An event graph construction method, device, equipment and medium

Abstract

The application discloses an event graph construction method and device, equipment and medium, relates to the cross field of network security and artificial intelligence comprehensive application, and comprises the following steps: extracting entity triples based on the ATT&CK framework and target network security data; performing entity alignment and entity disambiguation processing on the entity triples; connecting the processed triples information through a target-driven mode to obtain a target event graph; the target-driven mode comprises entity driving and mixed driving; and the target event graph comprises a threat intelligence event graph and a traceability event graph. Based on the ATT&CK framework, the application can fuse the traceability event graph and the threat event graph to a semantic level, solving the semantic fusion problem caused by the heterogeneity of network security data; and the application connects the triples information through mixed driving to realize the correlation of events, solving the problem that the correlation between events is not considered when constructing the threat graph and the traceability graph.

Description

Technical Field

[0001] This invention relates to the interdisciplinary field of network security and artificial intelligence, and in particular to an event graph construction method, apparatus, device and medium. Background Technology

[0002] With the rapid development of science and technology and the increasing complexity of cyberspace and its structure, cyberattacks are exhibiting characteristics of diversity, intelligence, stealth, and persistence. To reduce the impact of cyberattacks on enterprises and society, cyberattack attribution techniques are typically used to identify the source or medium of the attack and the attack chain, and to develop targeted protection and countermeasure strategies. Cyberattack attribution techniques are mainly divided into active attribution and passive attribution techniques. Active attribution techniques mainly include routing debugging techniques, ITrace techniques, and packet tagging techniques, which are more difficult to implement. Passive attribution techniques mainly refer to internal detection, log analysis, and network traffic analysis, which are difficult to conduct due to the lack of key clues.

[0003] Currently, most technologies address the lack of key clues by constructing threat graphs, which mainly consist of two parts: graph construction and attacker mining and analysis. Graph construction is further divided into threat graph construction and attribution graph construction. A threat graph refers to a knowledge graph describing threat knowledge based on intelligence, while an attribution graph is a directed graph data structure generated based on security events produced by security devices and systems. Threat and attribution graphs are formed by collecting threat intelligence text data and cybersecurity events, and using custom ontology models to extract entity relationships. Attack mining primarily employs three methods: first, mapping the attribution graph to the threat graph using rules to form a high-level scenario graph for judgment; second, constructing attribution and threat graph feature vectors using machine learning algorithms and detecting attack behavior using similarity algorithms; and third, extracting attack mining features and performing behavioral modeling based on the constructed threat and attribution graphs using deep learning algorithms.

[0004] In existing technologies, due to the diverse and heterogeneous sources of cybersecurity data, there are ambiguities and alignment difficulties in semantic fusion when constructing threat maps and source maps. Furthermore, when constructing threat maps and source maps, only the chronological order of events is considered, without taking into account the correlation between events.

[0005] Therefore, how to solve the semantic fusion problem caused by the heterogeneity of network security data, and how to address the issue of not considering the correlation between events when constructing threat maps and source maps, still require further exploration by those skilled in the art. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide an event graph construction method, apparatus, device, and medium that can solve the semantic fusion problem caused by the heterogeneity of network security data, and to address the problem of not considering the correlation between events when constructing threat graphs and source tracing graphs. The specific solution is as follows:

[0007] Firstly, this application discloses a method for constructing an event graph, including:

[0008] Based on the ATT&CK framework, entity relationships are extracted from the target network security data to obtain a number of entity triples.

[0009] The entity triples are subjected to entity alignment and entity disambiguation to obtain the processed entity triples.

[0010] By connecting the triple information in a number of processed entity triples using a target-driven approach, a target event graph is obtained; the target-driven approach includes an entity-driven approach and a hybrid approach; the target event graph includes a target threat intelligence event graph and a target attribution event graph.

