Attack profile-based network attack prediction method and system

Abstract

This invention relates to the field of network information security technology, and in particular to a network attack prediction method and system based on attack profiles. By parsing system logs, a temporal attack knowledge graph is constructed to describe entities, relationships, and time information related to threat attack behaviors. Based on the temporal attack knowledge graph and the behavioral logic of both attackers and defenders, an attack profile is generated, describing the tactical attack chain and attack steps adopted by the attacker. The most likely attack trajectory of the attacker is obtained from the attack profile, and the attacker's next attack tactics and specific attack behaviors are predicted based on historical tactical sequences to guide the defender's deployment of defensive actions. This invention combines various machine learning models to enhance the ability to construct temporal attack knowledge graphs from system logs, and combines real-world attack tactics to predict and judge the next attack event of the relevant attacker, guiding the deployment and implementation of defensive actions based on the prediction results, thereby improving network information security.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to a network attack prediction method and system based on attack profiles. Background Technology

[0002] Preventing cyberattacks is central to cybersecurity research and practice. Significant successes have been achieved in attack detection and collaborative defense after a cyberattack, such as with Intrusion Detection Systems (IDS), honeypots, and MITRE D3FEND. However, detection methods cannot prevent damage already incurred by the time a cyberattack occurs; therefore, the ability to accurately predict cyberattacks is highly desirable for researchers. Attack prediction has long been an open problem, but recent advances in machine learning have greatly enhanced its predictability. Early predictive cases included attack prediction and attack intent identification, both closely linked to intrusion detection, tasked with predicting the attacker's next move and ultimate goal (in an observed attack). In practice, similar methods can be applied interchangeably to these two tasks. More recent attack prediction relies on data mining, automatically generating attack patterns from IDS alert sequences to predict attacks, while recurrent neural networks are used to explore the possibilities of cyberattack prediction. It is noteworthy that existing work largely focuses on the analysis of attack patterns, with little attention paid to adapting to complex and intelligent attacks. Subsequently, attack prediction techniques evolved into intrusion prediction, which does not require observation of prior activities. Its aim is to predict an attack before it actually occurs, without focusing on the continuity of a series of observed events. The emergence and development of methods such as Hidden Markov models, Bayesian networks, and machine learning have made it possible to predict potential security threats (and possible countermeasures). In this case, knowledge of potential events can be inferred without sufficient prior information, inferring the probability of future attacks based on given sources. However, how to predict specific attack types remains unclear, although this capability is crucial for defensive strategy deployment. Recently, cybersecurity situation prediction has become dominant in Cyberspace Situation Awareness (CSA) or Network Security Situation Awareness (NSSA) scenarios. It predicts the overall security status of the network (macro perspective), i.e., the possible changes in the number of attacks or vulnerabilities in the network, rather than individual potential attacks (micro perspective). In this case, quantitative analysis is often used to describe the cybersecurity status at a certain point in time and predict the resulting values ​​into the future. Its technical focus is on the expected number of attacks detected within a future time interval, without information about the exact nature of future attacks.

[0003] Therefore, the following problems still exist in the existing network attack prediction: (1) it is impossible to clearly depict his / her tactical path from the attacker's past behavior; (2) it is impossible to predict the specific attack techniques that the attacker will take next in order to guide the deployment of defense strategies. Summary of the Invention

[0004] To address this, the present invention provides a network attack prediction method and system based on attack profiles, which solves the problem in the prior art that it is impossible to clearly depict the tactical path from the attacker's past behavior and to predict the specific attack techniques that the attacker will take next. By analyzing the attack profile, the method predicts the attacker's next attack strategy to guide the deployment and implementation of defenses.

[0005] According to the design scheme provided by the present invention, a network attack prediction method based on attack profiles is provided, comprising:

[0006] Analyze system logs and construct a time-series attack knowledge graph based on the system logs to describe entities, relationships, and time information related to threat attack behavior;

[0007] An attack profile is generated based on a temporal attack knowledge graph and the behavioral logic of both the attacker and the defender. The attack profile is used to describe the tactical attack chain and attack steps adopted by the attacker.

[0008] Based on the attack profile, the attacker's most likely attack trajectory is obtained, and based on the historical tactical sequence, the attacker's next attack tactics and specific attack behaviors are predicted to guide the defender in deploying defensive actions.

[0009] As a network attack prediction method based on attack profiles in this invention, a temporal attack knowledge graph is further constructed based on entity, relationship, and time information related to threat attack behavior in system logs, including:

[0010] First, the system logs are parsed using log analysis tools, and the meta-information used to construct the knowledge graph is obtained from the system logs. The meta-information includes: recorded events, number of events, target files marked as malware, number of processes contained in the target files, and process name, process ID and event list of each process. Each event also includes time attribute, event id attribute, string id attribute, action attribute and target attribute.

[0011] Then, a knowledge graph of temporal attacks is constructed based on the metadata.

