An organization attribution method and device based on TTPs and multi-dimensional features, electronic equipment and storage medium

Abstract

The application relates to a method and device for attributing an organization based on TTPs and multi-dimensional features, electronic equipment and a storage medium, which comprises the following steps: extracting multi-dimensional feature vectors of a plurality of known malicious codes to generate a data set; constructing a model and training the model by using the data set; inputting an unknown malicious code into the trained model to obtain organization information of the unknown malicious code. Compared with a traditional manual analysis and comparison mode, the method and device are more efficient and faster when processing a large number of malicious code samples.

Description

Technical Field

[0001] This invention relates to the field of malicious code identification technology, and in particular to an organization attribution method, apparatus, electronic device, and storage medium based on TTPs and multidimensional features. Background Technology

[0002] Traditional methods for identifying the APT group to which a sample belongs involve manually analyzing and debugging the virus, examining its behavior patterns and code snippets to find similarities with known groups, and then further determining its affiliation. However, manually analyzing the network attribution of an attack event or malicious sample to obtain labeled malicious sample data is extremely time-consuming.

[0003] Secondly, there are many studies on detecting attacks or malicious samples using machine learning, but they all use a certain type of data and train machine learning by labeling. A single data type can lead to large errors in the detection results.

[0004] In view of the shortcomings of the existing technology, the inventors, through continuous research, design, repeated trials and improvements, have finally created this invention with practical value. Summary of the Invention

[0005] The main objective of this invention is to overcome the shortcomings of existing technologies and provide a new tissue attribution method, device, electronic device, and storage medium based on TTPs and multidimensional features. The technical problem to be solved is to enable it to quickly process massive amounts of malicious code samples and obtain the ATP tissue to which each malicious code sample belongs, which is very suitable for practical use.

[0006] Another objective of this invention is to overcome the deficiencies of existing technologies and provide a novel tissue attribution method, apparatus, electronic device, and storage medium based on TTPs and multidimensional features. The technical problem to be solved is to ensure that the relevant ECG data can be continuous and that multiple samples can be periodically sampled at the same time, enabling cross-period comparisons, thereby making it more suitable for practical use.

[0007] The objective of this invention and the technical problem it solves are achieved through the following technical solution. According to this invention, an organizational attribution method based on TTPs and multidimensional features includes:

[0008] Step 1: Extract multi-dimensional feature vectors from several known malicious codes to generate a dataset;

[0009] Step 2: Build the model and train it using the dataset;

[0010] Step 3: Input the unknown malicious code into the trained model to obtain the organization information to which the unknown malicious code belongs.

[0011] The objectives of this invention and the technical problems it addresses can be further achieved by the following technical measures.

[0012] Furthermore, the step of extracting multi-dimensional feature vectors from several known malicious codes to generate a dataset includes:

[0013] Obtain several known malicious codes;

[0014] For each known malicious code, construct a tactical feature vector based on ATT&CK, construct an IOC feature vector, and construct a dynamic behavior feature vector;

[0015] A multidimensional feature vector set is generated based on the tactical feature vector, IOC feature vector, and dynamic behavior feature vector based on ATT&CK.

[0016] A dataset is formed by combining several sets of multidimensional feature vectors.

[0017] Furthermore, the construction of the tactical feature vector based on ATT&CK is as follows:

[0018] Extract the tactical features of ATT&CK from known malicious code, convert the tactical features of ATT&CK into vector form, and calculate the weights according to the set weights.

[0019] Furthermore, the construction of the IOC feature vector is as follows:

[0020] Extract IP and DNS information from known malicious code;

[0021] Construct an IP feature vector based on the IP information in the known malicious code;

[0022] A DNS feature vector is constructed based on the DNS information in the known malicious code.

[0023] Furthermore, the construction of the dynamic behavior feature vector involves: using a word segmenter to segment the dynamic behavior name, and then using TF-IDF to vectorize the segmented data to obtain the dynamic behavior feature vector.

