An attack detection method and device, electronic equipment and storage medium

Abstract

The application discloses an attack detection method and device, electronic equipment and storage medium, and relates to the technical field of computers. The method comprises the following steps: modeling a collected Windows audit log to generate a host behavior dependency graph; performing feature extraction on the host behavior dependency graph to obtain multi-view information; wherein the multi-view information comprises path information, structure information and event type information; determining an attack behavior score of the Windows audit log according to the path information, the structure information and the event type information; and if the attack behavior score meets an attack requirement, determining that the Windows audit log contains an attack behavior, so as to improve the robustness and accuracy of attack behavior detection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an attack detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the advent of the digital age, enterprises, organizations, and institutions store important files or data on their own mainframes. Once an attacker compromises a mainframe, these important files or data can be stolen, causing incalculable losses. Therefore, implementing security protection measures for mainframes has become crucial.

[0003] With the development of information security technology, in order to defend against attacks, victims will establish security defenses at the network boundary, such as firewalls, Internet Protocol Suite (IPS), and Web Application Firewall (WAF). However, attackers' attack methods are constantly evolving, making these defenses unable to detect various complex attacks.

[0004] Currently, the detection of attacks on hosts generally relies on certain rules to determine whether an attack has occurred. However, when attackers use variant attack methods to attack hosts, this method has a certain lag and cannot accurately detect the variant attack methods.

[0005] Therefore, improving the robustness and accuracy of attack detection is an urgent problem to be solved. Summary of the Invention

[0006] This application provides an attack detection method to improve the robustness and accuracy of attack behavior detection.

[0007] Firstly, an attack detection method is provided, including:

[0008] The collected Windows audit logs are modeled to generate a host behavior dependency graph; features are extracted from the host behavior dependency graph to obtain multi-view information; wherein, the multi-view information includes path information, structure information, and event type information; based on the path information, structure information, and event type information, the attack behavior score of the Windows audit logs is determined; if the attack behavior score meets the attack requirements, it is determined that there is an attack behavior in the Windows audit logs.

[0009] Optionally, the step of modeling the collected Windows audit logs to generate a host behavior dependency graph includes:

[0010] The unstructured data in the Windows audit log is converted into a standard event format to obtain at least one event;

[0011] Based on the set of target events, extract the target events that meet the requirements from each event;

[0012] Generate the host behavior dependency graph based on the target event;

[0013] An event is represented as event = (src, dst, rel, time), where src represents the source entity, dst represents the destination entity, rel represents the event type, and time represents the time when the event occurs.

[0014] Optionally, the path information includes attack paths generated by random walks in the host behavior dependency graph, the structure information includes the dependency relationships between entities in the host behavior dependency graph, and the event type information includes actions or activities of malicious data.

[0015] Optionally, the attack behavior score satisfies the following expression:

[0016]

[0017]

[0018] y pred =W·aggregate(X) all )+b

[0019] Wherein, X p The entity representation matrix representing the path information, the X et The entity embedding matrix representing the event type information, the The adjacency matrix representing the structural information, the ReLU representing the activation function, and the W... (0) W (1) W (2) The weight matrices of the first, second, and third layers in the graph convolutional neural network are respectively represented by y. pred The attack behavior score is represented by the aggregate, the information set calculation component is represented by the aggregate, and the bias term is represented by b.

[0020] Secondly, an attack detection device is provided, comprising:

[0021] The generation module is used to model the collected Windows audit logs and generate a host behavior dependency graph; the feature extraction module is used to extract features from the host behavior dependency graph to obtain multi-view information; wherein, the multi-view information includes path information, structure information, and event type information; the detection module is used to determine the attack behavior score of the Windows audit log based on the path information, structure information, and event type information; and, if the attack behavior score meets the attack requirements, to determine that the Windows audit log contains attack behavior.

[0022] Optionally, the generation module is specifically used for:

[0023] The unstructured data in the Windows audit log is converted into a standard event format to obtain at least one event;

[0024] Based on the set of target events, extract the target events that meet the requirements from each event;

[0025] Generate the host behavior dependency graph based on the target event;

[0026] An event is represented as event = (src, dst, rel, time), where src represents the source entity, dst represents the destination entity, rel represents the event type, and time represents the time when the event occurred. Optionally, the path information includes attack paths generated by random walks in the host behavior dependency graph, the structure information includes the dependencies between entities in the host behavior dependency graph, and the event type information includes the actions or activities of malicious data.