[0011] Optionally, before extracting entity relationships from the target network security data based on the ATT&CK framework to obtain a certain number of entity triples, the method further includes:

[0012] The original network security data is subjected to redundancy, missing data, and deduplication processing to obtain preprocessed data; wherein, the original network security data includes first data for constructing the target threat intelligence event map and second data for constructing the target source tracing event map;

[0013] Entity and relationship annotations are performed on the preprocessed data to obtain the target network security data.

[0014] Optionally, the original network security data is the first data, and the step of connecting the triple information in a number of processed entity triples using a target-driven approach to obtain a target event graph includes:

[0015] The target threat intelligence event map is obtained by connecting the triple information in a number of processed entity triples using an entity-driven approach.

[0016] Optionally, the original network security data is the second data, and the step of connecting the triple information in a number of processed entity triples using a target-driven approach to obtain a target event graph includes:

[0017] By connecting the triple information in a number of processed entity triples using a hybrid driving method, the target tracing event map is obtained.

[0018] Optionally, the original network security data is the second data, and after performing entity alignment and disambiguation processing on the entity triples to obtain the processed entity triples, the method further includes:

[0019] Through statistical analysis and clustering, the triplet information in a number of processed entity triplets is merged.

[0020] Accordingly, the step of concatenating the triple information in a number of processed entity triples using a hybrid driving method to obtain the target tracing event graph includes:

[0021] By connecting the triple information in a number of merged entity triples using a hybrid driving method, the target tracing event map is obtained.

[0022] Optionally, the process of concatenating the triple information in a number of merged entity triples using a hybrid driving method to obtain the target tracing event map further includes:

[0023] According to the preset weight determination formula, the weight of the edge related to the first information in the triplet information is increased, and the edge related to the second information in the triplet information is connected by dashed lines.

[0024] Secondly, this application discloses a network attack attribution analysis method based on event graphs, including:

[0025] The target threat intelligence event map and the target source tracing event map constructed by the aforementioned disclosed event map construction method are tiled to obtain the target threat intelligence map attack matrix and the target source tracing map attack matrix;

[0026] The semantic vectors of the target threat intelligence graph attack matrix and the target source tracing graph attack matrix are determined respectively, and the semantic vectors of the target threat intelligence graph attack matrix and the target source tracing graph attack matrix are fused to obtain the fused vector;

[0027] The fused vector is subjected to self-attention operation to obtain the self-attention operation result, and the self-attention operation result is subjected to BiLSTM bidirectional encoding to obtain the encoded result;

[0028] The encoded result is then subjected to network attack attribution classification to obtain the classification result.

[0029] Thirdly, this application discloses an event graph construction apparatus, comprising:

[0030] The entity triple extraction module is used to extract entity relationships from target network security data based on the ATT&CK framework, and obtain a number of entity triples.

[0031] The entity triplet processing module is used to perform entity alignment processing and entity disambiguation processing on the entity triplet to obtain the processed entity triplet.

[0032] The connection module is used to connect the triple information in a number of processed entity triples in a target-driven manner to obtain a target event graph; the target-driven manner includes an entity-driven manner and a hybrid-driven manner; the target event graph includes a target threat intelligence event graph and a target tracing event graph.

[0033] Fourthly, this application discloses an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor for executing the computer program to implement the aforementioned method.

[0036] Fifthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned method.

[0037] As can be seen, this application discloses an event graph construction method, including: extracting entity relations from target network security data based on the ATT&CK framework to obtain a number of entity triples; performing entity alignment and entity disambiguation processing on the entity triples to obtain processed entity triples; connecting the triple information in the processed entity triples through a target-driven approach to obtain a target event graph; the target-driven approach includes an entity-driven approach and a hybrid approach; the target event graph includes a target threat intelligence event graph and a target attribution event graph. In summary, this application extracts entity relations from target network security data based on the ATT&CK framework, enabling the constructed attribution event graph and threat event graph to be integrated at a semantic level, solving the semantic fusion problem caused by the heterogeneity of network security data. Furthermore, this application uses a hybrid approach to connect triple information to achieve association of events corresponding to the triple information, solving the problem that when constructing threat event graphs and attribution event graphs, only the temporal sequence is considered, without considering the relationships between events. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 This is a flowchart of an event graph construction method disclosed in this application;

[0040] Figure 2 This is a flowchart of a specific event graph construction method disclosed in this application;

[0041] Figure 3 This application discloses a flowchart of a network attack attribution analysis method based on event graphs.