[0024] Furthermore, the step of vectorizing the segmented data using TF-IDF includes: vectorizing the data using the following formula,

[0025] tfidf i，j =tf i，j ×idf i

[0026] Among them, tfidf i，j The degree of importance of word i to document j;

[0027] tfi，j : The percentage of times word i appears in document j;

[0028] tf i，j The calculation formula is as follows:

[0029]

[0030] Where, n k，j The number of times word i appears in document j, ∑ k n k,j This refers to the sum of the occurrences of all words in document j.

[0031] IDF i The document frequency of word i is the ratio of the total number of documents to the number of documents containing word i. The formula for calculating this frequency is as follows:

[0032]

[0033] Where |D| is the total number of documents, |{j:t i ∈d j}| indicates the inclusion of the word t i The number of documents.

[0034] Furthermore, the model construction and training of the model using the dataset are as follows: select the XGBoost model as the classifier, take the multi-dimensional feature vector set as the input, the organization to which the malicious code belongs as the output, and train the model using the dataset.

[0035] The objectives of this invention and the technical problems it solves are also achieved by the following technical solutions.

[0036] A tissue attribution device based on TTPs and multidimensional features proposed according to the present invention is characterized by comprising:

[0037] The dataset generation module is used to extract multi-dimensional feature vectors from several known malicious codes and generate a dataset.

[0038] The model generation and training module is used to build a model and train the model using the dataset.

[0039] The discrimination module is used to input unknown malicious code into the trained model and obtain the organization information to which the unknown malicious code belongs.

[0040] The objectives of this invention and the technical problems it solves are also achieved by the following technical solutions.

[0041] According to the embodiments of the present invention, an electronic device is provided, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the intelligent screening and scheduling method for order executors described in any of the foregoing implementations.

[0042] The objectives of this invention and the technical problems it solves are also achieved by the following technical solutions.

[0043] According to the present invention, a computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the intelligent screening and scheduling method for order executors as described in any of the foregoing implementations.

[0044] This invention has significant advantages and beneficial effects compared with the prior art. It has at least the following advantages:

[0045] This invention generates a dataset by extracting multidimensional feature vectors from several known malicious codes. After training the model using the dataset, when it is necessary to detect a large number of unknown malicious codes, the unknown malicious codes can be input into the trained model to obtain the organization information to which the unknown malicious codes belong. Compared with the traditional manual analysis and comparison method, this method is more efficient and faster when processing a large number of malicious code samples.

[0046] This invention characterizes malicious code features from multiple dimensions, basically covering all dimensions of malicious code behavior in the experiment, and significantly improves the accuracy of detection results compared to single-dimensional malicious code detection.

[0047] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating the organizational attribution method based on TTPs and multidimensional features, as described in Embodiment 1 of the present invention.

[0049] Figure 2 This is a schematic diagram illustrating the process of constructing tactical feature vectors based on ATT&CK according to the present invention.

[0050] Figure 3 This is a schematic diagram of the IP feature vector construction process of the present invention;

[0051] Figure 4 This is a schematic diagram of the DNS feature vector construction process of the present invention;

[0052] Figure 5 This is a schematic diagram illustrating the process of constructing dynamic behavior feature vectors according to the present invention;

[0053] Figure 6 This is a functional structure diagram of the tissue attribution device based on TTPs and multidimensional features according to Embodiment 2 of the present invention;

[0054] Figure 7 This is a schematic diagram of the structure of an electronic device provided in one embodiment of the present invention. Detailed Implementation

[0055] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, describes an organizational attribution method based on TTPs and multidimensional features proposed according to the present invention, including:

[0056] Step 1: Extract multi-dimensional feature vectors from multiple known malicious codes, generate a dataset, and normalize the multi-dimensional feature vectors to facilitate model training;

[0057] Step 2: Build the model and train it using the dataset;

[0058] Step 3: Input the unknown malicious code into the trained model to obtain the organization information to which the unknown malicious code belongs.

[0059] Its specific implementation methods, steps, structure, characteristics, and effects are detailed below.

