Traceability graph construction and pruning method and device based on system audit log and medium

Abstract

The embodiment of the specification provides a method, device and medium for constructing and pruning a traceability graph based on system audit logs, wherein the method comprises the following steps: obtaining different operating system audit logs, obtaining subject information, event information and object information according to each audit log information, and respectively forming three-element information groups, wherein the subject is a process, and the object is a program, a file or a socket; determining a corresponding processing method according to each three-element information group information and a corresponding event type, and calculating and obtaining unique identifiers of subjects and objects of each event; judging whether each entity exists in a node set according to the unique identifiers of the subjects and the objects, if not, creating an entity node in the node set and creating an edge between the corresponding subject and object entities in an edge set; and if yes, performing a pruning operation to obtain a traceability graph. The application prunes the system-generated unified format traceability graph, greatly reduces the system space required by the traceability graph under the premise of ensuring the integrity of the cause-effect semantics.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to a method, apparatus and medium for constructing and pruning a source graph based on system audit logs. Background Technology

[0002] Modern cyberattacks are characterized by their long duration, high degree of concealment, and unknown origin. These attacks often exploit various types of vulnerabilities and penetrate target systems in multiple stages. Faced with increasingly complex and diverse cybersecurity risks, traditional passive defense methods based primarily on signature databases are proving inadequate and struggling to cope, making it difficult for security devices to reconstruct the full picture of an attack.

[0003] Endpoint and traffic monitoring devices can collect all network-wide information in the form of logs to assess attack behavior, thereby enabling better targeting, effective investigation, attribution, and response. However, due to interference from a large amount of benign background logs and the discontinuity of log semantics, completing attack investigations is extremely difficult. The emergence of attribution graphs has greatly alleviated these problems. An attribution graph is a graph abstraction of system logs; it represents system execution as a graph, describing the information flow between system entities (such as processes) and objects (such as files and sockets), and expressing the system's behavioral state. Attribution graphs have powerful causal analysis and semantic expression capabilities, but their construction presents certain technical challenges. The innovation of this invention mainly focuses on the construction of attribution graphs.

[0004] In existing technologies, BackTracker is a classic source graph construction technique, primarily focused on uncovering causal dependencies between processes, files, and filenames. SPADE is a source graph data collection system whose underlying data model is graph-based, consisting of vertices and directed edges modeled according to the node and relationship types described in open source graph models. CamFlow is a flexible, efficient, and easy-to-use Linux source graph data capture system that leverages the latest Linux kernel design to improve the efficiency of source graph generation. However, these source graph construction techniques have high requirements for computer system environments and demanding software configurations. For example, SPADE requires the installation of numerous pre-installed or complementary software programs (such as Process Monitor and Neo4j), while CamFlow is only applicable to Linux kernel systems, exhibiting poor portability and lacking a unified cross-platform source graph construction representation method. Furthermore, current source graph construction techniques generate large graphs, placing an excessive burden on the system. The main reasons for these shortcomings are: existing technologies lack a unified data format processing method for source graphs; and they lack corresponding processing logic for data filtering and graph pruning during source graph construction.

[0005] Therefore, there is an urgent need to provide a highly efficient and low-overhead method for constructing source graphs that can be implemented across platforms and operating systems. Summary of the Invention

[0006] To overcome the problems existing in related technologies, this disclosure provides a method, apparatus and medium for constructing and pruning a traceability graph based on system audit logs, in order to solve the technical problems that there is a lack of unified data format processing methods for traceability graphs in related technologies, and that there is a lack of corresponding processing logic for data filtering and graph pruning.

[0007] This specification provides one or more embodiments of a method for constructing and pruning a source graph based on system audit logs, including the following steps:

[0008] Obtain audit logs from different operating systems, and extract subject information, event information, and object information from each audit log to form a three-element information group. The subject is a process, and the object is a program, file, or socket.