[0042] Figure 4 This application discloses a flowchart of a specific network attack attribution analysis method based on event graphs.

[0043] Figure 5 This is a schematic diagram of an event graph construction device disclosed in this application;

[0044] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] In existing technologies, due to the diverse and heterogeneous sources of cybersecurity data, there are ambiguities and alignment difficulties in semantic fusion when constructing threat maps and source maps. Furthermore, when constructing threat maps and source maps, only the chronological order of events is considered, without taking into account the correlation between events.

[0047] To address this, this application proposes an event graph construction scheme that can solve the semantic fusion problem caused by the heterogeneity of network security data, and also solve the problem of not considering the correlation between events when constructing threat graphs and source tracing graphs.

[0048] This application discloses an event graph construction method, see [link to relevant documentation]. Figure 1 As shown, the method includes:

[0049] Step S11: Extract entity relationships from the target network security data based on the ATT&CK framework to obtain a number of entity triples.

[0050] To reduce the computational load and improve the quality of the event graph during its construction, this embodiment first performs redundancy, missing data, and deduplication on the original cybersecurity data to obtain preprocessed data. The original cybersecurity data includes first data for constructing the target threat intelligence event graph and second data for constructing the target attribution event graph. Specifically, the first data comes from threat intelligence centers of different organizations and is a summary of cybersecurity events; its data structure includes structured, unstructured, and semi-structured data. The second data mainly comes from logs and analysis reports reported by terminals, and its data format is mainly divided into unstructured and structured data. After obtaining the preprocessed data, entity and relationship annotations are performed on the preprocessed data to obtain the target cybersecurity data, which is used for entity relationship extraction.

[0051] In this embodiment, the event graph is defined as follows: Definition 1. Event Graph: A labeled directed acyclic graph, G = (V, E, L, A, M, K). Where V is a vertex in the graph, representing the set of network entities in the attack chain; E is the set of edges in the graph, representing the relationships between entities; L is the set of entity labels; A is the stage of the network attack chain in which the network entity is located; M is the set of stage labels in the network attack chain; and K is the set of entities, relationships, and attack stages in the network graph. Definition 2. Network Entity: An objective entity existing in a network security event, mainly divided into concepts and objects. A concept is an abstract set of objective entities with relevant attributes and characteristics, represented by α; an object is an instance of a concept, represented by β. Definition 3. Network Entity Relationship: Represents the relationship between entities, represented by the symbol R. Definition 4. Network Entity Attack Chain Stage: Represents the stage position of the entity in the network attack chain, represented by the symbol δ.

[0052] Furthermore, based on the event graph definition, entity relations are extracted from the target network security data using the ATT&CK framework, resulting in a number of entity triples. During the entity extraction process, this embodiment employs various entity extraction methods to extract entity relations from data with different structures. Specifically, unstructured labeled data is used for entity relation model training and prediction; structured labeled data is extracted using rule-based extraction methods; and semi-structured labeled data is extracted using a combination of dependency syntax and rules, resulting in a number of entity triples. It should be noted that ATT&CK refers to adversarial tactics, techniques, and common sense, encompassing multiple tactical phases, specific links, and key technologies.

[0053] Step S12: Perform entity alignment and entity disambiguation processing on the entity triples to obtain the processed entity triples.

[0054] In this embodiment, entity alignment is performed on the entity triples, and entity disambiguation is performed on ambiguous entities, thus ensuring the correctness of extraction.