[0027] Optionally, the attack behavior score satisfies the following expression:

[0028]

[0029]

[0030] y pred =W·aggregate(X) all )+b

[0031] Wherein, X p The entity embedding matrix representing the path information, the X et The entity embedding matrix representing the event type information, the The adjacency matrix representing the structural information, the ReLU representing the activation function, and the W... (0) W (1) W (2)The weight matrices of the first, second, and third layers in the graph convolutional neural network are respectively represented by y. pred The attack behavior score is represented by the aggregate, the information set calculation component is represented by the aggregate, and the bias term is represented by b.

[0032] Thirdly, an electronic device is provided, comprising:

[0033] A memory for storing computer programs; a processor for executing the computer programs stored in the memory to implement the method steps described in any one of the first aspects.

[0034] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the steps of the method described in any one of the first aspects.

[0035] In this embodiment, by modeling the collected Windows audit logs to generate a host behavior dependency graph, various attack behaviors of malicious data (malicious programs) can be visualized intuitively, providing information at the attack structure level for subsequent analysis. This also facilitates more granular analysis by the attacked party. Furthermore, by extracting multi-dimensional features from the host behavior dependency graph, path information, structural information, and event type information are obtained. Based on this information, it is determined whether the Windows audit logs contain attack behaviors. Compared to attack behavior detection based on single-dimensional information, this provides a more granular analysis of the attack behaviors of malicious data, thus improving the accuracy and robustness of detection.

[0036] For the various aspects of the second to fourth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, which will not be repeated here. Attached Figure Description

[0037] Figure 1 A flowchart illustrating an attack detection method provided in an embodiment of this application;

[0038] Figure 2 A logical diagram illustrating an attack detection method provided in an embodiment of this application;

[0039] Figure 3 This is a schematic diagram of the structure of an attack detection device provided in an embodiment of this application;

[0040] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operational methods in the method embodiments can also be applied to the device embodiments or system embodiments. It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A connected to B can represent: A and B directly connected, and A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for distinguishing the purpose of description and should not be construed as indicating or implying relative importance or order.

[0042] To better understand the embodiments of this application, the technical terms involved in the embodiments of this application will be explained below.

[0043] (1) The Windows audit log is used to record detailed activities of the operating system. For example, when a malicious program (malicious data) runs on the host, a series of attack behaviors of the malicious program will be recorded in the Windows audit log, which may include a series of detailed information such as the time of occurrence of the event, files, registry, processes, sockets, etc.

[0044] (2) An event represents an entity and the actions between entities, and can be represented by event = (src, dst, rel, time); where src represents the source entity, dst represents the destination entity, rel is the relationship between src and dst (also called the event type), and time is the time point when the event occurs.

[0045] (3) The host behavior dependency graph is used to record the behavioral logical dependencies of entities on the host, and can be represented by G = (V, E); where V is a set of nodes, which may include entity points such as files, processes, and domain names; E is a set of edges, which may include behaviors such as file reading and writing, process creation, and image loading.

[0046] (4) Sysmon is a lightweight system monitoring tool that can record process creation, file access and network information through system services and device drivers, and write the relevant information into the Windows audit log. This system service and device driver can be deployed on a Windows virtual machine system.

[0047] (5) VirusTotal is a website that provides free analysis of suspicious documents.

[0048] (6) The deepwalk technique is mainly divided into two parts: random walk and generating representation vectors. First, the random walk algorithm is used to extract some vertex sequences from the graph (such as the host behavior dependency graph below); then, with the help of natural language processing, the generated vertex sequences are regarded as sentences composed of words. All sequences can be regarded as a large corpus. Finally, natural language processing tools (such as word2vec) are used to represent each vertex (also called entity) as an entity embedding matrix with dimension d.

