APT attack data generation method and related apparatus
By obtaining APT attack data from terminal logs and using the least squares loss function to fit the trained model to generate target link attack data, the problem of insufficient APT attack data samples is solved, the generation and expansion of complex time series data are realized, and the stability and generalization ability of the model are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA TELECOM CORP LTD TECHNOLOGY INNOVATION CENTER
- Filing Date
- 2023-07-05
- Publication Date
- 2026-05-19
AI Technical Summary
Existing technologies struggle to generate complex time-series APT attack data, resulting in insufficient sample sizes to meet the detection requirements of machine learning or deep learning models.
By obtaining raw APT attack data and its associated network address information from terminal logs, initial link attack data is generated. Then, using an APT attack data generation model trained based on least squares loss function, target link attack data is generated or expanded. Finally, the data format is converted.
It enables the generation or expansion of complex time series data, solves the problem of insufficient negative samples in APT attack detection, alleviates the problems of vanishing network gradients and unstable training, and improves the generalization ability of the model.
Smart Images
Figure CN116996266B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network information security, and in particular to a method and apparatus for generating APT attack data. Background Technology
[0002] Advanced Persistent Threats (APTs) are covert and persistent cyberattacks launched by certain organizations against specific targets. Therefore, APTs are usually characterized by stealth, long-term persistence, and threat.
[0003] Furthermore, because APT attacks are stealthy and adept at disguising themselves during the attack process, they are not easily detected. Moreover, after completing the data theft, they delete the logs that record the traces, making it difficult to trace the source. Therefore, in typical threat detection, the number of APT attack samples is extremely small, which is insufficient to meet the sample data requirements for detection based on machine learning or deep learning models.
[0004] See related technologies. Figure 1 As shown, Generative Adversarial Networks (GANs) are typically used to generate or augment sample datasets to obtain synthetic data that closely resembles real data. The generator G receives random noise and generates synthetic data that closely approximates the distribution of real data, while the discriminator D receives real and synthetic data and accurately classifies real and fake data.
[0005] However, using the above-mentioned sample data generation method makes it difficult to synthesize complex time series data (such as APT attack data) because GANs cannot capture the temporal dependencies of sequences.
[0006] Therefore, how to address the current shortage of APT attack data samples, which fails to meet the APT attack data sample requirements for APT attack detection, is an urgent problem that needs to be solved. Summary of the Invention
[0007] This application provides a method and related apparatus for generating APT attack data, which addresses the problem that there is currently a shortage of APT attack data samples, which cannot meet the needs of APT attack data samples for APT attack detection, thereby enriching and expanding APT attack data.
[0008] In a first aspect, embodiments of this application provide a method for generating Advanced Persistent Threat (APT) attack data, the method comprising:
[0009] The original APT attack data is obtained from the interception results in the terminal logs, and the initial link attack data is generated based on the original APT attack data and its associated network address information; wherein, the network address information includes at least a set of source Internet Protocol IP and target IP;
[0010] The initial link attack data feature set is input into a preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model. The data feature set contains various data features that represent the request information of the corresponding data link. The APT attack data generation model is obtained by fitting and training based on the least squares loss function.
[0011] According to the set APT data format, the target link attack data is converted to obtain the corresponding target APT attack data.
[0012] Secondly, embodiments of this application also provide an apparatus for generating APT attack data, the apparatus comprising:
[0013] The acquisition module is used to obtain raw APT attack data from the interception results in the terminal logs, and generate initial link attack data based on the raw APT attack data and its associated network address information; wherein, the network address information includes at least a set of source IPs and target IPs;
[0014] The generation module is used to input the data feature set of the initial link attack data into the preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model. The data feature set contains various data features that represent the request information of the corresponding data link. The APT attack data generation model is obtained by fitting and training based on the least squares loss function.
[0015] The conversion module is used to convert the target link attack data according to the set APT data format to obtain the corresponding target APT attack data.
[0016] In an optional embodiment, when generating initial link attack data based on the original APT attack data and its associated network address information, the acquisition module is specifically used for:
[0017] Obtain the network address information associated with the data identifier of the original APT attack data from the terminal logs;
[0018] Initial link attack data is generated based on the network characteristics and attributes contained in the network address information, as well as the original APT attack data.
[0019] In one alternative embodiment, the APT attack data generation model is trained in the following manner:
[0020] Based on multiple sample APT attack data, the following operations were performed:
[0021] Feature extraction is performed on the sample link attack data corresponding to the first sample APT attack data to obtain the data feature set of the sample link attack data; wherein, the first sample APT attack data is any one of multiple sample APT attack data;
[0022] Based on the data feature set of sample link attack data and the least squares loss function, the APT attack data generation model is trained iteratively multiple times until the APT attack data generation model meets the preset APT attack data generation conditions.
