Attack investigation method, device and medium based on a traceability graph, POI and dijkstra algorithm

Abstract

The application provides an attack investigation method and device based on a traceability graph, POI and Dijkstra algorithm and a medium, wherein the method comprises the following steps: collecting underlying audit logs to generate a traceability graph; pruning the traceability graph based on a POI alarm time, and calculating the edge weight of the pruned traceability graph based on a time weight, an aggregation weight and an anomaly weight; obtaining a shortest path through a POI node according to the edge weight of the traceability graph; selecting N nodes with the minimum weight in the shortest path, denoted as Top-N nodes, and pruning the traceability graph through the Top-N nodes; and generating a pruned traceability graph, and traversing the pruned traceability graph from the Top-N nodes to obtain a traversal graph through a BFS algorithm. The application successfully solves the dependence explosion problem by compressing the edges, and simultaneously finds the attack entry point and displays the most likely attack path of the attack. The application solves the shortcomings of the traditional technology, such as the inability to accurately locate the attack path, the low robustness and the low portability.

Description

TECHNICAL FIELD

[0001] The present document relates to the technical field of traceability graph, and particularly relates to an attack investigation method, device and medium based on a traceability graph, a POI and a Dijkstra algorithm. BACKGROUND

[0002] In recent years, the increasingly rampant network attack activities have caused great losses. Modern network attacks have the characteristics of long duration, strong concealment and unknown source. These attacks often use multiple types of vulnerabilities and penetrate into target systems in multiple stages. In the face of more complex and diverse network security risks, the traditional passive defense means based on feature library are insufficient to cope with the situation, and security devices are difficult to restore the full picture of the attack.

[0003] Endpoint and traffic monitoring devices can collect all information within the network in the form of logs to evaluate attack behavior, so as to better target these attacks and conduct effective investigation, traceability and response. However, due to the interference of a large number of benign background logs and the discontinuity of log semantics, it is extremely difficult to complete attack investigation, and the emergence of traceability graph greatly alleviates these problems. The traceability graph is a graph abstraction of system logs, which represents system execution as a graph, describes the information flow between system subjects and objects, and expresses the system behavior state. The traceability graph has strong causal analysis and semantic expression capabilities, and most of the existing technologies are based on the traceability graph to conduct network attack investigation. However, there are still many problems in restoring the attack scene after obtaining the POI in the prior art.

[0004] For example, SLEUTH proposed in 2017 relies heavily on expert knowledge to supplement rules and the confidentiality label needs to be set according to the specific situation of the enterprise, so that the attack investigation method based on the label lacks robustness and universality. In addition, the attack investigation method based on the label cannot well solve the dependence explosion problem in the traceability graph, which may cause errors in the entry point finally found, and Nodoze proposed in 2019 learns the structure of the traceability graph to determine whether the system is attacked and feeds back the result to the security personnel. However, the attack investigation method based on the anomaly feeds back a complete traceability graph, which cannot help the security personnel accurately locate the attack and needs to consume a large amount of manpower to restore the attack path. SUMMARY

[0005] The present application provides an attack investigation method, device and medium based on a traceability graph, a POI and a Dijkstra algorithm, which aims to solve the above problems.

[0006] The present application provides an attack investigation method based on a traceability graph, a POI and a Dijkstra algorithm, which includes:

[0007] S1, collect the bottom audit log to generate a traceability graph;

[0008] S2, after pruning the traceability graph through the POI alarm time, calculate the edge weight value of the pruned traceability graph based on the time weight value, the aggregation weight value and the abnormal weight value;

[0009] S3, obtain the shortest path through the POI node according to the edge weight value of the traceability graph;

[0010] S4, select N nodes with the minimum weight value in the shortest path, denoted as Top-N nodes, and prune the traceability graph generated in S1 through the Top-N nodes;

[0011] S5, traverse the pruned traceability graph generated in S4 from the Top-N nodes to obtain a traversal graph through the BFS algorithm.

[0012] An electronic device is provided in an embodiment of the application, comprising:

[0013] a processor; and

[0014] a memory arranged to store computer-executable instructions that, when executed, cause the processor to perform the steps as described in the attack investigation method based on a traceability graph, POI and Dijkstra algorithm.