[0049] Currently, host attack detection typically utilizes Long Short-Term Memory (LSTM) networks to extract path sequences from a constructed host behavior dependency graph. These extracted path sequences are then analyzed to determine if they are malicious. If so, the Windows audit logs for a given period are classified as malicious; otherwise, they are classified as benign. However, due to the ever-evolving nature of malware attacks, relying solely on one source of information may result in some malware going undetected, reducing the accuracy and robustness of the detection process.

[0050] Therefore, in this embodiment of the application, multi-dimensional information extraction (feature extraction) is performed on the created host behavior dependency graph, and the multi-dimensional information is comprehensively evaluated based on the graph convolutional neural network to detect attack behavior on the host.

[0051] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application. In actual processing or when the device executes the method, it may be executed in the order shown in the embodiments or drawings, or in combination.

[0052] Figure 1 This is a flowchart illustrating an attack detection method provided in an embodiment of this application. The process can be executed by an attack detection device, which can be implemented in software, hardware, or a combination of both. As shown in the figure, it may include the following steps:

[0053] In this embodiment, before performing the following steps, a target event set can be pre-defined. This target event set is used to define various malicious data that may be attacking the host, and each type of malicious data is classified into event types to facilitate subsequent targeted attack behavior analysis. For example, Windows audit logs of programs on the host can be collected and identified using the Sysmon tool. If malicious data is identified in the Windows audit logs, it can be marked according to its threat level score using VirusTotal, thereby distinguishing benign data in the Windows audit logs. Then, according to a customized configuration file, the type of event to which the malicious data in the Windows audit logs belongs can be captured. This configuration file includes a summary of different types of events, thereby classifying the captured malicious data and obtaining the target event set.

[0054] 101: Model the collected Windows audit logs to generate a host behavior dependency graph.

[0055] Optionally, a host behavior dependency graph can be generated in the following ways:

[0056] Preprocessing Windows audit logs involves converting unstructured data into a standard event format to obtain at least one event. This improves the accuracy of the subsequently constructed host behavior dependency graph. An event is represented as event = (src, dst, rel, time). The meaning of each parameter is explained previously and will not be repeated here. Secondly, based on the defined target event set, target events that meet the requirements are extracted from each event, narrowing the scope of attack behavior analysis and improving data processing efficiency. Finally, based on the extracted target events, the host behavior dependency graph G(V, E) is generated, where V is the node set (which may contain source and destination entities in the target events), and E is the edge set (which may contain the time point when the event occurred and the event type). Specifically, this host behavior dependency graph is a directed multigraph, consisting of nodes of source and destination entities, and directed edges connecting events from the source entity to the destination entity at a specific time point.

[0057] Optionally, after generating the host behavior dependency graph, redundant information can be removed to avoid interfering with the analysis of subsequent attack behaviors and to improve the processing efficiency of subsequent steps. For example, this can be achieved through the following methods:

[0058] Method 1: Aggregate edges with the same triple (src, dst, rel) in the host behavior dependency graph and use their calculated frequency as edge attributes to effectively aggregate domain information and avoid data sparsity problems.

[0059] Method 2: Based on the operating principle of the sandbox, identify the software that inserts into the Windows audit log and clean it up. This software includes specific processes that contain malicious data, thereby deleting invalid node information, edge information, etc. in the host behavior dependency graph.

[0060] 102: Perform feature extraction on the above host behavior dependency graph to obtain multi-view information. This multi-view information includes path information, structure information, and event type information.

[0061] Optionally, this path information may include attack paths generated by random walks in the host behavior dependency graph. Taking Deepwalk as an example, the process of generating this path information is described below:

[0062] First, attack paths for the host behavior dependency graph (G) are obtained based on a random walk algorithm. For example, given entity v0, multiple attack paths can be obtained starting from it, path = (v0, v1, ..., v l ), where l represents the length of the random walk.

[0063] Secondly, by combining deepwalk technology, the aforementioned attack paths are learned to obtain an entity embedding matrix (X) containing path information. p This may involve the following expressions:

[0064] Pr(v i |(Φ(v1),Φ(v2),...,Φ(v i-1 )))………(1)

[0065] minimize Φ -logPr(v i-w ,...,v i-1 ,v i+1 ,...,v i+w |v i ))………(2)

[0066] Wherein, expression (1) above is the estimated likelihood function, and expression (2) is the optimized estimated likelihood function, minimize Φ The mapping function Φ is used to solve for minimizing the objective function, and w represents the window size. For the mapping function, v i Let be the i-th entity in the node set V, d be the dimension of the entity embedding matrix, and |V| be the number of entities in V.