[0009] Based on the information of each ternary information group and the corresponding event type, determine the corresponding processing method and calculate and obtain the unique identifier of the subject and object of each event;

[0010] Based on the unique identifier of each subject and object, determine whether each entity exists in the node set. If it does not exist, create an entity node in the node set and create an edge between the corresponding subject and object entities in the edge set. If it exists, determine the time t when the new edge from the source entity to the destination entity is generated, and determine whether time t is later than the time when the set of the most recent source entity's ancestors changed. If it is later, create a new edge with a time interval of time t. If it is not later, merge the time t into the existing time interval from the source entity to the destination entity to obtain the source graph.

[0011] This specification provides one or more embodiments of a source graph construction and pruning device based on system audit logs, including...

[0012] Information acquisition module: Based on the audit logs of different operating systems, it obtains subject information, event information, and object information from each audit log, which are then used to form a three-element information group; where the subject is a process, and the object is a program, file, or socket.

[0013] Unique Identifier Confirmation Module: Based on the information of each ternary information group obtained by the information acquisition module and the corresponding event type, determine the corresponding processing method and calculate and obtain the unique identifier of the subject and object of each event;

[0014] Pruning module: Based on the unique identifier of each subject and object, determine whether each entity exists in the node set. If it does not exist, create an entity node in the node set and create an edge between the corresponding subject and object entities in the edge set. If it exists, determine the time t when the new edge from the source entity to the destination entity is generated, and determine whether time t is later than the time when the set of the most recent source entity's ancestors changed. If it is later, create a new edge with a time interval of time t. If it is not later, merge the time t into the existing time interval from the source entity to the destination entity to obtain the source graph.

[0015] This specification provides one or more embodiments of a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the source graph construction and pruning method based on system audit logs as described above.

[0016] This specification provides one or more embodiments of a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the source graph construction and pruning method based on system audit logs as described above.

[0017] This invention provides a unified source graph construction and representation method that is cross-platform and cross-operating system based on a convenient audit log data source acquisition method. Furthermore, it prunes the source graph generated by the system in a unified format, which greatly reduces the system space required for the source graph while ensuring the integrity of causal semantics. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This diagram illustrates a first scenario of a source graph construction and pruning method based on system audit logs, provided for one or more embodiments of this specification.

[0020] Figure 2 A schematic diagram of the process framework for a source graph construction and pruning method based on system audit logs provided for one or more embodiments of this specification;

[0021] Figure 3 This specification provides a pruning diagram illustrating a source graph construction and pruning method based on system audit logs, used in one or more embodiments of this specification.

[0022] Figure (a) is a schematic diagram of pruning when pruning is permissible; Figure (b) is a schematic diagram of pruning when pruning is not permissible.

[0023] Figure 4 A schematic diagram of a source graph construction and pruning device based on system audit logs provided for one or more embodiments of this specification;

[0024] Figure 5 This is a schematic diagram of the structure of a computer provided for one or more embodiments of this specification. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this invention.

[0026] The present invention will now be described in detail with reference to specific embodiments and accompanying drawings.

[0027] Method Implementation Examples

[0028] According to embodiments of the present invention, a method for constructing and pruning a source graph based on system audit logs is provided, such as... Figure 1-2 As shown, Figure 1 This is a flowchart of the source graph construction and pruning method based on system audit logs provided in this embodiment. Figure 2 This is a flowchart illustrating the source graph construction and pruning method based on system audit logs provided in this embodiment. The source graph construction and pruning method based on system audit logs according to this embodiment includes:

[0029] Step S1: Obtain audit logs from different operating systems. Based on the information in each audit log, obtain subject information, event information, and object information, which are then used to form a ternary information group. The subject is a process, and the object is a program, file, or socket.

[0030] In some embodiments, different operating systems on a host generate audit logs, which are then retrieved using different tools. For example, on Windows systems, ETW (Event Tracing for Windows), the Windows event tracing framework, is used to obtain audit logs related to processes, files, and sockets, such as process startup and process file read / write operations. On Linux systems, the system audit log collection tool Auditd is used to collect system kernel activity logs.