[0023] In an optional embodiment, when the APT attack data generation model is trained iteratively multiple times based on the data feature set of sample link attack data and the least squares loss function, the generation module is specifically used for:
[0024] During one iteration of training, perform the following operations:
[0025] Input the data feature set of the sample link attack data into the APT attack data generation model to obtain the synthetic link attack data output by the APT attack data generation model;
[0026] Based on the least squares loss function, the loss value between sample link attack data and synthetic link attack data is obtained; whereby the loss value represents the data similarity between sample link attack data and synthetic link attack data.
[0027] Based on the obtained loss values, the model parameters of the APT attack data generation model are adjusted.
[0028] In an optional embodiment, the APT attack data generation model is determined to meet preset APT attack data generation conditions if the following conditions are met:
[0029] In the sample link attack data, the duration of each data link is obtained; each data link consists of a set of source IPs and target IPs, and the duration of each link represents the time during which the sample link attack data continuously attacks through the corresponding data link.
[0030] The duration of each data link is analyzed to obtain the distribution of test data link duration of sample link attack data.
[0031] If the distribution of test data link duration and the distribution of expected data link duration corresponding to the first sample APT attack data meet the preset similarity requirements of link duration distribution, then the APT attack data generation model is determined to meet the APT attack data generation conditions.
[0032] Thirdly, this application provides an electronic device including a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the APT attack data generation method described in the first aspect.
[0033] Fourthly, this application provides a computer-readable storage medium including program code that, when run on an electronic device, causes the electronic device to perform the steps of the APT attack data generation method described in the first aspect.
[0034] Fifthly, this application provides a computer program product that, when invoked by a computer, causes the computer to execute the steps of the APT attack data generation method as described in the first aspect.
[0035] The beneficial effects of this application are as follows:
[0036] In the APT attack data generation method provided in this application embodiment, since APT attack data has the characteristic of persistence, the original APT attack data is converted into initial link attack data containing network address information during the generation of APT attack data, so as to facilitate the generation of subsequent APT attack data. Furthermore, the APT attack data generation model obtained by fitting and training based on the least squares loss function is adopted, which not only realizes the generation or expansion of complex time series data (i.e., APT attack data) and solves the problem of insufficient negative samples and imbalanced samples in APT attack detection, but also effectively alleviates the problems of network gradient vanishing and training instability in related technologies by introducing the least squares loss function.
[0037] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description
[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:
[0039] Figure 1 This is a schematic diagram of the structure of a GAN model provided in an embodiment of this application;
[0040] Figure 2 A schematic diagram of the structure of a DoppelGANger sequence generation model provided in this application embodiment;
[0041] Figure 3 This is a schematic diagram of an optional system architecture applicable to the embodiments of this application;
[0042] Figure 4 A schematic diagram illustrating the implementation process of an APT attack data generation method provided in this application embodiment;
[0043] Figure 5 A schematic diagram illustrating the implementation process of a training method for an APT attack data generation model provided in this application embodiment;
[0044] Figure 6 A logical diagram illustrating the adjustment of model parameters in an APT attack data generation model, provided as an embodiment of this application;
[0045] Figure 7 A logical diagram illustrating how to determine if an APT attack data generation model satisfies APT attack data generation conditions, provided in an embodiment of this application;
[0046] Figure 8 A method based on the embodiments of this application is provided. Figure 4 A flowchart illustrating specific application scenarios;
[0047] Figure 9 A schematic diagram illustrating the characteristics and attributes of APT attack data provided in an embodiment of this application;
[0048] Figure 10 A schematic diagram of the structure of an APT attack data generation device provided in an embodiment of this application;
[0049] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.
[0051] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.
[0052] Furthermore, the data collection, dissemination, and use in the technical solution of this application all comply with the requirements of relevant national laws and regulations.
[0053] The following explanations of some technical terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.
[0054] (1) Uniform Resource Locator (URL): It is a uniform resource location identifier for the World Wide Web or the World Wide Web. It can also be called a network address. Therefore, on the Web, every information resource has a uniform address on the network.
[0055] (2) DoppelGANger Sequence Generation Model: Also known as the DG network model, it is a model based on the GAN framework. For an example, see [link to documentation]. Figure 2 As shown, the DoppelGANger sequence generation model uses two networks (a multilayer perceptron (MLP) and a recursive neural network (RNN)) to capture temporal dependencies, which can accelerate the convergence speed of GANs and avoid mode collapse, making it possible to generate complex sequential datasets.
