Metaverse Network Threat Event Inference Method

Abstract

This invention discloses a method for estimating threat events in a metaverse network, primarily addressing the problems of existing threat detection methods failing to fully reflect the dynamics of the system, lacking the ability to detect real-time network attacks, and lacking the capability to reconstruct attack scenarios. The implementation scheme involves: monitoring changes in virtual resource parameters within the metaverse virtual environment and issuing warnings about the current virtual boundary status of the user; constructing a source map using system log data collected from the user's device and network space anchor entity information; compressing the source map to obtain a compressed source map, which is then visualized in the Neo4j database; setting attack stage labels for entity matching in the compressed source map, and performing forward and reverse searches on the compressed source map to extract the attack map of metaverse security boundary attacks. This invention can detect attacks in the metaverse network in real time, has a wider range of applications, enhances the ability to proactively respond to metaverse network threats, and can be used for network security.

Description

Technical Field

[0001] This invention belongs to the field of computer technology and further relates to an event deduction method that can be used to detect attacks in the metaverse network in real time and provide a more comprehensive description of the attack behavior, thereby enhancing the ability to proactively respond to threats in the metaverse network and protecting network security. Background Technology

[0002] The metaverse is a self-sustaining, hyperspace-based 3D immersive virtual shared space created by the fusion of persistent virtual environments and augmented physical reality. With the rapid development of the metaverse, various new types of attacks are constantly emerging. On the one hand, compared to traditional networks, the metaverse involves a wider range of data and services, leading to a larger attack surface. On the other hand, the metaverse integrates multiple technologies such as virtual reality (VR), augmented reality (AR), the Internet of Things (IoT), blockchain, and artificial intelligence, all of which contain vulnerabilities, posing new threats to user security and privacy.

[0003] Metaverse applications and various sensing devices provide users with channels to enter virtual worlds and interact with other users. After processing input commands, applications send output to sensing devices. During this process, malicious applications can alter the output display, misleading users in the virtual environment. Due to the immersive and present-oriented characteristics of the metaverse, the impact of such threats is amplified in the virtual world. Malicious output acts on the user's senses through sensing devices, causing discomfort such as nausea and dizziness; furthermore, attackers can control the user's body movements, manipulating their direction and position without their knowledge, causing physical harm.

[0004] Casey P et al., in their paper "Immersive Virtual Reality Attacks and the Human Joystick" (IEEE Transactions on Dependable and Secure Computing, 2019, 18(2): 550-562), proposed an attack method targeting VR boundary systems. When users participate in a metaverse experience using VR devices, they are immersed in the virtual world. To help users avoid unseen obstacles while wearing VR devices, a boundary system needs to be set up, defining the area where users can safely move. If an attacker maliciously modifies the configuration of the boundary system, the user's personal safety will be threatened. This method has an exploitable security vulnerability because it stores security feature data in plaintext in the boundary configuration file of the Chaperone boundary system. When the user is immersed in the virtual world, tampering with the data in the boundary configuration file can cause the user to lose their way in the metaverse scene or lead the user to collide with physical objects, causing physical injury or even a threat to life.

[0005] Valluripally S et al., in their paper "Attack trees for security and privacy in social virtual reality learning environments" (2020 IEEE 17th Annual Consumer Communications & Networking Conference (CCNC). IEEE, 2020: 1-9), developed an anomaly monitoring tool for VR learning environments. This tool triggers alarms based on simple threshold checkers, such as when the incoming rate of network packets exceeds a threshold. The attack tree method is used to model and describe potential security and privacy risks in VR learning environments, analyze potential attack paths and attacker behavior, and make decisions based on different detected threats. However, because the attack tree is a static model built in one go, it cannot fully reflect the dynamic nature of the system and therefore cannot detect real-time network attacks occurring within the system.