[0060] This invention provides a method for intelligent screening and scheduling of order executors, addressing the issue that using a program to manipulate documents may lead to document content tampering or leakage when the program corresponding to the document has security vulnerabilities. Please refer to [link / reference]. Figure 1 As shown, a preferred embodiment of the present invention provides an organizational attribution method based on TTPs and multidimensional features, which mainly includes the following steps:

[0061] Step 1: Extract multi-dimensional feature vectors from multiple known malicious codes, generate a dataset, and normalize the multi-dimensional feature vectors to facilitate model training;

[0062] Specifically, the generated dataset includes: acquiring several known malicious codes;

[0063] Based on expert experience, we propose different feature extraction methods from multiple dimensions of malicious code and for data of different dimensions. For each known malicious code, we construct a tactical feature vector based on ATT&CK, an IOC feature vector, and a dynamic behavior feature vector.

[0064] A multidimensional feature vector set is generated based on the tactical feature vector, IOC feature vector, and dynamic behavior feature vector based on ATT&CK.

[0065] A dataset is formed by combining several sets of multidimensional feature vectors.

[0066] Specifically, the tactical feature vector based on ATT&CK is constructed as follows:

[0067] Extract the tactical features of ATT&CK from known malicious code, convert the tactical features of ATT&CK into feature vector form, and calculate the weights according to the set weights.

[0068] The ATT&CK model includes 14 tactics, each composed of multiple techniques. Tactical weights are calculated based on their importance in actual attack scenarios, and these weights are then applied to the system. For technique weights, techniques appearing in every sample are assigned lower weights as they have minimal impact on the classification results. For techniques not appearing in every sample, their frequency of use within each APT group is calculated; higher frequencies result in higher weights. Finally, the ATT&CK matrix is ​​converted into tactical / technical unit vectors, with unused techniques represented by 0 and used techniques by 1, and weights are calculated according to the assigned weights. This results in a feature vector set for multiple samples across various APT groups.

[0069] like Figure 2 As shown, the mapping from the ATT&CK combat technology matrix to the vector set is used to specially mark multiple technologies that appear in the same tactic.

[0070] When performing weighted calculations on vector sets, greater weighting is given to labeled tactics and technologies.

[0071] Specifically, the construction of the IOC feature vector is as follows:

[0072] Extract IP and DNS information from known malicious code;

[0073] Construct an IP feature vector based on the IP information in the known malicious code; such as Figure 3 The diagram shown illustrates the process of constructing an IP feature vector based on the IP information in the known malicious code.

[0074] A DNS feature vector is constructed based on the DNS information in the known malicious code. For example... Figure 4 The diagram shown illustrates the process of constructing a DNS feature vector based on DNS information in the known malicious code.

[0075] The construction of IOC feature vectors primarily involves statistical analysis of the IP and DNS information involved in each known malware sample. Since IP and DNS information are susceptible to forgery—for example, by hiding the real attacking IP through proxy services, evading detection using dynamic DNS services, or malware using C&C infrastructure provided by legitimate server operators—the first step is to analyze the network behavior records of each sample, removing untrusted or low-credibility data. At this point, information such as IPs communicating between different APT groups and IPs appearing in malware sample records are considered to have higher credibility. During feature construction, for a given sample, if an IP appears once or multiple times, it is represented as 1; otherwise, it is represented as 0, thus constructing the IOC feature vector set. The IP information can come from the IPs in the known malware's host database, and the DNS information is extracted from domain name resolution records, specifically, such as... Figure 5 As shown, the construction of the dynamic behavior feature vector involves: using a word segmenter to segment the dynamic behavior names, and then using TF-IDF to vectorize the segmented data to obtain the dynamic behavior feature vector. The construction of the dynamic behavior feature vector is mainly based on text similarity calculation. During the analysis of the collected sample dynamic behavior information, it was found that different samples from the same organization have a high probability of performing the same behavior. For example, multiple samples belonging to the Darkhotel organization performed behaviors such as "OLE," while samples belonging to other organizations generally did not perform this behavior. Based on this observed feature, the names of the operations performed by samples from different organizations are used to construct dynamic behavior feature vectors by calculating text similarity. First, the collected dynamic behavior names are segmented using a word segmenter, and then the segmented data is vectorized using TF-IDF to construct the dynamic behavior feature vector set.

