An attack scene reconstruction method and device, and an electronic device

Abstract

The application provides an attack scene reconstruction method and device and electronic equipment, and is applied to the technical field of network security. The attack scene reconstruction method comprises the following steps: acquiring an alarm event association graph constructed according to alarm data; wherein the alarm data comprises data corresponding to a plurality of alarm events in a first preset time period, and the alarm event association graph takes the alarm events as nodes and the association relationship between the alarm events as edges; extracting a plurality of target links from the alarm event association graph; inputting the target links into an entity relationship joint extraction model to obtain an attack prediction result output by the entity relationship joint extraction model; and reconstructing an attack scene based on the attack prediction result to obtain a corresponding attack scene reconstruction graph. In the above scheme, the entity relationship joint extraction model is used to extract the entity relationship of the alarm event, so that the attack scene reconstruction can also be performed on the alarm with a partially missing attribute field.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and more specifically, to an attack scenario reconstruction method and apparatus, and electronic equipment. Background Technology

[0002] An attack scenario is defined as a sequence of alert data based on specific relationships (e.g., chronological order, causal relationships, etc.) to depict a complete attack intrusion process; attack scenario reconstruction is the process of reconstructing the attack scenario from alert log data. Through attack scenario reconstruction, the attack methods and intentions commonly used by attackers can be analyzed, thus providing a basis for security administrators to build a more secure protection system, thereby ensuring the security of cyberspace.

[0003] In existing attack scenario reconstruction methods, if the causal relationship field information (such as kill chain stage) in the alarm event attribute information is missing, the reconstruction operation cannot be completed. Summary of the Invention

[0004] The purpose of this application is to provide an attack scenario reconstruction method, apparatus, and electronic device to solve the technical problem in the prior art that the reconstruction operation cannot be completed if the causal correlation field information in the alarm event attribute information is missing.

[0005] Firstly, embodiments of this application provide an attack scenario reconstruction method, comprising: acquiring an alarm event association graph constructed based on alarm data; wherein the alarm data includes data corresponding to multiple alarm events within a first preset time period, and the alarm event association graph uses the alarm events as nodes and the association relationships between the alarm events as edges; extracting multiple target links from the alarm event association graph; inputting the target links into an entity relationship joint extraction model to obtain an attack prediction result output by the entity relationship joint extraction model; and reconstructing the attack scenario based on the attack prediction result to obtain a corresponding attack scenario reconstruction graph. In the above scheme, after constructing the alarm event association graph, multiple target links can be extracted from the alarm event association graph, and the target links can be used as model input to obtain the attack prediction result output by the model. The above model can employ an entity relationship joint extraction model, which extracts entity relationships from alarm events, thereby enabling attack scenario reconstruction even for alarms with missing attribute fields.

[0006] In an optional implementation, extracting multiple target links from the alarm event association graph includes: clustering the alarm events based on the alarm event association graph to obtain a clustered association graph; wherein the number of nodes in the clustered association graph is less than the number of nodes in the alarm event association graph; and extracting the target links from the clustered association graph. In the above scheme, after constructing the alarm event association graph, the alarm events in the graph can be clustered, thereby reducing the computational load of the model and enhancing its detection efficiency.

[0007] In an optional implementation, the alarm events are clustered using a local community detection algorithm. In the above scheme, the local community detection algorithm can be used to cluster alarm events in the alarm event association graph, thereby reducing the computational load of the model and enhancing its detection efficiency.

[0008] In an optional implementation, obtaining the alarm event correlation graph constructed based on the alarm data includes: obtaining initial data; formatting and / or de-false alarm processing the initial data to obtain the alarm data; and constructing the alarm event correlation graph based on the alarm data. In the above scheme, since the initial data comes from different devices, the format of the initial data may differ. Formatting the initial data can unify the data format, facilitating subsequent data processing. Furthermore, since the initial data may include false alarms, de-false alarm processing can be performed on the initial data to improve prediction accuracy and avoid the impact of false alarms on prediction.

[0009] In an optional implementation, the initial data undergoes false alarm removal processing, including: grouping the alarm events according to the initial data to obtain multiple alarm groups; removing alarm groups where the number of alarm events is greater than a preset number or the interval between alarm events is less than a preset time; and / or calculating the alarm period corresponding to the alarm event based on the initial data; and removing alarm events where the autocorrelation coefficient corresponding to the alarm period is greater than a preset coefficient. In the above scheme, since false alarms are regular, false alarm removal can be performed based on the high frequency and / or periodicity of false alarms, thereby improving the accuracy of prediction.

[0010] In an optional implementation, after reconstructing the attack scenario based on the attack prediction results to obtain a corresponding attack scenario reconstruction map, the method further includes: determining the last kill chain stage node based on the attack scenario reconstruction map; and identifying the host connected to the last kill chain stage node as the target host. In the above scheme, after obtaining the attack scenario reconstruction map, the target host that may be attacked next can be determined based on the attack scenario reconstruction map, thereby enabling the formulation of corresponding preventive measures.

