Attack chain query method and device, program product, electronic equipment and storage medium

Abstract

The application provides an attack chain query method and device, a program product, an electronic device and a storage medium. The method comprises: obtaining a query parameter, the query parameter comprising description information of a starting query node; determining the starting query node from a graph structure according to the query parameter, and performing attack chain query from the starting query node along edges between nodes in the graph structure to obtain a target attack chain meeting the query parameter; the graph structure comprises nodes and edges between the nodes, the nodes represent entities in a network, the edges between the nodes represent relationships between the entities, the edges between the nodes comprise behavior edges, the behavior edges represent behaviors occurring between the entities, and the attack chain represents an attack behavior chain existing between the entities. The graph structure comprises the behavior edges, so behaviors occurring between an entity corresponding to the starting query node and other entities can be reflected through edges in the target attack chain, the attack chain query is more targeted, and the work efficiency is improved compared with manual analysis.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to an attack chain query method, apparatus, program product, electronic device, and storage medium. Background Technology

[0002] With the continuous development of computer networks, network attacks are becoming increasingly frequent, and network information security is receiving more and more attention. Current methods for analyzing attack behavior typically involve manual rule-based analysis or association methods based on signature databases. Faced with massive amounts of network data, manual network attack analysis methods are time-consuming and inefficient. Summary of the Invention

[0003] The purpose of this application is to provide an attack chain query method, apparatus, program product, electronic device, and storage medium to improve the above-mentioned technical problems.

[0004] In a first aspect, embodiments of this application provide an attack chain query method, comprising: obtaining query parameters, the query parameters including descriptive information of a starting query node; determining a starting query node from a graph structure according to the query parameters, and starting from the starting query node, performing an attack chain query along the edges between nodes in the graph structure to obtain a target attack chain that conforms to the query parameters; wherein, the graph structure includes nodes and edges between nodes, nodes represent entities in the network, edges between nodes represent relationships between entities, edges between nodes include behavioral edges, behavioral edges represent behaviors occurring between entities, and attack chains represent chains of attack behaviors existing between entities.

[0005] In the above implementation process, the entities in the network and the relationships between them are modeled through the nodes in the graph structure and the edges between the nodes. In particular, the behavior edges are used to model the behavior between entities. Thus, the starting query node is determined from the graph structure based on the description information of the starting query node in the query parameters. Starting from the starting query node, the query is performed along the edges (especially the behavior edges) in the graph structure, which allows the tracing of a series of related attack behaviors that occur in the network, thereby obtaining the target attack chain.

[0006] This method can automatically query attack chains based on graph structures, thus significantly improving the efficiency of network attack analysis. Furthermore, due to the comprehensiveness of graph structures in network modeling, this method has high comprehensiveness and accuracy in querying attack chains.

[0007] In one implementation of the first aspect, the edges between nodes also include belonging edges; belonging edges are used to describe the belonging relationship between entities; starting from the initial query node, an attack chain query is performed along the edges between nodes in the graph structure to obtain the target attack chain that meets the query parameters, including: starting from the current node, querying upwards along the belonging edges in the graph structure to obtain the top-level node to which the current node belongs; at the start of the query, the current node is the initial query node; starting from the top-level node, querying downwards along the belonging edges in the graph structure to obtain the lower-level nodes belonging to the top-level node; querying the first row edge in the first direction from the row edges connected to the lower-level nodes in the graph structure; if the initial query node is the starting node of the attack chain, then the first direction is the outgoing edge direction of the lower-level node; if the initial query node is the ending node of the attack chain, then the first direction is the incoming edge direction of the lower-level node; taking the opposite node of the lower-level node connected by the first row edge as the current node, repeating the above query steps until the query terminates, to obtain the existing attack chain formed based on the path in the graph structure traversed during the query process; and determining the target attack chain based on the existing attack chain.

[0008] In the above implementation process, during the attack chain query, the top-level node of the current node and the lower-level nodes of the top-level node are queried. Based on the lower-level nodes, the behavior edges are queried, and more comprehensive attack behaviors are mined according to the affiliation relationship between nodes, thereby obtaining a more comprehensive and accurate target attack chain. It also supports specifying the starting query node as the starting node or ending node of the attack chain, so that the query can be performed from the outgoing edge direction or the incoming edge direction of the node. The query method is flexible, and the target attack chain queried is more in line with the requirements.

[0009] In one implementation of the first aspect, determining the target attack chain based on existing attack chains includes: filtering existing attack chains to obtain the target attack chain based on a first additional query condition indicated by the query parameters and / or the default condition of the target attack chain itself; and / or: querying a first row edge in a first direction from the action edges of the graph structure connected to lower-level nodes, including: querying a first row edge in the first direction from the action edges of the graph structure connected to lower-level nodes that satisfies a second additional query condition indicated by the query parameters and / or the default condition of the target attack chain itself; and / or: taking the peer node of the lower-level node connected to the first row edge as the current node and repeating the above query steps, including: if the peer node of the lower-level node connected to the first row edge satisfies a third additional query condition indicated by the query parameters, then taking the peer node as the current node and repeating the above query steps.

[0010] In the above implementation process, during the query of the target attack chain, the query parameters can be used to filter behavior edges or nodes during the query process or to filter attack chains after the query. In addition to the query parameters, the query can also be based on the default conditions of the target attack chain itself, thereby supporting the flexible construction of different query logics to meet different levels of query needs (such as the need for query efficiency, storage space, and coding complexity). Furthermore, the query of the target attack chain can be refined through a variety of optional query conditions to make the queried target attack chain more in line with the requirements.

[0011] In one implementation of the first aspect, the description information of the starting query node in the query parameters includes the type of the starting query node and / or the attribute value of the starting query node; the query parameters also include at least one of the following: the type of the ending query node; the attribute value of the ending query node; whether to filter ordinary behavior: the attribute of the behavior edge in the graph structure includes a danger score, which is used to characterize the degree of danger of the behavior corresponding to the behavior edge; if the danger score exceeds a threshold, the behavior edge corresponds to an attack behavior; if the danger score does not exceed a threshold, the behavior edge corresponds to an ordinary behavior; if the query parameter is to filter ordinary behavior, then only behavior edges containing the corresponding attack behavior are allowed in the target attack chain; if the query parameter is not to filter ordinary behavior, then behavior edges containing the corresponding ordinary behavior are allowed in the target attack chain; total attack duration: the attribute of the behavior edge in the graph structure includes the behavior occurrence time, and the difference between the occurrence time of the first behavior edge and the last behavior edge in the target attack chain is not... Exceeding the total attack duration; Attack occurrence time: The attribute of the behavior edge in the graph structure includes the behavior occurrence time, and the behavior occurrence time of the first behavior edge in the target attack chain is not earlier than the attack occurrence time; Attack end time: The attribute of the behavior edge in the graph structure includes the behavior occurrence time, and the behavior occurrence time of the last behavior edge in the target attack chain is not later than the attack end time; Minimum step size: The number of behavior edges in the target attack chain is not less than the minimum step size; Maximum step size: The number of behavior edges in the target attack chain is not greater than the maximum step size; Maximum number of returned entries: The number of target attack chains is not greater than the maximum number of returned entries; The type of the termination query node and the attribute value of the termination query node are used to indicate the third additional query condition; Whether to filter ordinary behavior, total attack duration, attack occurrence time, attack end time, maximum step size and maximum number of returned entries are used to indicate the first additional query condition or the second additional query condition; Minimum step size is used to indicate the first additional query condition.

[0012] In the above implementation process, a variety of different query parameters can be specified to meet the diverse query needs of users. At the same time, the restrictions of these query parameters can make the query of the target attack chain more refined.

[0013] In one implementation of the first aspect, the attributes of the behavioral edges in the graph structure include the behavioral occurrence time, and the default conditions of the target attack chain itself include: if the starting query node is the starting node of the target attack chain, then the behavioral occurrence time of each behavioral edge in the target attack chain except the first one is greater than the behavioral occurrence time of the previous behavioral edge in the target attack chain; if the starting query node is the ending node of the target attack chain, then the behavioral occurrence time of each behavioral edge in the target attack chain except the last one is less than the behavioral occurrence time of the next behavioral edge in the target attack chain.

[0014] In the above implementation process, it is required that the occurrence time of each behavior edge is incremented starting from the starting node of the target attack chain. This way, the target attack chain queried can reflect the real attack behavior chain (the real attack behavior occurs in the order of time increment), thereby improving the accuracy of attack chain query.

[0015] In one implementation of the first aspect, the method further includes: displaying the target attack chain on a visualization interface; the display state of the target attack chain includes a micro state, a macro state, and an intermediate state; the micro state refers to the complete display of all nodes in the target attack chain and the edges between nodes, the macro state refers to the display of only the top-level nodes and the edges between the top-level nodes in the target attack chain, and the edges between the top-level nodes are obtained by aggregating the edges between the lower-level nodes of the two top-level nodes; the intermediate state refers to the display state between the micro state and the macro state; the display state is switched in response to a state switching operation triggered on the visualization interface.

[0016] In the above implementation process, the macroscopic display presents key information in the target attack chain from a macro perspective, clearly showing the relationships and interactions between them, thus enabling faster location of key nodes. The microscopic display delves into the details of the target attack chain at a micro level, showing more detailed and specific information to facilitate further analysis. The intermediate display can show both key information in the target attack chain and detailed information on key nodes, flexibly meeting different user display needs.

[0017] In one implementation of the first aspect, the attributes of the nodes in the graph structure include a node importance score, which is used to characterize the importance of the entity corresponding to the node; the attributes of the behavioral edges in the graph structure include a danger score, which is used to characterize the danger level of the behavior corresponding to the behavioral edge; the method further includes: obtaining an attack chain score corresponding to the target attack chain based on at least one of the node importance scores of the nodes in the target attack chain, the danger scores of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain.

[0018] In the above implementation process, the attack chain score corresponding to the target attack chain is calculated. The attack chain score can serve as an important warning signal and reference, helping to quickly identify vulnerabilities that attackers can easily exploit, thereby enabling security protection measures, optimizing the protection system, and improving network security. Furthermore, the attack chain score is influenced by three factors: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. This makes the evaluation dimensions of the attack chain score relatively comprehensive and reasonable.

[0019] In one implementation of the first aspect, the attack chain score is positively correlated with the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain.