[0015] An embodiment of the application provides a storage medium for storing computer-executable instructions that, when executed, implement the steps as described in the attack investigation method based on a traceability graph, POI and Dijkstra algorithm.

[0016] By adopting the weighting method combining the timestamp of the object and the event proportion as parameters, and by compressing the edges, the application successfully solves the problem of dependence explosion, and at the same time of finding the attack entry point, the most likely attack path of the attack is displayed. The shortcomings of the traditional technology that cannot accurately locate the attack path and has low robustness and portability are solved. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present specification or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0018] Figure 1 The flowchart of the attack investigation method based on a traceability graph, POI and Dijkstra algorithm of the embodiments of the application;

[0019] Figure 2 The specific implementation steps of the embodiment of the application are shown in the figure. DETAILED DESCRIPTION

[0020] In order to make the person skilled in the art better understand the technical scheme in one or more embodiments of the present specification, the technical scheme in one or more embodiments of the present specification will be described clearly and completely in the following with reference to the drawings in one or more embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, not all the embodiments. Based on one or more embodiments of the present specification, all other embodiments obtained by the person skilled in the art without creative labor should belong to the protection scope of the present document.

[0021] The application proposes an attack investigation method based on a traceability graph, a POI and a Dijkstra algorithm. Specifically, assuming that a POI has been obtained, the method will convert the collected audit log data into a traceability graph, in which the nodes are system entities (for example, files, processes and network connections), and the edges are system call events (for example, a process reading a file). The edges in the traceability graph carry many attributes. The TimeStamp attribute represents the time when the event occurs, the out_degree and in_degree are the out-degree and in-degree of the subject node of the edge, and the application proposes three kinds of weight values, namely a time weight value, an aggregation weight value and an abnormal weight value. The time weight value: intuitively, edges occurring at relatively the same time are more likely to be related.

[0022] The aggregation weight value: in the causal relationship analysis, if the number of source nodes that can be searched from the node v is 1 (i.e., there is only one incoming edge from v), it is considered that the dependency represented by the edge is highly concentrated on v. Therefore, the degree of dependence on the previous node is represented by the aggregation weight value.

[0023] The abnormal weight value: Freq represents how many times the event occurs in the historical record of the execution of the program for a period of time, and Frcqsrc_rel represents how many times the event occurs in the traceability graph. By comparing the number of times in the historical record with the number of times of the current event execution, it is determined whether the event is abnormal.

[0024] And since the attacker tends to use the least steps to achieve the purpose of invading the target computer, therefore, through the Dijkstra algorithm, the operation steps of the attacker in the host can be accurately restored.

[0025] Method embodiment

[0026] The embodiment of the application provides an attack investigation method based on a traceability graph, a POI and a Dijkstra algorithm, Figure 1A flowchart of an attack investigation method based on a traceability graph, POI and Dijkstra algorithm according to an embodiment of the present application is shown in FIG. 1. The attack investigation method based on the traceability graph, POI and Dijkstra algorithm according to an embodiment of the present application specifically includes the following steps: Figure 1

[0027] S1, collecting underlying audit logs to generate a traceability graph; specifically, step S1 includes the following steps:

[0028] Existing tools are used to collect system underlying audit logs, for example, Windows system uses ETW to collect logs, and Linux system uses system audit log collection tool Auditd to collect system kernel activity logs.

[0029] The generation of the traceability graph includes the following steps:

[0030] 1. Determine the event type

[0031] 2. According to different event types, jump to the corresponding processing method, and obtain the unique identifier (UUID) of the event subject and object

[0032] 3. Determine whether the entity exists according to the UUID. If not, create an entity node in the node set, and then create an edge between the subject and object entities in the edge set, otherwise directly create an edge between the subject and object entities;

[0033] 4. Read new logs and repeat steps 1-3.