[0011] In an optional implementation, the entity relationship joint extraction model is trained through the following process: obtaining a sample event association graph constructed based on sample data; wherein the sample data includes data corresponding to multiple sample events within a second preset time period, the second preset time period being longer than the first preset time period, and the sample event association graph using the sample events as nodes and the association relationships between the sample events as edges; extracting multiple sample links from the sample event association graph, and labeling the attack links and non-attack links in the sample links to obtain corresponding labeled data; updating the parameters of the entity relationship joint extraction model based on the sample links and the labeled data. In the above scheme, after constructing the sample event association graph, multiple sample links can be extracted from the sample event association graph and labeled, thereby enabling the entity relationship joint extraction model to be trained based on the labeled data and sample links. Specifically, by extracting entity relationships from alarm events using the above entity relationship joint extraction model, attack scenario reconstruction can be performed even for alarms with missing attribute fields.

[0012] Secondly, embodiments of this application provide an attack scenario reconstruction apparatus, comprising: an acquisition module, configured to acquire an alarm event association graph constructed based on alarm data; wherein the alarm data includes data corresponding to multiple alarm events within a first preset time period, and the alarm event association graph uses the alarm events as nodes and the association relationships between the alarm events as edges; an extraction module, configured to extract multiple target links from the alarm event association graph; a prediction module, configured to input the target links into an entity relationship joint extraction model to obtain an attack prediction result output by the entity relationship joint extraction model; and a reconstruction module, configured to reconstruct the attack scenario based on the attack prediction result to obtain a corresponding attack scenario reconstruction graph. In the above scheme, after constructing the alarm event association graph, multiple target links can be extracted from the alarm event association graph, and the target links can be used as model input to obtain the attack prediction result output by the model. The model can employ an entity relationship joint extraction model, which extracts entity relationships from alarm events, thereby enabling attack scenario reconstruction even for alarms with missing attribute fields.

[0013] In an optional implementation, the extraction module is specifically used to: cluster the alarm events based on the alarm event association graph to obtain a clustered association graph; wherein the number of nodes in the clustered association graph is less than the number of nodes in the alarm event association graph; and extract the target link from the clustered association graph. In the above scheme, after constructing the alarm event association graph, the alarm events in the alarm event association graph can be clustered, thereby reducing the computational load of the model and enhancing the detection efficiency of the model.

[0014] In an optional implementation, the alarm events are clustered using a local community detection algorithm. In the above scheme, the local community detection algorithm can be used to cluster alarm events in the alarm event association graph, thereby reducing the computational load of the model and enhancing its detection efficiency.

[0015] In an optional implementation, the acquisition module is specifically used to: acquire initial data; perform formatting and / or false alarm removal processing on the initial data to obtain the alarm data; and construct the alarm event association graph based on the alarm data. In the above scheme, since the initial data comes from different devices, the format of the initial data may differ. Formatting the initial data can unify the data format, facilitating subsequent data processing. Furthermore, since the initial data may include false alarms, false alarm removal processing can be performed on the initial data to improve the accuracy of the prediction and avoid the impact of false alarms on the prediction.

[0016] In an optional implementation, the acquisition module is specifically used to: group the alarm events according to the initial data to obtain multiple alarm groups; remove alarm groups whose number of alarm events is greater than a preset number or whose interval between alarm events is less than a preset time; and / or, calculate the alarm period corresponding to the alarm event according to the initial data; remove alarm events whose autocorrelation coefficient corresponding to the alarm period is greater than a preset coefficient. In the above scheme, since false alarms have regularity, false alarm elimination can be performed based on the high frequency and / or periodicity of false alarms, thereby improving the accuracy of prediction.

[0017] In an optional implementation, the attack scenario reconstruction device further includes: a first determining module, configured to determine the last kill chain stage node based on the attack scenario reconstruction graph; and a second determining module, configured to identify the host connected to the last kill chain stage node as the target host. In the above scheme, after obtaining the attack scenario reconstruction graph, the target host for the next possible attack can be determined based on the attack scenario reconstruction graph, thereby enabling the formulation of corresponding preventative measures.

[0018] In an optional implementation, the attack scenario reconstruction device further includes a training module, used to train the entity relationship joint extraction model through the following process: obtaining a sample event association graph constructed based on sample data; wherein the sample data includes data corresponding to multiple sample events within a second preset time period, the second preset time period being longer than the first preset time period, and the sample event association graph using the sample events as nodes and the association relationships between the sample events as edges; extracting multiple sample links from the sample event association graph, and labeling the attack links and non-attack links in the sample links to obtain corresponding labeled data; updating the parameters of the entity relationship joint extraction model based on the sample links and the labeled data. In the above scheme, after constructing the sample event association graph, multiple sample links can be extracted from the sample event association graph and labeled, thereby enabling the entity relationship joint extraction model to be trained based on the labeled data and sample links. Specifically, by extracting entity relationships from alarm events through the entity relationship joint extraction model, attack scenario reconstruction can be performed even for alarms with partially missing attribute fields.

