An attack investigation method based on behavior sequence and language model

Abstract

The application discloses an attack investigation method based on a behavior sequence and a language model, which comprises the following steps: behavior sequence generation, extracting a behavior dependency subgraph from a behavior dependency graph, converting the subgraph into a behavior sequence, and processing the sequence by using a part-of-speech restoration method; a pre-training model, which is used for performing representation learning on an unlabeled behavior sequence in a self-supervised manner; and fine-tuning for a downstream task, which is used for fine-tuning the model by using labeled data to obtain a trained model and realizing a classification task of the behavior sequence. The application provides a new design idea for attack investigation by constructing a method based on a behavior sequence and a language model.

Description

Technical Field

[0001] This invention belongs to the field of log analysis, and particularly relates to language models and attack investigation based on audit logs. Background Technology

[0002] Security incidents are on the rise in large enterprises and organizations, with sophisticated attacks, represented by advanced persistent threats (APTs), becoming a major threat. To address these threats, enterprises deploy threat detection software, such as intrusion prevention systems (IPS) and security information and incident management (SIEM) tools. This software continuously monitors enterprise-wide activity, capturing system behavior and status, and generating threat alerts when suspicious activity is detected. Cybersecurity analysts respond to these incidents, filtering alerts through attribution or causal analysis to uncover the root cause of the attack and its extent of damage. However, the aforementioned automated software often employs simple matching methods, resulting in a high false positive rate. This forces security analysts to spend significant time filtering alerts, hindering the timely detection of genuine attacks. Furthermore, APT attacks are stealthy, easily bypassing these automated detection tools and remaining hidden, making it difficult to detect these disguised attack behaviors by analyzing individual incidents.

[0003] To overcome the aforementioned shortcomings, recent work has considered the correlation between IOCs and the contextual information of alert events. In fact, correlation and contextual information contain attacker behavior and goals, which differ significantly from those of normal users and are difficult to conceal. Attack investigations automatically analyze the authenticity of alerts and reduce false positives by analyzing the contextual information of alert events offline, while simultaneously identifying undetected threat behaviors through analysis of historical audit logs. Some attack investigation solutions, such as matching rule knowledge bases or using tagging strategies, require manual involvement from domain experts, and the completeness and accuracy of expert knowledge will affect the analysis results.

[0004] To address the aforementioned issues, Nodoze built an event frequency database to replace the rule knowledge base, based on the fact that attack-related audit events occur infrequently. However, to avoid detection, attackers may disguise themselves as normal behavior or use seemingly legitimate processes, such as svchost.exe. This affects the accuracy of threat scoring methods based on matching or individual event frequencies. Furthermore, these methods only consider reducing false positives in threat detection software and do not address the challenge of missed detections. Some existing work extracts attack behaviors from threat intelligence and designs matching algorithms to search for these known attacks in audit logs. However, many APT attacks are not disclosed by security companies. Moreover, APT attacks are targeted, upgrading cyber weapons or changing intrusion strategies when attacking new targets. This makes threat intelligence-based methods unable to detect unknown attacks.

[0005] Pre-trained language models have proven effective in improving many natural language processing tasks. Pre-trained methods learn representations from large amounts of unlabeled data, and with a certain amount of labeled data, these representations can be easily transferred to downstream tasks through fine-tuning or feature-based methods. However, these language models are unidirectional and cannot consider context in both directions when dealing with character-level tasks. Summary of the Invention

[0006] This invention proposes an attack investigation method based on behavior sequences and language models. This method generates behavior sequences of events from a behavior dependency graph constructed based on audit logs, uses a deep bidirectional pre-trained language model based on transformers to learn representations of the behaviors in the sequences, and learns normal behavior sequences and attack behavior sequences through labeled data, thereby realizing the analysis and discovery of attack behavior events.

[0007] This invention provides an attack investigation method based on behavioral sequences and language models, comprising the following steps:

[0008] 1) Extract entities and relationships between entities from the audit logs and construct a behavior dependency graph. Nodes in the graph represent entities in the audit logs, and directed edges represent relationships between entities.

[0009] 2) Starting with attack events and normal events respectively, traverse the behavior dependency graph forward and backward to generate a subgraph containing the context information of the behavior event. Optimize the subgraph and merge similar behaviors and nodes.

