacent point according to the correlation of the relationship matrix until it transfers to the target position x i Stop iteration; in each iteration, there is a certain probability of returning to the initial position, that is, in each iteration, the probability of returning to the initial position x is p. j ; until When the random walk algorithm is restarted to reach convergence, x is generated j With x i On this basis, in this embodiment, if Figure 3 As shown, the specific process of step S2 is:

[0143] S21, using the restarted random walk algorithm to calculate the attack sample relationship matrix R obtained in step S1 Sample Iterate, the calculation steps are as follows: The attack sample relationship matrix R Sample Split by column into (where m is the number of nodes); the formula for iteration using the restarted random walk algorithm is as follows:

[0144] G Sample =R Sample

[0145] Among them, “=” is the assignment symbol.

[0146]

[0147]

[0148]

[0149] In the above formula, Denotes the standardized G Sample ; represents the transition probability vector when the number of iterations is t, When the next step is to transfer to R Sample Target node x i probability; represents the initial vector of size [m, 1], when the target node x i When it is 1, the other elements are 0, m is the number of nodes; p means returning to the initial position x in each iteration. j The probability of attack sample relationship matrix R Sample Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate the attack sample relationship matrix R Sample The correlation score matrix Sr Sample ;

[0150] S22, using the restart random walk algorithm to analyze the attack mode relationship matrix R TTP Iterate to generate the attack mode relationship matrix R TTP The correlation score matrix Sr TTP , the specific process is:

[0151] The attack pattern relationship matrix R TTP Split by column into (where m is the number of nodes); the formula for iteration using the restarted random walk algorithm is as follows:

[0152] G TTP =R TTP

[0153] Among them, “=” is the assignment symbol.

[0154]

[0155]

[0156]

[0157] In the above formula, Denotes the standardized G TTP .

[0158] Then, the attack pattern relationship matrix R TTP Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate the attack mode relationship matrix R TTP The correlation score matrix Sr TTP .

[0159] S23, using the restart random walk algorithm to calculate the IOC relationship matrix R IOC Iterate to generate the correlation score matrix Sr of the IOC relationship matrix IOC ; The specific process is:

[0160] The IOC relationship matrix R IOC Split by column into (where m is the number of nodes); the formula for iteration using the restarted random walk algorithm is as follows:

[0161] G IOC =R IOC

[0162] Among them, “=” is the assignment symbol.

[0163]

[0164]

[0165]

[0166] In the above formula, Denotes the standardized G IOC ;

[0167] Then, the IOC relationship matrix R IOC Restart the random walk for each pair of nodes in and convert the obtained transition probability vector The correlation score matrix Sr of the IOC relationship matrix is ​​generated by splicing IOC .

[0168] S24, correlation score matrix Sr based on attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Generate a correlation score matrix triple {Sr Sample , Sr. TTP , Sr. IOC}.

[0169] Furthermore, in this embodiment, if Figure 4 As shown, the specific process of step S3 is:

[0170] S31, correlation score matrix Sr based on attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC , use linear regression to calculate the bias value b, and pre-set the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Set the weight w Sample 、w TTP 、w IOC .

[0171] Specifically, due to w Sample 、w TTP 、w IOC The value of is positively correlated with the importance of attack samples, attack patterns, and IOC to relational reasoning; the correlation score matrix Sr of the attack sample relation matrix Sample The correlation between attack tools and the correlation score matrix Sr of the attack pattern relationship matrix are presented. TTP Reflects the correlation between the attack pattern diagrams used by the attack tools; the correlation score matrix Sr of the IOC relationship matrixIOC Reflects the correlation of IOCs generated by attack tools; among the three, IOCs can better reflect the characteristics of different attack tools, so it is more meaningful to judge whether two attack tools have a reasoning relationship; while attack samples and attack patterns reflect the characteristics of attack tools less than IOCs, so the pre-set w IOC The larger the value, w Sample , W TTP Value relative to w IOC Smaller.

[0172] Furthermore, based on the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC , the calculation steps of using linear regression to calculate the bias value b are: sample , W TTP 、w IOC Combined with the bias value b, represented by δ, is expressed as δ = (w Sample , w TTP , w IOC , b), the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Rewrite separately Then the above correlation score matrix is ​​expressed as:

[0173]

[0174] Then the relational reasoning probability Sr tool Written as: Y = (y 1 ,y 2 ,y 3 ) T , and then, the relationship between network attack tools reasoning probability Sr tool It is expressed as: f(X) = Xδ;

[0175] Define the loss function, expressed as:

[0176]

[0177] Then, δ is derived, and the specific calculation process is:

[0178]

[0179] make We can get:

[0180] XT Xδ-X T Y=0

[0181] δ=(X T X) -1 X T Y

[0182] Furthermore, and Y=(y 1 ,y 2 ,y 3 ) T Substitute into the above formula and solve for the specific value of δ. Since w Sample 、w TTP 、w IOC The value of has been preset, and the bias value b is generated based on δ.