[0076] TF-IDF refers to the ability of a word or phrase to distinguish categories well if it appears frequently in one text but infrequently in other texts (i.e., it has a low inverse document frequency, IDF).

[0077] The step of vectorizing the segmented data using TF-IDF includes: vectorizing the data using the following formula.

[0078] tfidf i，j =tf i，j×idf i

[0079] Among them, tfidf i，j The degree of importance of word i to document j;

[0080] tf i，j : The percentage of times word i appears in document j;

[0081] tf i，j The calculation formula is as follows:

[0082]

[0083] Where, n k，j The number of times word i appears in document j, ∑ k n k，j This refers to the sum of the occurrences of all words in document j.

[0084] IDF i The document frequency of word i is the ratio of the total number of documents to the number of documents containing word i. The formula for calculating this frequency is as follows:

[0085]

[0086] Where |D| is the total number of documents, |{j:t i ∈d j}| indicates the inclusion of the word t i The number of documents.

[0087] Step 2: Build the model and train it using the dataset;

[0088] Specifically, the model is constructed and trained using a dataset as follows: The XGBoost model is selected as the classifier, a multi-dimensional feature vector set is used as input, and the organization to which the malicious code belongs is used as output. The dataset is then used to train the model. The trained model can be reused when identifying the organization to which the malicious code belongs.

[0089] Step 3: Input the unknown malicious code into the trained model to obtain the organization information to which the unknown malicious code belongs. Specifically, the multi-dimensional feature vector set corresponding to any unknown malicious code can be extracted, and then the multi-dimensional feature vector set can be input into the trained model. The trained model will then output the organization information of the unknown malicious code.

[0090] 1. The feature information formed by fine-grained analysis of samples can more effectively express the behavior and function of samples. At the attack technology level of malicious samples, the organization to which the malicious code belongs is identified, effectively bypassing the mechanism by which malicious code evades detection by modifying local features.

[0091] 2. At the same time, by shifting the identification of the organizations to which malicious code belongs from manual to automated identification, work efficiency can be greatly improved.

[0092] like Figure 6 As shown, a tissue attribution device based on TTPs and multidimensional features in this embodiment may include:

[0093] The dataset generation module is used to extract multi-dimensional feature vectors from several known malicious codes and generate a dataset.

[0094] The model generation and training module is used to build models and train the malware family identification model using the dataset to form an attack organization attribution detection model.

[0095] The discrimination module is used to input unknown malicious code into a pre-trained attack organization attribution model to obtain information about the organization to which the unknown malicious code belongs.

[0096] The apparatus in this embodiment can be used to execute the technical solutions of the method embodiments shown above. Its implementation principle and technical effects are similar, and will not be repeated here. Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can implement the process of the embodiment of the organization attribution method based on TTPs and multidimensional features of the present invention, as shown above. Figure 7 As shown, the aforementioned electronic device may include: a housing 51, a processor 52, a memory 53, a circuit board 54, and a power supply circuit 55. The circuit board 54 is disposed inside the space enclosed by the housing 51, and the processor 52 and the memory 53 are disposed on the circuit board 54. The power supply circuit 55 is used to supply power to the various circuits or devices of the aforementioned electronic device. The memory 53 is used to store executable program code. The processor 52 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 53, for executing an organizational attribution method based on TTPs and multidimensional features as described in any of the foregoing embodiments.

[0097] For details on the specific execution process of the above steps by the processor 52, and the steps further executed by the processor 52 through running executable program code, please refer to the present invention. Figure 1 , Figure 6 The description of the illustrated embodiments will not be repeated here.

[0098] This electronic device exists in various forms, including but not limited to:

[0099] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0100] (2) Mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0101] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0102] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0103] (5) Other electronic devices with data interaction functions.

[0104] Embodiments of the present invention also provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement an organizational attribution method based on TTPs and multidimensional features as described in any of the foregoing embodiments.

[0105] Embodiments of the present invention also provide a malicious code organization attribution device, comprising a module, an electronic device, and a computer-readable storage medium, wherein the module is disposed on the circuit board of the electronic device.