[0067] The extracted path information obtained through the above method can describe the causal relationship of the path in the host behavior dependency graph, reflect the attack activities of malicious data (malicious activities), and can be used as one of the key features for attack behavior detection.

[0068] Optionally, the structural information includes the dependencies between entities in the host behavior dependency graph. For example, it describes the dependencies between entities such as processes, files, and the registry on the host. The structural information of the host behavior dependency graph can be extracted based on a graph convolutional neural network.

[0069] When using a two-layer graph convolutional neural network to extract structural information, the following formulas may be involved:

[0070]

[0071] Where σ represents the activation function, for example, Relu(·) = max(0,·). A is the adjacency matrix of the host behavior dependency graph, I N It is the identity matrix. yes The degree matrix, where, H represents the edge connecting the i-th node and its j-th neighboring node. (l) H is the activation matrix of the node in layer l. l+1 H represents the activation matrix of a node in the (l+1)th layer after convolution. (0) =X, where X represents the entity embedding matrix of all entities, W (l) This represents the trainable weight matrix for a specific layer.

[0072] When using a three-layer graph convolutional neural network to extract structural information, the following formulas may be involved:

[0073]

[0074] in, The meaning of each parameter is described in the above formula (3), and will not be repeated here.

[0075] The structural information can be extracted from the host behavior dependency graph using the above formulas (3) and (4). This structural information can reflect the attack pattern or activity of the attack behavior, providing another dimension of information for subsequent detection and analysis, making the detection results more effective.

[0076] Optionally, since an event is composed of event = (src, dst, rel, time), where rel represents the event type, event type information plays a very important role in attack behavior detection, and can include the actions or activities of malicious data (malicious programs); while the frequency of event types represents the preferences of malicious data, and can also be used as one of the key features for attack behavior detection.

[0077] In this embodiment, the event type can be analyzed as edge information of the host behavior dependency graph, or as entity feature (point feature) in the host behavior dependency graph, which can avoid a large amount of feature analysis work, as shown below:

[0078] In some embodiments, when event type information is used as edge information in a host behavior dependency graph, the following formula applies:

[0079]

[0080] Among them, h Θ This represents a fully connected neural network, x i Let x represent the entity embedding matrix of the i-th entity. j Let N(i) be the entity embedding matrix of the j-th entity, and let N(i) be the neighborhood set of the i-th entity. i,j This represents the edge information (edge ​​embedding matrix) between entity i and entity j. The edge embedding matrix can be obtained using one-hot encoding.

[0081] In other embodiments, each entity may belong to more than one event type. When event type information is used as a point feature in the host behavior dependency graph, the following formula is involved:

[0082]

[0083] Among them, et i The event type embedding matrix represents the i-th entity; This indicates the concatenation of two matrices.

[0084] In this embodiment, based on the constructed host behavior dependency graph, multi-view information is extracted, and features in the Windows audit log can be extracted from multiple dimensions. Based on these features, it is easier to detect attack behaviors in the Windows audit log, thereby improving the robustness and accuracy of subsequent detection results.

[0085] 103: Based on the above path information, structure information, and event type information, determine the attack behavior score of this Windows audit log.

[0086] Optionally, the path information and event type information can be concatenated first, and then the structural information can be incorporated into the calculation. This is then combined with a single-layer weighting function to determine the attack behavior score. Specifically, the attack behavior score satisfies the following expression:

[0087]

[0088]

[0089] y pred =W·aggregate(X) all )+b………(9)

[0090] Among them, X p The entity embedding matrix X represents path information. et An entity embedding matrix representing event type information. The adjacency matrix represents structural information, ReLU represents the activation function, and W... (0) W (1) W (2) These represent the weight matrices of the first, second, and third layers in a graph convolutional neural network, respectively. pred The score represents the attack behavior, aggregate represents the information set calculation operator (e.g., summation, average, max-min operator, etc.), and b represents the bias term.