[0183] S32, the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Perform linear fitting to generate the relationship inference probability Sr between network attack tools tool :

[0184] Sr tool =w Sample ×Sr Sample +w TTP ×Sr TTP +w IOC ×Sr IOC +b

[0185] Among them, w Sample 、w TTP 、w IOC represents the weight, and b represents the bias value.

[0186] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A network attack tool relationship discovery method based on hierarchical restart random walk algorithm, characterized in that: The specific process is: S1. Constructing a network attack tool relationship matrix: extracting data about attack samples, attack patterns and IOCs from multi-source data, and constructing an attack sample relationship matrix, an attack pattern relationship matrix and an IOC relationship matrix; an attack sample refers to a malicious code sample of a certain scale that can threaten the network; an attack pattern refers to an abstract attack action of executing malicious code, that is, the attack process of executing malicious code; and an IOC refers to an indicative value generated during the attack process; S2. Calculate hierarchical reasoning probability: Use the obtained attack sample relationship matrix, attack pattern relationship matrix and IOC relationship matrix as the initial probability distribution matrix, and use the restarted random walk algorithm to walk the three matrices respectively to obtain the three-level correlation score matrices of attack sample relationship matrix, attack pattern relationship matrix and IOC relationship matrix; S3. Calculate the probability of network attack tool relationship reasoning: Linearly fit the obtained three-level correlation score matrix to obtain the relationship reasoning probability Sr of the target network attack tool pair attack ; S4, determine the relationship between network attack tool pairs: set the threshold to σ, and judge the inference relationship results of network attack tool pairs according to the threshold σ. attack >σ, it is considered that there is an inference relationship between the corresponding attack tool pairs; The specific process of step S1 is: S11. Construct attack sample relationship matrix R Sample : Extract data about attack samples from multi-source data and construct the relationship matrix R between attack samples and attack samples Sample , R Sample Each element in represents the correlation of each attack sample pair. The correlation of any attack sample pair is calculated by the similarity of the attack sample grayscale images. S12. Construct attack mode relationship matrix R TTP : Extract data about attack patterns from multi-source data and construct the relationship matrix R between attack patterns and attack patterns TTP , R TTP Each element in represents the correlation of each attack pattern pair. The correlation of any attack pattern pair is calculated by attack pattern graph matching; S13. Construct IOC relationship matrix R IOC : Extract data about IOC from network attack tool analysis reports, APT analysis reports and related forums, and construct the relationship matrix R between IOC and IOC IOC ; R IOC Each element in represents the relevance of each IOC pair. The relevance of any IOC pair is calculated by the edit distance; S14, based on the attack sample relationship matrix R Sample , attack mode relationship matrix R TTP and IOC relationship matrix R IOC Generate a relation matrix triple: {R Sample , R TTP , R IOC }; The specific process of step S2 is: S21, using the restarted random walk algorithm to calculate the attack sample relationship matrix R obtained in step S1 Sample Iterate, the calculation steps are as follows: The attack sample relationship matrix R Sample Split by column into m is the number of nodes; the formula for iteration using the restarted random walk algorithm is as follows: G Sample =R Sample Among them, "=" is the assignment symbol; In the above formula, Denotes the standardized G Sample ; represents the transition probability vector when the number of iterations is t, When the next step is to transfer to R Sample Target node x i probability; Represents the initial vector of size [m,1], when the target node x i When it is 1, the other elements are 0, m is the number of nodes; p means returning to the initial position x in each iteration. j The probability of attack sample relationship matrix R Sample Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate the attack sample relationship matrix R Sample The correlation score matrix Sr Sample ; S22, using the restart random walk algorithm to analyze the attack mode relationship matrix R TTP Iterate to generate the attack mode relationship matrix R TTP The correlation score matrix Sr TTP , the specific process is: The attack pattern relationship matrix R TTP Split by column into m is the number of nodes; the formula for iteration using the restarted random walk algorithm is as follows: G TTP =R TTP Among them, "=" is the assignment symbol; In the above formula, Denotes the standardized G TTP ; Then, the attack pattern relationship matrix R TTP Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate the attack mode relationship matrix R TTP The correlation score matrix Sr TTP ; S23, using the restart random walk algorithm to calculate the IOC relationship matrix R IOC Iterate to generate the correlation score matrix Sr of the IOC relationship matrix IOC ; The specific process is: The IOC relationship matrix R IOC Split by column into m is the number of nodes; the formula for iteration using the restarted random walk algorithm is as follows: G IOC =R IOC Among them, "=" is the assignment symbol; In the above formula, Denotes the standardized G IOC ; Then, the IOC relationship matrix R IOC Restart the random walk for each pair of nodes in and convert the obtained transition probability vector Perform splicing to generate a correlation score matrix of the IOC relationship matrix; S24, correlation score matrix Sr based on attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Generate a correlation score matrix triple {Sr Sample , Sr. TTP , Sr. IOC }; The specific process of step S3 is: S31, correlation score matrix Sr based on attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC , use linear regression to calculate the bias value b, and pre-set the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Set the weight w Sample 、w TTP 、w IOC ; S32, the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Perform linear fitting to generate the relationship inference probability Sr between network attack tools tool : Sr tool =w Sample ×Sr Sample +w TTP ×Sr TTP +w IOC ×Sr IOC +b Among them, w Sample 、w TTP 、w IOC represents the weight, and b represents the bias value.