[0012] As a network attack prediction method based on attack profiles in this invention, further, the attack profile is generated based on a temporal attack knowledge graph and according to the behavioral logic of both the attacker and defender, including:

[0013] First, a pre-trained BERT model is used to map threat attack behavior entities in the temporal attack knowledge graph to attack tactics in a pre-set public adversarial tactical technology knowledge base, and an attack tactic label is assigned to each threat attack behavior entity in the knowledge graph.

[0014] Then, attack tactics are used to filter the attacker's attack trajectory, and an attack profile is constructed according to the logical relationship of the attack trajectory in the attack tactics.

[0015] As a network attack prediction method based on attack profiles in this invention, the threat attack behavior entities in the attack tactics mapped to the pre-set public adversarial tactical and technical knowledge base in the temporal attack knowledge graph include: target object threat behavior, software and hardware threat platforms for program code execution, and target object family names.

[0016] As a network attack prediction method based on attack profiles in this invention, further, obtaining the attacker's most likely attack trajectory based on the attack profile includes:

[0017] First, based on the attack profile and using the SAC algorithm, a problem space is constructed that includes an attack action space, a state space, and a reward function. The attack action space is all possible attack actions that the attacker can perform from the current node based on the attack profile. The state space represents the execution position of the attack trajectory in the attack profile. The reward function is used to evaluate the attacker's actions to determine the attack trajectory.

[0018] Then, based on the preset objective function, the problem space is iteratively solved by maximizing the attack benefit, and the most likely attack trajectory of the attacker is obtained based on the solution results.

[0019] As a network attack prediction method based on attack profiles in this invention, further, the problem space is iteratively solved by maximizing attack gains based on a preset objective function, including: first, sampling the action at the current time point t from the attacker's attack trajectory candidate strategy, and changing the action environment state from s t Switch to s t+1 The transition experience during the transition is stored in the replay buffer; then, in each iteration gradient, the parameters θ, policy weights φ, and temperature α in the preset objective function are updated to obtain the optimal strategy for the attacker's attack trajectory by maximizing the attack benefit.

[0020] As a network attack prediction method based on attack profiles in this invention, the preset objective function is further expressed as: Where π represents the attacker's candidate attack trajectory strategy, π * Let r() be the optimal strategy to be solved, γ be the reward function, and s be the discount rate. t Let a be the state at time t. t Action at time t; Tπ Let H(π) be the trajectory distribution caused by the candidate policy π, α be the temperature network parameter used to determine the relative importance of the entropy term and the reward, and H(π(.|s) be the trajectory distribution caused by the candidate policy π. t )) represents the policy π in state s t The entropy value.

[0021] As a network attack prediction method based on attack profiles in this invention, further, predicting the attacker's subsequent attack tactics and specific attack behaviors based on historical tactical sequences includes:

[0022] First, obtain the log threat sequence from the attacker's most likely attack trajectory;

[0023] Then, the log threat sequence is fed into a pre-trained Transformer model, which is used to predict the attacker's next attack tactics and specific attack behaviors.

[0024] As a network attack prediction method based on attack profiles in this invention, the Transformer model is further used to predict the attacker's next attack tactics and specific attack behaviors. This includes: encoding the meaning of the log threat sequence using a model embedding layer; encoding the position of the sequential information representing the time series in the sequence using a position encoding layer; adding the meaning encoding result and the position encoding result and inputting them into a model encoder layer; compressing the key information of the sequence into a fixed-length vector using the model encoder layer; and converting the fixed-length vector into the model output through a model decoder layer. The model encoder layer consists of M encoders with the same structure stacked together. Each encoder uses a multi-head attention mechanism to focus on different representation sequence subspace information and transforms the dimensionality of the subspace information through a fully connected layer. Two multi-head attention mechanisms are set in the model decoder layer to fuse historical tactical sequences during prediction.

[0025] Furthermore, the present invention also provides a network attack prediction system based on attack profiles, comprising: a graph construction module, a profile generation module, and an attack prediction module, wherein,

[0026] The graph construction module is used to parse system logs and build a time-series attack knowledge graph based on the system logs to describe the entities, relationships and time information related to threat attack behavior.

[0027] The profile generation module is used to generate attack profiles based on a temporal attack knowledge graph and according to the behavioral logic of both the attacker and the defender. The attack profiles are used to describe the tactical attack chain and attack steps adopted by the attacker.

[0028] The attack prediction module is used to obtain the most likely attack trajectory of the attacker based on the attack profile, and to predict the attacker's next attack tactics and specific attack behaviors based on historical tactical sequences, so as to guide the defender to deploy defensive behaviors.