[0020] In the above implementation process, since the node importance score can characterize the importance of the entity corresponding to the node, and the more important these entities are, the more severe the harm caused by an attack on them, the attack chain score can be set to be positively correlated with the node importance score of the nodes in the target attack chain. Similarly, since the danger score of a behavior edge can characterize the danger level of the behavior corresponding to that edge, and the more dangerous the behavior between entities, the more likely these behaviors are to be attack behaviors, and the more severe the harm caused, the attack chain score can be set to be positively correlated with the danger score of the behavior edges in the target attack chain. Furthermore, the greater the number of behavior edges in the attack chain, the wider the scope of the attack chain and the more entities that may be attacked, thus the attack chain score can be set to be positively correlated with the number of behavior edges in the target attack chain. Therefore, setting the attack chain score to be positively correlated with the above three factors is reasonable.

[0021] In one implementation of the first aspect, the attack chain score corresponding to the attack chain is obtained based on at least one of the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. This includes: using a preset relation function to obtain the attack chain score corresponding to the target attack chain based on at least one of the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain; the value range of the preset relation function is a finite interval.

[0022] In the above implementation process, by using a relational function with a finite range to calculate the attack chain score, the attack chain score is not overly sensitive to any of the following: the node importance score of the node in the target attack chain, the danger score of the behavioral edge in the target attack chain, and the number of behavioral edges in the target attack chain. Such a score is more meaningful and valuable.

[0023] In one implementation of the first aspect, the types of nodes in the graph structure include at least one of device nodes, network interface card (NIC) nodes, process nodes, port nodes, software nodes, and vulnerability nodes; the attribution relationships between entities include at least one of the following: NIC nodes belong to device nodes, port nodes belong to NIC nodes, software nodes belong to device nodes, process nodes belong to software nodes, and vulnerability nodes belong to software nodes.

[0024] In the above implementation process, nodes in the graph structure are classified, and the attribution relationships between entities are determined. The node classification covers all entities in the network, making the graph-based attack chain query method applicable to more scenarios and improving the versatility of attack chain queries. Furthermore, considering the attribution relationships between entities when querying attack chains enhances the comprehensiveness of the query.

[0025] In one implementation of the first aspect, before determining the starting query node from the graph structure based on the query parameters, the method further includes: extracting entities and relationships between entities from log data; the relationships between entities include behaviors occurring between entities and attribution relationships between entities; generating nodes in the graph structure based on the entities, and generating edges between nodes in the graph structure based on the relationships between entities; the behaviors occurring between entities are used to generate behavioral edges between nodes, and the attribution relationships between entities are used to generate attribution edges between nodes.

[0026] In the above implementation process, a graph structure for attack chain query is constructed based on the log data generated by network devices. The log data has a rich source and a huge amount of data. The constructed graph structure can comprehensively reflect the entities in the network and the relationships between them. Based on this graph structure, a comprehensive and accurate attack chain query can be performed.

[0027] Secondly, embodiments of this application also provide an attack chain query device, comprising: a parameter acquisition module for acquiring query parameters, the query parameters including descriptive information of a starting query node; and a query module for determining a starting query node from a graph structure based on the query parameters, and starting from the starting query node, performing an attack chain query along the edges between nodes in the graph structure to obtain a target attack chain that conforms to the query parameters; wherein, the graph structure includes nodes and edges between nodes, nodes represent entities in the network, edges between nodes represent relationships between entities, edges between nodes include behavioral edges, behavioral edges represent behaviors occurring between entities, and attack chains represent chains of attack behaviors existing between entities.

[0028] Thirdly, embodiments of this application also provide a computer program product, including computer program instructions, which are executed by a processor to perform the method provided in the first aspect or any implementation thereof.

[0029] Fourthly, embodiments of this application also provide an electronic device, including: a processor and a memory, the memory storing computer program instructions, which are executed by the processor to perform the method provided in the first aspect or any implementation thereof.

[0030] Fifthly, embodiments of this application also provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, perform the method provided in the first aspect or any implementation thereof. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A flowchart illustrating an attack chain query method provided in an embodiment of this application;

[0033] Figure 2 A schematic diagram of a graph structure provided in an embodiment of this application;

[0034] Figure 3 A schematic diagram illustrating the microscopic state of the target attack chain provided in the embodiments of this application;

[0035] Figure 4 A schematic diagram illustrating the macroscopic state of the target attack chain provided in the embodiments of this application;

[0036] Figure 5 This is a schematic diagram of the attack chain query device provided in the embodiments of this application;

[0037] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0038] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this application.

[0040] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0041] Please see Figure 1 The illustration shows a flowchart of an attack chain query method provided in an embodiment of this application. The attack chain query method provided in this application can be applied to electronic devices, which may include physical devices such as servers, PCs, tablets, or smartphones, or virtual devices such as virtual machines or containers. The electronic device can be a single device, a combination of multiple devices, or a cluster of a large number of devices. The attack chain query method may include:

[0042] Step S110: Obtain query parameters, which include the description information of the starting query node.

[0043] Step S120: Based on the query parameters, determine the starting query node from the graph structure, and starting from the starting query node, perform attack chain query along the edges between nodes in the graph structure to obtain the target attack chain that meets the query parameters; wherein, the graph structure includes nodes and edges between nodes, nodes represent entities in the network, edges between nodes represent the relationships between the entities, edges between nodes include behavioral edges, behavioral edges represent the behaviors that occur between entities, and attack chains represent the chain of attack behaviors that exist between entities.

[0044] In step S110, query parameters can be used to query and determine attack chains that meet the parameter requirements from the graph structure, referred to as target attack chains. The meaning of attack chains will be explained later. Query parameters include at least the descriptive information of the starting query node, and may also include query-related constraints, as detailed below. The descriptive information of the starting query node is used to determine one or more starting query nodes from the graph structure. It should be noted that the starting query node here refers to the starting node in the process of querying the target attack chain. This starting node can be the starting node, intermediate node, or termination node in the target attack chain. The descriptive information of the starting query node may include at least one of the following: node type, node attribute values, and additional data. The node type of the starting query node is used to characterize the type of entity corresponding to the node. For example, the node type may include device nodes and network interface card (NIC) nodes. The node attribute values ​​are used to describe the characteristics of the node. For example, the attribute values ​​of a device node may include the device name, and the attribute values ​​of a NIC node may include the IP address of the NIC. The additional data may specify that the starting query node is the starting node or termination node of the attack chain.

[0045] Query parameters can be obtained, but are not limited to, through the following methods: obtaining query parameters input by the user through a web page; providing an API interface for attack chain querying for user programs to call, with the user passing in the query parameters when calling; and reading query parameters from a configured attack chain query task file.

[0046] In step S120, before querying the attack chain, the graph structure is first introduced. A graph structure is a data structure based on nodes and the edges between them. Nodes in a graph structure represent entities in a network; these entities can refer to network participants, such as devices or network interface cards (NICs), and the network can refer to a local or wide-area computer network or communication network of interest. Edges between nodes represent relationships between entities; in a graph structure, these relationships can be used to represent one-to-many or many-to-many relationships between entities.

[0047] Relationships between entities must at least include the actions that occur between them. That is, edges between nodes include action edges, which represent the actions that happen between the entities. For example, a network interface card (NIC) node is connected to another NIC node by an action edge representing an access action; the access action is the action that occurs between the NICs represented by these two NIC nodes. Relationships between entities can also include hierarchical relationships, etc. Correspondingly, in a graph structure, edges of corresponding types can represent the relationships between entities of corresponding types.

[0048] An attack chain represents a chain of attack behaviors between entities in a network. In a graph structure, an attack chain corresponds to a path in the graph. A path in a graph structure is a link formed by nodes and edges in the graph. Since attack chain queries are performed along the nodes and edges in the graph structure, they essentially involve continuously visiting the nodes and edges in the graph structure and determining whether to include these nodes and edges in the attack chain. Therefore, paths in the graph structure, i.e., attack chains, are naturally formed during the query process.

[0049] It should be noted that while in principle, behavioral edges in an attack chain should represent attack behaviors between entities, to accommodate user query needs, behavioral edges in an attack chain are also allowed to represent non-attack behaviors, i.e., ordinary behaviors, between entities. This compatibility has practical significance: firstly, not every behavioral edge in an attack chain is necessarily an attack behavior; secondly, there is sometimes no strict boundary between attack behaviors and ordinary behaviors, and the restriction on attack behaviors can be relaxed to obtain more query results before further judgment.

[0050] Based on one or more descriptive information from the starting query node, the starting query node corresponding to the descriptive information is determined from the nodes of the graph structure. Starting from the starting query node, an attack chain query is performed along the edges between nodes in the graph structure and the nodes corresponding to the queried edges to obtain the target attack chain that meets the query parameters. If the edges in the graph structure are directed edges, the attack chain query along the edges between the nodes includes querying along the outgoing edges of the edges between the nodes or querying along the incoming edges of the edges between the nodes.

[0051] In addition to the description information of the starting query node, the query parameters may also include other information that indicates certain additional query conditions besides the starting query node. Thus, the target attack chain that matches the query parameters can refer to the attack chain in the graph structure that matches the description information of the starting query node and the additional query conditions (if any).

[0052] exist Figure 1 The method shown uses nodes in the graph structure and edges between nodes to model entities in the network and the relationships between them. In particular, behavioral edges are used to model the behaviors that occur between entities. Based on the description information of the starting query node in the query parameters, the starting query node is determined from the graph structure. Starting from the starting query node, the query is performed along the edges (especially behavioral edges) in the graph structure, which allows the tracing of a series of related attack behaviors that occur in the network, thereby obtaining the target attack chain.

[0053] Optionally, in this embodiment of the application, the edges between nodes also include belonging edges; belonging edges are used to describe the belonging relationship between entities; belonging relationship refers to the fact that an entity in the network belongs to or depends on another entity in a logical or structural sense.

[0054] Optionally, in this embodiment, the types of nodes in the graph structure include at least one of the following: device node (corresponding to the entity of a device), network interface card (NIC) node (corresponding to the entity of a NIC), process node (corresponding to the entity of a process), port node (corresponding to the entity of a port), software node (corresponding to the entity of software), and vulnerability node (corresponding to the entity of a vulnerability). The attribution relationships between entities include at least one of the following: NIC belongs to device, port belongs to NIC, software belongs to device, process belongs to software, and vulnerability belongs to software. Based on these possible attribution relationships, different attribution edges can be constructed in the graph structure, such as an attribution edge connecting a NIC node and a device node (indicating that the NIC corresponding to the NIC node belongs to the device corresponding to the device node; the following attribution edges can be understood similarly), an attribution edge connecting a port node and a NIC node, an attribution edge connecting a software node and a device node, an attribution edge connecting a process node and a software node, and an attribution edge connecting a vulnerability node and a software node.