[0031] Because the collected logs were not filtered, they contained a large number of event types or system call types unrelated to attacks. To reduce system processing time, this embodiment filters out useless event types by judging the event type field, thereby obtaining the required audit logs. The required event or system call types for Windows logs are shown in Table 1 below. The required event or system call types for Linux logs include, but are not limited to, exec(), fork(), clone(), exit(), open(), close(), read(), write(), clone(), truncate(), and rename(). After type filtering, the average amount of logs processed can be reduced by 50%.

[0032] Table 1. List of Event Types Required for Windows Logs

[0033]

[0034]

[0035] In this embodiment, to facilitate subsequent source map generation and alignment format calculation, subject information, event information, and object information are obtained from each audit log, forming ternary information groups to achieve unified format processing of logs from Windows and Linux platforms; wherein...

[0036] The main fields of the main information may include: process PID, process name, and user ID;

[0037] The main fields of event information may include: event timestamp and event type;

[0038] The main fields of object information can include (different types of objects):

[0039] Process: Process PID, Process Name, User ID;

[0040] File: Filename;

[0041] Socket: source IP, source port, destination IP, destination port.

[0042] Step S2: Based on the information of each ternary information group and the corresponding event type, determine the corresponding processing method and obtain the unique identifier (UUID) of the subject and object of each event. In some embodiments, the method for obtaining the unique identifier of the subject and object of the event will be different due to the different event types. For example, when processing a process start event, it is necessary to extract the subject information from the parent process related attributes of the log and extract the object information from the child process related attributes. On the other hand, when processing a file-related event, it is necessary to extract the subject information from the process (operation subject) related attributes of the log and extract the object information from the file-related attributes (file path, etc.) of the log. Therefore, the method for obtaining the unique identifier of the subject and object of the event will be different depending on the event type.

[0043] Step S3: Determine whether each entity exists in the node set based on its unique identifier (UUID). If not, create an entity node in the node set and create an edge between the corresponding entity in the edge set. If it exists, determine the time t at which the new edge from the source entity (startEntity) to the destination entity (endEntity) was generated, and determine whether time t is later than the time when the set of the most recent source entity's ancestor changed. If it is later, create a new edge at time t. If it is not later, merge the time t into the existing time interval from the source entity (startEntity) to the destination entity (endEntity) to obtain the source graph.

[0044] The implementation process of this step is illustrated below through examples;

[0045] In this embodiment, the main function of step S3 is to perform real-time pruning of the edges of the source graph during the process of generating and establishing the source graph based on the audit log information, thereby alleviating the storage pressure caused by the excessive size of the source graph. The pruning process is as follows:

[0046] This embodiment utilizes a source graph for attack investigation, which can be divided into two stages. First, starting from the alert point, a backward analysis is performed to find the entry point of the network attack. Next, starting from the entry point, a forward analysis is conducted to discover the complete scope of the attack and reconstruct the attack chain. Therefore, pruning the source graph requires preserving its forward and backward reachability while significantly reducing the size of its edges. This method targets the event type of process reading and writing to files, as these two types of events account for over 90% of all audit events.

[0047] In this embodiment, the pruning method for the source graph has the following prerequisites:

[0048] At any time t (for all t∈NewAnc(u)), maintain the forward reachability of u@t to node v; at any time t, maintain the backtracking reachability of v@t to node u. That is, the backtracking forensic analysis results for any node v will be exactly the same; the results will be exactly the same if forward analysis is started at any time when node u may be compromised.

[0049] 1. Backtracking reachability: At time t, if there exists a causal path from node u to node v.

[0050] e1,e2,...,e n-1 ,e n ,i=1,…,n; where, And t≥

[0051] t(e i If for all i, then node u is said to be reachable from node v backtracking, denoted as u→v@t;

[0052] Where t represents time, e i This represents the event that occurs at time i.