[0029] The beneficial effects of this invention are:

[0030] This invention constructs a Temporal Attack Knowledge Graph (TAKG) from real-time system logs detailing operating system and user activities. The TAKG is used to identify attack-related entities and relationships, while integrating temporal information from the logs. Attack profiles are generated based on the logical relationships between attack tactics and the Tactic-based Cyber ​​Kill Chain (TCKC). These profiles are used to identify the most probable attack trajectories, and historical tactical sequences are used to predict the attacker's next attack tactics and specific actions, guiding defensive actions. Furthermore, various machine learning models are incorporated to enhance the ability to construct the TAKG from system logs, considering real-world attack tactics to predict and assess the likelihood of future attacks. The predictions guide defensive deployment and improve network security. Attached image description:

[0031] Figure 1 This is a schematic diagram of the network attack prediction process based on attack profiles in the embodiment;

[0032] Figure 2 This is a schematic diagram illustrating the principle of the composite learning framework for predicting attacks based on attack profiles in the embodiment.

[0033] Figure 3 This is a schematic diagram of the TAKG knowledge graph structure for temporal attacks in the embodiment;

[0034] Figure 4 The TAKG subgraph is illustrated as an example in the embodiment;

[0035] Figure 5 This is a schematic diagram of the entity structure labeled "Threat" in the embodiment;

[0036] Figure 6 This is a schematic diagram of the Tactical Kill Chain (TCKC) model in the embodiment;

[0037] Figure 7 This example illustrates the log relationship in the embodiment.

[0038] Figure 8 This example illustrates a tactical-level attack profile in the embodiment.

[0039] Figure 9 This is a schematic diagram illustrating the process of reasoning about tactical paths and attack trajectories based on the SAC algorithm in the embodiment.

[0040] Figure 10 This example illustrates the most likely attack trajectory in the embodiment.

[0041] Figure 11 This is a schematic diagram of the Transformer model structure used for attack prediction in the embodiment;

[0042] Figure 12 This is a schematic diagram of the self-attention mechanism structure in the embodiment. Detailed implementation method:

[0043] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0044] Discrete attack data, when correlated, can form attack knowledge, describing the entities related to the attack and the relationships between them. Supported by this attack knowledge, the tactical attack chains and detailed attack steps employed by the attacker can be discovered, creating an attack profile. By extracting the most probable attack trajectory from the attack profile, the specific attack techniques the attacker is about to employ can be predicted. An attack profile represents the attacker's recent behavioral characteristics, while attack prediction represents the process of predicting the specific action sequence taken by the attacker and the specific attack steps. A tactical path is the sequence of tactics employed by the attacker. For example, an attacker might use "Initial Access" to enter the network, "Execution" to run malicious code, "Defense Evasion" to avoid detection, "Persistence" to maintain a foothold, "Impact" to manipulate the system, and finally "Exfiltration" to steal target data. All tactical paths can be obtained using the Tactic-based Cyber ​​Kill Chain (TCKC) model, which describes the logical relationships between tactics within the TCKC model. Considering the logic of the attack and the preconditions for tactical execution, any tactical path conforms to a tactical attack chain. More specifically, an attack trajectory can be found by considering all the attacker's specific actions along the tactical path. For example, an attacker might "Execute" a missing or insecure ".dll" or ".drv" file to trick a running system into executing a malicious payload, "Create" an executable file on the affected computer, and "Modify" registry information to add themselves to the list of applications authorized to access the internet, allowing them to quietly download and install other programs without consent.

[0045] In attack prediction, the input data consists of consecutive threats in attack tracks marked "Threat" by Kaspersky in the logs. The prediction result is a specific threat "threat" claimed in Kaspersky's threat database. The specific attack technique used by the threat is determined by comparing the threat details in the corresponding log files with the description of the attack technique in MITRE ATT&CK. See also Figure 2 As shown, CL-AP 2 In this framework, the attack profiling stage is viewed as generating attack profiles by processing attack-related data, and the attack prediction stage is viewed as predicting specific attacks to guide defensive actions. This is based on building a temporal attack knowledge graph from system logs. Referring to knowledge integrated into the TAKG, and utilizing the logical relationships between MITRE ATT&CK tactics, attack profiles are generated by removing attack trajectories from the TAKG that do not conform to the tactical attack chain. Then, the Soft Actor-Critic algorithm is used to find attack trajectories with high attack gains. Finally, the Transformer model predicts upcoming threats and, based on this, predicts specific attack techniques to meet the needs of defense guidance.

[0046] Based on the above theoretical framework, the embodiments of the present invention are described below. Figure 1 As shown, a network attack prediction method based on attack profiles is provided, which includes the following:

[0047] S101. Parse the system logs and construct a time-series attack knowledge graph based on the system logs to describe the entities, relationships, and time information related to threat attack behavior.

[0048] Specifically, firstly, system logs can be parsed using log analysis tools to obtain metadata for constructing a knowledge graph. This metadata includes: recorded events, the number of events, target files marked as malware types, the number of processes contained in the target files, and the process name, process ID, and event list corresponding to each process. Each event also includes time attributes, event ID attributes, string ID attributes, action attributes, and target attributes. Then, a time-series attack knowledge graph can be constructed based on the metadata.

[0049] Knowledge graphs have become a powerful tool in cybersecurity applications, possessing the ability to aggregate, represent, manage, and reason about knowledge. They constitute a large-scale security semantic network, providing intuitive modeling for various attack and defense scenarios in the real world.

