A threat detection method, device and equipment based on APT attack graph

Abstract

The present invention discloses a threat detection method, device and equipment based on an APT attack graph. The method of the present invention includes the steps of APT attack graph generation, intrusion alarm collection, attack path identification, APT attack detection, and evidence chain reconstruction. The present invention reduces the real-time attack analysis overhead by designing an APT attack graph and pre-analyzing attack actions according to network and system information; evaluates attacks from multiple angles such as harmfulness and necessity to ensure the comprehensiveness of threat detection, and designs an attack path scoring method to achieve global attack analysis; associates attack behavior traces to form an evidence chain, and uses a gray list to associate multiple attack entities to achieve accurate positioning of the attack impact range. By combining the three capabilities of APT attack prediction, detection and monitoring, the problem of threat alarm fatigue is effectively combated, and the robustness of zero-day vulnerability exploit detection is improved, so that the present invention can efficiently and accurately detect APT attacks.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a threat detection method, device and equipment based on APT attack graph. Background Art

[0002] Advanced persistent threat (APT) attacks are cyberattacks launched by sophisticated and well-resourced attackers against high-value targets such as enterprises or governments. Compared with general cyberattacks, APT attacks can cause more serious damage, including intellectual property theft, financial information leakage, and destruction of critical infrastructure, and are a huge threat to current network security. APT attacks have three characteristics: long latency, slow action, and exploitation of zero-day vulnerabilities, which make detection difficult. Currently, there are two main challenges in detection: (1) Intrusion detection tools generate a large number of false alarms, which creates a backlog of investigation tasks for analysts. At the same time, due to the large size of the low-level log system, confirming the authenticity of threat alarms requires tedious manual labor, resulting in threat alarm fatigue. (2) Zero-day vulnerability exploitation during the attack is difficult to detect. Therefore, how to design a low-overhead method to effectively combat threat alarm fatigue and promptly detect traces of zero-day vulnerability exploitation is the main problem that needs to be solved.

[0003] An attack graph is a directed graph that represents all possible attack paths that an attacker may take. It is a powerful security technology that can simulate the many ways that an attacker may compromise different assets in a network. It uses threat intelligence information as an external information resource for direct or potential security threats to help security personnel quickly identify malicious threat attacks and respond to defenses in a timely manner. Therefore, attack graphs are widely used to proactively discover vulnerabilities in the system and understand the current security status of the network. The attack graph is the most commonly used and effective method among the existing network vulnerability analysis methods. It intuitively and graphically displays the details of the attack behavior through the attack path, provides support for predicting the attacker's intentions and subsequent behaviors, and helps defenders understand the relationship between vulnerabilities in the target network and the relationship between vulnerabilities and network security configurations. However, in the field of APT attack detection, it loses adaptability due to the inability to detect location attacks, so there is a lack of feasible application of attack graphs.

[0004] Existing APT attack detection methods can be roughly divided into two categories: heuristic matching-based methods and anomaly analysis-based methods. The former relies on prior knowledge and constructs rules for matching detection by observing malicious behavior characteristics. It can usually only detect known attacks and has a high false positive rate. The latter first observes and collects benign system environment data, establishes a benign system behavior model, and discovers attack behaviors based on behavioral model deviations. The use conditions are strict and the portability is weak, and the missed detection rate is serious. There are also methods that use attribute attack graph technology to analyze the system, which is not only costly, but also often causes missed reports due to information asymmetry. Regardless of heuristic matching or anomaly analysis, current APT detection methods mainly face two problems: missed detection caused by zero-day vulnerability exploits and threat alert fatigue. Summary of the invention

[0005] Purpose of the invention: In view of the problems existing in the prior art, the purpose of the present invention is to provide a threat detection method, device and equipment based on APT attack graph to combat the problem of threat alarm fatigue in APT attack detection, improve the ability to resist zero-day vulnerability exploitation attacks, identify major intrusions occurring in the system and locate the scope of attack impact.