[0010] 3) Generate action sequences based on the extracted action dependency subgraphs, and process the entities in the action sequences based on the idea of ​​lemmatization in natural language processing while preserving the features of the entities;

[0011] 4) Use a transformer-based deep bidirectional pre-trained model (BERT) to learn the representation of the behavior sequence, obtain the vector representation of entities and behaviors in the sequence, fine-tune the model through the labeled behavior sequence, and apply the model to the downstream classification task to realize the discovery of attack sequences, thereby reducing false positives or discovering unknown attack behaviors.

[0012] Furthermore, the generation of the behavior sequence and the construction and training of the language model include:

[0013] a) A behavior dependency graph is a graph data structure extracted from audit logs that represents causal relationships between entities. The dependency graph consists of nodes and directed edges. Nodes represent entities in the audit logs, such as processes and files, while directed edges represent behaviors such as reads and joins.

[0014] b) Starting from the behavioral event, use the depth-first traversal (DFS) method to extract the context information of the behavioral event from the dependency graph. The DFS for attacking behavioral events terminates when the entity is normal, and the DFS for normal behavioral events terminates when the entity is attacking. Then, optimize the generated subgraph and merge events that are close in time and similar.

[0015] c) Transform the subgraph into a sequence of actions in chronological order, where the action events in the sequence are represented as follows: ,in and Represents a specific entity, To represent the behavior between entities, based on the idea of ​​lemmatization in natural language processing, entities in the sequence are mapped:

[0016]

[0017] in The basic characteristics of entities are preserved, such as file type and process name. This process preserves the characteristics of the sequence, which is beneficial for learning based on behavior sequences.

[0018] d) Construct a deep bidirectional pre-trained model based on transformers and design a pre-training task. The model input consists of a large number of tokenized unlabeled action sequences. 15% of the tokens in the input sequence are randomly masked, and 10% of these tokens will be randomly replaced. The masked tokens are represented by special tokens. Instead, the model is trained to predict the occluded location of the token based on the context;

[0019] e) For downstream tasks, input labeled behavior sequences into the model and fine-tune the pre-trained model based on the classification task to achieve the classification of attack behavior sequences and normal behavior sequences.

[0020] Furthermore, in step 1), there are three types of entity types: processes, files, and IP addresses. The relationships between entities represent operations, such as a process reading and writing to a file, or a process connecting to an IP address.

[0021] Furthermore, in step 2), during the forward depth traversal starting from the attack behavior event, the traversal ends when the starting node of the traversed behavior event is a normal behavior, and the backward depth traversal ends when the ending node of the event is a normal behavior. The depth traversal starting from the normal behavior event is the opposite of the attack behavior event.

[0022] Furthermore, in step 2), multiple actions of one entity on another entity within a short period of time are merged. For operations of one entity on multiple similar entities within a short period of time, these entities are merged to optimize the dependency subgraph.

[0023] Furthermore, in step 3), lemmatization is mainly performed based on the characteristics of the entities, including removing the process ID and mapping the files according to file type. This preserves the basic characteristics of the entities, which is beneficial for the model to learn the representation of the sequence.

[0024] The method of this invention can effectively reduce the false alarm rate of automated threat detection software and detect hidden attack behaviors, compared with existing methods:

[0025] 1. This invention proposes an attack investigation method based on behavior sequence and language model, which can fully consider the contextual information of behavioral events. By performing self-supervised learning on behavior sequence, the dependence on labeled data is reduced. The learned data representation is used to fine-tune the model for downstream tasks, which can learn sentence-level features and achieve good results in identifying attack sequences.

[0026] 2. This invention proposes a lexical reconstruction method for entities, which can significantly reduce the size of the dictionary and retain the features of entities at the system level, which is beneficial for the model to learn the representation of behavior sequences.

[0027] 3. This invention uses a deep bidirectional pre-trained model based on transformer and designs a pre-training task based on a masked language model. Compared with other language models, it can consider the context in two directions at the same time, which improves the model's representation learning performance of entities.

[0028] 4. This invention requires only a small amount of labeled data to enable the model to learn sentence-level features through fine-tuning, resulting in better performance in downstream tasks and reducing dependence on labeled data. Attached Figure Description

[0029] Figure 1 This is a structural diagram of the method framework of the present invention. It mainly includes three parts: behavior sequence generation, language model pre-training, and fine-tuning for downstream tasks.