[0056] (3) MLP: also known as Artificial Neural Network (ANN), in addition to the input layer and output layer, there can be multiple hidden layers in the middle; among them, the simplest MLP contains only one hidden layer, that is, a three-layer structure.
[0057] (4) Recurrent Neural Network: ANN is an ANN with a tree-like hierarchical structure in which network nodes recursively process input information according to their connection order. It is one of the deep learning (DL) algorithms.
[0058] (5) Web Application Firewall (WAF): Also known as Web Application Protection System, it provides protection for Web applications by implementing a series of security policies for Hypertext Transfer Protocol (HTTP) / Hypertext Transfer Protocol Secure (HTTPS) with security as the goal.
[0059] (6) Gradient Vanishing (GV): When a neural network performs backpropagation, the parameter w is updated. Gradient vanishing occurs when the later network layers can obtain a reasonable partial derivative, but the partial derivatives calculated by the network layers closer to the input layer are almost zero, making it almost impossible to update the parameter w.
[0060] Furthermore, based on the above explanations of terms and related terminology, the design concept of the embodiments of this application will be briefly introduced below:
[0061] Due to the stealthy nature of APT attacks, they are adept at disguising themselves during the attack process, making them difficult to detect. Furthermore, after stealing data, they delete logs that record their tracks, making it difficult to trace the source. Therefore, the number of APT attack data samples is extremely small in typical threat detection, making it very difficult to use machine learning or deep learning models for detection.
[0062] Although GANs can often be used to generate or supplement datasets, they are difficult to synthesize complex time series data (such as APT attack data) because they cannot capture the temporal dependencies of sequences. In other words, when using GANs to generate APT attack data, it is very easy to cause training instability problems such as pattern collapse.
[0063] In view of this, in order to address the problem that the current APT attack data samples are insufficient to meet the needs of APT attack detection, and to enrich and expand APT attack data, this application proposes a method for generating APT attack data. Specifically, the method includes: obtaining raw APT attack data from the interception results of terminal logs, and generating initial link attack data based on the raw APT attack data and its associated network address information; wherein the network address information includes at least a set of source Internet Protocol (IP) and target IP addresses; next, inputting the data feature set of the initial link attack data into a preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model; wherein the data feature set includes various data features representing: the request information of the corresponding data link, and the APT attack data generation model is obtained based on least squares loss function fitting training; finally, according to the set APT data format, the target link attack data is converted to obtain the corresponding target APT attack data; thus, through the preset APT attack data generation model, the generation or expansion of complex time series data (i.e., APT attack data) can be achieved.
[0064] In addition, this approach also improves the problem of insufficient negative samples in current APT attack detection methods to some extent. Most methods rely on model optimization and upsampling of a small number of attack samples, which involves a large workload for model optimization and may not necessarily yield good results. Furthermore, it avoids the problem of duplicate samples in upsampling, which is not conducive to improving the model's generalization ability. Moreover, by learning more sample features through the model, the model's generalization ability is improved.
[0065] In particular, the preferred embodiments of this application will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments of this application and the features in the embodiments can be combined with each other without conflict.
[0066] See Figure 3 The diagram illustrates a system architecture applicable to an embodiment of this application. This system architecture includes a target terminal 301 and a server 302. The target terminal 301 and the server 302 can interact via a communication network. The communication network can employ wireless communication or wired communication methods.
[0067] For example, the target terminal 301 can access the network and communicate with the server 302 through cellular mobile communication technology, wherein the cellular mobile communication technology includes, for example, 5th Generation Mobile Networks (5G) technology.
[0068] Optionally, the target terminal 301 can access the network and communicate with the server 302 via short-range wireless communication, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.
[0069] This application embodiment does not impose any limitation on the number of communication devices involved in the above system architecture. For example, there may be more target terminals, or no target terminals, or other network devices may be included, such as... Figure 3 As shown, only the target terminal 301 and server 302 are described as examples. The following is a brief introduction to each of the above devices and their respective functions.
[0070] The target terminal 301 is a device that can provide voice and / or data connectivity to a user, and can be a device that supports wired and / or wireless connection methods.
[0071] For example, the target terminal 301 includes, but is not limited to: mobile phones, tablets, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in autonomous driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.
[0072] Furthermore, the target terminal 301 may have a related client installed. This client can be software, such as an application (APP), browser, short video software, or a webpage, mini-program, etc. In this embodiment, the target terminal 301 can use the aforementioned client related to APT attack data generation to send terminal logs of the target terminal 301 to the server 302 for subsequent APT attack data generation and other method steps.