[0055] Step S13: Connect the triple information in a number of processed entity triples using a target-driven approach to obtain a target event graph; the target-driven approach includes an entity-driven approach and a hybrid approach; the target event graph includes a target threat intelligence event graph and a target attribution event graph.

[0056] In a specific embodiment, when the original network security data is the first data used to construct the target threat intelligence event map, the target event map is obtained by connecting the triple information in a number of processed entity triples in a target-driven manner. Specifically, this includes connecting the triple information in a number of processed entity triples in an entity-driven manner to obtain the target threat intelligence event map.

[0057] It should be noted that, on the one hand, due to the singularity of the data in the attribution event graph and the factual nature of the data being more opinionated than factual, there are challenges in generating the attribution event graph: how to associate and connect single attribution entity relationship data with other attribution entity relationship data to generate the attribution event graph. To address this, when the original network security data serves as the second data for constructing the target attribution event graph, this embodiment uses a hybrid-driven approach to connect the triple information in several processed entity triples to obtain the target attribution event graph. In this way, this embodiment, by associating and connecting single attribution entity relationship data with other attribution entity relationship data through a hybrid-driven approach to generate the attribution event graph, not only reduces the complexity of threat intelligence graphs and attribution graphs in terms of temporal granularity but also adds the phased nature of network attacks in terms of spatial dimension, and the resulting directed acyclic graph increases feature richness. It should be noted that there are five main types of attribution entity relationship data connection methods: data-driven, intelligence-driven, entity-driven, strategy-tactical-process (TTP), and hybrid-driven.

[0058] Secondly, due to the large amount of traceability information, in order to form a high-quality traceability event graph and reduce useless information, this embodiment uses statistical analysis and clustering to merge the triple information in a number of processed entity triples. In this way, the amount of traceability information is reduced. Correspondingly, the step of connecting the triple information in a number of processed entity triples through a hybrid driving method to obtain the target traceability event graph includes: connecting the triple information in a number of merged entity triples through a hybrid driving method to obtain the target traceability event graph.

[0059] Thirdly, existing technologies have the problem of directly and crudely deleting conflicting or suspected false alarm information during the process of tracing information, which may lead to misjudgment and misoperation of key information. This embodiment uses a probability model to perform objective calculations and automatically search and judge whether to retain or delete the information, so as to retain the valuable information of tracing as much as possible and greatly improve the accuracy of tracing.

[0060] In a specific embodiment, for suspected conflict information in the source tracing information, conflict-related information is retained, and the logical loss weight of the relevant edges is increased according to a preset weight determination formula. The suspected conflict information is also the first information.

[0061] The specific formula for determining the weights is as follows:

[0062]

[0063] Where p(x) i ) represents the probability of a conflicting information entity.

[0064] In a specific embodiment, for information suspected of being a false alarm, the edges related to the suspected false alarm are connected with dashed edges according to the threat intelligence knowledge base. The suspected false alarm information is also the second information. In other words, for suspected conflict information and suspected false alarm information, this embodiment proposes a logical loss and a dashed edge processing definition. In this way, the source information is preserved to the maximum extent, and misjudgment and operation of key information are prevented.

[0065] Fourthly, regarding the increased complexity of model learning and detection caused by lateral movement in attack tracing, this embodiment proposes the following solution: For different entities and attributes (different nodes), a unique f(x), x = 1, 2, ..., n, is used for representation. Furthermore, for adjacent temporal nodes in the same intermediate stage of the attack (lateral movement stage), the following relationship is satisfied:

[0066] f(x i )*f(x j )=1,i=1,2,…,m; j=1,2,…,n;

[0067] For example, for a series of nodes, nodes A, B, C, and D, these four nodes are adjacent nodes in the lateral movement phase. In this embodiment, node A is mapped to f(x1), node B to f(x2), node C to f(x3), and node D to f(x4). Furthermore, node A and node B are merged into one node, satisfying the following relationship:

[0068] f(x1)*f(x2)=1;

[0069] Merge node C and node D into one node, satisfying the following relationship:

[0070] f(x3)*f(x4)=1;

[0071] Furthermore, the weight of a node is used to determine whether it is a potentially vulnerable node. For example, if node A has a weight of 0.4 and node B has a weight of 0.6, then node B is likely a vulnerable node. In summary, this embodiment uses mathematical formulas to represent adjacent entities and parallelizes the lateral movement in the event graph, significantly reducing the complexity of model detection and solving the problem that lateral movement complicates the learning and detection of attack models.