[0055] Given the complex interrelationships and attack behaviors within a network, and the close correlation between them, attack chain queries can leverage the affiliation relationships between nodes to uncover more comprehensive attack behaviors, resulting in a more complete and accurate target attack chain. For example, in terms of affiliation, a device node can have multiple network interface cards (NICs), meaning multiple NICs belong to that device node. When this device node launches an attack, it may use these NICs to launch attacks on other nodes, indicating a potentially divergent attack pattern. Therefore, attack chain queries can begin by identifying the device node to which one NIC belongs, and then further querying all NICs under that device node to obtain a more comprehensive attack chain.

[0056] In the above implementation process, nodes in the graph structure are classified, and the attribution relationships between entities are determined. The node classification covers all entities in the network, making the graph-based attack chain query method applicable to more scenarios and improving the versatility of attack chain queries. Furthermore, considering the attribution relationships between entities when querying attack chains enhances the comprehensiveness of the query.

[0057] Please see Figure 2 The diagram shown is a schematic representation of a graph structure provided in an embodiment of this application. The steps for attack chain lookup are described below, and the description will incorporate... Figure 2 Starting from the initial query node, attack chain queries are performed along the edges between nodes in the graph structure to obtain target attack chains that match the query parameters, including:

[0058] Step (1): Starting from the current node, query upwards along the belonging edges in the graph structure to obtain the top-level node to which the current node belongs; at the start of the query, the current node is the starting query node.

[0059] The starting query node can be determined from the graph structure using the description information in the query parameters. This description includes the node's type and / or attribute value. For example, if the starting query node's type is a network interface card (NIC) node and its attribute value is the NIC's IP address (23.233.23.233), then the node with the NIC type and IP address 23.233.23.233 from all nodes in the graph structure will be selected as the starting query node. Alternatively, if the description only includes the node's type, then all nodes of that type in the graph structure can be used as starting query nodes; or if the description only includes the attribute value, then any node in the graph structure with that attribute value can be used as the starting query node. At the start of the query, the starting query node determined from the graph structure will be designated as the current node. In subsequent query steps, the current node refers to the node currently being queried.

[0060] Upward query refers to querying a node in the graph structure that is connected to the current node through one or more consecutive belonging edges and is the node to which the current node belongs. For example... Figure 2 As shown, the current node is network interface card (NIC) node B0. A query in the graph shows that NIC B0 is connected to device node A1 via a home edge, indicating that NIC B0 belongs to device node A1. Therefore, device node A1 is designated as the parent node of the current node. The query continues upwards along the home edges in the graph, searching for the node to which device node A1 belongs, until a node is found that has no parent node. This node is then designated as the top-level node to which NIC B0 belongs. Figure 2 In the diagram, the top-level node to which network card node B0 belongs is device node A1.

[0061] Specifically, if the current node does not have a parent node, then the current node itself is taken as its parent top-level node, and subsequent query steps are executed.

[0062] Step (2): After determining the top-level node to which the current node belongs, start from the top-level node and query downwards along the belonging edges in the graph structure to obtain the lower-level nodes that belong to the top-level node. Querying downwards along the belonging edges in the graph structure means querying the lower-level nodes in the graph structure that are connected to the top-level node through one or more consecutive belonging edges and belong to the top-level node. It can be understood that these lower-level nodes may include the current node from the previous step.

[0063] In particular, the lower-level nodes belonging to the top-level node also include the top-level node itself.

[0064] Following the above embodiment, it is found that the top-level node to which the current node network card node B0 belongs is device node A1. Then, the query is performed down the graph structure along the belonging edge to find the lower-level nodes belonging to device node A1, including network card node B1, software node C1, process node E1, network card node B0, and device node A1 itself.

[0065] Step (3): Query the first row edge in the first direction from the row edges connected to the lower-level nodes in the graph structure. If the starting query node is the starting node of the attack chain, then the first direction is the outgoing edge direction of the lower-level node; if the starting query node is the ending node of the attack chain, then the first direction is the incoming edge direction of the lower-level node.

[0066] If the query parameters specify the starting query node as either the starting or ending node of the attack chain, the first row of edges connecting the lower-level nodes can be queried based on the corresponding outgoing or incoming edge direction. If the query parameters do not specify the starting query node as either the starting or ending node of the attack chain, the first direction can be assumed to be the outgoing or incoming edge direction of the lower-level nodes for subsequent query steps. The first row of edges in the first direction can be one or more. After determining the first row of edges, the peer node of the lower-level node connected by that first row of edges can be obtained.

[0067] In different implementations, when the first direction is the outgoing edge direction of the lower-level node, all outgoing edges of the lower-level node can be used as the first row of edges, or all outgoing edges of the lower-level node can be filtered, and the filtered outgoing edges can be used as the first row of edges. When the first direction is the incoming edge direction of the lower-level node, all incoming edges of the lower-level node can be used as the first row of edges, or all incoming edges of the lower-level node can be filtered, and the filtered incoming edges can be used as the first row of edges.

[0068] Following the above embodiment, taking network interface card (NIC) node B1 as an example, if the initial query node B0 is the starting node of the attack chain, then the first outgoing action edge is queried from all action edges connected to the lower-level node B1 in the graph structure. The first action edge represents the action sent by NIC node B1 to other nodes; the first action edge includes action edge T1. If NIC node B0 is the ending node of the attack chain, then the first incoming action edge is queried from all action edges connected to the lower-level node B1 in the graph structure. In this case, the first action edge represents the action sent by other nodes received by NIC node B1.

[0069] The above query can be performed on every lower-level node belonging to the top-level node. For example, for the five lower-level nodes of device node A1, network interface node B1, software node C1, process node E1, network interface node B0, and device node A1 itself, the query can be performed to find the first row of edges for each node. Alternatively, the query can be performed by selecting target nodes from the lower-level nodes, such as nodes with higher node importance scores.

[0070] For software node C1, there is no corresponding action edge in the graph structure, so there is no need to perform a first action edge query for C1. The same applies to device node A1.

[0071] Step (4): Take the peer node of the lower-level node connected by the edge in the first row as the current node, and repeat the above query steps (1) to (3) until the query terminates, to obtain the existing attack chain formed by the path in the graph structure traversed during the query process. It should be noted that in some cases, not all peer nodes of the lower-level nodes connected by the edge in the first row will be taken as the current node and the above query steps (1) to (3) will be repeated. For example, if the peer node is the termination query node, then it is not necessary to repeat the above query steps, and the existing attack chain formed by the path in the graph structure traversed during the query process will be obtained. The existing attack chain is the attack chain from the starting query node to the termination query node.

[0072] Please continue reading Figure 2The first row of edges connects to the lower-level node B1, whose peer node is network interface card (NIC) node B2. Taking NIC B2 as the current node, we query the top-level node to which NIC B2 belongs. The top-level node to which NIC B2 belongs is device node A2. We continue querying the lower-level nodes of device node A2, which include device node A2, NIC node B2, and NIC node B3. Taking NIC B3 as an example, we query the first row of NIC node B3 using edge T1-2. Taking the peer node of the lower-level node connected to the first row of edges, NIC node B6, as the current node, we repeat the above query steps until the query terminates, obtaining the existing attack chain based on the paths traversed in the graph structure during the query process. Alternatively, we can continue querying the first row of NIC node B2 using edge T1-1, taking the peer node of the lower-level node connected to the first row of edges, NIC node B5, as the current node, and repeat the above query steps until the query terminates. Query termination can refer to situations such as not finding the required node or edge in the graph structure, query timeout, or other additional query termination conditions. These conditions do not need to be specified in the query parameters. It's important to note that query termination here can be for a single attack chain; when query termination is reached, the query for that attack chain stops, and the existing attack chains formed by the paths traversed by that attack chain in the graph structure during the query process are obtained. Of course, query termination can also apply to the entire query process. For example, after a query timeout, queries for all attack chains can be stopped, or the entire query process terminates when all attack chains have been terminated.

[0073] Step (5): Determine the target attack chain based on the existing attack chains. For example, filter the attack chains from the existing attack chains according to the conditions in the query parameters; or calculate the attack chain score of the existing attack chains and determine the target attack chain from the existing attack chains based on the attack chain score; or directly use the queried existing attack chains as the target attack chain, etc.

[0074] In the above implementation process, during the attack chain query, the top-level node of the current node and the lower-level nodes of the top-level node are queried. Based on the lower-level nodes, the behavior edges are queried, and more comprehensive attack behaviors are mined according to the affiliation relationship between nodes, thereby obtaining a more comprehensive and accurate target attack chain. It also supports specifying the starting query node as the starting or ending node of the attack chain, so that the query can be performed from the outgoing or incoming edge direction of the node. The attack chain can be queried in the forward or reverse order of the behavior occurrence, which is flexible and the target attack chain queried is more in line with the requirements.

[0075] Optionally, in this embodiment, the query parameters are further used to indicate additional query conditions. These additional query conditions are used to retrieve target attack chains that meet the conditions from the graph structure. The methods for determining target attack chains that meet the conditions using the query parameters include:

[0076] The first approach involves querying all existing attack chains that match the description of the initial query node during the query phase. Then, based on the first additional query condition indicated by the query parameters and / or the default conditions of the target attack chain itself, the existing attack chains are filtered to obtain the target attack chain. The default conditions of the target attack chain refer to the constraints that the target attack chain must satisfy by default. These conditions reflect the actual attack behavior chain and are independent of the query parameters.

[0077] The second method is to use the conditions in the query parameters during the process of querying the graph structure. Each queried node or edge meets the default conditions of the target attack chain itself and the additional conditions indicated by the query parameters.

[0078] For example, based on the second additional query condition indicated by the query parameters and / or the default condition of the target attack chain itself, query the behavior edges that meet the conditions, and only perform subsequent queries on behavior edges that meet the second additional query condition and / or the default condition of the target attack chain itself. The first additional query condition and the second additional query condition can be the same or different.

[0079] The second method also includes query conditions for nodes. If the peer node of the lower-level node connected by the edge in the first row satisfies the third additional query condition indicated by the query parameters, then the peer node is taken as the current node, and the above query steps are repeated. The third method combines the first and second methods. This combination involves querying the graph structure using at least one of the second additional query conditions, the third additional query conditions, and the default conditions of the target attack chain itself during the query process. This yields existing attack chains that meet the above query conditions. Then, the first additional query condition is used to filter these existing attack chains to obtain the target attack chain. The first additional query condition used to filter existing attack chains can be different from the second and third additional query conditions used in the query process. For example, during the query process, the second additional query condition indicated by query parameters such as whether to filter normal behavior, total attack duration, attack occurrence time, and attack end time can be used to obtain existing attack chains. Then, the first additional query condition indicated by the query parameter "maximum step size" can be used to filter the existing attack chains to obtain the target attack chain. The specific query parameters mentioned here will be introduced later.