[0006] In their paper "Detecting framerate-oriented cyberattacks on user experience in virtual reality" (VR4Sec: 1st International Workshop on Security for XR and XR for Security (2021)), OdeleyeB et al. proposed the first VR intrusion detection system, designed to prevent malicious attackers from disrupting the user experience by reducing the frame rate of VR applications. This system utilizes machine learning to detect ongoing attacks and provide early warnings before their impact escalates. The detection steps are as follows: First, collect a large amount of VR application data, including frame rate and latency under different scenarios and operating conditions; second, extract features from the collected data to represent changes in frame rate and latency, monitoring system metrics including average frame rate, frame rate standard deviation, average frame latency, frame latency standard deviation, and frame rate entropy change; third, use unsupervised machine learning with isolated forests to learn the normal state of a specific VR system; fourth, distinguish whether an attack has occurred by comparing machine learning-based classification with the actual state, marking and warning the user when multiple consecutive attack data points are detected. The shortcomings of this method are that it only detects attacks and issues warnings based on some system characteristics, without taking into account the causal relationship between attack events. Therefore, it cannot trace the attacker's attack chain and lacks the ability to reconstruct the attack scenario. Summary of the Invention

[0007] The purpose of this invention is to address the security threats in the aforementioned metaverse and the shortcomings of existing threat detection technologies by providing a threat event deduction method based on a source graph. This method can fully reflect the dynamics of the system, detect network attacks occurring in the system in real time, and improve the ability to reconstruct attack scenarios.

[0008] The key technology of this invention is: monitoring changes in virtual resource parameters in the metaverse; if an attack is detected, issuing a warning in the metaverse virtual environment and tracing the attack source; collecting system logs to build a source map, and extracting the attack graph from the source map according to attack rules and tag propagation methods. The implementation steps include the following:

[0009] (1) Monitor changes in virtual resource parameters in the metaverse:

[0010] The hash value of the boundary file is calculated using a hash algorithm, and the hash value corresponding to the initial boundary file set by the user when entering the metaverse virtual environment is recorded.

[0011] While the user is immersed in the metaverse experience, the hash value of the boundary file at the current moment is continuously obtained, and it is determined whether the initial hash value of the boundary file is the same as the current hash value:

[0012] If they are the same, it means the current virtual environment is secure, and monitoring should continue.

[0013] If they are different, it means that the virtual boundary resources of the metaverse have been tampered with, and step (2) is executed;

[0014] (2) In the metaverse virtual environment, issue a warning to the user about the current virtual boundary status, that is, use OpenGL to render a warning prompt pattern and use PyOpenVR to display it in the metaverse virtual environment to warn the user that the current virtual boundary has been maliciously tampered with.

[0015] (3) Collect system log data on user devices;

[0016] (4) Process log data to construct a source graph:

[0017] (4a) Parse the system log data, that is, parse it into three parts: a source entity, a target entity, and the relationship between them; extract key information related to attack tracing from the log, including timestamps and event types; and establish the relationship between different log events.

[0018] (4b) The parsed source entity and target entity are used as nodes in the source graph, and the relationship between entities is used as directed edges in the source graph to form the source graph;

[0019] (5) Create network space anchor point entities in the source map:

[0020] Create network space anchor entities in the source map. The attributes of the anchor entity include anchor ID, account, anchor permissions, anchor creation time, anchor type, anchor validity period, anchor coordinates, anchor gesture, and associated anchor ID.

[0021] Associate each network space anchor with its unique corresponding metaverse application, find a process entity corresponding to that metaverse application in the source graph, and establish the relationship between network space anchor entities and process entities in the source graph.

[0022] (6) Compress the source map:

[0023] (6a) Merge identical interactive operations between nodes in the source graph. That is, for the same operation that occurs at different times between two nodes, only one operation information is retained in the source graph to obtain the merged compressed graph a.

[0024] (6b) Remove a large number of benign nodes and relation edges that are not related to the attack from the merged compressed graph a to obtain the node-removed compressed graph b;

[0025] (6c) Prune the weak dependencies in the compressed graph b to obtain the final compressed source graph;

[0026] (7) Visualize the compressed source map in the Neo4j database;

[0027] (8) Extract the attack graph from the compressed source graph:

[0028] (8a) Establish attack rules, that is, define the attack phases and the entities involved in each attack phase, the related operation attributes, and the prerequisites that must be met to match the attack phase.

[0029] (8b) Use attack rules to match multiple stages of the attack in the compressed source graph, and use the prerequisites in the attack rules to establish the connection between each attack stage. Set a label for each attack stage and pass the matched prerequisites through the label to avoid repeated traversal.

[0030] (8c) Perform forward and reverse searches on the compressed source graph to extract the attack graph for the metaverse security boundary attack:

[0031] The reverse search starts from the alarm signal, traverses the compressed source map, and uses the labels of each stage of the attack rules to guide the location of the intrusion point during the traversal. Once an intrusion point is found, the traversal process is terminated.

