A method for predicting advanced persistent threats based on a sequenced graph generation model

Abstract

The present invention discloses a method for predicting advanced persistent threats based on a serialized graph generation model. The method comprises the following steps: constructing a provenance graph from system audit kernel logs and modeling the graph as an attack heterogeneous graph with multiple types of nodes and edges; representing the attack heterogeneous graph representing the attacker's contextual attack behavior in the form of an adjacency matrix; and constructing an autoregressive deep neural network to sequentially generate an attack prediction graph to predict the type of the next node and the dependencies between the node and existing nodes. The advantage of this method is that it utilizes a serialized graph generation model to simultaneously capture features such as node attributes, edge attributes, and edge temporal properties in the attack graph. During the occurrence of an advanced persistent threat attack, the attacker's next attack method can be proactively predicted in real time.

Description

Technical Field

[0001] The present invention belongs to the field of network security and deep learning technology, and specifically relates to an advanced persistent threat prediction method based on a serialized graph generation model. Background Art

[0002] In recent years, APT attacks have become a focal point for cybersecurity governance worldwide. APT attacks utilize advanced attack methods to conduct long-term, covert, and sustained attacks against specific targets. In real-world cyberattacks, attackers typically maintain the initiative and attempt to exploit zero-day vulnerabilities and new malware to launch attacks. Faced with advanced attack techniques, there is a gap between detection capabilities and attack methods. This asymmetry in offensive and defensive techniques means that by the time an attack is detected, it has already inflicted significant damage.

[0003] Currently, as APT attacks become more phased and diverse, attackers often combine multiple tactics to construct a complete attack. The implementation of a single tactic often involves multiple techniques and variations, making it extremely difficult to accurately predict an attacker's subsequent actions. On the one hand, attackers often lurk within an organization, waiting for an opportunity to strike a fatal blow. This makes it difficult for analysts to automatically predict the attacker's next move in advance or in real time based on early behavioral information to effectively harden systems. On the other hand, defenders often rely too heavily on the experience and knowledge of security professionals to determine the attacker's next move or target. Therefore, there is a lack of a method that incorporates artificial intelligence to proactively predict potential subsequent attack behaviors during an intrusion, providing comprehensive awareness and early warning of future threats. This can assist analysts in making proactive defense decisions and help enterprises prevent potential attacks before they occur.

[0004] In response to the above problems, how to proactively predict the attacker's next attack method in real time during the attack process and provide early warning guidance to security personnel is an issue that needs to be solved urgently. Summary of the Invention

[0005] The purpose of the present invention is to provide an advanced persistent threat prediction method based on a serialized graph generation model, so as to proactively predict potential subsequent attack behaviors during the intrusion process.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A method for predicting advanced persistent threats based on a serialized graph generation model, comprising:

[0008] Step 1: Construct an attack heterogeneous graph based on the system audit log;

[0009] Step 1-1: Capture system audit logs and collect kernel-level system events to form a provenance graph.

[0010] Step 1-2: Use node type definition and verb dependency definition to model the nodes and edges of the provenance graph respectively, and construct an attack heterogeneous graph with abstract attack context relationships;

[0011] Step 2: Characterize the attack heterogeneous graph based on the adjacency matrix;

[0012] Step 2-1: Define the attack heterogeneous graph as G = (V, E), where the node set is V = (v1,…,v n ), the set of edges between nodes is E=(v i ,v j |v i ,v j ∈V);

[0013] Step 2-2, under the node order π, the adjacency matrix is defined as are adjacent elements;

[0014] Step 2-3, define a mapping function f S Map the graph G to an adjacency matrix, express the order of nodes in the graph G and the dependency relationship between nodes in the form of a sequence, and obtain a serialized graph;

[0015] Step 3: Generate an attack prediction graph based on the serialization graph;

[0016] Step 3-1: Concatenate the sequence tensors in the serialization graph and input them into the node prediction network to obtain the entity type of the new node;

[0017] Step 3-2: Input the serialized graph and the entity type of the new node output in step 3-1 into the dependency prediction network to obtain the dependency relationship between the new node and the previous node;

[0018] Step 3-3: Update the attack heterogeneous graph according to the entity type of the new node and its dependency relationship with the previous node, and return to step 2 to continue prediction until the prediction node is empty or the set prediction length is reached, and then output the final attack heterogeneous graph as the attack prediction graph.