[0073] It should be noted that in this embodiment of the application, the operating system of the target terminal 301 can be configured with a WAF, which can record APT attacks. Therefore, the terminal log (web log) of the target terminal 301 is obtained through the WAF.
[0074] Server 302 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. It should be noted that, in this embodiment of the application, a trained APT attack data generation model is deployed on server 302 for generating APT attack data; optionally, the APT attack data generation model can be a DoppelGANger sequence generation model.
[0075] It is worth mentioning that, in this embodiment of the application, the server 302 is used to obtain the original APT attack data from the interception results of the terminal log, and generate initial link attack data based on the original APT attack data and its associated network address information; then, the data feature set of the initial link attack data is input into a preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model; finally, the target link attack data is converted according to the set APT data format to obtain the corresponding target APT attack data.
[0076] The method for generating APT attack data provided by the exemplary embodiments of this application will be described below in conjunction with the above system architecture and with reference to the accompanying drawings. It should be noted that the above system architecture is only shown for the purpose of understanding the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.
[0077] See Figure 4 The diagram illustrates the implementation flow of an APT attack data generation method provided in this application embodiment. Taking a server as an example, the specific implementation flow of this method is as follows:
[0078] S401: Obtain the raw APT attack data from the interception results in the terminal log, and generate initial link attack data based on the raw APT attack data and its associated network address information.
[0079] The network address information includes at least one set of source IPs and destination IPs, and each set of source IPs and destination IPs can constitute a data (access) link.
[0080] In one alternative implementation, when performing step S401, the server can obtain the network address information associated with the data identifier of the original APT attack data from the terminal log of the target terminal, and then generate initial link attack data based on the network characteristics and network attributes contained in the network address information and the original APT attack data.
[0081] For example, the server can obtain the original APT attack data from the interception results of the web logs (i.e., terminal logs) of the WAF firewall deployed on the target terminal; and, based on the long-term persistence of APT attacks, it can generate initial link attack data based on the original APT attack data and its associated network address information (e.g., access URLs in the web logs), so that APT attack data can be generated subsequently through the trained APT attack data generation model.
[0082] Based on this, the aforementioned initial link attack data can specifically be: URL link data composed of IPs with the same source and target in the APT attack. The network features included in the aforementioned network address information can be items extracted from the URL access text, including but not limited to: url, connection, content-type, Charset, accept, referer, user-agent, host, x-forwarded-for; optionally, the network attributes included in the network address information can be the access volume of the link composed of the source IP and the target IP within a set time range (e.g., every day or every 12 hours).
[0083] S402: Input the data feature set of the initial link attack data into the preset APT attack data generation model, and obtain the target link attack data output by the APT attack data generation model.
[0084] The data feature set includes various data feature representations: request information of the corresponding data link; and the APT attack data generation model is obtained by fitting and training based on the least squares loss function.
[0085] For example, assuming the initial link attack data is URL link data, then each data feature included in the above data feature set is a separate item from the URL access text segmentation, and the specific expression of the above least squares loss function is as follows:
[0086] L D1 =E[(D(x)-1) 2 ]+E[D(G(z)) 2 ]
[0087] Where x represents real data (i.e., real samples), D(x) represents the probability that the discriminator D classifies a sample as real, z represents noise, G(z) represents samples generated by the generator G, E represents the expectation, and L D1 This represents the loss value obtained according to the least squares loss function. It should also be noted that D(x)∈(0,1).
[0088] It should be noted that during the training process of the APT attack data generation model, the least squares loss function is used instead of the original loss function. This not only distinguishes between real and fake data, but also penalizes outlier generated samples, alleviating the gradient vanishing problem. As a result, the generated samples fit the real samples as closely as possible, and the problem of the generated data having a single distribution is also alleviated.
[0089] For example, taking the Sigmoid cross-entropy loss function used in the baseline model of the DG network as an example, the specific expression of the Sigmoid cross-entropy loss function is as follows:
[0090] L D2 =E[log(D(x))]+E[log(1-D(G(z)]
[0091] Where x represents real data (i.e., real samples), D(x) represents the probability that the discriminator D classifies a sample as real, z represents noise, G(z) represents the sample generated by the generator G, E represents the expectation, and L D2 This represents the loss value obtained according to the Sigmoid cross-entropy loss function. It should also be noted that D(x)∈(0,1).
[0092] Clearly, the aforementioned Sigmoid cross-entropy loss function only judges whether a sample is true or false, regardless of distance (i.e., it does not penalize outlier generated samples). This makes it easy for fake data that deviates greatly from the real data to fool the discriminator D, resulting in insufficient training of the generator G and thus causing mode collapse.