[0006] Technical solution: The technical solution to achieve the purpose of the present invention is: a threat detection method based on APT attack graph, comprising the following steps:

[0007] Generate an APT attack graph based on the collected network and protected system information, and collect malicious behavior intrusion alerts through the deployed intrusion detection system; the attack behavior nodes in the APT attack graph include attack technology and APT stage information;

[0008] Matching the intrusion alarm with the attack technology in the APT attack graph to obtain the attack path associated with the intrusion alarm, where the attack path includes at least one attack behavior node that matches the intrusion alarm;

[0009] Based on the commonness, severity and necessity of the attack behavior, a quantitative analysis is performed on each attack behavior node on the attack path to obtain the commonness score S c , Severity score S s and necessity score S n ,Will As the comprehensive score of APT attack behavior, A is the highest value of commonness and severity score, α and β are weights greater than 0 and less than 1, α+β=1, S n The value is 0 or 1. If the attack behavior is a necessary stage of the APT attack, the necessity value is 1. The comprehensive scores of all attack behavior nodes that match the intrusion alarm on the entire attack path are accumulated as the path score, and the APT attack is identified based on the path score.

[0010] The attack path of the detected APT attack is reconstructed through the evidence chain to show the interaction between the attacker's actions and the risk entities in the protected system.

[0011] As a preferred method, when generating an APT attack graph, the Mulval framework is used to perform reasoning and analysis on the collected information, first inferring possible attack behaviors, and then analyzing the APT stages corresponding to the attack behaviors; starting from the initial attack node whose attack stage is reconnaissance, resource development or initial access, reasoning is performed along the direction of the edge; if there is a directed edge from node A to node B in the attack graph, node A is defined as the predecessor node of node B, and node B is the successor node of node A; the reasoning rules are as follows: (1) The corresponding stage of the successor node is the subsequent stage of the predecessor node, and the subsequent stage is the next stage of the APT stage of the predecessor node or the same as the APT stage of the predecessor node; (2) If a node has multiple subsequent stages, backward analysis is performed based on each stage respectively; (3) If the successor node cannot meet the attack stage relationship requirements, the path is invalid; (4) The final attack graph contains all the attack stage paths obtained by reasoning.

[0012] Preferably, in the process of quantitative analysis of attack behaviors, the commonness and severity of attack behaviors are graded based on the ATT&CK model. The more common the attack behaviors, the higher the commonness score, and the more severe the attack behaviors, the higher the severity score.

[0013] Preferably, the collected intrusion alarms are aggregated according to the similarity between the alarm features, and multiple alarms caused by the same attack behavior are merged into one alarm group to reduce the alarm scale.

[0014] Preferably, when matching the intrusion alarm with the attack graph, if there is an alarm that is not matched to any attack behavior node in the attack graph, it is saved as an independent alarm; if there is a similar alarm to the independent alarm, the independent alarm is added to the attack behavior node matched by the similar alarm.

[0015] As a preferred method, when reconstructing the chain of evidence, the alarm entities on the APT attack path are first associated, and the initial chain of evidence is generated based on the association between alarms; then, the method of reducing the chain of evidence based on the frequency of event occurrence and the multi-attack entity association mechanism based on the gray list are used to screen system entities based on the intrusion alarm information.

[0016] Preferably, the gray list-based multi-attack entity association mechanism is: adding system entities excluded based on event frequency to the monitoring gray list, evaluating the credibility of gray list entities, with level 0 being the lowest credibility; if an entity associated with an event with an anomaly score lower than a set threshold appears for the first time in an attack, it is not displayed as attack evidence and is recorded in the gray list, and the credibility is set to 1; if an entity with a credibility of 1 is associated with other attacks, its credibility is set to 0 and checked; if the entity check result is safe, the credibility is set to 2; entities with a credibility of 2 are deleted after a set time window; wherein the event anomaly score = 1-event frequency score, and the event frequency score is normalized to the interval [0,1].

[0017] Based on the same inventive concept, the present invention provides a threat detection device based on an APT attack graph, comprising:

[0018] An APT attack graph generation module is used to generate an APT attack graph based on the collected network and protected system information. The attack behavior nodes in the APT attack graph include attack technology and APT stage information.

[0019] An alarm collection module is used to collect malicious behavior intrusion alarms through the deployed intrusion detection system;

[0020] An attack path identification module is used to match the intrusion alarm with the attack technology in the APT attack graph to obtain the attack path associated with the intrusion alarm, where the attack path includes at least one attack behavior node that matches the intrusion alarm;

[0021] The APT attack detection module is used to quantitatively analyze each attack behavior node on the attack path based on the commonness, severity, and necessity of the attack behavior, and obtain the commonness score S c , Severity score S s and necessity score S n ,Will As the comprehensive score of APT attack behavior, A is the highest value of commonness and severity score, α and β are weights greater than 0 and less than 1, α+β=1, S n The value is 0 or 1. The comprehensive scores of all attack behavior nodes that match the intrusion alarm on the entire attack path are accumulated as the path score, and APT attacks are identified based on the path score.