[0091] 104: Determine whether the attack requirements are met based on the attack behavior score. If yes, it is determined that there is an attack behavior in the Windows audit log; otherwise, it is determined that there is no attack behavior in the Windows audit log.

[0092] Specifically, this step could be: when y pred When y = 1, it indicates that there is an attack in the Windows audit log. pred When the value is 0, it indicates that there is no attack activity in the Windows audit log and the system can run normally on the host.

[0093] In some embodiments, when an attack is detected in the Windows audit log, it can be intercepted and an alarm message can be output to notify the attacked host that it is under attack, so that the attacked host can take appropriate measures.

[0094] In this embodiment, by modeling the collected Windows audit logs to generate a host behavior dependency graph, various attack behaviors of malicious data (malicious programs) can be visualized intuitively, providing information at the attack structure level for subsequent analysis. This also facilitates more granular analysis by the attacked party. Furthermore, by extracting multi-dimensional features from the host behavior dependency graph, path information, structural information, and event type information are obtained. Based on this information, it is determined whether the Windows audit logs contain attack behaviors. Compared to attack behavior detection based on single-dimensional information, this provides a more granular analysis of the attack behaviors of malicious data, thus improving the accuracy and robustness of detection.

[0095] Based on the above Figure 1 The process shown is as follows: Figure 2 An exemplary schematic diagram of an attack detection method provided in an embodiment of this application is shown.

[0096] First, the collected Windows audit logs are modeled to obtain host behavior dependency graph 201. Second, by combining deepwalk technology and graph convolutional neural network, features of different dimensions are extracted from the host behavior dependency graph 201 to obtain structural information, path information, and event type information. Finally, the structural information, path information, and event type information are effectively combined to calculate the attack behavior score of the Windows audit logs and output the detection results of the attack behavior.

[0097] Based on the same technical concept, this application also provides an attack detection device, which can implement the attack detection method flow described above in this application.

[0098] Figure 3 This is a schematic diagram of an attack detection device provided in an embodiment of this application. Figure 3 As shown, the device includes a generation module 301, a feature extraction module 302, and a detection module 303.

[0099] The generation module 301 is used to model the collected Windows audit logs and generate a host behavior dependency graph.

[0100] The feature extraction module 302 is used to extract features from the host behavior dependency graph to obtain multi-view information; wherein, the multi-view information includes path information, structure information, and event type information;

[0101] The detection module 303 is used to determine the attack behavior score of the Windows audit log based on the path information, structure information, and event type information; and to determine that there is an attack behavior in the Windows audit log if the attack behavior score meets the attack requirements.

[0102] Optionally, module 301 is used specifically for:

[0103] The unstructured data in the Windows audit log is converted into a standard event format to obtain at least one event;

[0104] Based on the set of target events, extract the target events that meet the requirements from each event;

[0105] Generate the host behavior dependency graph based on the target event;

[0106] An event is represented as event = (src, dst, rel, time), where src represents the source entity, dst represents the destination entity, rel represents the event type, and time represents the time when the event occurs.

[0107] It should be noted that the apparatus provided in this application embodiment can implement all the method steps in the above method embodiment and achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0108] Based on the same technical concept, this application also provides an electronic device that can realize the function of the aforementioned attack detection device.

[0109] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0110] At least one processor 401 and a memory 402 connected to at least one processor 401. In this embodiment, the specific connection medium between the processor 401 and the memory 402 is not limited. Figure 4 The example shown is the connection between processor 401 and memory 402 via bus 400. Bus 400 is... Figure 4 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 400 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 4 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, processor 401 can also be called a controller; there is no restriction on the name.

[0111] In this embodiment, memory 402 stores instructions executable by at least one processor 401. By executing the instructions stored in memory 402, at least one processor 401 can execute an attack detection method as described above. Processor 401 can implement... Figure 3The functions of each module in the device shown.

[0112] The processor 401 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 402 and calling data stored in memory 402, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0113] In one possible design, processor 401 may include one or more processing units. Processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 401. In some embodiments, processor 401 and memory 402 may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0114] Processor 401 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of an attack detection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0115] Memory 402, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 402 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 402 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 402 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0116] By designing and programming the processor 401, the code corresponding to one of the attack detection methods described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute it during runtime. Figure 2 The illustrated embodiment presents an attack detection method. How to design and program the processor 401 is a technique well-known to those skilled in the art and will not be described further here.