[0050] It is important to note that existing attack knowledge graphs are mostly learned from triples that lack temporal awareness, while temporal information is an important but overlooked factor. In this embodiment, a Temporal Attack Knowledge Graph (TAKG) is constructed, integrating attack-related entities, relationships, and temporal information from logs. The logs record detailed information about the operating system and user activity.

[0051] System log files contain metadata such as the time of recording and the number of events: a file contains 1 to m processes, each with a process name "name", process ID "pid", and a corresponding list of events. An event is the smallest unit, with the following attributes: time "time", event ID "event_id", string ID "string_id", action "action", and target "target". Each file is tagged with the malware type detected by Kaspersky, and log parsing can be performed using a pre-trained sequence-to-sequence NERLogParser model. Figure 3 The TAKG diagram shown illustrates how nodes represent entities and edges represent different types of relationships. "Log" is the name of the log file, and the threats it carries are flagged as "Threat" by Kaspersky.

[0052] "AlertScore" represents the alert level obtained after scraping the Microsoft Threat Wiki website. If "Threat" is a perfect match, a value is assigned directly based on the alert levels found; otherwise, the average of the alert levels from the search results is used. Depending on the alert level, "AlertScore" can be categorized as Low / Medium / High / Severe: 2 / 4 / 8 / 10. The log file contains a process that, starting at a time, executes an action targeting a specific target. This action can also enable sub-processes to aid in the attack.

[0053] like Figure 4 The TAKG subgraph shown has "Log" (purple), "cuckoo_.." marked as "Threat" (red), "Trojan-D.." marked as "Trojan-D..", and "AlertScore" (blue) as "10". The log contains multiple "Processes" (yellow) and "Sub-processes" (yellow) that operate on the "Target" (light blue) "[temp]\1..", executing a series of "Actions" (green) at different "Times" (orange) to achieve the threat behavior. This data has been anonymized to protect privacy.

[0054] S102. Generate an attack profile based on a temporal attack knowledge graph and according to the behavioral logic of both the attacker and the defender, wherein the attack profile is used to describe the tactical attack chain and attack steps adopted by the attacker.

[0055] Specifically, the design can include the following: First, using a pre-trained BERT model, threat attack behavior entities in the temporal attack knowledge graph are mapped to attack tactics in a pre-set public adversarial tactical technology knowledge base, assigning an attack tactic label to each threat attack behavior entity in the knowledge graph. Then, attack tactics are used to filter attacker trajectories, and attack profiles are constructed according to the logical relationships of the attack trajectories within the attack tactics. Threat attack behavior entities can include: the target's threat behavior, the software and hardware threat platform executing the program code, and the target's family name.

[0056] The original TAKG involves time information of all attack behaviors recorded in the log file, many of which do not conform to the tactical logic of the attack. For example, some "Persistence" actions are performed without prior privilege escalation.

[0057] Directly referencing the original TAKG can easily introduce unnecessary biases when predicting attacker behavior. Furthermore, the original TAKG, as a graphical representation of a large number of data items in a file, may be overly complex. Therefore, the original TAKG should be "simplified" to accurately describe attacker behavior.

[0058] MITRE ATT&CK tactics excel at devising realistic attack campaigns; the CL-AP implementation scheme in this case demonstrates this. 2 Attack profiles can be generated by deleting attack trajectories in TAKG that do not conform to the tactical attack chain. The main focus is on the time sequence of the logs and the relationship between the attack tactics corresponding to the "Threat" entity in TAKG.

[0059] MITRE ATT&CK is a knowledge framework for addressing cyberattacks against organizations, encompassing detailed information about such attacks. Attack tactics, as shown in Table 1, represent the adversary's short-term tactical objectives, helping to filter attack trajectories and construct attack profiles based on their logical relationships. For threat classification, the primary task here is to map "Threat" behaviors in TAKG to corresponding attack tactics in ATT&CK.

[0060] Table 1: Description of MITRE ATT&CK Attack Tactics

[0061]

[0062]

[0063] A threat typically consists of three parts: behavior, platform, and name.

[0064] The behavior specifies the actions of the detected object. For "Viruses" and "Worms," ​​the behavior is selected based on the propagation method used. For "Trojans" and "Malicious Tools," the behavior is selected based on the type of malicious payload. For "Suspicious Packers," the behavior is selected based on the packer's actions. For "Adware," "Riskware," and "Pornware," the behavior is selected based on the functionality of the detected object.

[0065] A platform is the environment in which program code executes. This can refer to both software and hardware. For a detection target that can run on multiple platforms, the platform is defined as "Multi". There are two platforms that support heuristic analyzers: "Win32" and "Script" (a general-purpose platform for various scripts). The "Win32" platform is used for the proactive defense module.

[0066] The name is the formal name given to the object being detected; it defines the family of objects being detected. A family refers to a group of objects that share the same origin (author, source code), operating principle, or payload. For example, malware in the "Trojan.Win32.StartPage" family can change the start page of an internet browser.