[0053] 2. Forward reachability: At time t, if there exists a causal path e1, e2, ..., e from node u to node v, then... n-1 ,e n ,i=1,…,n; where And t≤end(e) i If for all i, then node v is said to be reachable from node u in the forward direction, denoted as u@t→v;

[0054] 3. Ancestor node set:

[0055] The set of ancestors of node v at time t is represented as:

[0056] Anc(v,t)={u|u→v@t}.

[0057] 4. Set of times when new ancestor nodes are generated:

[0058] The moments when the ancestor set of node v changes are recorded as a set, represented as:

[0059]

[0060] When executing step S3, the entity objects are first read. Each entity maintains a list recording the edges from the current entity to its various child nodes, and the edges record the time interval, such as [t1, t2]. The entities are connected in chronological order. When a new time t arrives, and an attempt is made to generate a new edge from the source entity (startEntity) to the destination entity (endEntity), it is determined whether time t is later than the latest time in NewAnc(startEntity). If it is, a new edge with timestamp t is created; otherwise, time t is merged into the existing saved time interval, that is, the time interval from startEntity to endEntity is updated to [t1, t3] (assuming it was originally [t1, t2]). The following example illustrates the pruning process;

[0061] like Figure 3 (a) As shown in the figure, Process A performs write operations on File B at times 1, 2, and 3. Therefore, NewAnc(Process A) is time 0. Thus, the time intervals of Process A's write operations on File B from time 1 to 3 can be merged into a time interval.

[0062] like Figure 3 (b) As shown in the figure, the time t when the new edge is generated is later than the time when the set of the nearest source entity ancestors changes, which is the case where they cannot be merged. This is because Process A reads File C at time 4, and the latest operation time in NewAnc(Process A) is time 4. Therefore, the write of File B by Process A at time 5 cannot be merged into time 1-3.

[0063] In this preferred embodiment, to support the attack investigation task, the pruned and optimized source graph should be persistently saved. For visualization purposes, the optimized (pruned) source graph can be stored in a graph database to facilitate the display of paths on the graph. From a graph computation perspective, the optimized source graph can be stored in a relational database MySQL or a non-relational database MongoDB to improve computational efficiency.

[0064] The specific technical solution is as follows:

[0065] Graph Database Storage: This method uses Neo4j as the graph database. The simplified source graph generated in Module 2 is processed into the format required by Neo4j, forming node files and edge files. The node files store node-related information, and the edge files store subject-object and edge-related information. The graph is then imported into the Neo4j database to form a visual source graph display.

[0066] MySQL: It uses a traditional relational database to store the source graph, transforming the source graph into a data table format, and storing different types of node information (processes, files, sockets) and edge information in different data tables.

[0067] MongoDB: Utilizing a non-relational database for efficient storage and retrieval of source graphs, MongoDB can directly store dictionary structures. We store the edge set in a table, retaining only the UUIDs of the subject and object and the information on the edges; storing node information in dictionary form compresses the space required to store the source graph to a certain extent.

[0068] Through the processing of the above three modules, we have achieved a complete process from audit log collection to source graph pruning and storage.

[0069] The method in this embodiment achieves the following beneficial effects:

[0070] 1. Based on a relatively convenient method for obtaining audit log data sources, a unified traceability graph construction and representation method is completed across platforms and operating systems.

[0071] 2. Pruning is performed on the unified format source graph generated by the system. While ensuring the integrity of causal semantics, the system space required for the source graph is greatly reduced, realizing a source graph construction method with high efficiency, low overhead, and low storage cost.

[0072] Device Examples

[0073] According to embodiments of the present invention, a device for constructing and pruning a source graph based on system audit logs is provided, such as... Figure 4 The diagram shown is a schematic block diagram of the source graph construction and pruning device based on system audit logs provided in this embodiment. The device monitoring, display, and interaction optimization system for complex scenarios according to this embodiment of the invention includes:

[0074] Information Acquisition Module: Based on the audit logs of different operating systems, it acquires subject information, event information, and object information from each audit log, forming a three-element information group; where the subject is a process, and the object is a program, file, or socket.