[0117] It should be noted that the electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0118] This application also provides a computer-readable storage medium storing computer-executable instructions for causing a computer to execute an attack detection method described in the above embodiments.

[0119] This application also provides a computer program product, which, when invoked by a computer, causes the computer to execute an attack detection method described in the above embodiments.

[0120] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0121] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0122] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0123] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

Claims

1. An attack detection method, characterized in that, include: The collected Windows audit logs are modeled to generate a host behavior dependency graph; Feature extraction is performed on the host behavior dependency graph to obtain multi-view information; wherein, the multi-view information includes path information, structure information, and event type information; Based on the path information, structure information, and event type information, the attack behavior score of the Windows audit log is determined; If the attack behavior score meets the attack requirements, then it is determined that there is an attack behavior in the Windows audit log; The attack behavior score satisfies the following expression: y pred =W·aggregate(X all )+b Wherein, X p The entity embedding matrix representing the path information, the X et The entity embedding matrix representing the event type information, the The adjacency matrix representing the structural information, the ReLU representing the activation function, and the W... (0) W (1) W (2) The y represents the weight matrices of the first, second, and third layers in the graph convolutional neural network, respectively. pred The attack behavior score is represented by the aggregate, the information set calculation component is represented by the b, and the bias term is represented by the b. This represents the concatenation of two matrices, where X... all The entity embedding matrix represents structural information, and W represents the weight matrix of the information set unit.

2. The method as described in claim 1, characterized in that, The step of modeling the collected Windows audit logs to generate a host behavior dependency graph includes: The unstructured data in the Windows audit log is converted into a standard event format to obtain at least one event; Based on the set of target events, extract the target events that meet the requirements from each event; Generate the host behavior dependency graph based on the target event; An event is represented as event = (src, dst, rel, time), where src represents the source entity, dst represents the destination entity, rel represents the event type, and time represents the time when the event occurs.

3. The method as described in claim 1, characterized in that, The path information includes attack paths generated by random walks in the host behavior dependency graph; the structure information includes the dependency relationships between entities in the host behavior dependency graph; and the event type information includes actions or activities of malicious data.

4. An attack detection device, characterized in that, include: The generation module is used to model the collected Windows audit logs and generate a host behavior dependency graph; The feature extraction module is used to extract features from the host behavior dependency graph to obtain multi-view information; wherein, the multi-view information includes path information, structure information, and event type information; The detection module is used to determine the attack behavior score of the Windows audit log based on the path information, structure information, and event type information; and to determine that there is attack behavior in the Windows audit log if the attack behavior score meets the attack requirements. The attack behavior score satisfies the following expression: y pred =W·aggregate(X all )+b Wherein, X p The entity embedding matrix representing the path information, the X et The entity embedding matrix representing the event type information, the The adjacency matrix representing the structural information, the ReLU representing the activation function, and the W... (0) W (1) W (2) The y represents the weight matrices of the first, second, and third layers in the graph convolutional neural network, respectively. pred The attack behavior score is represented by the aggregate, the information set calculation component is represented by the b, and the bias term is represented by the b. This represents the concatenation of two matrices, where X... all The entity embedding matrix represents structural information, and W represents the weight matrix of the information set unit.

5. The apparatus as described in claim 4, characterized in that, The generation module is specifically used for: The unstructured data in the Windows audit log is converted into a standard event format to obtain at least one event; Based on the set of target events, extract the target events that meet the requirements from each event; Generate the host behavior dependency graph based on the target event; An event is represented as event = (src, dst, rel, time), where src represents the source entity, dst represents the destination entity, rel represents the event type, and time represents the time when the event occurs.

6. The apparatus as claimed in claim 4, characterized in that, The path information includes attack paths generated by random walks in the host behavior dependency graph; the structure information includes the dependency relationships between entities in the host behavior dependency graph; and the event type information includes actions or activities of malicious data.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method of any one of claims 1-3.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-3.

Images