[0067] Taking "Trojan.Win32.Vobfus" as an example, it uses malicious code to damage, block, modify, or copy data, or disrupt the operation of a computer or network. This malware uses obfuscation techniques coded in Visual Basic, a notable characteristic of this family. Code obfuscation complicates antivirus software's attempts to analyze suspicious malware. Based on the aforementioned behavior of the threat "Trojan.Win32.Vobfus," and according to the tactical descriptions in Table 1, this threat can be mapped to the "Defense Evasion" and "Impact" tactics.

[0068] There are approximately one thousand known threats, making manual labeling impossible. Inspired by recent advances in Natural Language Processing (NLP), BERT (Bidirectional Encoder Representations from Transformers) is applied to Multi-Label Text Classification (MLTC) tasks. Therefore, in this embodiment, a pre-trained BERT model is used to assign attack policy labels to each threat. During pre-training, the model is trained on unlabeled data in different pre-training tasks; during fine-tuning, the BERT model is first initialized with pre-trained parameters, and then all parameters are fine-tuned using labeled data from downstream tasks.

[0069] The BERT model was fine-tuned using 500 manually labeled threats to identify the remaining threats, and the corresponding attack tactics were added to the TAKG as an attribute of "Threat". Figure 5 As shown, the “Trojan-Downloader.Win32.Genome” threat is mapped to several tactics, including “Execution”, “DefenseEvasion”, and “Discovery” as “ATT&CK Tactics” attributes.

[0070] ATT&CK categorizes attackers' tactics, techniques, and procedures (TTPs), which attackers can execute to achieve their goals. To understand attack patterns and identify potential attack paths, attack profiles are constructed by considering the temporal relationships in logs and removing attack paths from TAKG that do not conform to the tactical attack chain.

[0071] By evaluating the behavior of various attack groups, a tactic-based cyber kill chain (TCKC) model can be constructed to highlight the logical relationship between ATT & CK tactics. Figure 5 The tactics used by the attackers are visualized, but several attack tactics that are difficult to detect and do not affect the overall tactical path are omitted, such as "Reconnaissance", "Resource Development" and "Collection".

[0072] In order to discover the tactical path of the attack, log entries that do not conform to TCKC are deleted, taking into account the time sequence of the logs. Figure 7An example of the relationship between logs is given, where the text under each node represents the attack tactic corresponding to the threat "Threat". The data has been anonymized, and for ease of reading, individual logs are represented by numbers. Here, 1) nodes represent logs, and 2) edges represent how head nodes can be linked to tail nodes through a series of actions. The head node's log always starts earlier than the tail node's log.

[0073] Attack profiles are generated by examining the "ATT&CK Tactics" attribute marked "Threat" in the logs and the temporal relationships between them. After analyzing the preconditions and postconditions in the logs, attack tracks that do not conform to TCKC can be eliminated, such as... Figure 8 As described. Note that some logs contain multiple tactics, thus requiring further analysis. For example, although "Log 3" is mapped to both "Execution" and "Defense Evasion," based on the premise that "Log 1" is mapped to "InitialAccess," "Log 3" can only be "Execution"; "Log 6" and "Log 7" do not conform to the tactical logic based on TCKC, so their subsequent actions are also removed.

[0074] After removing all attack tracks that do not conform to TCKC, the remaining graph can be considered an attack profile. More detailed attack behavior can be obtained by expanding the log entities to create a more specific graph, including all log-related entities. The attack profile shows the tactical attack chain and detailed attack steps employed by the attacker, thereby predicting the specific attack techniques the attacker will employ next.

[0075] S103. Obtain the attacker's most likely attack trajectory based on the attack profile, and predict the attacker's next attack tactics and specific attack behaviors based on historical tactical sequences, so as to guide the defender in deploying defensive actions.

[0076] The Soft Actor-Critic (SAC) algorithm is used to find tactical paths and attack trajectories; the Transformer model is used to predict upcoming threats, and then the specific attack techniques to be used next are determined by referring to MITRE ATT&CK.

[0077] The process of obtaining the attacker's most likely attack trajectory based on the attack profile can be designed to include the following: First, based on the attack profile and using the SAC algorithm, a problem space is constructed, which includes an attack action space, a state space, and a reward function. The attack action space represents all possible attack actions that the attacker can perform from the current node based on the attack profile. The state space represents the execution position of the attack trajectory in the attack profile. The reward function is used to evaluate the attacker's actions to determine the attack trajectory. Then, based on a preset objective function, the problem space is iteratively solved by maximizing the attack reward. The most likely attack trajectory of the attacker is obtained based on the solution results.

[0078] like Figure 9 As shown, by defining the problem space, namely the action space, state space, and reward function, we describe the definition of the problem space and the problem-solving process, which is a prerequisite for deriving tactical paths and attack trajectories.