[0072] In other words, this embodiment uses the ATT&CK framework to fuse network security data at the semantic layer and uses a custom event graph to construct a threat graph and a source graph. This further solves the problems of suspected conflict / false alarm information and the complexity of model detection caused by lateral movement in the graph, improves the feature representation of attack source tracing, and reduces the complexity of graph learning and model detection.

[0073] As can be seen, this application discloses an event graph construction method, including: extracting entity relations from target network security data based on the ATT&CK framework to obtain a number of entity triples; performing entity alignment and entity disambiguation processing on the entity triples to obtain processed entity triples; connecting the triple information in the processed entity triples through a target-driven approach to obtain a target event graph; the target-driven approach includes an entity-driven approach and a hybrid approach; the target event graph includes a target threat intelligence event graph and a target attribution event graph. In summary, this application extracts entity relations from target network security data based on the ATT&CK framework, enabling the constructed attribution event graph and threat event graph to be integrated at a semantic level, solving the semantic fusion problem caused by the heterogeneity of network security data. Furthermore, this application uses a hybrid approach to connect triple information to achieve association of events corresponding to the triple information, solving the problem that when constructing threat event graphs and attribution event graphs, only the temporal sequence is considered, without considering the relationships between events.

[0074] See Figure 2 As shown, the application first processes structured, semi-structured, and unstructured data by handling duplication, missing data, and redundancy. The processed data is then manually labeled with entities and relationships. Next, within the ATT&CK framework, entity relationship models are extracted from the labeled data to form entity triples. Furthermore, entity alignment and disambiguation are performed on the entities in the triples to ensure the accuracy of the extraction. Taking the formation of a source event graph as an example, the process involves statistical analysis and clustering of the event triple information to reduce data processing volume. Finally, according to the event graph model definition, the event triple information is connected using a target-driven approach. Edge weights are added to suspected conflict information, and suspected false alarm information is connected with dashed edges using a threat intelligence knowledge base, thus forming the source event graph. It should be noted that after obtaining the source event graph, the attack chain is flattened to form a graph attack matrix.

[0075] This application discloses a network attack attribution analysis method based on event graphs. (See also...) Figure 3 as well as Figure 4 As shown, it specifically includes:

[0076] Step S21: Tiling the target threat intelligence event map and the target source tracing event map constructed by the aforementioned event map construction method to obtain the target threat intelligence map attack matrix and the target source tracing map attack matrix.

[0077] Step S22: Determine the semantic vectors of the target threat intelligence graph attack matrix and the target source tracing graph attack matrix respectively, and fuse the semantic vectors of the target threat intelligence graph attack matrix and the target source tracing graph attack matrix to obtain the fused vector.

[0078] Step S23: Perform self-attention operation on the fused vector to obtain the self-attention operation result, and perform BiLSTM bidirectional encoding on the self-attention operation result to obtain the encoded result.

[0079] Step S24: Perform network attack tracing and classification on the encoded result to obtain the classification result.

[0080] In this embodiment, the module takes as input a target threat intelligence event graph and a target attribution event graph, and flattens the links in the graph to form a graph attack matrix. The target attribution graph attack matrix and the target threat intelligence graph attack matrix are then used to perform vector semantic representation using an embedding method, and the attribution and threat intelligence embedding semantic vectors are concatenated and fused. The fused embedding vector is input into an attention layer for self-attention mechanism calculation. The vector calculated by the self-attention mechanism is then encoded using BiLSTM (Bidirectional Long Short-Term Memory Network). The bidirectional encoded data is input into a softmax layer for grid attack attribution classification. Finally, the softmax classification result is analyzed and returned. In the above process, this application achieves network attack path reconstruction, that is, the attack links detected by the event graph attack model are reconstructed using a directed graph. This facilitates the display of causal events, enabling further exploration and discovery.