[0080] The first method requires no constraints during the graph structure query phase, only using constraints to filter existing attack chains at the end. The query logic is relatively simple, reducing coding complexity. The second method uses constraints to filter existing attack chains during the graph structure query phase. The query logic is relatively complex, but it may preemptively eliminate some attack chains that do not meet the requirements, thus improving query efficiency and saving hardware resources. The third method combines the advantages of the first two methods, making the query logic more flexible and able to meet different query needs.

[0081] In particular, if the query parameters only contain the description information of the starting query node, then you can directly perform the query according to steps (1) to (4) without considering the influence of other query conditions.

[0082] The following describes the contents of the query parameters. The description information of the starting query node in the query parameters includes the type of the starting query node and / or the attribute value of the starting query node; the query parameters also include at least one of the following: the type of the ending query node, the attribute value of the ending query node, whether to filter normal behavior, the total attack duration, the attack occurrence time, the attack end time, the minimum step size, the maximum step size, and the maximum number of entries returned.

[0083] Regarding whether to filter ordinary behaviors: the attributes of the behavioral edges in the graph structure (see later for details on how to obtain the attributes of nodes or edges in the graph structure) include a danger score, which is used to characterize the degree of danger of the behavior corresponding to the behavioral edge (see later for details on how to obtain the danger score); if the danger score exceeds the threshold, the behavioral edge corresponds to an attack behavior; if the danger score does not exceed the threshold, the behavioral edge corresponds to an ordinary behavior; if the value of this query parameter is to filter ordinary behaviors, then the target attack chain is only allowed to contain behavioral edges that correspond to the corresponding attack behavior; if the value of the query parameter is not to filter ordinary behaviors, then the target attack chain is allowed to contain behavioral edges that correspond to the corresponding ordinary behaviors.

[0084] Total attack duration: The attributes of the action edges in the graph structure include the time of action occurrence. The difference between the occurrence times of the first action edge and the last action edge in the target attack chain does not exceed the total attack duration.

[0085] Attack occurrence time: The attribute of the behavioral edges in the graph structure includes the behavior occurrence time. The behavior occurrence time of the first behavioral edge in the target attack chain is no earlier than the attack occurrence time.

[0086] Attack end time: The attributes of the behavioral edges in the graph structure include the time when the behavior occurs. The behavior of the last behavioral edge in the target attack chain occurs no later than the attack end time.

[0087] Minimum step size: The number of action edges in the target attack chain is not less than the minimum step size.

[0088] Maximum step size: The number of action edges in the target attack chain is not greater than the maximum step size.

[0089] Maximum number of returned entries: The number of target attack chains is no greater than the maximum number of returned entries.

[0090] The type of the terminating query node and the attribute value of the terminating query node are used to indicate the third additional query condition mentioned above; whether to filter ordinary behavior, total attack duration, attack occurrence time, attack end time, maximum step size, and maximum number of returned entries are used to indicate the first additional query condition or the second additional query condition mentioned above; the minimum step size is used to indicate the first additional query condition mentioned above.

[0091] If the attribute of the action edge in the graph structure includes the action occurrence time, then the default conditions of the target attack chain itself include: if the starting query node is the starting node of the target attack chain, then the action occurrence time of each action edge in the target attack chain except the first one is greater than the action occurrence time of the previous action edge in the target attack chain; if the starting query node is the ending node of the target attack chain, then the action occurrence time of each action edge in the target attack chain except the last one is less than the action occurrence time of the next action edge in the target attack chain.

[0092] The query process for the first method is described below, based on the query parameters mentioned above. Determining the target attack chain based on existing attack chains includes: filtering existing attack chains according to the first additional query conditions indicated by the query parameters and / or the default conditions of the target attack chain itself to obtain the target attack chain. The first additional query conditions may include at least one of the following: whether to filter ordinary behavior, total attack duration, attack occurrence time, attack end time, maximum step size, minimum step size, and maximum number of returned entries.

[0093] For example, the query parameters obtained to indicate the first additional query condition are: filter for ordinary behavior, total attack duration is 1 hour, attack occurred at 9:00 AM on March 3rd, and maximum step size is unlimited. Filtering for ordinary behavior means that only behavior edges containing the corresponding attack behavior are allowed in the target attack chain. Therefore, it is necessary to remove attack chains that include behavior edges from the existing attack chains to obtain attack chains that only contain behavior edges containing the corresponding attack behavior. The filtered attack chains may or may not include the belonging edge.

[0094] Then, the above filtering results are filtered for the total attack duration. Among all attack chains that filter for normal behavior, attack chains whose difference between the occurrence time of the first behavior edge and the last behavior edge exceeds 1 hour of the total attack duration are removed. Attack chains with a total attack duration of no more than 1 hour are obtained as the filtering results for the total attack duration.

[0095] The attack occurrence time is then filtered based on the total attack duration: Attack chains corresponding to the total attack duration are selected where the occurrence time of the first action edge is no earlier than the attack occurrence time, and these chains are then considered target attack chains. It's understood that if the occurrence time of the first action edge is no earlier than the attack occurrence time, then the occurrence times of all other action edges in the attack chain are also no earlier than the attack occurrence time. Alternatively, the attack occurrence time can be verified for each action edge in the attack chain.

[0096] The maximum step size is set to unlimited, meaning there's no need to filter based on the maximum step size; therefore, the result of filtering based on the attack occurrence time is used as the target attack chain. It's understandable that if the query parameter is set to not filter ordinary behaviors, then the target attack chain is allowed to contain behavioral edges corresponding to those ordinary behaviors, meaning there's no need to filter based on the type of behavioral edge. Attack end time, maximum step size, minimum step size, and maximum number of returned entries can all be set to unlimited, meaning there's no need to filter existing attack chains based on this parameter.

[0097] When the first additional condition has multiple parameters, the order of filtering can be set according to actual needs, and this application does not limit this.

[0098] The following describes the query process for behavioral edges in the second method, based on the query parameters described above. Querying the first behavioral edge in the first direction from the behavioral edges connected to lower-level nodes in the graph structure includes: querying the first behavioral edge in the first direction from the behavioral edges connected to lower-level nodes in the graph structure that satisfies the second additional query condition indicated by the query parameters and / or the default condition of the target attack chain itself.

[0099] The second additional query criteria may include at least one of the following: whether to filter normal behavior, total attack duration, attack occurrence time, attack end time, maximum step size, and maximum number of returned entries.

[0100] For example, the starting query node in the query parameters is the starting node of the target attack chain; the second additional query conditions indicated by the query parameters are filtering ordinary behaviors, the total attack duration is 2 hours, the attack occurred at 9:00 AM on March 3rd, the attack ended at 11:00 AM on March 3rd, the maximum step size is 10, and the default conditions of the target attack chain itself. The total attack duration and the default conditions of the target attack chain only need to be queried and judged for each behavior edge except the first one; that is, when querying the first behavior edge, it is not necessary to judge the total attack duration and the default conditions of the target attack chain itself.

[0101] After obtaining the lower-level node in step (2), if step (3) queries the first action edge in the attack chain, the first action edge is queried from the action edges connected to the lower-level node in the graph structure. The conditions that the first action edge needs to meet include: the action edge is an action edge representing the attack action, the direction of the action edge satisfies the first direction, the action edge's action occurrence time is no earlier than the attack occurrence time of 9:00 AM on March 3rd and no later than the attack end time of 11:00 AM on March 3rd, and the number of action edges in the attack chain (including the queried action edge) is less than the maximum step size of 10.

[0102] If the query is for behavior edges in the attack chain other than the first behavior edge, the first behavior edge must meet the following conditions in addition to the above conditions: the difference between the behavior occurrence time of this behavior edge and the behavior occurrence time of the first behavior edge must not exceed 2 hours of the total attack duration, and the behavior occurrence time of this behavior edge must be greater than the behavior occurrence time of the previous behavior edge in the target attack chain.

[0103] After the above query steps, each queried first row edge satisfies the preset first direction and the second additional query condition indicated by the query parameters and / or the default condition of the target attack chain itself. If the first row edge in the attack chain does not satisfy the second additional query condition and / or the default condition of the target attack chain itself, for example, if the behavior of the edge occurs later than the attack end time indicated by the query parameters at 11:00 AM on March 3rd, or if the number of behavior edges in the attack chain (including the queried behavior edge) is greater than the maximum step size of 10, then the attack chain is deleted. It should be noted that if this attack chain has other branches, that is, if the attack chain to be deleted shares nodes and edges with other attack chains, deleting the attack chain to be deleted will not affect other attack chains that share nodes and edges.

[0104] In an optional embodiment, the query parameters may include descriptions of the starting query node and the ending query node. The description of the ending query node includes its type and attribute value. In this case, the attack chain retrieved based on the query parameters is a chain of attack behaviors from the starting query node to the ending query node. Specifically, the starting query node can be the starting node of the attack chain, in which case the ending query node is the ending node, and the direction of the behavior edge query is the outgoing edge direction of the node; alternatively, the starting query node can also be the ending node of the attack chain, in which case the ending query node is the starting node, and the direction of the behavior edge query is the incoming edge direction of the node. Both methods can retrieve the attack behavior chain from the starting query node to the ending query node.

[0105] To find the attack chain from the starting query node to the ending query node, the peer node of the lower-level node connected by the edge in the first row must satisfy the third additional query condition in the query parameters. The type and attribute value of the ending query node are used to indicate the third additional query condition. The query process is described below:

[0106] Take the peer node of the lower-level node connected by the edge in the first row as the current node, and repeat the above query steps, including: if the peer node of the lower-level node connected by the edge in the first row satisfies the third additional query condition indicated by the query parameters, then take the peer node as the current node and repeat the above query steps.

[0107] After obtaining the first row of edges and the peer nodes of the lower-level nodes connected by the first row of edges, it is determined whether the peer node satisfies the third additional query condition indicated by the query parameters. For example, it is determined whether the peer node does not conform to the type and attribute value of the termination query node. If the peer node does not conform to the type and attribute value of the termination query node, it is considered that the peer node satisfies the third additional query condition indicated by the query parameters, and the peer node can be used as the current node to repeat the above query steps. Not conforming to the type and attribute value of the termination query node means that the peer node is not a termination query node and does not belong to the termination query node.