[0106] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0107] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0108] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0109] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0110] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0111] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An organizational attribution method based on TTPs and multidimensional features, characterized in that, include: Step 1: Extract multi-dimensional feature vectors from multiple known malicious codes, generate a dataset, and normalize the multi-dimensional feature vectors to facilitate model training; The generated dataset includes: Obtain multiple known malicious codes; From multiple dimensions of malicious code, and for data of different dimensions, different feature extraction methods are proposed based on expert experience. For each known malicious code, a tactical feature vector based on ATT&CK, an IOC feature vector, and a dynamic behavior feature vector are constructed. The construction of the ATT&CK-based tactical feature vector is as follows: extract the ATT&CK tactical features present in known malicious code, convert the ATT&CK tactical features into feature vector form, and calculate the weights according to the set weights. The construction of the IOC feature vector involves: extracting IP information and DNS information from known malicious code; constructing an IP feature vector based on the IP information from the known malicious code; and constructing a DNS feature vector based on the DNS information from the known malicious code. The construction of the dynamic behavior feature vector is as follows: the dynamic behavior name is segmented into words using a word segmenter, and the segmented data is vectorized using TF-IDF to obtain the dynamic behavior feature vector. A multidimensional feature vector set is generated based on the tactical feature vector, IOC feature vector, and dynamic behavior feature vector based on ATT&CK. A dataset is formed by combining multiple sets of multidimensional feature vectors. Step 2: Build the model and train it using the dataset; Step 3: Input the unknown malicious code into the trained model to obtain the organization information to which the unknown malicious code belongs.

2. The tissue attribution method based on TTPs and multidimensional features according to claim 1, characterized in that, The step of vectorizing the segmented data using TF-IDF includes: vectorizing the data using the following formula. tfidf i,j =tf i,j ×idf i Among them, tfidf i,j The degree of importance of word i to document j; tf i,j : The percentage of times word i appears in document j; tf i,j The calculation formula is as follows: Where, n i,j The number of times word i appears in document j, ∑ k n k,j This refers to the sum of the occurrences of all words in document j. IDF i The document frequency of word i is the ratio of the total number of documents to the number of documents containing word i. The formula for calculating this frequency is as follows: Where |D| is the total number of documents, |{j:t i ∈d j }| represents the number of documents containing the word i.

3. The tissue attribution method based on TTPs and multidimensional features according to claim 1, characterized in that, The process of training the model using the dataset is as follows: select the XGBoost model as the classifier, take the multidimensional feature vector set as the input, take the organization to which the malicious code belongs as the output, and use the dataset to train the model.

4. The tissue attribution method based on TTPs and multidimensional features according to claim 1, characterized in that, Step 3 involves extracting the corresponding multidimensional feature vector set from any unknown malicious code, and then inputting the multidimensional feature vector set into the trained model. The trained model then outputs the organizational information of the unknown malicious code.

5. A malicious code organization attribution device, which employs the organization attribution method based on TTPs and multidimensional features as described in any one of claims 1-4, characterized in that, include: The dataset generation module, model generation and training module, and discriminant module all run within the organizational attribution device, wherein: The dataset generation module is used to extract multidimensional feature vectors from multiple known malicious codes and generate datasets. The model generation and training module is used to build a model and train the malicious code family identification model using the dataset to form an attack organization attribution detection model. The discrimination module is used to input unknown malicious code into a pre-trained attack organization attribution model to obtain information about the organization to which the unknown malicious code belongs.

6. An electronic device, characterized in that, It includes: The device includes a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is housed within the space enclosed by the housing, and the processor and memory are mounted on the circuit board; the power supply circuit provides power to the various circuits or devices of the aforementioned electronic device. The memory is used to store executable program code; the processor runs the program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the organizational attribution method based on TTPs and multidimensional features as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, It stores one or more programs, which can be executed by one or more processors to implement the organizational attribution method based on TTPs and multidimensional features as described in any one of claims 1 to 4.

8. A malicious code organization attribution device, characterized in that, It comprises a module, an electronic device, and a computer-readable storage medium, wherein the module is disposed on the circuit board of the electronic device to implement the organizational attribution method based on TTPs and multidimensional features as described in any one of claims 1 to 4.

Images