[0019] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution. They are merely further supplements or optimizations. Under the premise that there are no technical or logical contradictions, each optional method can be combined separately for the above-mentioned overall solution, or multiple optional methods can be combined.

[0020] Preferably, in the provenance graph, the subject and object in the entity object of the kernel-level system event are taken as nodes in the provenance graph, and the relationship between the entities is taken as the edge in the provenance graph, and the direction of the edge represents the flow direction of data content or control information between the two entities.

[0021] Preferably, the entity types included in the node type definition are Process, File, Registry and Socket, wherein the entity type Process is described as a program already running in the system, the entity type File is divided into four categories, which are respectively described as sensitive files containing configuration information, library files, executable files and other types of files, the entity type Registry is described as unified management of software and hardware configurations, and the entity type Socket is described as a socket;

[0022] In the verb dependency definition, the verb dependency read, write, exec, load, and unlink are defined as event relationships of Process To File, the verb dependency send and receive are defined as event relationships of Process To Socket, and the verb dependency fork, clone, start, and exit are defined as event relationships of Process To Process.

[0023] Preferably, the node type definition and verb dependency definition are used to model the nodes and edges of the provenance graph respectively, and to construct an attack heterogeneous graph with abstract attack context relationships, including:

[0024] According to the node type definition, the nodes that meet the description in the provenance graph are replaced with the corresponding entity type; according to the verb dependency definition, the event relationship between the nodes in the provenance graph is replaced with the verb dependency corresponding to the command execution function between the nodes under the event relationship.

[0025] Preferably, the mapping function f S as follows:

[0026]

[0027] Where, is the adjacent vector, Represents node v i Verb dependency relationship between the preceding node and the adjacent element in the π order Represents node v i In the order of π with node v j The verb dependency relationship between them, P represents the number of the verb dependency relationship in the verb dependency definition, is the node type, Represents node vi The entity type to which it belongs, K represents the number of the entity type in the node type definition, and the node sequence of all nodes is The edge sequence of all edges is

[0028] As an advantage, the distribution p(G) of the attack heterogeneous graph can be expressed as p(S π ,C π ),and:

[0029] p(S π ,C π )=f S (G,π)

[0030] The distribution p(G) is decomposed into the likelihood function as follows:

[0031]

[0032] For the terminal node n+1, it is expressed as:

[0033] Preferably, the node prediction network and the dependency prediction network are both gated recurrent neural networks.

[0034] This paper provides an advanced persistent threat prediction method based on a sequenced graph generation model. Based on the graph structure definition of an adjacency matrix, it captures characteristics such as node attributes, edge attributes, and edge temporal sequence in the attack graph. By building a model based on the sequenced graph generation network and learning the attack patterns and distribution in the attack graph, it proactively predicts the attacker's next attack tactic in real time during an advanced persistent threat attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a framework diagram of the advanced persistent threat prediction method based on the serialized graph generation model of the present invention;

[0036] Figure 2 This is a structural diagram of the serialized graph generation model of the present invention. DETAILED DESCRIPTION

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0039] like Figure 1 As shown, this embodiment provides an advanced persistent threat prediction method based on a serialized graph generation model, comprising the following steps:

[0040] (1) Graph construction based on system audit logs: Use tools that can collect system events and behavior data to capture the system audit logs generated by script execution, and further convert them into attack heterogeneous graphs based on node types and verb dependency definitions.