[0032] The forward search involves traversing nodes that match other attack rules besides the intrusion point, ultimately finding the complete attack path.

[0033] Compared with the prior art, the present invention has the following advantages:

[0034] First, because the present invention can collect system logs in real time and build a source map, it overcomes the problem that the existing technology cannot fully reflect the dynamics of the system and cannot detect network attacks that occur in the system in real time, making the present invention more practical in actual attack detection scenarios and with a wider range of applications.

[0035] Second, because the present invention uses a source graph to represent the interaction events between entities with time attributes in the metaverse network and establishes the correlation between various attack events, it overcomes the problem in the prior art that it is impossible to trace the attacker's attack chain and reconstruct the attack scenario. This enables the present invention to provide a more comprehensive description of attack behavior and further enhances the ability to proactively respond to threats in the metaverse network. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating the implementation of the present invention;

[0037] Figure 2 This is a schematic diagram of the metaverse security boundary attack principle involved in this invention;

[0038] Figure 3 This is a simulation result diagram of the present invention. Detailed Implementation

[0039] The embodiments of the present invention will now be described in further detail with reference to the accompanying drawings.

[0040] Reference Figure 1 The implementation steps for this example are as follows:

[0041] Step 1: Monitor changes in the virtual resource parameters of the metaverse.

[0042] Reference Figure 2 The principle of the metaverse security boundary attack involved in this invention is as follows: targeting the metaverse security boundary, the attacker first intrudes into the target computer, installs malicious code, executes malicious commands, manipulates the boundary configuration file, and starts an OpenVR instance. After the attack takes effect, the metaverse security boundary is tampered with, and the user loses the protection of the trusted boundary, which will cause dizziness, collisions, falls, and threats to life safety. Finally, the information extracted from the user's system is forwarded to the attacker.

[0043] Based on the principle of metaverse security boundary attacks, this example uses a hash algorithm to monitor parameter changes at the metaverse security boundary. The implementation steps include the following:

[0044] 1.1) Calculate the hash value of the boundary file using a hash algorithm, and record the hash value corresponding to the initial boundary file set by the user when entering the metaverse virtual environment:

[0045] 1.1.1) Padded file messages to make the file length congruent to 448 modulo 512, resulting in padded file messages;

[0046] 1.1.2) Append a 64-bit message length to the padded file message and group it;

[0047] 1.1.3) Use the MD5 helper function to calculate the hash value of each block, and concatenate the hash values ​​of each block into a 512-bit hash value;

[0048] 1.2) While the user is immersed in the metaverse experience, continuously obtain the hash value of the boundary file at the current moment and determine whether the initial hash value of the boundary file is the same as the current hash value:

[0049] If they are the same, it means the current virtual environment is secure, and monitoring should continue.

[0050] If they are different, it means that the virtual boundary resources of the metaverse have been tampered with, and step 2 should be executed.

[0051] Step 2: Issue a warning to the user regarding the current virtual boundary status within the metaverse virtual environment.

[0052] The warning pattern is rendered using the OpenGL graphics rendering application interface and displayed in the metaverse virtual environment using the Python open-source library PyOpenVR to warn the user that the current virtual boundary has been maliciously tampered with.

[0053] Step 3: Collect system log data on the user device.

[0054] Existing methods for collecting system log data on user devices include the operating system's built-in log collection function, security information and event management functions, log agents, and log collectors. This example uses, but is not limited to, the Windows system's built-in log collection function and log collector to collect system log data on user devices. The implementation steps include the following:

[0055] 3.1) Configure the system audit strategy to collect system logs related to processes, files, and network entities on the host connected to the sensing devices;

[0056] 3.2) The Winlogbeat log collector monitors the configured log sources. When a system log event that matches the configured filtering rules occurs, Winlogbeat retrieves these events from the operating system and sends them to the Kafka server.

[0057] 3.3) Start the Kafka server, connect the Kafka consumer application to the Kafka topic, and read the log data.

[0058] Step 4: Process the log data to construct a source graph.