[0019] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus; the processor and the memory communicate with each other through the bus; the memory stores computer program instructions that can be executed by the processor, and the processor can execute the attack scenario reconstruction method as described in the first aspect by calling the computer program instructions.

[0020] Fourthly, embodiments of this application provide a computer-readable storage medium that stores computer program instructions. When the computer program instructions are executed by a computer, the computer performs the attack scenario reconstruction method as described in the first aspect.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, embodiments of this application are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating an attack scenario reconstruction method provided in this application embodiment;

[0024] Figure 2 A structural block diagram of an attack scene reconstruction device provided in an embodiment of this application;

[0025] Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0027] Please refer to Figure 1 , Figure 1 A flowchart of an attack scenario reconstruction method provided in this application embodiment, the attack scenario reconstruction method may include the following steps:

[0028] Step S101: Obtain the alarm event association diagram constructed based on the alarm data.

[0029] Step S102: Extract multiple target links from the alarm event association graph.

[0030] Step S103: Input the target link into the entity relationship joint extraction model to obtain the attack prediction result output by the entity relationship joint extraction model.

[0031] Step S104: Reconstruct the attack scenario based on the attack prediction results to obtain the corresponding attack scenario reconstruction map.

[0032] Specifically, in step S101 above, the alarm data includes data corresponding to multiple alarm events within a first preset time period. The alarm event association graph uses alarm events as nodes and the association relationships between alarm events as edges. Therefore, the corresponding alarm event association graph can be constructed based on the alarm data above.

[0033] It should be noted that the embodiments of this application do not specifically limit the specific implementation of obtaining the alarm event association diagram constructed based on alarm data. Those skilled in the art can make appropriate adjustments according to the actual situation. For example, the alarm event association diagram sent by an external device can be received; or, the alarm event association diagram stored in advance can be read from the cloud or local; or, the alarm event association diagram can be directly obtained.

[0034] In step S102 above, multiple target links can be extracted from the alarm event association diagram above. Here, a target link refers to a link that may be an attack link, and the target link includes multiple connected alarm events.

[0035] In step S103 above, entity-relation joint extraction is a knowledge extraction method in natural language processing, often used in the construction of knowledge graphs. Entity extraction refers to named entity recognition, which mainly extracts information such as names, geographical locations, and organizations from text. Relation extraction is the extraction of relationships between entities to form relation triples. For example, if Wu Jing starred in Wolf Warrior, the extracted entities are Wu Jing and Wolf Warrior, and the relation is starred in, forming a triple (Wu Jing, starred in, Wolf Warrior). Entity-relation joint extraction means that in a model, entities and relations are extracted simultaneously to form triples.

[0036] The essence of the entity-relationship joint extraction model is to extract the relationships between entities from a large amount of text and form relationship triples. In the embodiments of this application, the above-mentioned alarm event association graph can be compared to a massive amount of text, and the nodes and relationships on the actual multi-step attack chain can be compared to the relationships between entities. Therefore, attack triples that satisfy the actual multi-step attack can be extracted, thereby completing the reconstruction of the attack scenario.

[0037] Based on the above analysis, the target link can be used as the model input and fed into the entity relationship joint extraction model to obtain the attack prediction results output by the entity relationship joint extraction model. Thus, the attack scenario can be reconstructed based on the above attack prediction results.

[0038] When the target link is input into the entity relationship joint extraction model, the attribute information of the alarm event (e.g., alarm name, alarm type, ATT&CK tags, etc.) can be encoded using the BERT model. Entity recognition is used to identify the entity in the kill chain stage of the alarm event. Then, the relationship is extracted based on the kill chain of the alarm event and the connection relationship of the alarm event, thereby completing the reconstruction of the attack scenario.

[0039] It should be noted that the entities identified by the above entity relationship joint extraction model can be the seven stages in the kill chain; the kill chain stages include: reconnaissance and tracking entity, weaponization development entity, payload delivery entity, vulnerability exploitation entity, installation and implantation entity, command and control entity, and target achievement entity.

[0040] It is understandable that although the above alarm events contain kill chain data, due to reasons such as mislabeled kill chains, empty kill chain fields in alarm events, and alarm events potentially corresponding to multiple kill chain stages, the above entity relationship joint extraction model can reconstruct attack scenarios under various circumstances.