[0022] And the evidence chain restoration module is used to reconstruct the evidence chain of the attack path of the detected APT attack, showing the interaction between the attacker's actions and the risk entities in the protected system.

[0023] Based on the same inventive concept, the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that when the computer program is loaded into the processor, the steps of the threat detection method based on the APT attack graph are implemented.

[0024] Based on the same inventive concept, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and is characterized in that when the computer program is executed by a processor, the steps of the threat detection method based on the APT attack graph are implemented.

[0025] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0026] (1) Robustness of zero-day vulnerability exploit detection. The present invention adds the discrimination information of the necessity of the attack stage in the threat detection process, so that the detection is comprehensively considered from the three perspectives of commonness, severity and necessity. At the same time, the attack path evaluation mechanism also enhances the detection capability of zero-day vulnerability exploit attacks, prevents attackers from bypassing detection by exploiting zero-day vulnerabilities, realizes comprehensive APT attack detection, and enhances the robustness of zero-day vulnerability exploit attack detection.

[0027] (2) Reduce the scale of alarms. The present invention uses the designed APT attack graph to pre-analyze the possibility of attack behavior, and uses the attack behavior and path scoring method to detect APT attacks. The analysis of long-term attacks greatly reduces the scale of alarms issued by the underlying intrusion detection system, combating the threat alarm fatigue problem in APT attack detection.

[0028] (3) Accurately restore the scope of attack impact. The present invention further designs an evidence chain reduction method based on event frequency and a multi-attack entity association method based on a gray list. When an APT attack is detected, the method of restoring the system entities involved in the attack alarm to restore the evidence chain will produce an excessively large inspection scope. Reducing the evidence chain by calculating the frequency of system events can reduce the evidence chain and narrow the inspection scope. The multi-attack entity association method based on a gray list can ensure the security of the evidence chain reduction.

[0029] (4) Low overhead. The present invention predicts attacks based on APT attack graphs, which is not limited by the real-time analysis of massive system events in traditional detection methods. The fast and efficient matching mechanism reduces the storage and computing overhead required for threat detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is an overall flow chart of the method of an embodiment of the present invention.

[0031] Figure 2 It is a schematic diagram of an APT attack graph in an embodiment of the present invention.

[0032] Figure 3 This is an example diagram of the result of restoring the evidence chain in an embodiment of the present invention.

[0033] Figure 4 Schematic diagram of the device structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are implemented based on the technical solution of the present invention, and detailed implementation methods and processes are given, but the protection scope of the present invention is not limited to the following embodiments.

[0035] An embodiment of the present invention discloses a threat detection method based on an APT attack graph. First, an APT attack graph is generated based on collected network and system information to be protected, and malicious behavior intrusion alarms are collected through a deployed intrusion detection system. Then, the intrusion alarms are matched with attack technologies in the APT attack graph to obtain an attack path associated with the intrusion alarm. Then, each attack behavior node on the attack path is quantitatively analyzed based on the commonness, severity and necessity of the attack behavior, and the attack behavior is comprehensively scored based on the commonness, severity and necessity, and the score of the entire attack path is calculated, and the APT attack is identified based on the path score. Finally, the attack path where the APT attack is detected is reconstructed through an evidence chain to display the interaction between the attacker's actions and the risk entities in the system to be protected.

[0036] like Figure 1 As shown, the specific implementation steps of this embodiment are as follows:

[0037] Step 1: APT attack graph generation.

[0038] First, the network and protected system information is collected to obtain network topology, network services, vulnerability information, system accounts, data access policies, and attack targets, to support the generation of APT attack graphs.

[0039] Then, based on the initial information collected, the Mulval framework is used for preliminary reasoning to analyze a series of possible attack behaviors under the current network conditions; the APT attack phase is analyzed based on the attack behavior sequence, and backward reasoning is performed from the nodes in the initial stage of the attack, and finally an APT attack graph is generated. Figure 2As shown in the figure, the APT attack graph mainly contains three types of nodes: initial information nodes, attack behavior nodes, and attack target nodes. In the figure, the initial information node is represented by a rectangle, showing the network topology, network services, vulnerability information, account information, and data access policies; the attack behavior node is represented by an ellipse, showing the attack technology and the corresponding APT stage, such as token theft technology-privilege escalation; the attack target node is represented by a diamond, showing the protected target device. The edge provides the connection between the system status and the attack action, and the attack action.