[0079] Action space A is determined based on all actions that can be performed from the current node in the attack profile, including every possible attack action a at time t. t The state space S includes the observation's current position in the attack profile, where s t ∈{0,1}: 0 / 1 represents not reaching a leaf node / reaching a leaf node. The target state in the state space S is s. t =1, meaning all nodes are executed along possible attack paths. The reward function r evaluates the action to find possible attack paths: (1) the alert score of the log of the action, (2) the number of paths n discovered from the current node, and (3) the importance of the target. Therefore, the reward function r can be expressed as:

[0080] r = score × n × importance (1)

[0081] The importance can be assigned by the type of target. Taking the target types in Windows as an example, as shown in Table 2. For example, if "Startup" is attacked, it may cause malicious files to start along with the system on the personal computer, thus causing significant damage to the personal computer. Therefore, its importance can be set to 10.

[0082] Table 2: Importance Allocation for Different Target Types (using Windows System as an Example)

[0083]

[0084]

[0085] Based on a pre-defined objective function, the problem space is iteratively solved by maximizing the attack benefit. Specifically, this may include: first, sampling the action at the current time t from the attacker's attack trajectory candidate strategies, and then changing the action environment state from s... t Switch to s t+1 The transition experience during the transition is stored in the replay buffer; then, in each iteration gradient, the parameters θ, policy weights φ, and temperature α in the preset objective function are updated to obtain the optimal strategy for the attacker's attack trajectory by maximizing the attack benefit.

[0086] SAC operates in the problem space, finding the most probable attack trajectory (i.e., problem solution) by maximizing the attack reward objective function (Equation 2). In this context, the optimal policy, state-value function, Q-network, policy network, and temperature network can be described as follows:

[0087] 1. Optimal Strategy. The problem of finding the optimal strategy can be formulated as: maximizing the maximum entropy objective using SAC.

[0088]

[0089] Where π is a candidate strategy, π * The best strategy to be derived; It is the reward function, γ∈[0,1] is the discount rate, and s t ∈S is the state at time point t, a t ∈A is the action at time point t; T π The trajectory distribution is caused by strategy π; α determines the relative importance of the entropy term and the reward, and is called the temperature parameter; H(π(.|s t )) is the policy π in state s t Entropy value: H(π(.|s t ))=-logπ(.|s t ).

[0090] 2. State-Value Function. To maximize the objective, the state-value function of policy π can be defined as:

[0091] V(s t ):=π(s t ) T [Q(s t )-αlog(π(s t (3)

[0092] 3. Q-Networks. Two Q-networks are then trained separately based on the Q-function, and the minimum of the two outputs is applied. This is done to avoid overestimating the state values ​​and to minimize the Bellman residuals, thus potentially improving the resulting policy.

[0093]

[0094] Where D is the buffer for replaying past experiences; It is the Monte Carlo estimate of Equation 4 after using the target network of Q and sampling experience from D.

[0095] 4. Policy Network. The objective policy can be improved by maximizing rewards. The Q-function guides any changes to the policy with the new policy objective.

[0096]

[0097] Among them, strategy π φ (s t Using a neural network with parameter φ, an accurate action distribution is provided to directly derive the expectation.

[0098] 5. Temperature network. The variance of temperature loss estimation can be reduced by learning the temperature (it does not need to be set as a hyperparameter):

[0099]

[0100] in It is a constant vector representing the hyperparameters of the target entropy.

[0101] In general, training in each iteration consists of two steps: 1) sampling action a from policy π. t Transitioning state s from the environment t →s t+1 1) Store the transition in the replay buffer D; 2) For each gradient step, update the Q function parameters θ, policy weights φ, and temperature α to optimize the parameters.

[0102] The most probable tactical paths and attack trajectories can be determined after training the SAC model. The former and the latter can also be viewed as tactical sequences and optimal policy sequences based on log threats within the attack trajectory, respectively. The most probable attack trajectory is the one with the highest rolling plot score, while those with scores greater than 0.95 will be further analyzed.

[0103] Predicting an attacker's next attack tactics and specific attack behaviors based on historical tactical sequences can include the following: First, obtaining log threat sequences from the attacker's most likely attack trajectory; then, inputting the log threat sequences into a pre-trained Transformer model to predict the attacker's next attack tactics and specific attack behaviors. The model embedding layer encodes the meaning of the log threat sequences, and the positional encoding layer encodes the positional information representing the time series within the sequences. The meaning encoding result and the positional encoding result are added and input into the model encoder layer. The model encoder layer compresses the key information of the sequence into a fixed-length vector, and the model decoder layer converts the fixed-length vector into the model output. The model encoder layer consists of M stacked encoders with identical structures. Each encoder uses a multi-head attention mechanism to focus on different representation sequence subspace information and transforms the dimensionality of the subspace information through a fully connected layer. Two multi-head attention mechanisms are set in the model decoder layer to fuse historical tactical sequences during prediction.

[0104] The attacker's next tactic can be predicted based on the tactical path, and the specific attack techniques can be further analyzed based on the threats predicted by the Transformer model.