[0093] It is easy to see that, based on the above method steps, and considering the characteristics of small APT attack sample size and varied attack forms, the DG network is used to synthesize new APT attack samples (data), enriching and expanding the APT attack data. Furthermore, to address the problem of unstable training of the DG network, the network structure is modified by replacing the original Sigmoid cross-entropy loss function with the least squares loss function, making the synthesized APT attack data closer to real APT attack data.
[0094] In one alternative implementation, the APT attack data generation model can be trained as follows, see [reference]. Figure 5 As shown, the server performs the following operations based on any one of the multiple sample APT attack data, namely the first sample attack data:
[0095] S501: Extract features from the sample link attack data corresponding to the first sample APT attack data to obtain the data feature set of the sample link attack data.
[0096] For example, when executing step S501, the server extracts features from the URL link data (i.e., sample link attack data) corresponding to the first sample APT attack data, thereby extracting each item of the URL access text split, i.e. obtaining the data feature set of the sample link attack data.
[0097] S502: Based on the data feature set of sample link attack data and the least squares loss function, the APT attack data generation model is trained iteratively multiple times until the APT attack data generation model meets the preset APT attack data generation conditions.
[0098] In one alternative implementation, when performing step S502, refer to... Figure 6 As shown, during each iteration of training, the server performs the following operations: inputs the data feature set of the sample link attack data into the APT attack data generation model, obtains the synthetic link attack data output by the APT attack data generation model, and then obtains the loss value between the sample link attack data and the synthetic link attack data based on the least squares loss function. The loss value represents the data similarity between the sample link attack data and the synthetic link attack data. Based on the obtained loss value, the model parameters of the APT attack data generation model are adjusted.
[0099] For example, the model parameters (hyperparameters) of the APT attack data generation model mentioned above include, but are not limited to: epoch, learning rate, and batch size. An epoch represents the completion of one forward computation and backpropagation cycle when all data is fed into the network. The size of the epoch is related to the diversity of the dataset; the greater the diversity, the larger the epoch. The learning rate is the most important of all hyperparameters. Choosing a good learning rate can not only accelerate model convergence, avoid getting trapped in local optima, and reduce the number of iterations, but also improve model progress. The batch size is the sample batch size, which affects the optimization degree and convergence speed of the model. It is usually set according to the size of the dataset. Specific problems require specific analysis. A smaller batch size allows the learning process to converge faster but generates more noise, while a larger batch size allows the learning process to converge slower but accurately estimates the error gradient.
[0100] Furthermore, during the iterative training of the APT attack data generation model, refer to... Figure 7As shown, the server can obtain the duration of each data link in the sample link attack data. Each data link consists of a set of source IPs and target IPs, and the duration of each link represents the time during which the sample link attack data continuously attacks through the corresponding data link. Then, the durations of each data link are organized to obtain the distribution of test data link durations of the sample link attack data. Finally, if the distribution of test data link durations and the distribution of expected data link durations corresponding to the first sample APT attack data meet the preset similarity requirements of link duration distribution, then the APT attack data generation model is determined to meet the APT attack data generation conditions.
[0101] It should be noted that, in terms of the distribution of APT attack data generated, the baseline model of the DG network using the original loss function and the optimized model using the least squares loss function have different results. The former synthesizes APT attack data with a data link duration concentrated in 2 days, while the latter synthesizes APT attack data with a data link distribution that is closer to the distribution of real APT attack data. That is, the distribution of test data link duration and the distribution of expected data link duration meet the preset similarity requirement of link duration distribution, which alleviates the pattern collapse problem and makes the APT attack data generation model meet the APT attack data generation conditions.
[0102] S403: According to the set APT data format, convert the target link attack data to obtain the corresponding target APT attack data.
[0103] The APT data format set above is the same as the original APT attack data format.
[0104] In one alternative implementation, based on the APT attack data generation method described in S401–S403 above, please refer to… Figure 8 As shown, assuming the APT attack data generation model is the DoppelGANger sequence generation model, the server can perform the following operations:
[0105] S801: Retrieve APT attack data from WAF-based web logs.
[0106] Specifically, during step S801, the server obtains APT attack data from the WAF's Web log interception results.
[0107] S802: Processes attack chain time series data as model input.
[0108] Specifically, during step S802, the server extracts features and attributes from the access URLs in the web logs based on the long-term persistence characteristics of APT attacks, and processes them into URL link data containing APT attack-related IPs from the same source and target.