[0040] Specifically, this embodiment infers possible attack behaviors based on initial information, and then analyzes the APT stage corresponding to the attack behaviors according to the relationship between technical stages. A top-down reasoning method is adopted, starting from the initial attack node whose attack stage is reconnaissance, resource development or initial access, and reasoning is performed along the direction of the edge. If there is a directed edge from node A to node B in the attack graph, node A is defined as the predecessor node of node B, and node B is defined as the successor node of node A.

[0041] The reasoning rules in the attack phase are as follows:

[0042] (1) The corresponding stage of the post-node is the subsequent stage of the pre-node, and the subsequent stage is the next stage of the APT stage of the pre-node (the stage to which the attacker takes further action) or is the same as the APT stage of the pre-node.

[0043] (2) If a node has multiple subsequent stages that meet the requirements, analyze backward based on each stage.

[0044] (3) If the subsequent node cannot meet the relationship requirements of the attack phase, this path is not valid.

[0045] (4) The final attack graph contains all the attack phase paths obtained by reasoning.

[0046] Step 2: Alert collection and aggregation.

[0047] Deploy the underlying Snort intrusion detection system on the protected host or device to collect malicious behavior intrusion alerts. Alerts can be further aggregated based on the similarity between alert features to reduce the scale of alerts. Alert aggregation is performed based on the similarity of feature fields such as source IP address, destination port, thread ID, process ID, alert event, proxy server, etc. For example, for alerts with the same source IP address, multiple alerts caused by the same attack behavior are merged into one alert group, and the attack alert event information is extracted to initially reduce the scale of alerts.

[0048] Step 3: Attack path identification

[0049] Intrusion alerts often contain malicious traces or attack tool information, which is finer in granularity than attack techniques. In order to establish the association between intrusion alerts and attack techniques, we collect common malicious behaviors in intrusion alerts in advance and establish corresponding relationships. On the other hand, we query attack tools and organize the high-level semantics of common intrusion alert information. Then, we match the intrusion alert information with the attack graph technology to obtain the APT attack graph after mapping the intrusion alert, which supports the analysis of the progress of the APT attack stage. If an alert that is not matched to any node in the attack graph appears, it will be defined as an independent alert and temporarily stored.

[0050] Search all attack paths in the attack graph and obtain a series of alarms and corresponding attack information on each attack path. For independent alarms, determine the broader similarity between alarms based on the alarm feature fields, such as alarms with source IP addresses in the same subnet. If an independent alarm has similar alarms, the independent alarm is used as the attached information of the path to which the similar alarm belongs for joint detection.

[0051] Step 4: APT attack detection

[0052] Design a missing path matching scoring algorithm for APT attacks, and conduct quantitative analysis of APT behaviors from three aspects: commonness, severity, and necessity of attack behaviors. Calculate the commonness score S c , Severity score S s and necessity score S n ,Will As the comprehensive score of APT attack behavior, A is the highest value of commonness and severity score, α and β are weights greater than 0 and less than 1, α+β=1, S n The value is 0 or 1. If the attack behavior is a necessary stage of the APT attack, the necessity value is 1.

[0053] In this example, the commonness and severity of attacks are quantified based on the technical analysis in the ATT&CK model, and the behavior is scored S c and S s The value range is [0, 10], with the lower the commonness score S c or higher severity score S sThe more likely the behavior is, the more likely it is an APT attack. In the latest research [Xiong C, Zhu T, Dong W, et al. CONAN: A practical real-time APT detection system with high accuracy and efficiency [J]. IEEE Transactions on Dependable and Secure Computing, 2020.], a three-phase detection model for APT attacks was proposed, pointing out that in the APT attack process, the three parts that remain unchanged are: (1) deploying and executing the attacker's code, that is, the attacker must first deploy the code to the victim to achieve the goal; (2) collecting sensitive information or causing damage. The attacker usually tries to steal confidential data or damage the victim's data and machine; (3) communicating with the C&C server or filtering sensitive data, which is also a necessary operation to complete the APT attack. Based on the conclusions of the necessity research in the APT attack three-phase detection model, this scheme evaluates the necessity of the attack behavior in the APT attack process, scoring S. n The value is 0 or 1. A behavior necessity score of 1 means that if this attack behavior occurs, then an APT attack must have occurred. In this example, according to the formula Quantify the APT behavior score of the alarm node. After accumulating the scores of the alarm nodes on the entire path, use the formula Pathsum' = (Pathsum-min(Pathsums)) / (max(Pathsums)-min(Pathsums)) for normalization analysis, where Pathsum and Pathsum' are the score values ​​of a certain attack path before and after normalization, and Pathsums is the score set of all attack paths. Paths with too high scores (exceeding the set threshold) are identified as APT attacks.