[0105] Figure 10 This example illustrates a most probable attack trajectory (details such as time, behavior, and target are hidden for simplicity). Nodes represent logs with corresponding tactics, and leaf nodes represent the latest tactic employed by the attacker. Based on the current tactic "Impact" of the leaf node, the next attack step is either "Defense Evasion" or "Exfiltration" by examining the tactical relationships in TCKC. If the leaf node's tactic is "Exfiltration," it means the attacker has completed the attack, and an attack prediction should be made for the next attack trajectory. When multiple tactics coexist, it is necessary to further predict the specific tactics the attacker might implement and the attack techniques they might utilize. The prediction of specific attack techniques can be treated as a time series prediction problem, implemented using a Transformer model for attack prediction, with input data being the threat sequence x1, x2, ..., x in the logs of the attack trajectory. T Finally, the model outputs an upcoming threat as a prediction of the attacker's next move, such as... Figure 11 As shown, threat shifting is achieved by predicting threats based on historical threats in attack logs. This Transformer model can be described as follows:

[0106] Embedding: This layer incorporates the threat sequence from the attack trail logs. The input is an embedding layer, and the d-dimensional embedding layer outputs a matrix through a fully connected network.

[0107] Positional encoding: To represent the sequential information in a time series, sine and cosine functions of different frequencies are used to encode positional information.

[0108] PE (t,2s) =sin(t / 10000) 2s / d )

[0109] PE (t,2s+1) =cos(t / 10000) 2s / d (7)

[0110] Where 1≤2s≤d, the position encoding information is: Then, the embedding and position encoding are added together and input into the encoder layer.

[0111] Encoder-decoder: The encoder compresses key information from the input sequence into a fixed-length vector, and the decoder then converts it into an output.

[0112] Encoder section, such as Figure 11 As shown on the left, it consists of M identical encoders stacked together. Each layer comprises two sub-layers: a multi-head attention layer and a fully connected neural network layer. Residual connections (Add) and normalization (Norm) are used in each sub-layer to improve performance.

[0113] Decoder section, such as Figure 11 As shown on the right, it includes two multi-head self-attention layers. Because all inputs are observed historical data with no future information, a masked attention mechanism is not used.

[0114] Among them, self-attention mechanism, such as Figure 12 As shown:

[0115]

[0116] in, and These are the query, key-value, and value matrix, which are three different outputs obtained by linearly transforming the input through a self-attention mechanism.

[0117] In multi-head attention, the outputs of all attention functions are concatenated through a linear layer of multi-head attention to produce the final result. The formula for multi-head attention is as follows:

[0118] MultiHead(Q,K,V)=Concat(head1,head2,...,head h W o

[0119] head i =Attention(QW i Q ,KW i K VW i V (9)

[0120] Where i = 1,...,h, W i Q W i K W i V and W o These are the weights of the corresponding network.

[0121] Multi-head attention mechanisms allow models to jointly attend to information from different representation subspaces at different locations, which is superior to single self-attention mechanisms.

[0122] After anticipating an impending threat, specific attack techniques can be matched by examining the description of the attack techniques against the details of the threat. MITRE ATT&CK summarizes the techniques and sub-techniques attackers use to implement their tactics, while MITRE D3FEND provides a methodological model for countering common attack techniques, outlining how defensive techniques affect an actor's ability to succeed, serving as a guide for defensive actions. (This is followed by a continuation of the CL-AP documentation.) 2 During the attack prediction phase, it is possible to predict the specific attack techniques that the attacker will use next, and provide defense guidelines against those attack techniques based on D3FEND.

[0123] In summary, the CL-AP implementation in this case... 2 It can effectively reveal the tactical paths taken by attackers and form a complete attack profile; it can effectively predict the specific attack techniques of attackers and provide defense guidance for predicted attacks using MITRE D3FEND.

[0124] Furthermore, based on the above method, this embodiment of the invention also provides a network attack prediction system based on attack profiles, comprising: a map construction module, a profile generation module, and an attack prediction module, wherein...

[0125] The graph construction module is used to parse system logs and build a time-series attack knowledge graph based on the system logs to describe the entities, relationships and time information related to threat attack behavior.

[0126] The profile generation module is used to generate attack profiles based on a temporal attack knowledge graph and according to the behavioral logic of both the attacker and the defender. The attack profiles are used to describe the tactical attack chain and attack steps adopted by the attacker.

[0127] The attack prediction module is used to obtain the most likely attack trajectory of the attacker based on the attack profile, and to predict the attacker's next attack tactics and specific attack behaviors based on historical tactical sequences, so as to guide the defender to deploy defensive behaviors.