[0041] (1-1) Provenance graph construction: CamFlow, SPADE and other system kernel log collection frameworks are used to capture logs generated by script execution. Drawing on the experience of existing provenance graph construction, data is reconstructed using time-series system entity objects and system events to form a unified interface data format. Through the operating system audit log, kernel-level system events are continuously collected and arranged into a provenance graph. Among them, the subject (process or thread) and object (file and network) in the system entity object serve as nodes in the dependency graph; the system event expresses the relationship between entities as the edge in the dependency graph. The direction of the edge indicates the flow direction of data content or control information between the two entities, such as file reading and writing, attribute modification, network operation, etc. An edge in the provenance graph represents a system event.

[0042] This embodiment constructs a provenance graph based on the reference Hossain MN, Milajerdi SM, Wang J, et al. {SLEUTH}: Real-time attack scenario reconstruction from {COTS} audit data[C] / / 26th USENIX Security Symposium (USENIX Security 17). 2017: 487-504. In other embodiments, other references can be used to construct a provenance graph.

[0043] (1-2) Attack Heterogeneous Graph Generation: The provenance graph is complex, involving a large number of different types of nodes (such as processes, files, and sockets) and edges (such as read, write, and access). Furthermore, the nodes in the graph are all specific instances of system entities, lacking generalization. Therefore, this embodiment uses the node type definitions shown in Table 1 and the verb dependency definitions shown in Table 2 to model the nodes and edges of the provenance graph, constructing an attack heterogeneous graph with abstract attack context relationships.

[0044] When constructing the attack heterogeneous graph, the nodes in the provenance graph are replaced with the entity types defined in Table 1. That is, the nodes that meet the description are replaced with the corresponding entity types. For further simplification, they can be replaced with the entity tags corresponding to the entity types, such as replacing / etc / passwd in the provenance graph with F0. The command execution event relationships between the nodes in the provenance graph are replaced with the verb dependency relationships shown in Table 2. That is, the event relationships between the nodes are replaced with the verb dependency relationships corresponding to the command execution functions between the nodes under the event relationships. For example, if the event relationship between the nodes is Process ToFile and the command execution function is read file, the event relationship of the edge is replaced with the verb dependency relationship read.

[0045] Table 1 Node type definition

[0046]

[0047]

[0048] Table 2 Verb dependency definitions

[0049] Event Relationship Verb dependency Process To File read,write,exec,load,unlink Process To Socket send,receive Process To Process fork,clone,start,exit

[0050] (2) Attack heterogeneous graph representation based on adjacency matrix: The attack heterogeneous graph representing the attacker's contextual attack behavior is represented in the form of an adjacency matrix according to the order of nodes and edges.

[0051] (2-1) Define the attack heterogeneous graph as G = (V, E), where the node set of G is V = (v1,…,v n ), the set of edges between nodes is E=(v i ,v j |v i ,v j ∈V), n is the total number of nodes in G, i,j∈(1,2,…,n).

[0052] (2-2) Definition of graph adjacency matrix: Under a certain node order π, the graph is to be represented by the adjacency matrix In the form of, π represents a permutation function for V, for example, the nodes are permuted into (π(v1),…,π(v n ))express.

[0053] In addition, adjacent elements Represents node v i In the order of π with node v j The verb dependency relationship between them, {0,1,2,…,P} represents the number of dependent verbs defined in step 1-2, and P is the maximum number of dependent verbs, which depends on the number of custom verbs. Represents the node π(v i ) is the verb dependency relationship between it and the preceding node in the π order.

[0054] Finally, the node type Indicates that the node belongs to a certain entity type, P0,1,2,…,K} represents the number of the entity type defined in step 1-2, K is the maximum number of the entity type, which is determined according to the custom entity type, then the node sequence of all nodes is The edge sequence of all edges is

[0055] (2-3) Graph sequence mapping: define a mapping function f S To map the graph to a sequence, we can get a sequenced graph, as shown in Formula 1, where G contains n nodes and is represented by the node order π. Finally, the graph G can be represented by a fixed sequence S π and C π The distribution p(G) we want to learn can be expressed as p(S π ,C π ). Due to the sequential nature of π, it is decomposed into a likelihood function as shown in Formula 2. That is, the sequential graph composed of the first i-1 nodes is used to predict the entity type of the new node, and then the two are combined to predict the dependency relationship between the new node and the previous node. Among them, for the terminal node n+1, it is expressed as:

[0056]

[0057]

[0058] (3) Model construction based on serialized graph generation network: In order to learn the true distribution of attack heterogeneous graphs, an autoregressive deep neural network is constructed. The learned distribution is used to generate a certain number of graph structures for graph inputs of arbitrary structures, that is, to generate attack prediction graphs in a serialized manner, such as Figure 2 shown.