[0059] Existing methods for processing log data to construct source graphs include association rule-based source graph construction methods, machine learning-based source graph construction methods, and causal relationship-based source graph construction methods. This example uses, but is not limited to, a causal relationship-based source graph construction method to process log data and construct a source graph. The implementation steps include the following:

[0060] 4.1) Parse system log data, that is, parse it into three parts: a source entity, a target entity, and the relationship between them; extract key information related to attack tracing from the logs, including timestamps and event types; and establish the correlation between different log events.

[0061] 4.2) The parsed source entity and target entity are used as nodes in the source graph, and the relationships between entities are used as directed edges in the source graph to form the source graph.

[0062] Step 5: Create network space anchor point entities in the source map.

[0063] Create network space anchor entities in the source map. The attributes of the anchor entity include anchor ID, account, anchor permissions, anchor creation time, anchor type, anchor validity period, anchor coordinates, anchor gesture, and associated anchor ID.

[0064] Each cyberspace anchor is associated with its unique corresponding metaverse application. In the source graph, a process entity corresponding to that metaverse application is found to establish the relationship between the cyberspace anchor entity and the process entity in the source graph.

[0065] Step 6: Compress the source map.

[0066] Existing methods for compressing source graphs include attribute-based compression, rule-based compression, clustering, K-Core graph compression algorithm, K-Truss graph compression algorithm, graph merging, graph pruning, and path factor algorithm. This example uses, but is not limited to, graph merging, graph pruning, and path factor algorithms to compress the source graph. The implementation steps include the following:

[0067] 6.1) Merge identical interactive operations between nodes in the source graph. That is, for the same operation that occurs at different times between two nodes, only one operation information is retained in the source graph to obtain the merged compressed graph a.

[0068] 6.2) Remove a large number of benign nodes and relational edges that are irrelevant to the attack from the merged compressed graph a to obtain the node-removed compressed graph b;

[0069] 6.3) In the node removal compressed graph b, the path factor is used to prioritize the information flow paths affected by the attacker, and the weak information flow paths are pruned to obtain the final compressed source graph, which is then visualized in the Neo4j database.

[0070] Step 7: Extract the attack graph from the compressed source graph.

[0071] Existing methods for extracting attack graphs from compressed source maps include machine learning-based threat detection methods, similarity-based threat detection methods, structure-based threat detection methods, and attack rule-based threat detection methods. This example uses, but is not limited to, an attack rule-based threat detection method to extract attack graphs from compressed source maps. The implementation steps include the following:

[0072] 8.1) Establish attack rules, that is, define the attack phases and the entities involved in each attack phase, the related operation attributes, and the prerequisites that must be met to match the attack phase:

[0073] This step sets up six attack phases, including initial penetration, establishing a foothold, privilege escalation, reading sensitive files, achieving the objective, and deleting traces. The entities involved in each phase, the related operation attributes, and the prerequisites that must be met to match that attack phase are defined as follows:

[0074] The initial penetration phase refers to the attacker making a remote connection, i.e. reading an untrusted IP address. The entities involved are process P and network S, the operation attribute is recvmsg, and the prerequisite is that S.ip is an untrusted IP address.

[0075] The establishment of the base point phase refers to the stage after the system has been initially penetrated. The attacker uses CnC communication to attempt to communicate with the server and receive further instructions. The entities involved are process P and network S, and the operation attributes are sendmsg and recvmsg. The prerequisite is that the first attack phase matched by the process matches the label value P of any other attack phase. 1,* =1 and S.ip are untrusted IP addresses;

[0076] The privilege escalation phase refers to the attacker using root privileges to execute malicious code written locally in order to gain more operational privileges. The entities involved are process P and file F, the operation attribute is exec, and the prerequisite is that user U = root privileges and the first attack phase label value P.step1 = 1 matched with the process.

[0077] The sensitive file reading stage refers to a process that matches other attack stages reading a file in the whitelist. The entities involved are process P and file F, the operation attribute is read, and the prerequisite is that F is a sensitive file and the first attack stage label value P.step1 = 1 or the second attack stage label value P.step2 = 1 matched by the process.

[0078] The target completion stage refers to the attacker executing a specific system instruction, using a malicious process to spawn other processes to submit malicious operations for execution. The entity involved is process P, the operation attributes are fork and exec, and the prerequisite is that P belongs to a sensitive system instruction, and the first attack stage label value P.step1 = 1 matched with the process or the second attack stage label value P.step2 = 1 matched with the process.