[0054] The attack path detected by the alarm node may lack information about certain stages of the APT attack. This is because the attacker's attack behavior using zero-day vulnerabilities evades the detection of the intrusion detection system. However, a comprehensive analysis of the risk level of the entire attack path, especially the inspection of the necessity of APT attacks, enables the system to still detect APT attacks. Therefore, although incomplete matching of local attack paths is allowed in the threat identification process, strict attack detection at the global level is achieved. This method provides the detection system with robustness for zero-day vulnerability exploit detection. Through subsequent evidence restoration, the attacker's action process can also be reversed to obtain evidence of zero-day vulnerability exploitation.

[0055] Based on the APT attack graph and intrusion alert collection, the algorithm for identifying the APT attack path is described as follows:

[0056] Algorithm 1. Missing Path Matching Scoring Algorithm MPS (AAG, Alerts).

[0057] Input: APT attack graph AAG, alert collection Alerts

[0058] Output: A set of attack paths with anomaly scores Apaths

[0059] 1 FOR each Ae in Alerts

[0060] 2Get the attack behavior action currently processing the alarm

[0061] 3 Get the action corresponding to the APT behavior APTAction

[0062] 4 Score<-GetScore(APTAction)

[0063] 5 FOR each V in AAG

[0064] 6 IF V=APTAction:action THEN

[0065] 7 V.score<-Score

[0066] 8 END

[0067] 9 IF NONE V=APTAction:action THEN

[0068] 10 SingleAlerts<-(Ae,APTAction,Score)

[0069] 11 END

[0070] 12

[0071] 13 SAlert=this->SingleAlerts

[0072] 14 FIND SAlert.similar

[0073] 15. Add SAlert to the corresponding node of similar alarms

[0074] 16 DELETE SAlert FROM SingleAlerts

[0075] 17 APaths=NULL

[0076] 18 FOR Attack Path in AAG

[0077] 19 APaths<-AttackPath

[0078] 20 Pathsum<-0

[0079] 21 FOR each V in AttackPath

[0080] 22 Pathsum=Pathsum+V.score

[0081] 23 END

[0082] 24 Pathsums<-Pathsum

[0083] 25 END

[0084] 26 FOR each Pathsum in Pathsums

[0085] 27 Pathsum=(Pathsum-min(Pathsums)) / (max(Pathsums)-min(Pathsums))

[0086] 28 APaths.score<-Pathsum

[0087] 29 END

[0088] 30 RETURN APaths

[0089] 31 END

[0090] Step 5: Evidence chain reconstruction

[0091] The threat judgment result is to reconstruct the evidence chain of the attack path detected by APT attack, showing the interaction between the attacker's actions and risk entities, and providing a reference for security personnel to isolate and analyze system entities. System entities mainly include files, processes, sockets, etc. First, associate the alarm entities on the APT behavior path, and generate an initial evidence chain based on the association between alarms. In order to accurately locate the impact range of the attack, system entities are screened based on the intrusion alarm information to exclude normal and potentially unaffected system entities. The specific method is to pre-collect the system events of the hosts in the area within the time window and store them in the database, and use the formula Calculate the event frequency score, where Freq(e) is the frequency score of event e, Freq max and Freq minare the maximum and minimum frequency scores in the current event frequency database, respectively. The above equation processes the event frequency score based on the minimum-maximum normalization algorithm, mapping the data to the interval of [0,1], which can avoid the impact of the number of hosts on the event frequency and the event normal score. 1 minus the event frequency score to get the event anomaly score, and the system entities associated with the events with anomaly scores lower than the set threshold are screened out. In order to avoid the attacker's deceptive behavior causing the system to be misscreened, a multi-attack entity association mechanism based on the gray list is established, and the excluded system entities are added to the monitoring gray list. The gray list entities are evaluated for credibility, and the evaluation is 0, 1 or 2, with 0 being the lowest credibility. If an entity with a low anomaly score appears in an attack for the first time, it will not be displayed as attack evidence and will be recorded in the gray list, and the credibility will be set to 1; if an entity with a credibility of 1 is associated with other attacks, that is, the system entity appears in the alarm information corresponding to other attacks, its credibility will be set to 0 and manually checked; if the entity inspection result is safe, the credibility will be set to 2; entities with a credibility of 2 will be deleted after a certain time window. Each time the trust level is changed, the change time is recorded to provide a reference for the trusted time window.