[0041] In addition, the aforementioned entity-relationship joint extraction model can also identify overlapping relationships. Relationship overlap refers to a single alarm event corresponding to multiple relationships, meaning that one alarm event connects to multiple alarm events in the alarm association graph. When multiple attacks occur within a single attack (e.g., after an exploit attack, information theft and lateral movement attacks occur), the entity-relationship joint extraction model uses relationship extraction to connect the exploit attack with the information theft attack and the lateral movement attack via two edges, thereby reconstructing the multi-attack scenario.

[0042] In step S104 above, since the entity relationship joint extraction model can identify the attack chain entities and connection relationships and output the attack prediction results, the attack scenario can be reconstructed based on the above attack prediction results to obtain the corresponding attack scenario reconstruction diagram.

[0043] As one implementation method, links that include five or more attack kill chain stages in the supply forecast results can be extracted to obtain an attack scenario reconstruction diagram.

[0044] In the above scheme, after constructing the alarm event association graph, multiple target links can be extracted from the graph and used as model inputs to obtain the attack prediction results output by the model. Specifically, the model can employ an entity relationship joint extraction model to extract entity relationships from the alarm events, enabling attack scenario reconstruction even for alarms with missing attribute fields.

[0045] Furthermore, based on the above embodiments, step S102 may specifically include the following steps:

[0046] Step 1) Cluster the alarm events based on the alarm event association graph to obtain the cluster association graph.

[0047] Step 2) Extract the target link from the cluster association graph.

[0048] Specifically, in step 1) above, since the amount of alarm event data in the actual scenario is huge, the number of nodes in the alarm event association graph can be reduced by clustering the alarm events in the alarm event association graph, so as to obtain a cluster association graph with a smaller amount of data.

[0049] It is understandable that the number of nodes in the cluster association graph obtained after clustering is less than the number of nodes in the alarm event association graph.

[0050] In step 2) above, similar to extracting multiple target links directly from the alarm event association graph, target links can be extracted from the cluster association graph.

[0051] In the above scheme, after constructing the alarm event association graph, the alarm events in the alarm event association graph can be clustered, thereby reducing the computational load of the model and enhancing the detection efficiency of the model.

[0052] Furthermore, based on the above embodiments, the alarm events are clustered using a local community detection algorithm.

[0053] Specifically, a community is a local structure characterized by tight internal connections and sparse connections between different local structures. Local community detection algorithms can be used to discover community structures in networks and can also be viewed as a type of clustering algorithm.

[0054] As one implementation method, alerts that hit malicious IPs, malicious domains, or important assets in the threat intelligence database can be used as seed nodes as input. The Local Community Discovery (ACL) algorithm can be used to obtain local community nodes around the seed node of the alert event, thereby achieving clustering of alert events.

[0055] In the above scheme, a local community detection algorithm can be used to cluster alarm events in the alarm event association graph, thereby reducing the computational load of the model and enhancing the detection efficiency of the model.

[0056] Furthermore, based on the above embodiments, step S101 may specifically include the following steps:

[0057] Step 1), obtain initial data.

[0058] Step 2) Format the initial data and / or remove false alarms to obtain alarm data.

[0059] Step 3) Construct an alarm event association diagram based on the alarm data.

[0060] Specifically, in step 1) above, the initial data can be data related to alarm events extracted from network logs. It should be noted that this application embodiment does not specifically limit the specific implementation method for obtaining the initial data. Those skilled in the art can make appropriate adjustments according to the actual situation. For example, initial data can be received from external devices; or, pre-stored initial data can be read from the cloud or local storage; or, the initial data can be obtained directly.

[0061] Taking the direct acquisition of initial data as an example, as one implementation method, an Intrusion Detection System (IDS) can be used to monitor multi-source logs in the network (e.g., Netflow logs, HTTP logs, DNS logs, etc., different logs record different network transmission protocol information). When the IDS discovers suspicious information and hits its detection rules, it can generate a network security alarm event, which represents a suspicious network attack event, thereby obtaining the initial data.

[0062] In step 2) above, since the network alarm events originate from different security detection devices, the format of the initial data they generate is not exactly the same. Therefore, the initial data can be mapped and extracted into a unified format to facilitate the next step of data processing; that is, the initial data can be formatted.

[0063] As one implementation method, the following important fields can be selected: source IP, destination IP, source port, destination port, transport protocol, alarm event name, event type 1 (such as web attack), alarm type 2 (which is a subdivision of alarm type 1, such as SQL injection attack subdivision of web attack), kill chain stage, ATT&CK tag, whether threat intelligence is hit, etc., and the initial data can be mapped to these important fields to achieve formatting processing of the initial data.

[0064] Since some normal business operations or normal user internet behavior can also generate alarms, these alarms are called false alarms. They generally account for a large proportion of alarm events, so they can be eliminated; that is, false alarm removal processing can be performed on the initial data.