[0108] If the peer node matches the type and attribute value of the termination query node, then the peer node is considered not to meet the third additional query condition indicated by the query parameters. Matching the type and attribute value of the termination query node means that the peer node is a termination query node or belongs to the termination query node group.

[0109] It should be noted that if the peer node satisfies the third additional query condition indicated by the query parameters, it means that no attack chain from the starting query node to the ending query node has been found, so the query steps can continue to be repeated. If the peer node does not meet the third additional query condition, it means that the peer node matches the type and attribute value of the ending query node. This attack chain is a chain from the starting query node to the ending query node; therefore, attack chains where the peer node does not meet the third additional query condition are output as existing attack chains. For other attack chains that satisfy the third additional query condition indicated by the query parameters, the query continues until the query terminates.

[0110] The first additional query condition, the second additional query condition, the default condition of the target attack chain itself, and the third additional query condition mentioned above can be used in any combination or individually.

[0111] In the above implementation process, during the query of the target attack chain, the query parameters can be used to filter behavior edges or nodes during the query process or to filter attack chains after the query. In addition to the query parameters, the query can also be based on the default conditions of the target attack chain itself, thereby supporting the flexible construction of different query logics to meet different levels of query needs (such as the need for query efficiency, storage space, and coding complexity). Furthermore, the query of the target attack chain can be refined through a variety of optional query conditions to make the queried target attack chain more in line with the requirements.

[0112] Optionally, in this embodiment, the method further includes: displaying the target attack chain on a visual interface; the display state of the target attack chain includes a micro state, a macro state, and an intermediate state. Visualization is a human-computer interaction interface display method, such as a front-end page, an interface within an application, etc.

[0113] The display of a target attack chain can be based on formatted data corresponding to the target attack chain. Formatted data can include data in formats such as JSON and XML; the following discussion primarily uses JSON data as an example. The JSON data corresponding to a target attack chain includes at least the nodes in the target attack chain, node attributes, edges, and edge attributes. Nodes can be identified by their unique identifier (node ​​ID) in the graph structure. Node attributes include at least one of the following: node type, node attribute value, node importance score, and node label. Edges can be identified by their unique identifier (edge ​​ID) in the graph structure. Edge attributes include at least one of the following: the number of the target attack chain corresponding to the edge, edge type, the affiliation relationship between the nodes connected by the edge, the time of the action of the action edge, the action between the entities corresponding to the action edge, the source node of the edge, the destination node of the edge, the danger score of the action edge, and the label of the action edge. The JSON data may also include the score corresponding to the target attack chain (how to calculate this score will be explained later).

[0114] The JSON data corresponding to an exemplary target attack chain can be:

[0115]

[0116]

[0117]

[0118] The target attack chain in the above JSON data is numbered 0 (gourpId=0), and the corresponding score is 0.99183742884. The following describes the edges and their attributes in the target attack chain numbered 0. The relationships section is a collection of edges.

[0119] The ID of the first edge is 16303. The attribute values ​​of edge 16303 include: the source of the edge is node 3809, the type of the edge is a behavioral edge, the danger score of the behavioral edge is 0.8, the time of occurrence of the behavioral edge is 986400000, the behavior between the entities corresponding to the behavioral edge is "ordinary remote control Trojan activity event", the target of the edge is node 17468, the source node of the behavioral edge is node 3809, the destination node of the behavioral edge is node 17468, and the label of the behavioral edge is attack.

[0120] The ID of the second edge is 20858; the attribute values ​​of edge 20858 include the source node being node 17468, the type being a belonging edge, the node importance score of the belonging edge being 0, the belonging relationship update time of the belonging edge being 986400000, the target node of the edge being node 2724, the source node of this belonging edge being node 17468, the destination node of the belonging edge being node 2724, and the label of the behavior edge being a belonging edge.

[0121] The target attack chain numbered 0 also includes edges 12638 and 20349, and each edge has corresponding attributes, which will not be described in detail here.

[0122] The following describes the nodes and their attributes in the target attack chain numbered 0. The "nodes" section is a collection of nodes. The source node of edge 16303 is numbered 3809. The attributes of node 3809 include an IP address of "23.233.23.233", an IP identifier of 3809, a node importance score of 0.8, and a node type of IP (network interface node).

[0123] The destination node of edge 16303 is numbered 17468. The attributes of node 17468 include port address "33.99.99.33", port number 46376, port identifier 2724, node importance score of 0, and node type is port (port node).

[0124] The target attack chain numbered 0 also includes nodes 2724, 15278, and 5453. Each node has corresponding attributes, which will not be described in detail here.

[0125] Based on the data in the JSON format above, the target attack chain numbered 0 can be determined as follows: network card node 3809 is connected to port node 17468 through behavior edge 16303. The source node of behavior edge 16303 is network card node 3809, and the destination node of behavior edge 16303 is port node 17468.

[0126] Port node 17468 is connected to network interface card node 2724 through home edge 20858. The source node of home edge 20858 is port node 17468 and the destination node is network interface card node 2724, indicating that port node 17468 belongs to network interface card node 2724.

[0127] Network interface node 2724 is connected to port node 15278 through behavior edge 12638. The source node of behavior edge 12638 is network interface node 2724, and the destination node of behavior edge 12638 is port node 15278.

[0128] Port node 15278 is connected to network card node 5453 through home edge 20349. The source node of home edge 20349 is port node 15278, and the destination node of home edge 20349 is IP node 5453, indicating that port node 15278 belongs to network card node 5453.

[0129] The following section explains the various display states of the target attack chain using the JSON format data corresponding to the target attack chain mentioned above.

[0130] Please see Figure 3 The diagram illustrates the micro-state of the target attack chain provided in this embodiment of the application. The micro-state refers to the complete display of all nodes in the target attack chain and the edges between them.

[0131] The micro-level target attack chain displays all nodes and edges included in the attack chain. In the micro-level display interface, hovering the mouse over a node in the target attack chain displays its description information, including the node's type and / or attribute values. For example, if the node type is a network interface card (NIC) node, the attribute value could be the NIC's IPv4 address; if the node type is a device node, the attribute value could be the device node's ID, etc. Hovering the mouse over an edge in the target attack chain displays the edge's attributes, including its type, which can be either a behavioral edge or an attribute edge. If the edge being hovered over is a behavioral edge, its attributes may also include the time the behavioral event occurred and the edge's risk score, etc.

[0132] like Figure 3 The microscopic state of the target attack chain shown is as follows: network interface node 3809 is connected to port node 17468, port node 17468 is connected to network interface node 2724, network interface node 2724 is connected to port node 15278, and port node 15278 is connected to network interface node 5453. Hovering the mouse over the edge connecting network interface node 3809 and port node 17468 displays the edge type as an action edge, the time of occurrence of the action edge, and the event that occurred.

[0133] As one example, different types of nodes can be distinguished by their color (or other graphical attributes). That is, different node types can be represented by different colors. For example, network card nodes 3809, 2724, and 5453 are displayed in one color, while port nodes 17468 and 152783 are displayed in another color. Of course, different types of edges can also be distinguished by color (or other graphical attributes).

[0134] Please see Figure 4 The diagram shown illustrates the macroscopic state of the target attack chain provided in this embodiment of the application. The macroscopic state refers to showing only the top-level nodes and the edges between them in the target attack chain. The edges between the top-level nodes are obtained by aggregating the edges between the lower-level nodes of the two top-level nodes.

[0135] In the macro-state display interface, only the top-level node in the target attack chain and the edges between two top-level nodes are shown. The top-level node is explained in step (1). Here, the top-level node represents all the lower-level nodes (including the top-level node itself) belonging to that top-level node. Alternatively, it can be considered that the top-level node in the macro-state display is obtained by aggregating all the lower-level nodes belonging to that top-level node and their respective edges. Placing the mouse over the top-level node will display the information of all the nodes represented by the top-level node. The interface used for macro-state display and the interface used for micro-state display can be the same interface, only the form of the target attack chain displayed on the interface will be switched.

[0136] In particular, top-level nodes may also have edges pointing to themselves. For example, if the top-level node is a device node, the lower-level nodes belonging to this device node include multiple network interface card (NIC) nodes and itself. These multiple NIC nodes are connected by edges. Such edges are represented in the macroscopic display by the top-level node pointing to itself.

[0137] The edges between top-level nodes are aggregated from the edges (behavioral edges) between the respective lower-level nodes of the two top-level nodes. Therefore, the edges between top-level nodes may not be actual edges in the attack chain, but rather used for macroscopic visualization. Hovering the mouse over the edge between top-level nodes will display information about all the edges used to aggregate this edge.

[0138] like Figure 4As mentioned above, in the target attack chain numbered 0 displayed in the JSON format, network interface node 3809 does not have a top-level node to which it belongs. Therefore, there is no need for aggregation, and network interface node 3809 is displayed as the top-level node in the macro state. Port node 17468 belongs to network interface node 2724. Therefore, in the macro state, port node 17468 and the belonging edge between port node 17468 and network interface node 2724 are aggregated into network interface node 2724. That is, network interface node 2724 represents the belonging edge between network interface node 2724, port node 17468, and network interface node 2724 and port node 17468. Similarly, port node 15278 belongs to network interface card (NIC) node 5453. In the macroscopic state, port node 15278 and the belonging edge between port node 15278 and NIC node 5453 are aggregated into NIC node 5453. That is, NIC node 5453 represents NIC node 5453, port node 15278, and the belonging edge between NIC node 5453 and port node 15278. After node aggregation, the behavioral edges connected to the nodes are also aggregated: the behavioral edge connecting port node 17468 and NIC node 3089 is aggregated into the edge connecting NIC node 2724 and NIC node 3089, and the behavioral edge connecting port node 15278 and NIC node 2724 is aggregated into the edge connecting NIC node 5453 and NIC node 2724.

[0139] Therefore, the target attack chain numbered 0, in its macroscopic state, includes network interface card (NIC) nodes 3809, 2724, and 5453, the edge between NIC nodes 3809 and 2724, and the edge between NIC node 2724 and 5453. Aggregated edges can be represented by dashed lines. Figure 4 The text also shows some edges pointing to themselves from the network card node.

[0140] Intermediate state refers to the state of presentation between micro and macro states. For example, in a target attack chain, some of the lower nodes of the top-level nodes are fully aggregated, some of the lower nodes of the top-level nodes are fully expanded, and some of the lower nodes of the top-level nodes are not fully expanded (e.g., only expanded to a certain level, but not the lowest level node).