[0079] The "trace removal phase" refers to the attacker clearing malicious code downloaded to the local machine. This involves process P and file F, with the operation attribute being "unlink." A prerequisite is that the process matches the tag values ​​P.step of the first and second attack phases. 1,2 =1;

[0080] 8.2) Use attack rules to match multiple stages of the attack in the compressed source graph, and establish connections between each attack stage using the prerequisites in the attack rules. Assign a label to each attack stage and pass the matched prerequisites through label passing to avoid repeated traversal.

[0081] 8.2.1) Based on the relationship edge (src, r, sink) in the source graph, set the label value of the target node sink to inherit from the source node src:

[0082] If the source node's src tag value is src.step at a certain attack stage... i If the value is 1, then the target node sink will have its label value sink.step set for this attack phase. i Set the value to 1, i = 1, 2, 3... 6, and execute step (8.2.2);

[0083] Otherwise, maintain the target node's label value sink.step. i The original value remains unchanged, and step (8.2.2) is executed;

[0084] 8.2.2) Based on the attack phase matched by the relation edge (src, r, sink), set the target node sink tag value:

[0085] If (src, r, sink) matches the j-th stage of the attack rule, then set the target node's label value sink.step. jThe value is 1, and j = 1, 2, 3...6;

[0086] Otherwise, maintain the target node's label value sink.step. j The original value remains unchanged;

[0087] 8.3) Perform forward and reverse searches on the compressed source graph to extract the attack graph for the metaverse security boundary attack:

[0088] 8.3.1) Perform a reverse search on the compressed source map, that is, starting from the alarm signal, use the labels of each stage of the attack rules to guide the location of the intrusion point to traverse the compressed source map, and terminate the traversal process immediately once the intrusion point is found.

[0089] 8.3.1) Perform a forward search on the compressed source map again, that is, traverse the nodes that match other attack rules except for the intrusion point, and finally find the complete attack path.

[0090] The labels used in the above steps are for the purpose of more clearly describing the implementation of the present invention, and the order of their numbers is not limited.

[0091] The effects of the present invention will be further described below with reference to simulation experiments.

[0092] 1. Simulation experimental conditions:

[0093] The hardware platform for the simulation experiment of this invention is: Intel(R) Core(TM) i7-9700F processor with a main frequency of 3.00GHz and 16GB of memory.

[0094] The software platform for the simulation experiment of this invention is Windows 10 operating system and Python 3.8.

[0095] The sensing device used in the simulation experiment of this invention is PICO4.

[0096] 2. Simulation Experiment Content and Result Analysis:

[0097] Under the above experimental conditions, the method of this invention was used to perform metaverse threat event simulation in a real attack environment, resulting in a compressed source map and an attack map of metaverse security boundary attacks. The results are as follows: Figure 3 As shown, where:

[0098] Figure 3 (a) is a compressed traceability graph constructed based on system logs collected on user devices. In the graph, black nodes are file entities, dark gray nodes are process entities, light gray nodes are network entities, and nodes marked with wireframes are network space anchor points. The directed edges between nodes represent data flow and inter-node operations.

[0099] Figure 3(b) is the attack graph of the metaverse security boundary attack extracted from the compressed source map. The graph reconstructs the attack scenario of the metaverse security boundary attack, in which:

[0100] “S_192.168.31.168 / 9999” is a network entity.

[0101] The following are process entities: “P_D:Software\Python38\python.exe”, “P_C:Windows\System32\cmd.exe”, “P_C:Users\67139\Desktop\Boundary\Attack-master\Demo-Tools\Attack-console\myOpenVr.exe”, and “P_C:\ProgramFiles(x86)\Steam\steamapps\common\SteamVR\bin\win64\vrserver.exe”.

[0102] "F_C:\ProgramFiles(x86)\Steam\config\chaperone_info.vrchap" is a file entity.

[0103] “b9b04d3g_cd4f_c585_56cc_588293264f38” is a cyberspace anchor entity.

[0104] from Figure 3 As shown in (b), when python.exe connects to an untrusted IP address, it becomes vulnerable to attack. After communicating with the untrusted address, malicious programs can read and modify the boundary file chaperone_info.vrchap, and finally execute the process myOpenVr.exe to reload the modified boundary information from the disk, thus completing the attack.