[0065] As one implementation method, false alarms are regular, so false alarms can be eliminated by considering their high frequency and periodicity.

[0066] It is understood that, depending on the application scenario, the initial data can be formatted and / or false alarm removal processed simultaneously to obtain alarm data; or only the initial data can be formatted to obtain alarm data; or only the initial data can be false alarm removal processed to obtain alarm data. This application embodiment does not impose specific limitations on these methods.

[0067] In addition, as an implementation method, besides formatting the initial data and / or removing false alarms, alarm events with incomplete information in the initial data can also be deleted because information loss may occur during network transmission.

[0068] In step 3) above, a corresponding alarm event association graph can be constructed based on the alarm data. As described in the above embodiment, the alarm event association graph can have alarm events as nodes and the relationships between alarm events as edges.

[0069] For example, network attack directions typically fall into two categories: vertical movement attacks and lateral movement attacks. When an attacker launches two attacks on the same target host, the source IP and destination IP of the two generated alarm events correspond to each other. For instance, the IP information for the first alarm is (SIP1, DIP1), and the IP information for the second alarm is (SIP2, DIP2). In this case, SIP1 == SIP2 and DIP1 == DIP2. After the target host is compromised, a lateral movement attack will be launched, and the source IP of the generated alarm event will be equal to the destination IP of the previous attack. For instance, the IP information for the lateral movement attack alarm is (SIP3, DIP3), and in this case, DIP2 == SIP3. Based on the above situations, an alarm event association graph can be constructed by using the alarm event that occurred earlier as the source node and the alarm event that occurred later as the destination node.

[0070] Therefore, the detection range of the model is enhanced in this embodiment, and it can also detect lateral movement multi-path attacks.

[0071] In the above scheme, since the initial data comes from different devices, the format of the initial data may be different. The initial data can be formatted to make the data uniform and facilitate the next step of data processing. Since the initial data may include false alarms, the initial data can be de-false alarmed to avoid the impact of false alarms on the prediction. Therefore, the accuracy of the prediction can be improved by de-false alarm processing.

[0072] Furthermore, based on the above embodiments, as one implementation method, the above-mentioned step of performing false alarm removal processing on the initial data may specifically include the following steps:

[0073] Step 1) Group the alarm events according to the initial data to obtain multiple alarm groups.

[0074] Step 2) Remove alarm groups whose number of alarm events exceeds a preset number or whose interval between alarm events is less than a preset time.

[0075] Specifically, false alarms have a regularity, so the initial data can be processed to eliminate false alarms based on high frequency.

[0076] In step 1) above, alarm events can be grouped based on initial data to obtain multiple alarm groups. It should be noted that this application embodiment does not specifically limit the specific implementation method for the grouping, and those skilled in the art can make appropriate adjustments according to actual circumstances. For example, grouping can be based on the same alarm event name, source IP, and destination IP.

[0077] In step 2) above, high-frequency alarm events can be removed, that is, alarm groups with a number of alarm events greater than a preset number or an interval between alarm events less than a preset time can be removed.

[0078] It should be noted that the embodiments of this application do not impose specific limitations on the above-mentioned preset quantity and preset event implementation methods, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, alarm events in alarm groups with a number of alarm events greater than 1000 and an interval of less than 10 seconds can be removed.

[0079] In the above scheme, since false alarms are regular, false alarms can be eliminated based on their high frequency, thereby improving the accuracy of prediction.

[0080] Furthermore, based on the above embodiments, as another implementation method, the step of performing false alarm removal processing on the initial data may specifically include the following steps:

[0081] Step 1) Calculate the alarm cycle corresponding to the alarm event based on the initial data.

[0082] Step 2) Remove alarm events whose autocorrelation coefficients corresponding to the alarm cycle are greater than the preset coefficient.

[0083] Specifically, false alarms have a regularity, so the initial data can be periodically processed to remove false alarms.

[0084] In step 1) above, the alarm period corresponding to the alarm event can be calculated based on the initial data using Fourier transform. In step 2) above, the alarm events can be periodically checked using the autocorrelation coefficient, and alarm events with an autocorrelation coefficient greater than a preset coefficient corresponding to the alarm period can be removed.

[0085] It should be noted that the embodiments of this application do not impose specific limitations on the specific implementation of the above-mentioned preset coefficients, and those skilled in the art can make appropriate adjustments according to the actual situation. For example, alarm events with an autocorrelation coefficient greater than 0.8 can be removed.

[0086] In the above scheme, since false alarms are regular, false alarms can be eliminated based on their periodicity, thereby improving the accuracy of prediction.

[0087] Furthermore, based on the above embodiments, after step S104, the attack scenario reconstruction method provided in this application embodiment may further include the following steps:

[0088] Step 1) Determine the last kill chain stage node based on the attack scenario reconstruction graph.