[0128] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0129] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0130] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0131] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0132] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A network attack prediction method based on attack profiles, characterized in that, Include: Analyze system logs and construct a time-series attack knowledge graph based on the system logs to describe entities, relationships, and time information related to threat attack behavior; A pre-trained BERT model is used to map threat attack behavior entities in a temporal attack knowledge graph to attack tactics in a pre-set public adversarial tactical technology knowledge base, and an attack tactic label is assigned to each threat attack behavior entity in the knowledge graph. Attack tactics are used to filter the attacker's attack trajectory, and an attack profile is constructed according to the logical relationship of the attack trajectory in the attack tactics. The threat attack behavior entity includes: the target object's threat behavior, the software and hardware threat platform for program code execution, and the target object's family name. The attack profile is used to describe the tactical attack chain and attack steps taken by the attacker. Based on the attack profile, the most likely attack trajectory of the attacker is obtained, and the log threat sequence in the most likely attack trajectory is obtained. The log threat sequence is input into a pre-trained Transformer model, and the Transformer model is used to predict the attacker's next attack tactics and specific attack behaviors to guide the defender in deploying defense behaviors.

2. The network attack prediction method based on attack profiles according to claim 1, characterized in that, A temporal attack knowledge graph is constructed based on entity, relationship, and time information related to threat attack behavior in system logs, including: First, the system logs are parsed using log analysis tools, and the meta-information used to construct the knowledge graph is obtained from the system logs. The meta-information includes: recorded events, number of events, target files marked as malware, number of processes contained in the target files, and process name, process ID and event list of each process. Each event also includes time attribute, event id attribute, string id attribute, action attribute and target attribute. Then, a knowledge graph of temporal attacks is constructed based on the metadata.

3. The network attack prediction method based on attack profiles according to claim 1, characterized in that, Based on the attack profile, obtain the attacker's most likely attack trajectory, including: First, based on the attack profile and using the SAC algorithm, a problem space is constructed that includes an attack action space, a state space, and a reward function. The attack action space is all possible attack actions that the attacker can perform from the current node based on the attack profile. The state space represents the execution position of the attack trajectory in the attack profile. The reward function is used to evaluate the attacker's actions to determine the attack trajectory. Then, based on the preset objective function, the problem space is iteratively solved by maximizing the attack benefit, and the most likely attack trajectory of the attacker is obtained based on the solution results.

4. The network attack prediction method based on attack profiles according to claim 3, characterized in that, Based on a pre-defined objective function, the problem space is iteratively solved by maximizing attack gains. This includes: first, sampling the action at current time t from the attacker's attack trajectory candidate strategies; and then changing the action environment state from... Transfer to And store the transition experience during the transfer in the replay buffer; Then, at each gradient iteration, the parameters in the preset objective function are updated. Strategy weights and temperature The parameters are the optimal strategy for obtaining the attacker's attack trajectory by maximizing attack gains. These are the weight parameters of the Q-function network in the SAC algorithm.

5. The network attack prediction method based on attack profiles according to claim 3 or 4, characterized in that, The predefined objective function is expressed as: ,in, Candidate attack strategies for attackers. The optimal strategy to be solved is... ( ) represents the reward function. For discount rate, The state at time point t, Actions at time point t; Candidate strategies The resulting trajectory distribution, where α is the temperature network parameter used to determine the relative importance of the entropy term and the reward. For strategy In state The entropy value.

6. The network attack prediction method based on attack profiles according to claim 1, characterized in that, This paper utilizes the Transformer model to predict the attacker's next attack tactics and specific attack behaviors. The process includes: encoding the meaning of log threat sequences using a model embedding layer; encoding the positional information representing the time series within the sequence using a positional encoding layer; adding the meaning and positional encoding results and inputting them into a model encoder layer; compressing the key sequence information into a fixed-length vector using the model encoder layer; and converting the fixed-length vector into model output using a model decoder layer. The model encoder layer consists of M stacked encoders with identical structures. Each encoder uses a multi-head attention mechanism to focus on different representation sequence subspace information and transforms the dimensionality of the subspace information through a fully connected layer. Furthermore, two multi-head attention mechanisms are set in the model decoder layer to fuse historical tactical sequences during prediction.

7. A network attack prediction system based on attack profiles, characterized in that, It includes: a graph construction module, a profile generation module, and an attack prediction module. The graph construction module is used to parse system logs and build a time-series attack knowledge graph based on the system logs to describe the entities, relationships and time information related to threat attack behavior. The profile generation module uses a pre-trained BERT model to map threat attack behavior entities in a temporal attack knowledge graph to attack tactics in a pre-set public adversarial tactical technology knowledge base, assigning attack tactic labels to each threat attack behavior entity in the knowledge graph; it uses attack tactics to filter attacker attack trajectories and constructs an attack profile according to the logical relationships of attack trajectories in the attack tactics. The threat attack behavior entity includes: the target object's threat behavior, the software and hardware threat platform executing the program code, and the target object's family name. The attack profile is used to describe the tactical attack chain and attack steps taken by the attacker. The attack prediction module is used to obtain the most likely attack trajectory of the attacker based on the attack profile, and to obtain the log threat sequence in the most likely attack trajectory of the attacker. The log threat sequence is input into the pre-trained Transformer model, and the Transformer model is used to predict the attacker's next attack tactics and specific attack behaviors to guide the defender to deploy defense behaviors.

Images