[0081] As can be seen, this application proposes a network attack attribution analysis method based on event graphs, including: tiling the target threat intelligence event graph and the target attribution event graph constructed by the aforementioned event graph construction method to obtain a target threat intelligence event graph attack matrix and a target attribution event graph attack matrix; determining the semantic vectors of the target threat intelligence event graph attack matrix and the target attribution event graph attack matrix respectively, and fusing the semantic vectors of the target threat intelligence event graph attack matrix and the target attribution event graph attack matrix to obtain a fused vector; performing self-attention operation on the fused vector to obtain the self-attention operation result, and performing BiLSTM bidirectional encoding on the self-attention operation result to obtain an encoded result; classifying the encoded result for network attack attribution to obtain a classification result. In summary, this application performs embedding vector fusion on the processed event graph, adds an attention mechanism and a BiLSTM model for vector encoding, and generates a network attack chain detection model after model training and optimization.

[0082] Accordingly, this application also discloses an event graph construction apparatus, see [link to relevant documentation]. Figure 5 As shown, the device includes:

[0083] The entity triple extraction module 11 is used to extract entity relationships from the target network security data based on the ATT&CK framework to obtain a number of entity triples.

[0084] The entity triplet processing module 12 is used to perform entity alignment processing and entity disambiguation processing on the entity triplet to obtain the processed entity triplet.

[0085] The connection module 13 is used to connect the triple information in a number of processed entity triples in a target-driven manner to obtain a target event graph; the target-driven manner includes an entity-driven manner and a hybrid-driven manner; the target event graph includes a target threat intelligence event graph and a target tracing event graph.

[0086] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0087] As can be seen, this application discloses an event graph construction device, comprising: an entity triple extraction module, used to extract entity relationships from target network security data based on the ATT&CK framework to obtain a number of entity triples; an entity triple processing module, used to perform entity alignment processing and entity disambiguation processing on the entity triples to obtain processed entity triples; and a connection module, used to connect the triple information in the number of processed entity triples through a target-driven method to obtain a target event graph; the target-driven method includes an entity-driven method and a hybrid-driven method; and the target event graph includes a target threat intelligence event graph and a target attribution event graph. In summary, this application extracts entity relationships from target network security data based on the ATT&CK framework, enabling the constructed source event graph and threat event graph to be integrated at a semantic level. This solves the semantic fusion problem caused by the heterogeneity of network security data. Furthermore, this application adopts a hybrid-driven approach to connect triple information to achieve the association of events corresponding to the triple information. This addresses the problem that when constructing threat event graphs and source event graphs, only the temporal sequence is considered, without considering the relationships between events.

[0088] Furthermore, embodiments of this application also provide an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0089] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the event graph construction method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0090] In this embodiment, the power supply 26 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0091] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon may include computer programs 221, and the storage method may be temporary storage or permanent storage. The computer programs 221 may include, in addition to computer programs capable of performing the event graph construction method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, computer programs capable of performing other specific tasks.

[0092] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned event graph construction method.

[0093] For the specific steps of this method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0094] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. For the same or similar parts between the various embodiments, refer to each other. As for the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and relevant parts can be referred to in the method section.