[0109] For example, the server can use the attack URL as metadata, then extract the items (url, connection, content-type, Charset, accept, user-agent, host, x-forwarded-for) from the URL access text split as features required for model training, then perform one-hot encoding on these features, select the daily access volume of the source IP and target IP links as attributes, and generate model input.
[0110] See Figure 9 As shown, Ai represents an array of 0s and 1s, one-hot encoded for each feature of the URL splitting item mentioned above. F1, ..., Fn represent the daily access volume of the data link composed of the source IP and the target IP, arranged from date to date. n is the longest duration of the attack. After arranging from left to right, the fewer the attack days, the more 0s are added (each column does not necessarily correspond to a single date). Each column corresponding to Ai includes multiple sub-columns, each sub-column representing a feature. Each row of sub-columns, corresponding to an array of 0s and 1s, represents the features involved in a data link (i.e., the URL). Each column corresponding to Fi represents the attack status of each data link on day Fi. If it is 0, it means that there is no longer a continuous attack through the corresponding data link; if it is 1, it means that the continuous attack through the corresponding data link continues. In addition, as... Figure 9 As shown, taking the first row as an example, it can be seen that the longest duration of an attack through the data link corresponding to the first row is 4 days, and the attack stops on the 5th day.
[0111] S803: Train the model to analyze the distribution of synthetic APT attack data.
[0112] Among them, the DoppelGANger model, which uses GANs for time series generation, uses two networks (a multilayer perceptron MLP and a recurrent neural network RNN) in the generator to capture time dependencies. It can be used to synthesize attack data that simulates real APT attack chains, thus enriching the amount of APT attack data.
[0113] It should be noted that, based on the network structure, the model training process first trains the features, and then uses the feature training results to retrain the attributes to obtain the final training data.
[0114] S804: Improved DoppelGANger model with optimized loss function.
[0115] Specifically, in step S804, the server uses the least squares loss function instead of the original loss function (i.e., the Sigmoid cross-entropy loss function). Least squares fitting is suitable for linear regression. The distance between the generated sample and the real sample is used instead of the cross-entropy, which increases the penalty for outlier generated samples. This not only distinguishes between real and fake samples but also alleviates the gradient vanishing problem, making the generated data results more reliable.
[0116] S805: Analysis of synthetic APT attack data before and after model optimization.
[0117] It should be noted that before analyzing the synthetic APT attack data before and after model optimization, the server needs to perform an inverse transformation of the link attack data output by the model, that is, to realize the data format conversion, so as to obtain the synthetic APT attack data.
[0118] In summary, in the APT attack data generation method provided in this application embodiment, since APT attack data has a continuous characteristic, the original APT attack data is converted into initial link attack data containing network address information during the generation of APT attack data, so as to facilitate the generation of subsequent APT attack data. Furthermore, the APT attack data generation model obtained by fitting and training based on the least squares loss function not only realizes the generation or expansion of complex time series data (i.e., APT attack data) and solves the problem of insufficient negative samples and imbalanced samples in APT attack detection, but also effectively alleviates the problems of network gradient vanishing and training instability in related technologies by introducing the least squares loss function.
[0119] Furthermore, based on the same technical concept, embodiments of this application provide an APT attack data generation apparatus, which is used to implement the above-described method flow of embodiments of this application. See also... Figure 10 As shown, the device for generating APT attack data includes: an acquisition module 1001, a generation module 1002, and a conversion module 1003, wherein:
[0120] The acquisition module 1001 is used to obtain the original APT attack data from the interception results of the terminal log, and generate initial link attack data based on the original APT attack data and its associated network address information; wherein, the network address information includes at least a set of source IP and target IP;
[0121] The generation module 1002 is used to input the data feature set of the initial link attack data into the preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model; wherein, the data feature set contains various data feature representations: the request information of the corresponding data link, and the APT attack data generation model is obtained by fitting and training based on the least squares loss function.
[0122] The conversion module 1003 is used to convert the target link attack data according to the set APT data format to obtain the corresponding target APT attack data.
[0123] In an optional embodiment, when generating initial link attack data based on the original APT attack data and its associated network address information, the acquisition module 1001 is specifically used for:
[0124] Obtain the network address information associated with the data identifier of the original APT attack data from the terminal logs;
[0125] Initial link attack data is generated based on the network characteristics and attributes contained in the network address information, as well as the original APT attack data.