[0092] by Figure 3 For example, the attacker uses the host with IP address 195.73.151.50 and starts from port 1028 to initiate ICMP scan. The target host Loche with IP address 172.16.112.10 is scanned. Then the Cobalt Strike tool is used to perform port scan. It is found that there is a vulnerability in the Apache service corresponding to port 25 of the target host. The vulnerability exploitation script quota.bash file is sent. After the script file is executed, the Trojan program Mstream is installed by exploiting the vulnerability on Apache. The attacker uses the Trojan program to direct the 172.16.112.10 host to launch a DDoS operation against the mill server with IP address 172.16.115.20.

[0093] like Figure 4 As shown, a threat detection device based on an APT attack graph disclosed in an embodiment of the present invention mainly includes an APT attack graph generation module, an alarm collection module, an attack path identification module, an APT attack detection module, and an evidence chain restoration module. The APT attack graph generation module is used to generate an APT attack graph based on the collected network and system information to be protected; the alarm collection module is used to collect malicious behavior intrusion alarms through the deployed intrusion detection system; the attack path identification module is used to match the intrusion alarm with the attack technology in the APT attack graph to obtain the attack path associated with the intrusion alarm; the APT attack detection module is used to quantitatively analyze each attack behavior node on the attack path based on the commonness, severity, and necessity of the attack behavior, and obtain the commonness score S respectively.c , Severity score S s and necessity score S n ,Will As a comprehensive score of APT attack behavior; the comprehensive scores of all attack behavior nodes that match the intrusion alarm on the entire attack path are accumulated as the path score, and APT attacks are identified based on the path score; the evidence chain restoration module is used to reconstruct the evidence chain of the attack path where the APT attack is detected, showing the interaction between the attacker's actions and the risk entities in the protected system.

[0094] Furthermore, the threat detection device is also provided with a gray list database for implementing a gray list-based multi-attack entity association mechanism. The specific working process of each module described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0095] Based on the same inventive concept, an embodiment of the present invention discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the threat detection method based on the APT attack graph are implemented.

[0096] Based on the same inventive concept, an embodiment of the present invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the threat detection method based on the APT attack graph are implemented.

[0097] It can be understood by those skilled in the art that the technical solution of the present invention, in essence or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present invention. The storage medium includes: various media that can store computer programs, such as a USB flash drive, a mobile hard disk, a read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

Claims

1. A threat detection method based on APT attack graph, characterized in that: The steps include: Generate an APT attack graph based on the collected network and protected system information, and collect malicious behavior intrusion alerts through the deployed intrusion detection system; the attack behavior nodes in the APT attack graph include attack technology and APT stage information; Matching the intrusion alarm with the attack technology in the APT attack graph to obtain the attack path associated with the intrusion alarm, where the attack path includes at least one attack behavior node that matches the intrusion alarm; Based on the commonness, severity and necessity of the attack behavior, each attack behavior node on the attack path is quantitatively analyzed to obtain the commonness score S c , Severity Rating S s and necessity score S n ,Will As a comprehensive score of APT attack behavior, A The highest value for the prevalence and severity scores, , is a weight greater than 0 and less than 1, , S n The value is 0 or 1. If the attack behavior is a necessary stage of the APT attack, the necessity value is 1. The comprehensive scores of all attack behavior nodes that match the intrusion alarm on the entire attack path are accumulated as the path score, and the APT attack is identified based on the path score. The attack path of the detected APT attack is reconstructed through the evidence chain to show the interaction between the attacker's actions and the risk entities in the protected system.