[0030] Figure 2 This is a mapping table for restoring the form of entities.

[0031] Figure 3 The accuracy, recall, precision, and F1 score of the model are calculated for different datasets.

[0032] Figure 4 This is a schematic diagram of the structure of an attack investigation device based on behavioral sequences and language models provided in this application. Detailed Implementation

[0033] To make the above-mentioned features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0034] The attack investigation method designed in this invention is based on behavioral sequences and language models. It is suitable for investigating the authenticity of alerts and discovering undetected attack behaviors using audit logs. This method represents audit logs as behavioral dependency graphs and generates behavioral sequences. It then uses a model to learn the features of these behavioral sequences, achieving the classification of attack behavior sequences and normal behavior sequences. The specific implementation process is as follows: Figure 1 As shown, its main steps include:

[0035] Step 101: Extract the behavior dependency graph from the audit log, including information about entity nodes and operations between entity nodes.

[0036] In this embodiment of the application, the audit logs may come from logging software of different operating systems, such as ETW (Event Trace For Windows) for Windows and the audit log system for Linux.

[0037] In this embodiment of the application, the content of the entity node is the entity name in the audit log, such as file name, process name and process ID, IP address, etc., and the operation between entity nodes is the behavior of the entity, such as the process's reading, writing, and deleting of files.

[0038] Step 201: Starting from the behavior event, perform a depth-first traversal of the behavior dependency graph based on the entity performing the operation and the entity being operated on in the event, and stop the traversal based on a specific condition to generate a behavior dependency subgraph.

[0039] Step 202: Traverse the behavior dependency subgraph, find behaviors where an entity performs multiple operations on another entity within 10 seconds and merge them, find behaviors where an entity performs the same operations on multiple similar entities and merge these similar entities, thereby optimizing the behavior dependency subgraph.

[0040] In this embodiment, there are multiple directed edges between two entity nodes, representing operations performed by the entities at different times. Merging operations that occur within a time window T can effectively reduce and optimize the graph; similar entities represent the same file type under the same path.

[0041] Step 301: Sort the behavioral events in the behavioral dependency subgraph according to time order and generate a behavioral sequence. For the attack behavioral sequence, increase the number of attack behavioral sequence samples by randomly removing an entity related to the attack.

[0042] In this embodiment of the application, the behavioral sequence is represented as follows: ,in and Represents the entity nodes in the graph. This represents a directed edge; to address the training problem caused by imbalanced samples, a certain attack-related entity in the attack behavior sequence is removed to generate a new attack behavior sequence.

[0043] Step 302: Traverse the behavior sequence and perform lexical reconstruction on the entities in the sequence. For common files, map them based on file extensions or types. For files that cannot be determined, design heuristic methods to hide the path or map them based on their location.

[0044] In this embodiment, lexical reconstruction of entities is similar to part-of-speech tagging in natural language processing, mainly involving removing irrelevant paths and filenames while retaining file types, such as... Figure 2 As shown, this step can remove irrelevant information from entities, which helps the model learn features.

[0045] Step 401: Tokenize all behavior sequences and add special tokens. and ,in and Used to indicate the beginning and end of a sequence. Used to pad shorter sequences to a fixed length.

[0046] In this embodiment of the application, tokenization is to represent the words in the sequence in the form of numbers, which makes it easier to input the sequence into the model.

[0047] Step 402: Randomly select 15% of the non-special tokens in the sequence, and replace 90% of these tokens with special envoy tokens. The remaining 10% are randomly replaced with other tokens. The tokenized sequence and the vector representing the position information are then input into the model for self-supervised learning.

[0048] Step 403: Define the downstream task as the classification of attack behavior sequences and normal behavior sequences, input the labeled data into the model and fine-tune it to obtain the trained model.

[0049] In this embodiment, the same number of normal behavior sequences and abnormal behavior sequences are selected, labeled, and input into the pre-trained model. Some parameters in the training model will be updated as training progresses, learning sentence-level behavioral features.

[0050] Step 404: Transform the unknown behavior time into an unknown behavior sequence and input it into the trained model to complete the classification of the behavior sequence and detect the attack behavior.