[0105] from Figure 3 As can also be seen in (b), the present invention traced the attacker's IP address to 192.168.31.168 through the attack graph and detected the network space anchor entity that may be attacked as b9b04d3g_cd4f_c585_56cc_588293264f38.

[0106] Simulation results show that the present invention can detect the occurrence of attacks on the security boundary of the metaverse in real time and reconstruct the attack chain.

[0107] The above description is merely a specific example of the present invention and does not constitute any limitation on the present invention. Obviously, those skilled in the art, after understanding the content and principles of the present invention, may make various modifications and changes in form and details without departing from the principles and structure of the present invention. However, these modifications and changes based on the ideas of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A method for extrapolating metaverse network threat events, characterized in that, Includes the following steps: (1) Monitor changes in virtual resource parameters in the metaverse: The hash value of the boundary file is calculated using a hash algorithm, and the hash value corresponding to the initial boundary file set by the user when entering the metaverse virtual environment is recorded. While the user is immersed in the metaverse experience, the hash value of the boundary file at the current moment is continuously obtained, and it is determined whether the initial hash value of the boundary file is the same as the current hash value: If they are the same, it means the current virtual environment is secure, and monitoring should continue. If they are different, it means that the virtual boundary resources of the metaverse have been tampered with, and step (2) is executed. (2) In the metaverse virtual environment, issue a warning to the user about the current virtual boundary status, that is, use OpenGL to render a warning prompt pattern and use PyOpenVR to display it in the metaverse virtual environment to warn the user that the current virtual boundary has been maliciously tampered with; (3) Collect system log data on user devices, including the following: (3a) Configure the system audit strategy and collect system logs related to processes, files and network entities on the host connected to the sensing device; (3b) Run Winlogbeat to monitor the configured log sources. When a system log event that matches the configured filtering rules occurs, Winlogbeat retrieves the event from the operating system and sends it to the Kafka server. (3c) Start the Kafka server, connect the Kafka consumer application to the Kafka topic and read the log data; (4) Process the log data to construct a source graph: (4a) Parse the system log data, that is, parse it into three parts: a source entity, a target entity and the relationship between them; extract key information related to attack tracing from the log, including timestamps and event types; and establish the relationship between different log events. (4b) The parsed source entity and target entity are used as nodes in the source graph, and the relationship between entities is used as directed edges in the source graph to form the source graph; (5) Create network space anchor entities in the source map: Create cyberspace anchor entities in the source map. The attributes of the anchor entity include anchor ID, account, anchor permissions, anchor creation time, anchor type, anchor validity period, anchor coordinates, anchor gesture, and associated anchor ID. Associate each network space anchor with its unique corresponding metaverse application, find a process entity corresponding to that metaverse application in the source graph, and establish the relationship between network space anchor entities and process entities in the source graph. (6) Compress the source map: (6a) Merge the same interactive operations between nodes in the source graph. That is, for the same operation that occurs at different times between two nodes, only one operation information is retained in the source graph to obtain the merged compressed graph a. (6b) Remove a large number of benign nodes and relation edges that are not related to the attack from the merged compressed graph a to obtain the node-removed compressed graph b; (6c) Prune the weak dependencies in the compressed graph b to obtain the final compressed source graph; (7) Visualize the compressed source map in the Neo4j database; (8) Extract the attack graph from the compressed source graph: (8a) Establish attack rules, that is, define the attack phases and the entities involved in each attack phase, the related operation attributes, and the prerequisites that must be met to match the attack phase. (8b) Use attack rules to match multiple stages of the attack in the compressed source graph, and use the prerequisites in the attack rules to establish the connection between each attack stage. Set a label for each attack stage and pass the matched prerequisites through the label to avoid repeated traversal. (8c) Perform forward and reverse searches on the compressed source graph to extract the attack graph for the metaverse security boundary attack: The reverse search starts from the alarm signal, traverses the compressed source map, and uses the labels of each stage of the attack rules to guide the location of the intrusion point during the traversal. Once an intrusion point is found, the traversal process is terminated. The forward search involves traversing nodes that match other attack rules besides the intrusion point, ultimately finding the complete attack path.

2. The method according to claim 1, characterized in that, Step (1) uses a hash algorithm to calculate the hash value of the boundary file, including the following: (1a) Fill the file message so that the file length is congruent to 448 modulo 512, and obtain the filled file message; (1b) Append a 64-bit message length after the result value of (1a); (1c) Group the result values ​​of (1b) and obtain the hash value of each group according to the MD5 auxiliary function; (1d) Concatenate the hash values ​​of the obtained groups into a 512-bit hash value.