[0141] The display state changes in response to state switching actions triggered on the visualization interface. For example, if the visualization interface has a state switching button, the user can trigger a state switching action by clicking the button, allowing them to switch between three display states. Another example is that clicking a top-level node can trigger a state switching action. For instance, in the macro-level visualization interface, clicking a top-level node can switch the display state from the macro-level state to an intermediate state, displaying all nodes subordinate to that top-level node and the edges between them. Clicking the top-level node again collapses all nodes subordinate to that top-level node and the edges between them, returning the display state from the intermediate state back to the macro-level display.

[0142] As an implementer, clicking on the top-level node switches the display state from a macroscopic state to an intermediate state, showing the first-level subordinate nodes of that top-level node and the belonging edges between the top-level node and the first-level subordinate nodes (behavioral edges also expand to the first level accordingly). For example, the top-level node is device node A. Network interface card node B and software node C belong to device node A and are directly connected to device node A through belonging edges; process node D belongs to device node A, but is not directly connected to device node A, but is connected to software node C through a belonging edge. In the macroscopic state, device node A represents the belonging edges between device node A, network interface card node B, software node C, process node D, device node A and network interface card node B, device node A and software node C, and device node A and process node D. Clicking on device node A expands network interface card (NIC) node B and software node C, which belong to device node A and are directly connected to it. It also displays the belonging edges between device node A and NIC B, and between device node A and software node C, but does not display process node D. You can further expand process node D and the belonging edges between software node C and process node D by clicking on software node C.

[0143] Understandably, in order to clearly present the ownership relationship of each node within a limited space, the spatial allocation and arrangement of nodes can be considered when displaying the visualization interface. For example, when displaying the macro state, some space can be reserved next to the top-level node so that there is enough space to display the nodes under the top-level node after switching to the micro state display.

[0144] In the above implementation process, the macroscopic display presents key information in the target attack chain from a macro perspective, clearly showing the relationships and interactions between them, thus enabling faster location of key nodes. The microscopic display delves into the details of the target attack chain at a micro level, showing more detailed and specific information to facilitate further analysis. The intermediate display can show both key information in the target attack chain and detailed information on key nodes, flexibly meeting different user display needs.

[0145] The target attack chain can be displayed in the visualization interface as described above. Alternatively, in another optional embodiment, the target attack chain can be obtained by calling an interface. The target attack chain can be sent to the user program as data in JSON format.

[0146] Optionally, in this embodiment, the attributes of nodes in the graph structure include node importance scores, which are used to characterize the importance of the entity corresponding to the node; the node importance score is positively correlated with the importance of the entity.

[0147] The attributes of behavioral edges in a graph structure include a hazard score, which characterizes the degree of danger of the behavior corresponding to the behavioral edge; the hazard score is positively correlated with the degree of danger of the behavior.

[0148] Node importance scores and hazard scores for behavioral edges can be obtained from the log data used to construct the graph structure. For example, if the log data includes node importance scores, these scores can be read from the log data. If the log data does not include node importance scores, the scores can be obtained based on the number of connections and / or connection frequency. For instance, if device A is connected to by 10 machines in a day (high connection frequency), then device A is relatively important, and its node importance score can be set to high; if only 1 machine connects to device A in a day (high connection frequency), then device A is not very important, and its node importance score can be set to low. As one implementation, the number of connections and / or connection frequency of nodes can be divided into intervals, with each interval having a corresponding node importance score. The node importance score is determined based on the number of connections or the interval in which the connection is located.

[0149] The danger score of a behavior edge can be obtained by mapping the labels or ratings of behaviors occurring between nodes in the log data. For example, the labels or ratings of behaviors recorded in the log data can be normalized to obtain the danger score of the behavior edge. Normalization can include the following two cases: First, if the log data records behavior ratings, it is necessary to determine whether the behavior rating falls within a preset danger score range for the behavior edge. For example, if the preset danger score range is 0-1, and the ratings of the behaviors recorded in the log data are 0-100, then the behavior rating is mapped to the range of 0-1 based on the preset danger score range and the behavior rating. Second, if the log data records behavior labels, the danger score of the behavior edge is mapped based on the behavior label. For example, if the behavior label is "dangerous" or "attack," the danger score of the behavior edge can be mapped to 1; if the behavior label is "safe" or "normal," the danger score of the behavior edge can be mapped to 0.

[0150] If the log data does not record the label or score of the behavior, the danger score of the behavior edge in the log can be determined according to the log type. For example, for traffic logs, the danger score of the behavior edge can be mapped to 0.

[0151] After obtaining the target attack chain that matches the query parameters, the method further includes: obtaining the attack chain score corresponding to the target attack chain based on at least one of the following: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. The node importance score of the nodes in the target attack chain can be the sum of the node importance scores of the nodes in the target attack chain (or other calculation results), and the danger score of the behavioral edges in the target attack chain can be the sum of the danger scores of the behavioral edges in the target attack chain (or other calculation results).

[0152] The score corresponding to the target attack chain can reflect the degree of danger of the attack chain. Therefore, based on the attack chain score corresponding to the target attack chain, the degree of danger of the target attack chain can be reflected, thereby quickly identifying the target attack chain that needs to be analyzed, and more effectively blocking the attacker's behavior or strengthening the defense.

[0153] As one implementation method, the attack chain score of an existing attack chain can be determined based on at least one of the following: the node importance score of a node in the target attack chain, the danger score of a behavior edge in the target attack chain, and the number of behavior edges in the target attack chain. Then, the target attack chain can be selected based on the existing attack chain score. For example, if the maximum number of returned entries in the query parameters is 10, the 10 attack chains with the highest scores can be selected from the existing attack chains based on the attack chain score as the target attack chain output.

[0154] In the above implementation process, the attack chain score corresponding to the target attack chain is calculated. The attack chain score can serve as an important warning signal and reference, helping to quickly identify vulnerabilities that attackers can easily exploit, thereby enabling security protection measures, optimizing the protection system, and improving network security. Furthermore, the attack chain score is influenced by three factors: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. This makes the evaluation dimensions of the attack chain score relatively comprehensive and reasonable.

[0155] Optionally, in this embodiment, the attack chain score is positively correlated with the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. This positive correlation can be linear or non-linear. The attack chain score can roughly reflect the overall situation of the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and / or the number of behavioral edges in the target attack chain.

[0156] In the above implementation process, since the node importance score can characterize the importance of the entity corresponding to the node, and the more important these entities are, the more severe the harm caused by an attack on them, the attack chain score can be set to be positively correlated with the node importance score of the nodes in the target attack chain. Similarly, since the danger score of a behavior edge can characterize the danger level of the behavior corresponding to that edge, and the more dangerous the behavior between entities, the more likely these behaviors are to be attack behaviors, and the more severe the harm caused, the attack chain score can be set to be positively correlated with the danger score of the behavior edges in the target attack chain. Furthermore, the greater the number of behavior edges in the attack chain, the wider the scope of the attack chain and the more entities that may be attacked, thus the attack chain score can be set to be positively correlated with the number of behavior edges in the target attack chain. Therefore, setting the attack chain score to be positively correlated with the above three factors is reasonable.

[0157] Optionally, in this embodiment, considering that the number of action edges in the target attack chain is not equal, if the number of action edges is linearly correlated with the attack chain score, then the attack chain score will be overly sensitive to the number of action edges. For example, the attack chain score of a target attack chain with 100 action edges will be significantly different from that of a target attack chain with 5 action edges. The node importance score of the nodes in the target attack chain and the danger score of the action edges in the target attack chain are unlikely to affect this score difference. However, in reality, the danger level of a target attack chain with 5 action edges is not necessarily lower than that of a target attack chain with 100 action edges. In this case, the reference significance of the attack chain score is not great.

[0158] The same applies to node importance scores. If a node in an attack chain has a high importance score, even if the danger score of the edges in the target attack chain and the number of edges in the target attack chain are small, using a linear correlation expression will still result in a high attack chain score. If a linear correlation expression is used, the attack chain score increases with any one of the following: node importance score, danger score of edges in the target attack chain, or number of edges in the target attack chain. Theoretically, none of these three parameters have a fixed upper limit; therefore, the range of attack chain scores is not finite.

[0159] Therefore, in order to prevent the attack chain score from being overly sensitive to any of the following factors: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain, a preset relational function can be used to obtain the attack chain score corresponding to the target attack chain. The value range of the preset relational function is a finite interval, which locks the attack chain score within a finite interval, making it more meaningful and valuable for reference.

[0160] The attack chain score is obtained based on at least one of the following: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. This includes: using a preset relation function to obtain the attack chain score based on at least one of the following: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain; the value range of the preset relation function is a finite interval.

[0161] For example, the preset relational function could be:

[0162]

[0163] Here, Score represents the attack chain score. The sum of the node importance score of the nodes in the target attack chain, the danger score of the action edges in the target attack chain, and the number of action edges in the target attack chain is a positive number. Therefore, the value range of this relational function is (0.5, 1). The higher the attack chain score, the higher the danger level of the attack chain. That is, the closer the attack chain score is to 0.5, the less dangerous the attack chain is, and the closer the attack chain score is to 1, the more dangerous the attack chain is.

[0164] The attack chain score is determined by the above relational function. The scores of all target attack chains are locked within a limited range of (0.5,1). The attack chain score will not fail to reflect the true danger of the target attack chain due to any one of the three factors being too large: the node importance score of the node in the target attack chain, the danger score of the behavior edge in the target attack chain, or the number of behavior edges in the target attack chain. This reduces the sensitivity of the score to input factors.

[0165] In the above implementation process, by using a relational function with a finite range to calculate the attack chain score, the attack chain score is not overly sensitive to any of the following: the node importance score of the node in the target attack chain, the danger score of the behavioral edge in the target attack chain, and the number of behavioral edges in the target attack chain. Such a score is more meaningful and valuable.

[0166] Optionally, in this embodiment of the application, before determining the starting query node from the graph structure based on the query parameters, the method further includes: constructing the graph structure. The construction process may include:

[0167] Step 1: Extract entities and relationships between entities from the log data.

[0168] Log data generated on the network can be obtained using log collection tools. This log data records events, errors, warnings, or other important information during program or system execution. The source of this log data can be heterogeneous, originating from ordinary network devices, network security devices, databases, etc., and this heterogeneous log data is then integrated. Preprocessing of the acquired log data includes steps such as log data cleaning, format standardization, and field definition. Some log data records the start and end entities of events or operations; that is, the log is point-to-point. Therefore, the log data can be split into start nodes, target nodes, and edges. The start and target nodes represent entities, and the edges between them represent relationships between entities. The splitting process, for example, involves entity extraction from the preprocessed log data. This can be done based on rules, or using supervised or unsupervised learning methods to identify named entities and relationships within the logs.