[0089] Step 2) Identify the host connected to the last kill chain stage node as the target host.

[0090] In the above scheme, after obtaining the attack scenario reconstruction map, the target host that may be attacked next can be determined based on the attack scenario reconstruction map, so that corresponding preventive measures can be formulated.

[0091] Furthermore, based on the above embodiments, the above entity relationship joint extraction model can be trained through the following process:

[0092] Step 1) Obtain the sample event association graph constructed based on the sample data.

[0093] Step 2) Extract multiple sample links from the sample event association graph, and label the attack links and non-attack links in the sample links to obtain the corresponding labeling data.

[0094] Step 3) Update the parameters of the entity relationship joint extraction model based on the sample links and labeled data.

[0095] Specifically, in step 1) above, the sample data includes data corresponding to multiple sample events within a second preset time period. The second preset time period is longer than the first preset time period. The sample event association graph uses sample events as nodes and the association relationships between sample events as edges. Therefore, the corresponding sample event association graph can be constructed based on the above sample data.

[0096] It should be noted that the embodiments of this application do not specifically limit the specific implementation of the first preset time period and the second preset time period. Those skilled in the art can make appropriate adjustments according to the actual situation. For example, the first preset time period is 1 day and the second preset time period is 1 year.

[0097] Furthermore, this application does not impose specific limitations on the specific implementation of obtaining the sample event association diagram constructed based on the sample data. Those skilled in the art can also make appropriate adjustments according to the actual situation. For example, the sample event association diagram sent by an external device can be received; or, a sample event association diagram stored in advance can be read from the cloud or local storage; or, the sample event association diagram can be directly constructed based on the sample data.

[0098] Taking the sample event association graph directly constructed from sample data as an example, historical data can be obtained first, and then the historical data can be formatted and / or false alarms removed to obtain sample data; finally, the sample event association graph can be constructed based on the sample data.

[0099] It is understood that the above implementation of formatting and / or de-false alarm processing of historical data is similar to the implementation of formatting and / or de-false alarm processing of initial data in the above embodiments, and will not be described again here.

[0100] In step 2) above, multiple sample links can be extracted from the above sample event association diagram. A sample link refers to a link that may be an attack link, and the sample link includes multiple connected alarm events.

[0101] Then, attack links and non-attack links in the sample links can be labeled to obtain corresponding labeled data; that is, completed attack links can be found from the sample links, and the alarm nodes and their connection relationships and the respective kill chain stages of the alarm nodes can be labeled. Similarly, non-attack links (including incomplete attack links and links that are not attack links) can be found from the sample links, and the alarm nodes in them can also be labeled. In this way, an attack scenario reconstruction knowledge base can be constructed.

[0102] For example, suppose there are 1,000 alarm nodes in the sample event correlation graph within one day, of which there are 10 complete attack chains, each with 10 nodes. Then, 100 attack nodes need to be labeled, along with the attack chain stages and connection relationships of these 100 nodes; and 900 non-attack nodes need to be labeled.

[0103] In step 3) above, the sample links and labeled data are input into the entity relationship joint extraction model. By updating the parameters of the entity relationship joint extraction model, the entity relationship joint extraction model can be trained.

[0104] In the above scheme, after constructing the sample event association graph, multiple sample links can be extracted from the graph and labeled. This allows for the training of the entity relationship joint extraction model based on the labeled data and the sample links. Specifically, the entity relationship extraction model extracts entity relationships from alarm events, enabling attack scenario reconstruction even for alarms with missing attribute fields.

[0105] Please refer to Figure 2 , Figure 2This application provides a structural block diagram of an attack scenario reconstruction device 200, comprising: an acquisition module 201, used to acquire an alarm event association graph constructed based on alarm data; wherein the alarm data includes data corresponding to multiple alarm events within a first preset time period, and the alarm event association graph uses the alarm events as nodes and the association relationships between the alarm events as edges; an extraction module 202, used to extract multiple target links from the alarm event association graph; a prediction module 203, used to input the target links into an entity relationship joint extraction model to obtain an attack prediction result output by the entity relationship joint extraction model; and a reconstruction module 204, used to reconstruct the attack scenario based on the attack prediction result to obtain a corresponding attack scenario reconstruction graph.

[0106] In the above scheme, after constructing the alarm event association graph, multiple target links can be extracted from the graph and used as model inputs to obtain the attack prediction results output by the model. Specifically, the model can employ an entity relationship joint extraction model to extract entity relationships from the alarm events, enabling attack scenario reconstruction even for alarms with missing attribute fields.

[0107] Furthermore, based on the above embodiments, the extraction module 202 is specifically used to: cluster the alarm events based on the alarm event association graph to obtain a cluster association graph; wherein the number of nodes in the cluster association graph is less than the number of nodes in the alarm event association graph; and extract the target link from the cluster association graph.