[0126] In one alternative embodiment, the APT attack data generation model is trained in the following manner:
[0127] Based on multiple sample APT attack data, the following operations were performed:
[0128] Feature extraction is performed on the sample link attack data corresponding to the first sample APT attack data to obtain the data feature set of the sample link attack data; wherein, the first sample APT attack data is any one of multiple sample APT attack data;
[0129] Based on the data feature set of sample link attack data and the least squares loss function, the APT attack data generation model is trained iteratively multiple times until the APT attack data generation model meets the preset APT attack data generation conditions.
[0130] In an optional embodiment, when the APT attack data generation model is trained iteratively multiple times based on the data feature set of sample link attack data and the least squares loss function, the generation module 1002 is specifically used for:
[0131] During one iteration of training, perform the following operations:
[0132] Input the data feature set of the sample link attack data into the APT attack data generation model to obtain the synthetic link attack data output by the APT attack data generation model;
[0133] Based on the least squares loss function, the loss value between sample link attack data and synthetic link attack data is obtained; whereby the loss value represents the data similarity between sample link attack data and synthetic link attack data.
[0134] Based on the obtained loss values, the model parameters of the APT attack data generation model are adjusted.
[0135] In an optional embodiment, the APT attack data generation model is determined to meet preset APT attack data generation conditions if the following conditions are met:
[0136] In the sample link attack data, the duration of each data link is obtained; each data link consists of a set of source IPs and target IPs, and the duration of each link represents the time during which the sample link attack data continuously attacks through the corresponding data link.
[0137] The duration of each data link is analyzed to obtain the distribution of test data link duration of sample link attack data.
[0138] If the distribution of test data link duration and the distribution of expected data link duration corresponding to the first sample APT attack data meet the preset similarity requirements of link duration distribution, then the APT attack data generation model is determined to meet the APT attack data generation conditions.
[0139] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the APT attack data generation method flow provided in the above embodiments of this application. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. See also... Figure 11 As shown, the electronic device may include:
[0140] At least one processor 1101 and a memory 1102 connected to at least one processor 1101. In this embodiment, the specific connection medium between the processor 1101 and the memory 1102 is not limited. Figure 11 The example shown is the connection between processor 1101 and memory 1102 via bus 1100. Bus 1100 is... Figure 11 The connections between other components are shown in thick lines only and are not intended to be limiting. Bus 1100 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 11 The term 1101 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 1101 may also be referred to as a controller; there is no restriction on the name.
[0141] In this embodiment, memory 1102 stores instructions executable by at least one processor 1101. By executing the instructions stored in memory 1102, at least one processor 1101 can execute the APT attack data generation method described above. Processor 1101 can implement... Figure 10 The functions of each module in the device shown.
[0142] The processor 1101 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 1102 and calling data stored in memory 1102, the processor can perform various functions and process data, thereby monitoring the device as a whole.
[0143] In one possible design, processor 1101 may include one or more processing units. Processor 1101 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 1101. In some embodiments, processor 1101 and memory 1102 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.
[0144] Processor 1101 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the APT attack data generation method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.
[0145] Memory 1102, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 1102 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 1102 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 1102 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.
[0146] By designing and programming the processor 1101, the code corresponding to the APT attack data generation method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during runtime. Figure 4 The illustrated embodiment describes the steps of a method for generating APT attack data. How to design and program the processor 1101 is a technique well-known to those skilled in the art and will not be described further here.
[0147] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform an APT attack data generation method described above.
[0148] In some possible implementations, this application also provides a method for generating APT attack data that can also be implemented as a program product including program code that, when the program product is run on a device, causes the control device to perform the steps in a method for generating APT attack data according to various exemplary embodiments of this application as described above.
[0149] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.
[0150] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.
[0151] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0152] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0153] Program code for performing the operations of this application can be written using any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, as well as conventional procedural programming languages such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.
[0154] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0155] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
Claims
1. A method for generating Advanced Persistent Threat (APT) attack data, characterized in that, include: The original APT attack data is obtained from the interception results in the terminal logs, and initial link attack data is generated based on the original APT attack data and its associated network address information; wherein, the network address information includes at least a set of source Internet Protocol IPs and target IPs; The data feature set of the initial link attack data is input into a preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model; wherein, each data feature in the data feature set represents: the request information of the corresponding data link, and the APT attack data generation model is obtained by fitting and training based on the least squares loss function. According to the set APT data format, the target link attack data is converted to obtain the corresponding target APT attack data.
2. The method as described in claim 1, characterized in that, The process of generating initial link attack data based on the original APT attack data and its associated network address information includes: Obtain the network address information associated with the data identifier of the original APT attack data from the terminal log; The initial link attack data is generated based on the network characteristics and network attributes contained in the network address information, as well as the original APT attack data.