[0059] (3-1) Node prediction network construction: the representation S of the result of the graph G sequence mapping π and C π The network input is tensor splicing, as shown in Formula 3. The network for predicting new node types is defined as NodeRNN. Once the information of the first i-1 nodes under the node order π is determined, NodeRNN can determine the node type of the next node i. As shown in formula 4.

[0060]

[0061]

[0062] Where, is the edge sequence of the first i-1 nodes, is the node sequence of the first i-1 nodes, emb is the Embedding function, concat is the concatenation function, input i-1 The concatenated features of the first i-1 nodes are used as the input of NodeRNN for this iterative prediction. is the output of NodeRNN during the last iteration prediction, is the output of NodeRNN during this iteration prediction, Contains the node type of the new node i It is a predefined value, initialized to 0.

[0063] (3-2) Edge prediction network (dependency prediction network) construction: The network that predicts the dependency between a new node and its predecessor is called EdgeRNN. Based on the serialized graph composed of the first i-1 nodes and the output of NodeRNN The EdgeRNN model can generate the dependency relationship between node i and the previous node, that is, the adjacency vector As shown in Formula 5.

[0064]

[0065] Where, Represents the output of the last iteration of EdgeRNN, Represents node v i In the order of π with node v j-1 The adjacent elements between is the output of EdgeRNN in this iteration, Contains the dependency relationship between the new node i and the previous node is a predefined value, initialized to

[0066] It should be noted that this embodiment uses the first i-1 nodes as an example to illustrate the model input and output formulas, which is convenient for corresponding to the expression method in the attack heterogeneous graph. In actual application, when n nodes are known, n+1 nodes are predicted based on n nodes. In addition, in this embodiment, NodeRNN and EdgeRNN are both gated recurrent neural networks, specifically gated recurrent units (GRU). NodeRNN and EdgeRNN are collectively referred to as serialized graph generation models. By using the serialized graph generation model, the node attributes, edge attributes, and edge temporal characteristics in the attack graph are captured at the same time, which can actively predict the attacker's next attack method in real time during the occurrence of advanced persistent threat attacks.

[0067] (3-3) Generation of attack prediction graph: Update the attack heterogeneous graph according to the entity type of the new node and its dependency relationship with the previous node, and return to step 2 to continue prediction until the prediction node is empty or the set prediction length is reached, and then output the final attack heterogeneous graph as the attack prediction graph.

[0068] To train the graph generation model, this embodiment first collects logs generated by malicious script execution to train the graph generation model. The purpose of collecting logs generated by malicious script execution is to construct the data set required for network training. The prediction task is to predict the next behavior in real scenarios and provide early warnings for EDR. The model fully learns the node attributes, edge attributes, temporal properties, and inter-node dependencies of a large number of attack heterogeneous graphs. In the application process of the graph generation model, the input is the characterized attack heterogeneous graph, and the model predicts the node attributes of the next node n+1 in the graph, as well as the edge relationship between this node and the previous n nodes as output. The output and input are then merged as the next input, and traversed until the predicted node is empty (that is, the NodeRNN output is empty) or the set prediction length is reached. Ultimately, the generation of the attack prediction graph helps the detection and response system deployed in the enterprise to issue timely alarms, reminding analysts to prepare protection strategies.