3. The method according to claim 1, characterized in that, In step (4a), the system log data is parsed into three parts: a source entity, a target entity, and the relationship between them. Key fields are extracted from the system log data, including source entity Id, target entity Id, source entity name, target entity name, event operation type, and timestamp. Among them, source entity Id and target entity Id are two unique entities, the event operation type indicates the edge relationship and data flow between the two entities, and the timestamp indicates the time attribute of the event operation.

4. The method according to claim 1, characterized in that, In step (6c), the weak dependencies in the compressed graph b are pruned by removing nodes. This is based on the fact that in the source graph, the information flow path between two entities represents the possible data transmission relationship between the entities. The strength of the information flow is determined by whether the entities in the information flow share a common ancestor node. If two entities share a common ancestor node, it means they are part of an attack campaign and there is a strong dependency between them; therefore, they should be preserved in the source graph. Otherwise, it means that the dependency between them is weak, and they should be pruned.

5. The method according to claim 1, characterized in that, Step (8a) defines the attack phases and the entities involved in each attack phase, the related operational attributes, and the prerequisites that must be met to match the attack phase. The entities involved in each of the six attack phases, namely initial penetration, establishing a foothold, privilege escalation, reading sensitive files, completing the objective, and deleting traces, are defined as follows: The initial penetration phase refers to the attacker making a remote connection, i.e. reading an untrusted IP address. The entities involved are process P and network S, the operation attribute is recvmsg, and the prerequisite is that S.ip is an untrusted IP address. The establishment of the base point phase refers to the stage after the system has been initially penetrated. The attacker uses CnC communication to attempt to communicate with the server and receive further instructions. The entities involved are process P and network S, and the operation attributes are sendmsg and recvmsg. The prerequisite is that the first attack phase matched by the process matches the label value P of any other attack phase. 1,* =1 and S.ip are untrusted IP addresses; The privilege escalation phase refers to the attacker using root privileges to execute malicious code written locally in order to gain more operational privileges. The entities involved are process P and file F, the operation attribute is exec, and the prerequisite is that user U = root privileges and the first attack phase label value P.step1 = 1 matched with the process. The sensitive file reading stage refers to a process that matches other attack stages reading a file in the whitelist. The entities involved are process P and file F, the operation attribute is read, and the prerequisite is that F is a sensitive file and the first attack stage label value P.step1=1 or the second attack stage label value P.step2=1 matched by the process. The target completion stage refers to the attacker executing a specific system instruction, using a malicious process to spawn other processes to submit malicious operations for execution. The entity involved is process P, the operation attributes are fork and exec, and the prerequisite is that P belongs to a sensitive system instruction, and the first attack stage label value P.step1=1 or the second attack stage label value P.step2=1 matched with the process. The "trace removal phase" refers to the attacker clearing malicious code downloaded to the local machine. This involves process P and file F, with the operation attribute being "unlink." A prerequisite is that the process matches the tag values ​​P.step of the first and second attack phases. 1,2 =1.

6. The method according to claim 1, characterized in that, Step (8b) uses attack rules to match multiple stages of the attack in the compressed source graph. This involves traversing each attack stage described in step (8a) and determining the relation edges in the source graph. Does it meet the operational attributes and prerequisites defined for a certain attack phase? If the relation edge If the operational attributes and prerequisites defined for a certain attack phase are satisfied, then the relation edge matches that attack phase. Otherwise, the relationship edge It does not match any attack phase.

7. The method according to claim 1, characterized in that, In step (8b), the matched prerequisites are passed via label passing, including the following: (8b1) Based on the relation edges in the source graph Set the target node Inherited source node Tag value: If the source node Tag value at a certain stage of an attack If the value is 1, then the target node will be... Tag value during this attack phase Set the value to 1, i = 1, 2, 3... 6, and execute step (8b2); Otherwise, the label value of the target node Keep the original value unchanged and proceed to step (8b2). (8b2) Based on relation edges In the matched attack phase, set the target node. Tag value: if The first match of the attack rule In each stage, the label value of the target node is set. The value is 1, and j = 1, 2, 3... 6; Otherwise, the label value of the target node Keep the original value unchanged.

Images