[0169] Relationships between entities include the actions that occur between them and their affiliation. Actions between entities can be extracted based on specific log formats or patterns, or using a trained relation extraction model. During this process, attributes such as the time of occurrence can also be extracted. Of course, attributes of action edges can also be customized as needed. Affiliation relationships between entities can be obtained through semantic recognition of log data. For example, if the log records that process C of software B on device A executed a certain event, then the affiliation relationship between process C and software B can be obtained as process C belongs to software B, and the affiliation relationship between software B and device A can be obtained as software B belongs to device A.

[0170] After extracting entities and the relationships between them, a fusion operation can be performed. For example, the same attack behavior may generate different alarm messages from different data sources. An algorithm can be used to merge these two alarm messages into one to avoid duplicate entities and relationships between them.

[0171] Step 2: Generate nodes in the graph structure based on entities, and generate edges between nodes based on relationships between entities; behaviors between entities are used to generate behavioral edges between nodes, and ownership relationships between entities are used to generate ownership edges between nodes.

[0172] After obtaining the nodes, they can be classified according to the Logical Data Model (LDM). The LDM includes data access standards for each type, which specifies which fields are included in the node data for each type. For example, device nodes have preset fields, and each field has a preset type. If node data matches the preset field and the preset type of the field, it can be identified as a device node.

[0173] The process of node classification is to map the starting node and / or target node obtained from log data to different types of nodes in the graph structure. For example, system logs describe the relationships between processes, and the starting and ending nodes in the system logs can be mapped to process nodes. Similarly, security logs describe the relationships between IPs, and the starting and ending nodes in the security logs can be mapped to network interface card nodes, and so on.

[0174] In an optional embodiment, the behaviors occurring between entities corresponding to the behavioral edges can be categorized, including: a network interface card (NIC) node accessing another NIC node (NIC node), with the corresponding behavioral edge type being "access"; a NIC node logging into another NIC node, with the corresponding behavioral edge type being "login"; a process node connecting to another NIC node, with the corresponding behavioral edge type being "external connection"; a process node accessing another process node, with the corresponding behavioral edge type being "access"; a process node injecting into another process node, with the corresponding behavioral edge type being "injection"; a process node creating another process node, with the corresponding behavioral edge type being "creation"; a process node listening to a port node, with the corresponding behavioral edge type being "listening"; and a NIC node accessing a port node, with the corresponding behavioral edge type being "access". The target attack chain can be displayed on a visual interface while simultaneously showing the types of behavioral edges, allowing users to see more detailed information and determine corresponding protective measures based on the behavioral type.

[0175] Optionally, once the graph structure is built, it can be stored in a graph database (e.g., Neo4j, JanusGraph, etc.), and the attack chain can be queried directly from the graph database later.

[0176] In the above implementation process, a graph structure for attack chain query is constructed based on the log data generated by network devices. The log data has a rich source and a huge amount of data. The constructed graph structure can comprehensively reflect the entities in the network and the relationships between them. Based on this graph structure, a comprehensive and accurate attack chain query can be performed.

[0177] Please see Figure 5 The diagram shown is a structural schematic of the attack chain query device provided in an embodiment of this application; this application provides an attack chain query device 200, including:

[0178] The parameter acquisition module 210 is used to obtain query parameters, which include the description information of the starting query node;

[0179] The query module 220 is used to determine the starting query node from the graph structure according to the query parameters, and to perform attack chain query along the edges between the nodes in the graph structure starting from the starting query node, so as to obtain the target attack chain that meets the query parameters; wherein, the graph structure includes nodes and edges between nodes, the nodes represent entities in the network, the edges between nodes represent the relationships between the entities, the edges between nodes include behavioral edges, the behavioral edges represent the behaviors that occur between entities, and the attack chain represents the chain of attack behaviors that exist between entities.

[0180] Optionally, in this embodiment of the application, the attack chain query device further includes belonging edges between nodes; the belonging edges are used to describe the belonging relationship between entities; the query module is further configured to start from the current node, query upwards along the belonging edges in the graph structure to obtain the top-level node to which the current node belongs; at the start of the query, the current node is the starting query node; starting from the top-level node, query downwards along the belonging edges in the graph structure to obtain the lower-level nodes belonging to the top-level node; query the first row edge in the first direction from the row edges connected to the lower-level nodes in the graph structure; if the starting query node is the starting node of the attack chain, then the first direction is the outgoing edge direction of the lower-level node; if the starting query node is the ending node of the attack chain, then the first direction is the incoming edge direction of the lower-level node; take the opposite node of the lower-level node connected by the first row edge as the current node, repeat the above query steps until the query terminates, and obtain the existing attack chain formed based on the path in the graph structure traversed during the query process; determine the target attack chain based on the existing attack chain.

[0181] Optionally, in this embodiment of the application, the attack chain query device and the query module are further configured to: filter existing attack chains according to the first additional query conditions indicated by the query parameters and / or the default conditions of the target attack chain itself, to obtain the target attack chain; and / or: query the first row edge in the first direction from the row edges connected to the lower-level nodes of the graph structure, which satisfies the second additional query conditions indicated by the query parameters and / or the default conditions of the target attack chain itself; and / or: if the peer node of the lower-level node connected to the first row edge satisfies the third additional query conditions indicated by the query parameters, then the peer node is taken as the current node, and the above query steps are repeated.

[0182] Optionally, in this embodiment of the attack chain query device, the description information of the starting query node in the query parameters includes the type of the starting query node and / or the attribute value of the starting query node; the query parameters also include at least one of the following: the type of the ending query node; the attribute value of the ending query node; whether to filter ordinary behavior: the attribute of the behavior edge in the graph structure includes a danger score, which is used to characterize the degree of danger of the behavior corresponding to the behavior edge; if the danger score exceeds a threshold, the behavior edge corresponds to an attack behavior; if the danger score does not exceed the threshold, the behavior edge corresponds to an ordinary behavior; if the query parameter is to filter ordinary behavior, then only behavior edges containing the corresponding attack behavior are allowed in the target attack chain; if the query parameter is not to filter ordinary behavior, then behavior edges containing the corresponding ordinary behavior are allowed in the target attack chain; total attack duration: the attribute of the behavior edge in the graph structure includes the behavior occurrence time, the occurrence time of the first behavior edge and the last behavior edge in the target attack chain. The difference does not exceed the total attack duration; Attack occurrence time: The attributes of the behavioral edges in the graph structure include the behavior occurrence time, and the behavior occurrence time of the first behavioral edge in the target attack chain is not earlier than the attack occurrence time; Attack end time: The attributes of the behavioral edges in the graph structure include the behavior occurrence time, and the behavior occurrence time of the last behavioral edge in the target attack chain is not later than the attack end time; Minimum step size: The number of behavioral edges in the target attack chain is not less than the minimum step size; Maximum step size: The number of behavioral edges in the target attack chain is not greater than the maximum step size; Maximum number of returned entries: The number of target attack chains is not greater than the maximum number of returned entries; The type of the terminating query node and the attribute value of the terminating query node are used to indicate the third additional query condition; Whether to filter ordinary behavior, total attack duration, attack occurrence time, attack end time, maximum step size, and maximum number of returned entries are used to indicate the first or second additional query condition; The minimum step size is used to indicate the first additional query condition.

[0183] Optionally, in this embodiment of the attack chain query device, the attributes of the behavioral edges in the graph structure include the behavior occurrence time, and the default conditions of the target attack chain itself include: if the starting query node is the starting node of the target attack chain, then the behavior occurrence time of each behavioral edge in the target attack chain except the first one is greater than the behavior occurrence time of the previous behavioral edge in the target attack chain; if the starting query node is the ending node of the target attack chain, then the behavior occurrence time of each behavioral edge in the target attack chain except the last one is less than the behavior occurrence time of the next behavioral edge in the target attack chain.

[0184] Optionally, in this embodiment of the application, the attack chain query device further includes: a display module, used to display the target attack chain on a visual interface; the display state of the target attack chain includes a micro state, a macro state, and an intermediate state; the micro state refers to the complete display of all nodes in the target attack chain and the edges between nodes, the macro state refers to the display of only the top-level nodes and the edges between the top-level nodes in the target attack chain, and the edges between the top-level nodes are obtained by aggregating the edges between the lower-level nodes of the two top-level nodes; the intermediate state refers to the display state between the micro state and the macro state; the display state is switched in response to a state switching operation triggered on the visual interface.

[0185] Optionally, in this embodiment of the application, the attack chain query device includes: the node attributes in the graph structure include a node importance score, which is used to characterize the importance of the entity corresponding to the node; the behavior edge attributes in the graph structure include a danger score, which is used to characterize the danger level of the behavior corresponding to the behavior edge; and further includes: an attack chain score calculation module, used to obtain the attack chain score corresponding to the target attack chain based on at least one of the node importance score of the node in the target attack chain, the danger score of the behavior edge in the target attack chain, and the number of behavior edges in the target attack chain.

[0186] Optionally, in the embodiments of this application, the attack chain query device and the attack chain score calculation module are positively correlated with the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain.

[0187] Optionally, in this embodiment of the application, the attack chain query device and the attack chain score calculation module are specifically used to obtain the attack chain score corresponding to the target attack chain by using a preset relation function based on at least one of the node importance score of the node in the target attack chain, the danger score of the behavior edge in the target attack chain, and the number of behavior edges in the target attack chain; the value range of the preset relation function is a finite interval.

[0188] Optionally, in the embodiments of this application, the attack chain query device includes at least one of the following types of nodes in the graph structure: device node, network card node, process node, port node, software node, and vulnerability node; the attribution relationship between entities includes at least one of the following: network card node belongs to device node, port node belongs to network card node, software node belongs to device node, process node belongs to software node, and vulnerability node belongs to software node.

[0189] Optionally, in this embodiment of the application, the attack chain query device further includes: a graph structure generation module, used to extract entities and relationships between entities from log data; the relationships between entities include behaviors between entities and ownership relationships between entities; generating nodes in the graph structure based on entities, and generating edges between nodes in the graph structure based on the relationships between entities; behaviors between entities are used to generate behavioral edges between nodes, and ownership relationships between entities are used to generate ownership edges between nodes.