[0051] This invention utilizes the DAPRA CADETS dataset and publicly available audit log datasets generated from simulated APT attacks to conduct experimental analyses on the feasibility of the method, the accuracy of false positive identification, and the ability to investigate unknown attacks. Experimental results show that this method can effectively reduce the false positive rate of automated threat detection tools and can discover undetected unknown attacks.

[0052] The following section describes an attack investigation device based on behavioral sequences and language models provided in an embodiment of this application. For example... Figure 4 As shown, the attack investigation device includes a behavior sequence generation module 401, a language model pre-training module 402, a fine-tuning pre-trained language model module 403, and an attack investigation module 404.

[0053] The behavior sequence generation module 401 is used to convert audit logs into behavior dependency graphs and generate behavior sequences from the behavior dependency graphs.

[0054] The language model pre-training module 402 is used to tokenize the behavior sequence and learn the word representation in the behavior sequence using self-supervised learning to obtain the vectorized representation of the word.

[0055] The pre-trained language model module 403 is fine-tuned to learn sentence-level features of attack behavior sequences and normal behavior sequences, and the parameters of the model are updated to obtain a model that can achieve the task.

[0056] The attack investigation module 404 is used to classify unknown behavior sequences, determine whether the unknown behavior sequence is an attack behavior sequence, and determine the attack investigation based on the determination.

[0057] This disclosure also provides an electronic device, including a memory and a processor. The memory further stores computer instructions executable by the processor, which, when executed, implement the above-described processing method.

[0058] This disclosure also provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions, which, when executed on a computer, implement the above-described processing method.

[0059] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0060] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0061] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0062] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0063] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0064] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An attack investigation method based on behavioral sequences and language models, characterized in that, include: (1) Extract behavioral dependency graphs from audit logs and generate behavioral sequences, specifically including: Extract a behavior dependency graph from the audit logs. Nodes represent entities, and their types include processes, files, and IP addresses. Directed edges between entities represent operations between entities. Starting with attack events and normal events respectively, the behavior dependency graph is traversed forward and backward to extract behavior dependency subgraphs. The depth-first traversal for attack events terminates when the entity is normal, and the depth-first traversal for normal events terminates when the entity is attacking. To optimize the behavior dependency subgraph, a time window T is set, and the behaviors of an entity performing multiple operations on another entity within T are merged. The behaviors of an entity in the subgraph performing the same operations on multiple similar entities are found, and these similar entities are merged. Transform the subgraph into a sequence of behaviors in chronological order. ,in Indicates a behavioral event. and Represents an entity, Representing the behavior between entities, performing lexical reconstruction of entities in the sequence: in The basic characteristics of the entity are preserved, including file type and process name; (2) Construct a deep bidirectional pre-trained language model based on transformer to tokenize behavior sequences, specifically including: Tokenize all behavior sequences and add special tokens. and Construct a token dictionary, in which and Used to indicate the beginning and end of a sequence. Used to pad shorter sequences to a fixed length; Design a pre-training task: randomly select 15% of the non-special tokens in the sequence, and replace 90% of these tokens with special tokens. The remaining 10% are randomly selected to replace other tokens. The tokenized sequence and the vector representing the location information are input into the model, and the model is trained to predict the token at the occluded location based on the context. (3) Fine-tuning the pre-trained language model The sample data is labeled as either attack behavior sequences or normal behavior sequences. Data augmentation is performed on the attack behavior sequences, and random sampling is performed on the normal behavior sequences to obtain the training dataset. The vector representation of the entity and the training dataset are input into the model for training. During the training process, the parameters in the model are adjusted so that the model can learn sequence-level features, resulting in a fine-tuned attack behavior sequence classification model. (4) To make judgments on unknown events, specifically including: Extract the behavior dependency subgraph corresponding to the unknown behavior event according to step (1), and convert the behavior dependency subgraph into an unknown behavior sequence; Based on the token dictionary constructed in step (2), tokenize the unknown behavior sequence; The tokenized unknown behavior sequence is input into the fine-tuned attack behavior sequence classification model obtained in step (3) to obtain the classification result of the unknown sequence, and the unknown event attack investigation is determined based on the classification result.

Images