[0108] In the above scheme, after constructing the alarm event association graph, the alarm events in the alarm event association graph can be clustered, thereby reducing the computational load of the model and enhancing the detection efficiency of the model.

[0109] Furthermore, based on the above embodiments, the alarm events are clustered using a local community detection algorithm.

[0110] In the above scheme, a local community detection algorithm can be used to cluster alarm events in the alarm event association graph, thereby reducing the computational load of the model and enhancing the detection efficiency of the model.

[0111] Furthermore, based on the above embodiments, the acquisition module 201 is specifically used for: acquiring initial data; performing formatting processing and / or false alarm removal processing on the initial data to obtain the alarm data; and constructing the alarm event association diagram based on the alarm data.

[0112] In the above scheme, since the initial data comes from different devices, the format of the initial data may be different. The initial data can be formatted to make the data uniform and facilitate the next step of data processing. Since the initial data may include false alarms, the initial data can be de-false alarmed to avoid the impact of false alarms on the prediction. Therefore, the accuracy of the prediction can be improved by de-false alarm processing.

[0113] Furthermore, based on the above embodiments, the acquisition module 201 is specifically used to: group the alarm events according to the initial data to obtain multiple alarm groups; remove alarm groups whose number of alarm events is greater than a preset number or whose interval between alarm events is less than a preset time; and / or, calculate the alarm period corresponding to the alarm event according to the initial data; remove alarm events whose autocorrelation coefficient corresponding to the alarm period is greater than a preset coefficient.

[0114] In the above scheme, since false alarms are regular, false alarms can be eliminated based on their high frequency and / or periodicity, thereby improving the accuracy of prediction.

[0115] Furthermore, based on the above embodiments, the attack scenario reconstruction device 200 further includes: a first determining module, used to determine the last kill chain stage node according to the attack scenario reconstruction graph; and a second determining module, used to determine the host connected to the last kill chain stage node as the target host.

[0116] In the above scheme, after obtaining the attack scenario reconstruction map, the target host that may be attacked next can be determined based on the attack scenario reconstruction map, so that corresponding preventive measures can be formulated.

[0117] Furthermore, based on the above embodiments, the attack scenario reconstruction device 200 further includes: a training module, used to train the entity relationship joint extraction model through the following process: obtaining a sample event association graph constructed based on sample data; wherein, the sample data includes data corresponding to multiple sample events within a second preset time period, the second preset time period being longer than the first preset time period, and the sample event association graph using the sample events as nodes and the association relationships between the sample events as edges; extracting multiple sample links from the sample event association graph, and labeling the attack links and non-attack links in the sample links to obtain corresponding labeled data; updating the parameters of the entity relationship joint extraction model based on the sample links and the labeled data.

[0118] In the above scheme, after constructing the sample event association graph, multiple sample links can be extracted from the graph and labeled. This allows for the training of the entity relationship joint extraction model based on the labeled data and the sample links. Specifically, the entity relationship extraction model extracts entity relationships from alarm events, enabling attack scenario reconstruction even for alarms with missing attribute fields.

[0119] Please refer to Figure 3 , Figure 3 This application provides a structural block diagram of an electronic device 300, which includes at least one processor 301, at least one communication interface 302, at least one memory 303, and at least one communication bus 304. The communication bus 304 enables direct communication between these components, the communication interface 302 facilitates signaling or data communication with other node devices, and the memory 303 stores machine-readable instructions executable by the processor 301. When the electronic device 300 is running, the processor 301 communicates with the memory 303 via the communication bus 304. When the machine-readable instructions are invoked by the processor 301, the aforementioned attack scenario reconstruction method is executed.

[0120] For example, the processor 301 in this embodiment of the application can read a computer program from the memory 303 via the communication bus 304 and execute the computer program to implement the following method: Step S101: Obtain an alarm event association graph constructed based on alarm data. Step S102: Extract multiple target links from the alarm event association graph. Step S103: Input the target links into the entity relationship joint extraction model to obtain the attack prediction result output by the entity relationship joint extraction model. Step S104: Reconstruct the attack scenario based on the attack prediction result to obtain the corresponding attack scenario reconstruction graph.

[0121] The processor 301 may include one or more, and may be an integrated circuit chip with signal processing capabilities. The processor 301 may be a general-purpose processor, including a Central Processing Unit (CPU), a Microcontroller Unit (MCU), a Network Processor (NP), or other conventional processors; it may also be a special-purpose processor, including a Neural-network Processing Unit (NPU), a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Furthermore, when there are multiple processors 301, some may be general-purpose processors, and others may be special-purpose processors.