[0190] It should be understood that this device corresponds to the attack chain query method embodiment described above and is capable of executing the various steps involved in the above method embodiment. The specific functions of this device can be found in the description above, and detailed descriptions are omitted here to avoid repetition. The device includes at least one software functional module that can be stored in memory or embedded in the device's operating system (OS) in the form of software or firmware.

[0191] Please see Figure 6 The diagram shows a structural schematic of an electronic device provided in an embodiment of this application. An electronic device 300 provided in this application includes a processor 310 and a memory 320. The memory 320 stores machine-readable instructions executable by the processor 310. When the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0192] This application also provides a storage medium storing a computer program, which is executed by a processor to perform the above-described method.

[0193] The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0194] The above description is only an optional implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any combination, variation or substitution scheme that can be easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application.

Claims

1. An attack chain query method, characterized in that, include: Obtain query parameters, which include description information of the starting query node; Based on the query parameters, the starting query node is determined from the graph structure, and starting from the starting query node, an attack chain query is performed along the edges between nodes in the graph structure to obtain the target attack chain that matches the query parameters; wherein, the graph structure includes nodes and edges between nodes, the nodes represent entities in the network, the edges between nodes represent the relationships between the entities, the edges between nodes include behavioral edges, the behavioral edges represent the behaviors that occur between the entities, and the attack chain represents the chain of attack behaviors that exist between the entities; The edges between the nodes also include belonging edges; the belonging edges are used to describe the belonging relationship between the entities; the step of starting from the initial query node, performing an attack chain query along the edges between the nodes in the graph structure to obtain the target attack chain that matches the query parameters includes: Starting from the current node, query upwards along the belonging edges in the graph structure to obtain the top-level node to which the current node belongs; at the start of the query, the current node is the starting query node; Starting from the top-level node, query downwards along the belonging edges in the graph structure to obtain the lower-level nodes that belong to the top-level node; The first row edge in the first direction is queried from the row edges connected to the lower-level nodes in the graph structure; if the starting query node is the starting node of the attack chain, then the first direction is the outgoing edge direction of the lower-level node; if the starting query node is the ending node of the attack chain, then the first direction is the incoming edge direction of the lower-level node. Take the peer node of the lower-level node connected by the first row edge as the current node, repeat the above query steps until the query terminates, and obtain the existing attack chain based on the path in the graph structure traversed during the query process. The target attack chain is determined based on the existing attack chain; The query parameters include at least one of the following: Whether to filter ordinary behavior: The attributes of the behavior edges in the graph structure include a danger score, which is used to characterize the degree of danger of the behavior corresponding to the behavior edge; if the danger score exceeds a threshold, the behavior edge corresponds to an attack behavior; if the danger score does not exceed the threshold, the behavior edge corresponds to an ordinary behavior; if the query parameter is to filter ordinary behavior, then the target attack chain is only allowed to contain behavior edges corresponding to the attack behavior; if the query parameter is not to filter ordinary behavior, then the target attack chain is allowed to contain behavior edges corresponding to the ordinary behavior. Total attack duration: The attributes of the behavioral edges in the graph structure include the time of occurrence of the behavior, and the difference between the occurrence times of the first and last behavioral edges in the target attack chain does not exceed the total attack duration.

2. The method according to claim 1, characterized in that, The step of determining the target attack chain based on the existing attack chains includes: filtering the existing attack chains according to the first additional query conditions indicated by the query parameters and / or the default conditions of the target attack chain itself to obtain the target attack chain; and / or; Querying the first behavioral edge in the first direction from the behavioral edges of the graph structure connected to the lower-level nodes includes: querying the first behavioral edge in the first direction from the behavioral edges of the graph structure connected to the lower-level nodes, which satisfies the second additional query condition indicated by the query parameters and / or the default condition of the target attack chain itself; and / or; The step of taking the peer node of the lower-level node connected by the first row edge as the current node and repeating the above query steps includes: if the peer node of the lower-level node connected by the first row edge satisfies the third additional query condition indicated by the query parameter, then taking the peer node as the current node and repeating the above query steps.

3. The method according to claim 2, characterized in that, The description information of the starting query node in the query parameters includes the type of the starting query node and / or the attribute value of the starting query node; the query parameters also include at least one of the following: The type of node to terminate the query; Terminate the query for the node's attribute value; Attack occurrence time: The attribute of the behavior edge in the graph structure includes the behavior occurrence time, and the behavior occurrence time of the first behavior edge in the target attack chain is not earlier than the attack occurrence time; Attack end time: The attributes of the behavioral edges in the graph structure include the behavior occurrence time, and the behavior occurrence time of the last behavioral edge in the target attack chain is no later than the attack end time; Minimum step size: The number of behavioral edges in the target attack chain is not less than the minimum step size; Maximum step size: The number of behavioral edges in the target attack chain is not greater than the maximum step size; Maximum number of returned entries: The number of the target attack chains is not greater than the maximum number of returned entries; The type of the termination query node and the attribute value of the termination query node are used to indicate the third additional query condition; whether to filter ordinary behavior, the total attack duration, the attack occurrence time, the attack end time, the maximum step size, and the maximum number of returned entries are used to indicate the first additional query condition or the second additional query condition; the minimum step size is used to indicate the first additional query condition.

4. The method according to claim 2, characterized in that, The attributes of the behavioral edges in the graph structure include the behavior occurrence time. The default conditions of the target attack chain itself include: if the starting query node is the starting node of the target attack chain, then the behavior occurrence time of each behavioral edge in the target attack chain except the first one is greater than the behavior occurrence time of the previous behavioral edge in the target attack chain; if the starting query node is the ending node of the target attack chain, then the behavior occurrence time of each behavioral edge in the target attack chain except the last one is less than the behavior occurrence time of the next behavioral edge in the target attack chain.

5. The method according to claim 1, characterized in that, The method further includes: displaying the target attack chain on a visualization interface; the display state of the target attack chain includes a micro state, a macro state, and an intermediate state; the micro state refers to fully displaying all nodes in the target attack chain and the edges between nodes, the macro state refers to displaying only the top-level nodes and the edges between the top-level nodes in the target attack chain, the edges between the top-level nodes being the aggregation of the edges between the respective lower-level nodes of the two top-level nodes; the intermediate state refers to the display state between the micro state and the macro state; the display state is switched in response to a state switching operation triggered on the visualization interface.

6. The method according to claim 1, characterized in that, The attributes of the nodes in the graph structure include a node importance score, which characterizes the importance of the entity corresponding to the node; the attributes of the behavioral edges in the graph structure include a danger score, which characterizes the danger level of the behavior corresponding to the behavioral edge; the method further includes: The attack chain score corresponding to the target attack chain is obtained based on at least one of the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain.

7. The method according to claim 6, characterized in that, The attack chain score is positively correlated with the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain.

8. The method according to claim 6, characterized in that, The attack chain score is obtained based on at least one of the following: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain. This includes: Using a preset relational function, the attack chain score corresponding to the target attack chain is obtained based on at least one of the following: the node importance score of the nodes in the target attack chain, the danger score of the behavioral edges in the target attack chain, and the number of behavioral edges in the target attack chain; the value range of the preset relational function is a finite interval.

9. The method according to claim 1, characterized in that, The types of nodes in the graph structure include at least one of device nodes, network interface card (NIC) nodes, process nodes, port nodes, software nodes, and vulnerability nodes; the attribution relationships between the entities include at least one of the following: NIC nodes belong to device nodes, port nodes belong to NIC nodes, software nodes belong to device nodes, process nodes belong to software nodes, and vulnerability nodes belong to software nodes.

10. The method according to claim 1, characterized in that, Before determining the starting query node from the graph structure based on the query parameters, the method further includes: Extract the entities and relationships between them from the log data; the relationships between the entities include the actions that occur between the entities and the attribution relationships between them. Nodes in the graph structure are generated based on the entities, and edges between nodes in the graph structure are generated based on the relationships between the entities; the behaviors that occur between the entities are used to generate behavioral edges between the nodes, and the affiliation relationships between the entities are used to generate affiliation edges between the nodes.

11. An attack chain query device, characterized in that, include: The parameter acquisition module is used to acquire query parameters, which include the description information of the starting query node; The query module is used to determine the starting query node from the graph structure according to the query parameters, and to perform an attack chain query along the edges between the nodes in the graph structure starting from the starting query node to obtain the target attack chain that matches the query parameters; wherein, the graph structure includes nodes and edges between the nodes, the nodes represent entities in the network, the edges between the nodes represent the relationships between the entities, the edges between the nodes include behavioral edges, the behavioral edges represent the behaviors that occur between the entities, and the attack chain represents the chain of attack behaviors that exist between the entities. The edges between the nodes also include belonging edges; the belonging edges are used to describe the belonging relationship between the entities; the query module is specifically used to start from the current node, query upwards along the belonging edges in the graph structure to obtain the top-level node to which the current node belongs; at the start of the query, the current node is the starting query node; starting from the top-level node, query downwards along the belonging edges in the graph structure to obtain the lower-level nodes belonging to the top-level node; query the first row edge in the first direction from the row edges in the graph structure connected to the lower-level nodes; if the starting query node is the starting node of the attack chain, then the first direction is the outgoing edge direction of the lower-level node; if the starting query node is the ending node of the attack chain, then the first direction is the incoming edge direction of the lower-level node; take the opposite node of the lower-level node connected by the first row edge as the current node, repeat the above query steps until the query terminates, and obtain the existing attack chain formed based on the path in the graph structure traversed during the query process; determine the target attack chain based on the existing attack chain. The query parameters include at least one of the following: Whether to filter ordinary behavior: The attributes of the behavior edges in the graph structure include a danger score, which is used to characterize the degree of danger of the behavior corresponding to the behavior edge; if the danger score exceeds a threshold, the behavior edge corresponds to an attack behavior; if the danger score does not exceed the threshold, the behavior edge corresponds to an ordinary behavior; if the query parameter is to filter ordinary behavior, then the target attack chain is only allowed to contain behavior edges corresponding to the attack behavior; if the query parameter is not to filter ordinary behavior, then the target attack chain is allowed to contain behavior edges corresponding to the ordinary behavior. Total attack duration: The attributes of the behavioral edges in the graph structure include the time of occurrence of the behavior, and the difference between the occurrence times of the first and last behavioral edges in the target attack chain does not exceed the total attack duration.

12. A computer program product, characterized in that, It includes computer program instructions that, when executed by a processor, perform the method of any one of claims 1-10.

13. An electronic device, characterized in that, include: A processor and a memory, the memory storing computer program instructions that, when executed by the processor, perform the method as described in any one of claims 1 to 10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, perform the method as described in any one of claims 1 to 10.

Images