2. The method according to claim 1, characterized in that In step S11, the specific process of calculating the correlation of any attack sample pair according to the similarity of the attack sample grayscale image is as follows: Extract malicious code samples from multi-source data; use the B2M algorithm to convert the malicious code samples into attack sample grayscale images; arbitrarily select two attack sample grayscale images, and adjust the sizes of the two attack sample grayscale images to the same size to generate two grayscale histograms; divide each grayscale histogram into a region of 4 grayscale levels, a total of 64 regions, sum the 4 values ​​of each region, and obtain 64 values, which are used as the vectors of the grayscale histogram, and the cosine similarity of the two vectors corresponding to the two grayscale histograms is calculated to generate the attack sample grayscale image similarity, and the attack sample grayscale image similarity is used as the correlation between the corresponding two attack samples; thereby, the correlation between each attack sample pair in all attack samples is calculated to obtain the attack sample relationship matrix R Sample And expressed as: Among them, the matrix element a ij Represents the grayscale image of the attack sample a i And the attack sample grayscale image a j The value of the correlation between .

3. The method according to claim 2, characterized in that The calculation steps of converting the malicious code sample into the attack sample grayscale image by using the B2M algorithm are: reading the malicious code sample in a binary stream manner to generate a binary data stream; Taking 8-bit binary as a unit, convert 8-bit binary into an unsigned integer to form a numerical vector of specified width, namely the width vector; construct an array of the binary data stream according to the width vector; correspond the array values ​​0x00~0xFF to the image pixel values ​​0-255 one by one, realize the mutual conversion between the array values ​​and the image pixel values, and generate a grayscale image of the attack sample.

4. The method according to claim 1, characterized in that: In step S12, the specific process of generating the attack pattern graph based on the attack pattern related data is as follows: 1) The log information in the extracted attack pattern related data is used as input data for generating the attack pattern graph; The source data corresponding to the log information is grouped by IP address as input clusters, the attack events are marked as behavioral activities, the dependencies between the activities are mined, and the long-distance dependencies and self-loop relationships between the activities are found; Output the mining result, i.e. the directed graph G containing all attack chains; then calculate the complexity of the directed graph G. If the complexity of the directed graph G is greater than the specified threshold, output the directed graph G; otherwise, put the directed graph G into the queue Q. s In the queue Q s Used to store directed graphs to be split, initially an empty queue; 2) Traverse the queue Q s , for each directed graph G in the queue, find the branch point from top to bottom; use the branch point as the starting point for segmentation, remove the independent subgraphs in the directed graph G, and then add the remaining directed edges starting from the branch point to the queue Q e In the queue Q e Used to store the directed edges to be traversed starting from the branch point, initially an empty queue; 3) Traverse the queue Q e , use the breadth-first algorithm to traverse the traversed directed edge e and generate the successor subgraph of e. For each successor subgraph G e , calculate G e Complexity, if G e is not a complex subgraph, G e Add to the output queue, otherwise G e Join the queue s ; 4) Determine the queue Q s Is it empty? If Q s If it is not empty, return to step 2); If Q s If it is empty, the directed graph G in the output queue is processed by the branch information completion algorithm to obtain the directed graph G', and the output G' is the attack pattern graph; The branch information completion algorithm is as follows: remove the first element of the output queue from the queue, record it as G', obtain the starting point of G' as the vertex; check whether the predecessor vertex of the vertex exists, if so, add it to G'; traverse G' using the breadth-first algorithm, for all vertices v∈G', check the directed edge e with v as the end point and the predecessor vertex, if Then v pred And the directed edge e with v as the end point is added to G': Output attack pattern graph G'; Repeat the above steps until the output queue is empty.