[0034] S2, prune the traceability graph through the POI alarm time, and calculate the edge weight of the pruned traceability graph based on the time weight, aggregation weight and abnormal weight; specifically, step S2 includes the following steps:

[0035] S21, prune the traceability graph through the POI alarm time, delete the edges in the traceability graph whose event time is greater than the POI alarm time, and compress and prune the same event repeatedly generated in the preset event;

[0036] S22, calculate the time weight, aggregation weight and abnormal weight in the traceability graph; specifically, step S22 includes the following steps:

[0037] The time weight is calculated by formula 1:

[0038] a i .Time_value=log 10 1+(a i .TimeStamp-POI.TimeStamp) Formula 1

[0039] The aggregation weight is calculated by formula 2:

[0040] a​i Concentration_value = a i out_degree ÷ a i in_degree Formula 2

[0041] Calculate the abnormal weight value through Formula 3:

[0042] a i Abnormal_value = Freq(a i ) ÷ Frcqsrc_rel(a i ) Formula 3

[0043] Wherein, a i is all edges belonging to the parent node, a i imeStamp is the timestamp of edge a i , POI.TimeStamp is the POI timestamp, a i ut_degree is the number of out-degree edges of a i , a i n_degree is the number of in-degree edges of a i , Freq(a i ) is the number of times a i appears in a certain time window in the trace graph, and Frcqsrc_rel(a i ) is the number of times a i appears in a certain time window in the historical trace graph

[0044] S23, add the time weight value, the aggregation weight value and the abnormal weight value to obtain an average weight value, and then perform edge weight standardization on the average weight value. Step S23 specifically includes:

[0045] Perform edge weight standardization through Formula 4:

[0046] a i Standard_value = a i Average_value ÷ ∑ a∈A a.Average_value

[0047] Formula 4

[0048] Wherein, a i Average_value is the average value of the time weight value, the aggregation weight value and the abnormal weight value of edge a i .

[0049] S3, obtain the shortest path through the POI node according to the edge weight value of the trace graph; step S3 specifically includes:

[0050] Adding all edge weights between two points in the trace graph to the edge with the largest timestamp, and deleting the edges with non-maximal timestamps in the trace graph;

[0051] Calculating the minimum path weights from all nodes in the trace graph to the POI node by Dijkstra algorithm and keeping the corresponding paths as the shortest paths.

[0052] S4, selecting N nodes with the minimum weights in the shortest paths as Top-N nodes, and pruning the trace graph generated in step S1 through the Top-N nodes; step S4 specifically includes:

[0053] Putting the Top-N nodes back into the trace graph generated in step S1, and deleting events with timestamps smaller than the minimum timestamp in the Top-N nodes.

[0054] S5, traversing the pruned trace graph generated in step S4 from the Top-N nodes to obtain a traversal graph by BFS algorithm. Step S5 specifically includes:

[0055] Deleting multiple edges between two nodes in the pruned trace graph, and keeping only one edge to obtain a to-be-traversed trace graph;

[0056] Traversing the to-be-traversed trace graph from the Top-N nodes to obtain a traversal graph by BFS algorithm. Figure 2 The figure shows the specific implementation steps of the embodiment of the application. The figure shows the overall process and part of the details of the method for analyzing the original trace graph combined with the POI, calculating the weights of the trace graph to obtain possible entry points, and restoring a complete attack scene graph through forward analysis from the entry points.

[0057] The advantages of the technical scheme of the application are as follows:

[0058] 1. The conversion from POI information to attack investigation report is realized

[0059] 2. Compared with the traditional attack investigation report, the application can make it more convenient for security personnel to analyze in the form of a graph, and deleting a large amount of interference information helps security personnel to quickly and accurately determine the attack means.

[0060] 3. The application proposes a method for calculating the edge weights of the trace graph, which does not depend on the intervention of expert knowledge, and has strong robustness and portability.

[0061] 4. The application finds possible entry points from the POI, has high accuracy, and can quickly confirm the intrusion method combined with the attack path graph.

[0062] 5、The application can effectively find many intrusion steps without alarm of the alarm system by starting from the possible entry point and performing BFS, so that the security analyst can have a more comprehensive understanding of the overall situation of the attacker intrusion.