2. The threat detection method based on APT attack graph according to claim 1 is characterized in that: When generating an APT attack graph, the Mulval framework is used to perform reasoning and analysis on the collected information. The possible attack behaviors are first inferred, and then the APT stages corresponding to the attack behaviors are analyzed. Starting from the initial attack nodes where the attack stages are reconnaissance, resource development, or initial access, reasoning is performed along the direction of the edges. If there is a directed edge from node A to node B in the attack graph, node A is defined as the predecessor node of node B, and node B is defined as the successor node of node A. The inference rules are as follows: (1) The corresponding stage of the successor node is the subsequent stage of the predecessor node, and the subsequent stage is the next stage of the APT stage of the predecessor node or the same as the APT stage of the predecessor node; (2) If a node has multiple subsequent stages, backward analysis is performed based on each stage; (3) If the successor node cannot meet the attack stage relationship requirements, the path is invalid; (4) The final attack graph contains all the attack stage paths obtained by reasoning.

3. The threat detection method based on APT attack graph according to claim 1 is characterized in that: In the process of quantitative analysis of attack behaviors, the commonness and severity of attack behaviors are graded based on the ATT&CK model. The more common the attack behavior, the higher the commonness score, and the more severe the attack behavior, the higher the severity score.

4. The threat detection method based on APT attack graph according to claim 1, characterized in that: The collected intrusion alerts are aggregated according to the similarity between the alert features, and multiple alerts caused by the same attack behavior are merged into one alert group to reduce the alert scale.

5. The threat detection method based on APT attack graph according to claim 1, characterized in that: When matching intrusion alarms with attack graphs, if there are alarms that are not matched to any attack behavior node in the attack graph, they are saved as independent alarms; If an independent alarm has a similar alarm, the independent alarm is added to the attack behavior node matched by the similar alarm.

6. The threat detection method based on APT attack graph according to claim 1, characterized in that: When reconstructing the evidence chain, we first associate the alarm entities on the APT attack path and generate the initial evidence chain based on the association between alarms. Then, we use the evidence chain reduction method based on the frequency of events and the gray list-based multi-attack entity association mechanism to screen system entities based on the intrusion alarm information. The gray list-based multi-attack entity association mechanism is: adding system entities excluded based on event frequency to the monitoring gray list, and evaluating the credibility of the gray list entities, with level 0 being the lowest credibility; If the entity associated with an event with an anomaly score lower than the set threshold appears for the first time in an attack, it will not be displayed as attack evidence and will be recorded in the gray list, and the credibility will be set to 1; If an entity with a credibility of 1 is associated with other attacks, its credibility is set to 0 and checked; if the entity is safe, its credibility is set to 2; Entities with a credibility of 2 will be deleted after a set time window; The event anomaly score = 1-event frequency score, and the event frequency score is normalized to the interval [0,1].

7. A threat detection device based on APT attack graph, characterized in that: include: An APT attack graph generation module is used to generate an APT attack graph based on the collected network and protected system information. The attack behavior nodes in the APT attack graph include attack technology and APT stage information. An alarm collection module is used to collect malicious behavior intrusion alarms through the deployed intrusion detection system; An attack path identification module is used to match the intrusion alarm with the attack technology in the APT attack graph to obtain the attack path associated with the intrusion alarm, where the attack path includes at least one attack behavior node that matches the intrusion alarm; The APT attack detection module is used to quantitatively analyze each attack behavior node on the attack path based on the commonness, severity, and necessity of the attack behavior, and obtain commonness scores respectively. S c , Severity Rating S s and necessity score S n ,Will As a comprehensive score of APT attack behavior, A The highest value for the prevalence and severity scores, , is a weight greater than 0 and less than 1, , S n The value is 0 or 1. If the attack behavior is a necessary stage of the APT attack, the necessity value is 1. The comprehensive scores of all attack behavior nodes that match the intrusion alarm on the entire attack path are accumulated as the path score, and the APT attack is identified based on the path score. And the evidence chain restoration module is used to reconstruct the evidence chain of the attack path of the detected APT attack, showing the interaction between the attacker's actions and the risk entities in the protected system.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the computer program is loaded into a processor, the steps of the threat detection method based on the APT attack graph according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the threat detection method based on the APT attack graph according to any one of claims 1 to 6 are implemented.

Images