5. The method according to claim 1, characterized in that In step S12, the specific process of calculating the correlation of any attack pattern pair by attack pattern graph matching is as follows: (1) Extracting feature vectors from the attack pattern image: grayscale the attack pattern image and enhance the image using median filtering and morphological methods to ensure that the main texture features of the image are clear and discernible; use histogram equalization technology to process the image so that it meets the uniform mean and variance, thereby obtaining a standard image; (2) Feature extraction: construct a Gaussian pyramid of the image obtained by step (1), divide the image into blocks, and make it present a hierarchical pyramid structure. Further count the features of each sub-structure separately until all structural features are counted and spliced ​​into complete features; use the PCA algorithm to reduce the dimension of the image and store it in the image library after processing; use the K-means clustering method to discretize the feature set and convert the discretized features into neighborhood features; (3) Establishing an image feature index: using inverted indexing technology to quickly retrieve the image features obtained in step (2); (4) Image feature matching: A search feature is set. After quantization, the index item Wi corresponding to the search feature is determined in the inverse search. A series of related index features corresponding to the index item Wi are further used as candidate matching results to generate a feature vector in the attack pattern graph. (5) Based on the feature vector, the correlation between attack patterns is calculated using cosine similarity. The specific calculation formula is as follows: Among them, x i ,y i They represent the components of the feature vector x and feature vector y corresponding to the two attack pattern graphs, and θ represents the angle between the two vectors; (6) Collect the correlations between attack patterns and generate the relationship matrix R between attack patterns TTP , expressed as: Among them, the matrix element b ij Indicates attack mode b i With attack mode b j The value of the correlation between Specifically, data about IOC, i.e., IOC files, are extracted from network attack tool analysis reports, APT analysis reports, and related forums. The IOC files are disassembled to generate character strings. Based on the first character string and the second character string, i.e., the character strings corresponding to the two IOC files, the correlation between the IOCs is calculated using the edit distance.

6. The method according to claim 1, characterized in that In step S13, the specific process of calculating the relevance of any IOC pair using the edit distance is: cutting the first string and the second string to obtain a first substring of the first string and a second substring of the second string; The second substring is compared with the first string and the same part of the first string as the second substring is deleted to obtain a first difference string. The first substring is compared with the second string and the same part of the second string as the first substring is deleted to obtain a second difference string. The similarity between the first string and the second string is calculated according to the length of the first string, the length of the second string, the length of the first difference string and the length of the second difference string, that is, the correlation between the IOC files. The specific calculation formula is as follows: Wherein, L(S1) is the length of the first string, L(S2) ​​is the length of the second string, L(DS1) is the length of the first difference string, L(DS2) is the length of the second difference string, and A is the similarity; IOC relationship matrix R IOC It is expressed as: Among them, the matrix element c ij Indicates IOC data c i With IOC datac j The value of the correlation between .

7. The method according to claim 1, characterized in that The correlation score matrix Sr based on the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC , the specific process of calculating the bias value b using linear regression is: The weight w Sample 、w TTP 、w IOC Combined with the bias value b, represented by δ, is expressed as δ = (w Sample , w TTP ,w IOC ,b), the correlation score matrix Sr of the attack sample relationship matrix Sample , the correlation score matrix Sr of the attack pattern relationship matrix TTP , the correlation score matrix Sr of the IOC relationship matrix IOC Rewrite separately Then the above correlation score matrix is ​​expressed as: Then the relational reasoning probability Sr tool Written as: Y = (y 1 ,y 2 ,y 3 ) T , and then, the relationship between network attack tools reasoning probability Sr tool It is expressed as: f(X) = Xδ; Define the loss function, expressed as: Then, δ is derived, and the specific calculation process is: make We can get: X T Xδ-X T Y=0 δ=(X T X) -1 X T Y Furthermore, and Y=(y 1 ,y 2 ,y 3 ) T Substitute into the above formula and solve for the specific value of δ. Since w Sample 、w TTP 、w IOC The value of has been preset, and the bias value b is generated based on δ.

Images