[0063] By adopting the embodiment of the application, the following beneficial effects are achieved:

[0064] 1、The application proposes three weights, time weight, abnormal weight and aggregation weight, for weight calculation on events in the audit log, and through weighted average calculation and standardization processing on the three weights, weight calculation on all edges in the traceability graph is finally completed.

[0065] 2、The application proposes an advanced traceability graph pruning algorithm, which prunes the traceability graph under the guarantee of the time sequence relationship, and greatly reduces the storage space of the traceability graph through weight calculation and compression of the same event information.

[0066] 3、The application proposes a method for searching the shortest path to find the alarm point based on the weight, which judges the entry point of the attack through the most abnormal path, and greatly saves the time for analyzing the POI.

[0067] 4、The application proposes a limited forward analysis method, which searches through the distance threshold and multiple possible entry points, can fully reflect the attack process and method of the attacker in the computer, and shows many attacks without POI.

[0068] Device embodiment one

[0069] The embodiment of the application provides an electronic device, which comprises:

[0070] A processor; and

[0071] A memory arranged to store computer executable instructions which, when executed, cause the processor to perform the steps of the above method embodiment.

[0072] Device embodiment two

[0073] The embodiment of the application provides a storage medium for storing computer executable instructions which, when executed, implement the steps of the above method embodiment.

[0074] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit the present application; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions recorded in the above embodiments can be modified, or some or all of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for investigating an attack based on a trace graph, POI and Dijkstra algorithm, characterized in that, Comprise: S1, collect the bottom audit log to generate a traceability graph; S2, after pruning the traceability graph through the POI alarm time, calculate the edge weight value of the pruned traceability graph based on the time weight value, the aggregation weight value and the abnormal weight value; S3, according to the edge weight value of the traceability graph, obtain the shortest path through the POI node; S4, select the N nodes with the smallest weight value in the shortest path, denoted as Top-N nodes, and prune the traceability graph generated in S1 through the Top-N nodes; S5, traverse the pruned traceability graph generated in S4 from the Top-N nodes to obtain a traversal graph through the BFS algorithm. The S2 specifically comprises: S21, prune the traceability graph through the POI alarm time, delete the edges in the traceability graph whose event time is greater than the POI alarm time, and compress and prune the same event repeatedly generated in the preset event; S22, calculate the time weight value, the aggregation weight value and the abnormal weight value in the traceability graph; S23, add the obtained time weight value, aggregation weight value and abnormal weight value to obtain the average weight value, and then normalize the edge weight value of the average weight value; The S3 specifically comprises: Add all edge weights between two points in the traceability graph to the edge with the maximum timestamp, and delete the edges with non-maximum timestamps in the traceability graph; Start from the POI node in the traceability graph to calculate the minimum path weight value of all nodes to the POI node in the traceability graph through the Dijkstra algorithm, and reserve the corresponding path as the shortest path.

2. The method of claim 1, wherein, The S1 specifically comprises: Determine the event type in the bottom audit log; According to different event types, jump to the corresponding processing method, and obtain the unique identifier of the subject and object in the event; According to the unique identifier, determine whether the entity exists, if not, create an entity node in the node set and an edge between the subject and object entities in the edge set, if exists, directly create an edge between the subject and object entities.

3. The method of claim 1, wherein, The S4 specifically comprises: Put the Top-N nodes back into the traceability graph generated in step S1, and delete events with timestamps smaller than the minimum timestamp in the Top-N nodes.

4. The method of claim 1, wherein, The S5 specifically comprises: Delete multiple edges between two nodes in the pruned traceability graph, and only reserve one edge to obtain a to-be-traversed traceability graph; Traverse the to-be-traversed traceability graph from the Top-N nodes to obtain a traversal graph through the BFS algorithm.

5. An electronic device comprising: a processor; and a memory arranged to store computer-executable instructions that, when executed, cause the processor to perform the steps of any one of the attack investigation methods based on a traceability graph, a POI and a Dijkstra algorithm as claimed in claims 1-4.

6. A storage medium for storing computer-executable instructions that, when executed, implement the steps of any one of the attack investigation methods based on a traceability graph, a POI and a Dijkstra algorithm as claimed in claims 1-4.

Images