[0122] The memory 303 includes one or more, which may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0123] Understandable. Figure 3 The structure shown is for illustrative purposes only; the electronic device 300 may also include components that are more advanced than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3The components shown can be implemented using hardware, software, or a combination thereof. In the embodiments of this application, electronic device 300 can be, but is not limited to, physical devices such as desktop computers, laptops, smartphones, smart wearable devices, and in-vehicle devices, or virtual devices such as virtual machines. Furthermore, electronic device 300 is not necessarily a single device; it can be a combination of multiple devices, such as a server cluster, etc.

[0124] This application also provides a computer-readable storage medium that stores computer program instructions. When the computer program instructions are executed by a computer, the computer performs the attack scenario reconstruction method described in the foregoing method embodiments.

[0125] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0126] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0127] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0128] It should be noted that if the function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0130] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An attack scenario reconstruction method, characterized in that, include: Obtain an alarm event association graph constructed based on alarm data; wherein, the alarm data includes data corresponding to multiple alarm events within a first preset time period, and the alarm event association graph uses the alarm events as nodes and the association relationships between the alarm events as edges; Extract multiple target links from the alarm event association graph; The target link is input into the entity relationship joint extraction model to obtain the attack prediction result output by the entity relationship joint extraction model. Based on the attack prediction results, the attack scenario is reconstructed to obtain the corresponding attack scenario reconstruction map. The entity relationship joint extraction model is configured to: perform kill chain stage entity identification on the alarm event through entity recognition, and extract relationships based on the kill chain of the alarm event and the connection relationship of the alarm event.

2. The attack scenario reconstruction method according to claim 1, characterized in that, The extraction of multiple target links from the alarm event association graph includes: The alarm events are clustered based on the alarm event association graph to obtain a cluster association graph; wherein the number of nodes in the cluster association graph is less than the number of nodes in the alarm event association graph. Extract the target link from the cluster association graph.

3. The attack scenario reconstruction method according to claim 2, characterized in that, The alarm events are clustered using a local community detection algorithm.

4. The attack scenario reconstruction method according to claim 1, characterized in that, The step of obtaining the alarm event correlation graph constructed based on the alarm data includes: Get initial data; The initial data is formatted and / or false alarms are removed to obtain the alarm data; Construct the alarm event association graph based on the alarm data.

5. The attack scenario reconstruction method according to claim 4, characterized in that, The initial data is subjected to false alarm removal processing, including: The alarm events are grouped according to the initial data to obtain multiple alarm groups; Remove alarm groups whose number of alarm events exceeds a preset number or whose interval between alarm events is less than a preset time; And / or, Calculate the alarm period corresponding to the alarm event based on the initial data; Remove alarm events whose autocorrelation coefficients corresponding to the alarm period are greater than a preset coefficient.

6. The attack scenario reconstruction method according to claim 1, characterized in that, After reconstructing the attack scenario based on the attack prediction result to obtain the corresponding attack scenario reconstruction map, the method further includes: The final kill chain stage node is determined based on the attack scenario reconstruction graph. The host connected to the last kill chain stage node is identified as the target host.

7. The attack scenario reconstruction method according to any one of claims 1-6, characterized in that, The entity relationship joint extraction model is trained through the following process: Obtain a sample event association graph constructed based on sample data; wherein, the sample data includes data corresponding to multiple sample events within a second preset time period, the second preset time period being longer than the first preset time period, and the sample event association graph uses the sample events as nodes and the association relationships between the sample events as edges; Multiple sample links are extracted from the sample event association graph, and the attack links and non-attack links in the sample links are labeled to obtain the corresponding labeled data; The parameters of the entity relationship joint extraction model are updated based on the sample links and the labeled data.

8. An attack scene reconstruction device, characterized in that, include: The acquisition module is used to acquire an alarm event association graph constructed based on alarm data; wherein, the alarm data includes data corresponding to multiple alarm events within a first preset time period, and the alarm event association graph uses the alarm events as nodes and the association relationships between the alarm events as edges; The extraction module is used to extract multiple target links from the alarm event association graph; The prediction module is used to input the target link into the entity relationship joint extraction model to obtain the attack prediction result output by the entity relationship joint extraction model. The reconstruction module is used to reconstruct the attack scenario based on the attack prediction results to obtain the corresponding attack scenario reconstruction map. The entity relationship joint extraction model is configured to: perform kill chain stage entity identification on the alarm event through entity recognition, and extract relationships based on the kill chain of the alarm event and the connection relationship of the alarm event.

9. An electronic device, characterized in that, include: Processor, memory, and bus; The processor and the memory communicate with each other via the bus; The memory stores computer program instructions that can be executed by the processor, and the processor can execute the attack scenario reconstruction method as described in any one of claims 1-7 by calling the computer program instructions.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a computer, cause the computer to perform the attack scenario reconstruction method as described in any one of claims 1-7.

Images