[0069] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0070] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make numerous modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for predicting advanced persistent threats based on a sequenced graph generation model, characterized in that: The advanced persistent threat prediction method based on the serialized graph generation model includes: Step 1: Construct an attack heterogeneous graph based on the system audit log; Step 1-1: Capture system audit logs and collect kernel-level system events to form a provenance graph. Step 1-2: Use node type definition and verb dependency definition to model the nodes and edges of the provenance graph respectively, and construct an attack heterogeneous graph with abstract attack context relationships; Step 2: Characterize the attack heterogeneous graph based on the adjacency matrix; Step 2-1: Define the attack heterogeneous graph as G = (V, E), where the node set is V = (v1, ..., v n ), the set of edges between nodes is E=(v i , v j |v i , v j ∈V); Step 2-2, under the node order π, the adjacency matrix is defined as are adjacent elements; Step 2-3, define a mapping function f S Map the graph G to an adjacency matrix, express the order of nodes in the graph G and the dependency relationship between nodes in the form of a sequence, and obtain a serialized graph; Step 3: Generate an attack prediction graph based on the serialization graph; Step 3-1: Concatenate the sequence tensors in the serialization graph and input them into the node prediction network to obtain the entity type of the new node; Step 3-2: Input the serialized graph and the entity type of the new node output in step 3-1 into the dependency prediction network to obtain the dependency relationship between the new node and the previous node; Step 3-3: Update the attack heterogeneous graph according to the entity type of the new node and its dependency relationship with the previous node, and return to step 2 to continue prediction until the prediction node is empty or the set prediction length is reached, and then output the final attack heterogeneous graph as the attack prediction graph.

2. The advanced persistent threat prediction method based on the serialized graph generation model according to claim 1, characterized in that: In the provenance graph, the subject and object in the entity object of the kernel-level system event are taken as nodes in the provenance graph, and the relationship between the entities is taken as the edge in the provenance graph. The direction of the edge represents the flow direction of data content or control information between the two entities.

3. The advanced persistent threat prediction method based on the serialized graph generation model according to claim 1, characterized in that: The entity types included in the node type definition are Process, File, Registry, and Socket. The entity type Process is described as a program that is already running on the system. The entity type File is divided into four categories, which are respectively described as sensitive files containing configuration information, library files, executable files, and other types of files. The entity type Registry is described as a unified management of software and hardware configurations. The entity type Socket is described as a socket. In the verb dependency definition, the verb dependency read, write, exec, load, and unlink are defined as event relationships of Process To File, the verb dependency send and receive are defined as event relationships of Process To Socket, and the verb dependency fork, clone, start, and exit are defined as event relationships of Process To Process.

4. The advanced persistent threat prediction method based on the serialized graph generation model according to claim 3 is characterized in that: The node type definition and verb dependency definition are used to model the nodes and edges of the provenance graph respectively, and to construct an attack heterogeneous graph with abstract attack context relationships, including: According to the node type definition, the nodes that meet the description in the provenance graph are replaced with the corresponding entity type; according to the verb dependency definition, the event relationship between the nodes in the provenance graph is replaced with the verb dependency corresponding to the command execution function between the nodes under the event relationship.

5. The advanced persistent threat prediction method based on the serialized graph generation model according to claim 1, characterized in that: The mapping function f S as follows: Where, is the adjacent vector, Represents node v i Verb dependency relationship between the preceding node and the adjacent element in the π order Represents node v i In the order of π with node v j The verb dependency relationship between them, P represents the number of the verb dependency relationship in the verb dependency definition, is the node type, Represents node v i The entity type to which it belongs, K represents the number of the entity type in the node type definition, and the node sequence of all nodes is The edge sequence of all edges is 6. The advanced persistent threat prediction method based on the serialized graph generation model according to claim 5, characterized in that: The distribution p(G) of the attack heterogeneous graph can be expressed as p(S π , C π ),and: p(S π ,C π )=f S (G,π) The distribution p(G) is decomposed into the likelihood function as follows: For the terminal node n+1, it is expressed as:

7. The advanced persistent threat prediction method based on the serialized graph generation model according to claim 1, characterized in that: The node prediction network and the dependency prediction network are both gated recurrent neural networks.

Images