3. The method as described in claim 1 or 2, characterized in that, The APT attack data generation model is trained in the following manner: Based on multiple sample APT attack data, the following operations were performed: Feature extraction is performed on the sample link attack data corresponding to the first sample APT attack data to obtain the data feature set of the sample link attack data; wherein, the first sample APT attack data is any one of the plurality of sample APT attack data; Based on the data feature set of the sample link attack data and the least squares loss function, the APT attack data generation model is trained iteratively multiple times until the APT attack data generation model meets the preset APT attack data generation conditions.
4. The method as described in claim 3, characterized in that, The APT attack data generation model is trained iteratively multiple times using the data feature set based on the sample link attack data and the least squares loss function, including: During one iteration of training, perform the following operations: The data feature set of the sample link attack data is input into the APT attack data generation model to obtain the synthetic link attack data output by the APT attack data generation model; Based on the least squares loss function, the loss value between the sample link attack data and the synthetic link attack data is obtained; wherein, the loss value represents the data similarity between the sample link attack data and the synthetic link attack data; Based on the obtained loss value, the model parameters of the APT attack data generation model are adjusted.
5. The method as described in claim 3, characterized in that, The APT attack data generation model is determined to meet the preset APT attack data generation conditions if the following conditions are met: In the sample link attack data, the duration of each data link is obtained; wherein, each data link consists of a set of source IPs and target IPs, and the duration of each link represents the time during which the sample link attack data continuously attacks through the corresponding data link. The duration of each data link is organized to obtain the test data link duration distribution of the sample link attack data. If the test data link duration distribution and the expected data link duration distribution corresponding to the first sample APT attack data meet the preset link duration distribution similarity requirements, then the APT attack data generation model is determined to satisfy the APT attack data generation conditions.
6. An apparatus for generating APT attack data, characterized in that, include: The acquisition module is used to obtain raw APT attack data from the interception results of the terminal logs, and generate initial link attack data based on the raw APT attack data and its associated network address information; wherein, the network address information includes at least a set of source IPs and target IPs; The generation module is used to input the data feature set of the initial link attack data into a preset APT attack data generation model to obtain the target link attack data output by the APT attack data generation model; wherein, the data feature set includes each data feature representing: the request information of the corresponding data link, and the APT attack data generation model is obtained by fitting and training based on the least squares loss function. The conversion module is used to convert the target link attack data according to the set APT data format to obtain the corresponding target APT attack data.
7. The apparatus as claimed in claim 6, characterized in that, When generating initial link attack data based on the original APT attack data and its associated network address information, the acquisition module is specifically used for: Obtain the network address information associated with the data identifier of the original APT attack data from the terminal log; The initial link attack data is generated based on the network characteristics and network attributes contained in the network address information, as well as the original APT attack data.
8. The apparatus as claimed in claim 6 or 7, characterized in that, The APT attack data generation model is trained in the following manner: Based on multiple sample APT attack data, the following operations were performed: Feature extraction is performed on the sample link attack data corresponding to the first sample APT attack data to obtain the data feature set of the sample link attack data; wherein, the first sample APT attack data is any one of the plurality of sample APT attack data; Based on the data feature set of the sample link attack data and the least squares loss function, the APT attack data generation model is trained iteratively multiple times until the APT attack data generation model meets the preset APT attack data generation conditions.
9. The apparatus as claimed in claim 8, characterized in that, When the APT attack data generation model is trained iteratively multiple times based on the data feature set of the sample link attack data and the least squares loss function, the generation module is specifically used for: During one iteration of training, perform the following operations: The data feature set of the sample link attack data is input into the APT attack data generation model to obtain the synthetic link attack data output by the APT attack data generation model; Based on the least squares loss function, the loss value between the sample link attack data and the synthetic link attack data is obtained; wherein, the loss value represents the data similarity between the sample link attack data and the synthetic link attack data; Based on the obtained loss value, the model parameters of the APT attack data generation model are adjusted.
10. The apparatus as claimed in claim 8, characterized in that, The APT attack data generation model is determined to meet the preset APT attack data generation conditions if the following conditions are met: In the sample link attack data, the duration of each data link is obtained; wherein, each data link consists of a set of source IPs and target IPs, and the duration of each link represents the time during which the sample link attack data continuously attacks through the corresponding data link. The duration of each data link is organized to obtain the test data link duration distribution of the sample link attack data. If the test data link duration distribution and the expected data link duration distribution corresponding to the first sample APT attack data meet the preset link duration distribution similarity requirements, then the APT attack data generation model is determined to satisfy the APT attack data generation conditions.
11. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-5.
12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-5.