[0075] Based on the audit log information, subject information, event information, and object information are obtained and formed into three-element information groups, thereby enabling the processing of logs from Windows and Linux platforms into a unified format; among them,

[0076] The main fields of the main information may include: process PID, process name, and user ID;

[0077] The main fields of event information may include: event timestamp and event type;

[0078] The main fields of object information can include (different types of objects):

[0079] (1) Process: Process PID, Process Name, User ID;

[0080] (2) File: File name;

[0081] (3) Socket: source IP, source port, destination IP, destination port.

[0082] Unique Identifier Confirmation Module: Based on the information of each ternary information group obtained by the information acquisition module and the corresponding event type, determine the corresponding processing method and calculate and obtain the unique identifier (UUID) of the subject and object of each event.

[0083] The pruning module determines whether each entity exists in the node set based on its unique identifier (UUID). If it does not exist, it creates an entity node in the node set and creates an edge between the corresponding entity in the edge set. If it exists, it determines the time t at which the new edge from the source entity to the destination entity was generated and whether time t is later than the time when the set of the most recent ancestor of the source entity changed. If it is later, it creates a new edge at time t. If it is not later, it merges the time t into the existing time interval from the source entity to the destination entity to obtain the source graph.

[0084] In this embodiment, the part-time module has the following prerequisites for pruning the source map:

[0085] At any time t (for all t∈NewAnc(u)), maintain forward reachability from u@t to node v; at any time t, maintain backtracking reachability from v@t to node u. That is, the backtracking forensic analysis results for any node v will be exactly the same; the results will be exactly the same if forward analysis is started at any time when node u may be compromised.

[0086] To support the attack investigation task, the pruned and optimized source map needs to be persistently saved. In addition, for visualization purposes, this embodiment also sets up a source map storage module to store the pruned source map.

[0087] In some embodiments, the source graph storage module uses the Neo4j graph database implementation.

[0088] The embodiments of the present invention are device embodiments corresponding to the above method embodiments. The specific operations of each module processing step can be understood with reference to the description of the method embodiments, and will not be repeated here.

[0089] like Figure 5As shown, the present invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the source graph construction and pruning method based on system audit logs in the above embodiments, or when the computer program is executed by a processor, it implements the source graph construction and pruning method based on system audit logs in the above embodiments. When the computer program is executed by the processor, it implements the following method steps:

[0090] Step S1: Obtain audit logs from different operating systems. Based on the information in each audit log, obtain subject information, event information, and object information, which are then used to form a ternary information group. The subject is a process, and the object is a program, file, or socket.

[0091] Step S2: Based on the information of each ternary information group and the corresponding event type, determine the corresponding processing method and calculate and obtain the unique identifier (UUID) of the subject and object of each event;

[0092] Step S3: Determine whether each entity exists in the node set based on the unique identifier UUID of each subject and object. If it does not exist, create an entity node in the node set and create an edge between the corresponding subject and object entities in the edge set. If it exists, determine the time t when the new edge from the source entity to the destination entity is generated, and determine whether time t is later than the time when the set of the most recent source entity's ancestor changes. If it is later, create a new edge with a time interval of time t. If it is not later, merge the time t into the existing time interval from the source entity to the destination entity to obtain the source graph.

[0093] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0094] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for apparatus or system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The apparatus and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and the contents not described in detail in the specification of the present invention are well known to those skilled in the art.

Claims

1. A method for constructing and pruning a source graph based on system audit logs, characterized in that, Includes the following steps: Obtain audit logs from different operating systems, and extract subject information, event information, and object information from each audit log to form a three-element information group. The subject is a process, and the object is a program, file, or socket. Based on the information of each ternary information group and the corresponding event type, determine the corresponding processing method and calculate and obtain the unique identifier of the subject and object of each event; Based on the unique identifier of each subject and object, determine whether each entity exists in the node set. If it does not exist, create an entity node in the node set and create an edge between the corresponding subject and object entities in the edge set. If it exists, determine the time t when the new edge from the source entity to the destination entity is generated, and determine whether time t is later than the time when the set of the most recent source entity's ancestors changed. If it is later, create a new edge with a time interval of time t. If it is not later, merge the time t into the existing time interval from the source entity to the destination entity to obtain the source graph.