[0095] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0097] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] The above provides a detailed description of the event graph construction method, apparatus, device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for constructing an event graph, characterized in that, include: Based on the ATT&CK framework, entity relationships are extracted from the target network security data to obtain a number of entity triples. The entity triples are subjected to entity alignment and entity disambiguation to obtain the processed entity triples. A target event graph is obtained by connecting the triple information in a number of processed entity triples using a target-driven approach; the target-driven approach includes an entity-driven approach and a hybrid approach; the target event graph includes a target threat intelligence event graph and a target attribution event graph. The original cybersecurity data includes first data for constructing the target threat intelligence event map and second data for constructing the target attribution event map; the target cybersecurity data is data obtained by processing the original cybersecurity data. When the original network security data is the first data, the triple information in a number of processed entity triples is concatenated using a target-driven approach to obtain a target event graph, including: The target threat intelligence event map is obtained by connecting the triple information in a number of processed entity triples using an entity-driven approach. When the original network security data is the second type of data, the triple information in a number of processed entity triples is concatenated using a target-driven approach to obtain a target event graph, including: By connecting the triple information in a number of processed entity triples using a hybrid driving method, the target tracing event map is obtained.

2. The event graph construction method according to claim 1, characterized in that, Before extracting entity relationships from the target network security data based on the ATT&CK framework to obtain a certain number of entity triples, the process also includes: The original network security data is processed for redundancy, missing data, and deduplication to obtain preprocessed data. Entity and relationship annotations are performed on the preprocessed data to obtain the target network security data.

3. The event graph construction method according to claim 1, characterized in that, The original network security data is the second data. After performing entity alignment and disambiguation processing on the entity triples to obtain the processed entity triples, the process further includes: Through statistical analysis and clustering, the triplet information in a number of processed entity triplets is merged. Accordingly, the step of concatenating the triple information in a number of processed entity triples using a hybrid driving method to obtain the target tracing event graph includes: By connecting the triple information in a number of merged entity triples using a hybrid driving method, the target tracing event map is obtained.

4. The event graph construction method according to claim 3, characterized in that, The process of connecting the triple information in a number of merged entity triples using a hybrid driving method to obtain the target tracing event map also includes: According to the preset weight determination formula, the weight of the edge related to the first information in the triplet information is increased, and the edge related to the second information in the triplet information is connected by dashed lines.

5. A network attack attribution analysis method based on event graphs, characterized in that, include: The target threat intelligence event map and the target source tracing event map constructed by the event map construction method as described in any one of claims 1 to 4 are tiled to obtain the target threat intelligence map attack matrix and the target source tracing map attack matrix. The semantic vectors of the target threat intelligence graph attack matrix and the target source tracing graph attack matrix are determined respectively, and the semantic vectors of the target threat intelligence graph attack matrix and the target source tracing graph attack matrix are fused to obtain the fused vector; The fused vector is subjected to self-attention operation to obtain the self-attention operation result, and the self-attention operation result is subjected to BiLSTM bidirectional encoding to obtain the encoded result; The encoded result is then subjected to network attack attribution classification to obtain the classification result.

6. An event graph construction device, characterized in that, include: The entity triple extraction module is used to extract entity relationships from target network security data based on the ATT&CK framework, and obtain a number of entity triples. The entity triplet processing module is used to perform entity alignment processing and entity disambiguation processing on the entity triplet to obtain the processed entity triplet. The connection module is used to connect the triple information in a number of processed entity triples in a target-driven manner to obtain a target event graph; the target-driven manner includes an entity-driven manner and a hybrid-driven manner; the target event graph includes a target threat intelligence event graph and a target attribution event graph; The original cybersecurity data includes first data for constructing the target threat intelligence event map and second data for constructing the target attribution event map; the target cybersecurity data is data obtained by processing the original cybersecurity data. When the original network security data is the first data, the triple information in a number of processed entity triples is concatenated using a target-driven approach to obtain a target event graph, including: The target threat intelligence event map is obtained by connecting the triple information in a number of processed entity triples using an entity-driven approach. When the original network security data is the second type of data, the triple information in a number of processed entity triples is concatenated using a target-driven approach to obtain a target event graph, including: By connecting the triple information in a number of processed entity triples using a hybrid driving method, the target tracing event map is obtained.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the method according to any one of claims 1 to 5.

Images