2. The source graph construction and pruning method based on system audit logs as described in claim 1, characterized in that, In the ternary information group The main fields of the main information include: process PID, process name, and user ID; The main fields of event information include: event timestamp and event type; The main fields for different types of object information include: Process: Process PID, Process Name, User ID; File: Filename; Socket: source IP, source port, destination IP, destination port.

3. The source graph construction and pruning method based on system audit logs as described in claim 1, characterized in that, The following prerequisites must be set for the source map: At any time , ,Keep To the node Forward reachability; at any time ,Keep The backtracking reachability to node u, where, Backtracking reachability is in At any given time, if there exists a self-node To the node causal path And for all times i , Then a node is called a node. It is a self-node Retraceable, marked as ; in, This represents the event that occurs at time i; Forward reachability is in At any given time, if there exists a self-node To the node causal path And for all times i , Then node v is called a self-node. Forward reachable, marked as ; The moments when the set of ancestors of node v changes are recorded as a set, i.e.: ； The set of ancestor nodes is node v in The ancestor set of time, i.e.: 。 4. The source graph construction and pruning method based on system audit logs as described in claim 1, characterized in that, The source graph is stored in a relational database MySQL or a non-relational database MongoDB.

5. A device for constructing and pruning a source graph based on system audit logs, characterized in that, include Information acquisition module: Based on the acquired audit logs from different operating systems, it obtains subject information, event information, and object information from each audit log, which are then used to form a three-element information group. The subject is a process, and the object is a program, file, or socket. Unique Identifier Confirmation Module: Based on the information of each ternary information group obtained by the information acquisition module and the corresponding event type, determine the corresponding processing method and calculate and obtain the unique identifier of the subject and object of each event; The pruning module determines whether each entity exists in the node set based on its unique identifier. If it does not exist, it creates an entity node in the node set and creates an edge between the corresponding entity in the edge set. If it exists, it determines the time t when the new edge from the source entity to the destination entity is generated and whether time t is later than the time when the set of the most recent source entity's ancestors changed. If it is later, it creates a new edge with a time interval of time t. If it is not later, it merges the time t into the existing time interval from the source entity to the destination entity to obtain the source graph.

6. The source graph construction and pruning device based on system audit logs as described in claim 5, characterized in that, The unique identifier confirmation module obtains subject information, event information, and object information from each audit log, which are then combined into a three-element information group. Within this three-element information group: The main fields of the main information include: process PID, process name, and user ID; The main fields of event information include: event timestamp and event type; The main fields of object information include: Process: Process PID, Process Name, User ID; File: Filename; Socket: source IP, source port, destination IP, destination port.

7. The source graph construction and pruning device based on system audit logs as described in claim 5, characterized in that, The pruning module sets the following prerequisites for the source map: At any time , ,Keep To the node Forward reachability; at any time ,Keep The backtracking reachability to node u, where, Backtracking reachability is in At any given time, if there exists a self-node To the node causal path And for all times i , Then a node is called a node. It is a self-node Retraceable, marked as ,in, This represents the event that occurs at time i; Forward reachability is in At any given time, if there exists a self-node To the node causal path And for all times i , Then node v is called a self-node. Forward reachable, marked as ; The moments when the set of ancestors of node v changes are recorded as a set, i.e.: ； The set of ancestor nodes is node v in The ancestor set of time, i.e.: 。 8. The source graph construction and pruning device based on system audit logs as described in claim 5, characterized in that, The source graph is stored in a relational database MySQL or a non-relational database MongoDB.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the source graph construction and pruning method based on system audit logs as described in any one of claims 1 to 4.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the source graph construction and pruning method based on system audit logs as described in any one of claims 1 to 4.

Images