A method for tracing APT attacks by integrating sequence learning and causal analysis

Abstract

The present invention discloses an APT attack tracing method integrating sequence learning and causal analysis, including: obtaining system kernel logs and POI events, the system kernel logs including system kernel logs that have been attacked and those that have not been attacked; constructing a POI strong dependency influence module to obtain a POI strong dependency influence graph; adopting a key sequence recognition model training module to obtain a trained key sequence recognition model; tracing the APT attack through a key component recognition module, performing the following operations: inputting an embedded vector obtained based on the POI strong dependency influence graph into a trained model for recognition, identifying key processes and key events, combining key processes and key events into a key component graph, and realizing APT attack tracing according to the key component graph. The method can realize efficient, accurate, and fine-grained APT attack tracing, solve the problem of lack of labeled data sets, and help alleviate dependency explosion.

Description

Technical Field

[0001] The present invention belongs to the field of APT attack tracing, and specifically relates to an APT attack tracing method integrating sequence learning and causal analysis. Background Art

[0002] APT (Advanced Persistent Threat) attacks refer to network attacks with complex attack methods, long duration and high threat. Due to the advanced, persistent and threatening characteristics of APT attacks, the existing APT attack detection system can only detect isolated alarm points and it is difficult to reveal the full picture of the attack. Therefore, security analysts must use APT attack tracing methods on the basis of detection to identify and track the attacker's attack process within the organization system in order to understand the full picture of the attack and take action to curb the attack activities and reduce losses.

[0003] Existing APT attack tracing methods based on origin graphs, such as the ATLAS method (reference: Alsaheel AA, Nan Y, Ma S, et al. ATLAS: A Sequence-based Learning Approach for Attack Investigation [J]. USENIX Association, 2021.), use manually labeled datasets to learn attack semantics using sequence-based models to perform APT attack tracing, and the SLEUTH method (reference: Hossain MN, MilajerdiS M, Wang J, et al. SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data [C] / / USENIX Security Symposium. 2017.), which defines trusted labels and confidentiality labels, and prioritizes the most suspicious nodes for tracing. However, the above schemes have at least one of the following problems: ① There is a lack of labeled APT attack system log datasets in the field of APT attack tracing; ② It is difficult to directly capture the complex structure of APT attacks; ③ There is a dependency explosion problem, which also leads to high false positives. Summary of the invention

[0004] The purpose of the present invention is to address the above problems and propose an APT attack tracing method that integrates sequence learning and causal analysis to achieve efficient APT attack tracing.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] The present invention proposes an APT attack tracing method integrating sequence learning and causal analysis, comprising the following steps:

[0007] (1) Obtain system kernel logs and POI events. System kernel logs include system kernel logs that have been attacked and system kernel logs that have not been attacked.

[0008] (2) Construct a POI strong dependency impact module. The POI strong dependency impact module performs the following operations:

[0009] (2-1) constructing and compressing a POI event reverse dependency graph based on a first database, where the first database includes kernel logs of the attacked system and POI events;

[0010] (2-2) Extract event features from the compressed POI event reverse dependency graph, calculate and propagate dependency influences based on the extracted features, select nodes with a preset proportion of top dependency influence rankings as high dependency influence nodes, and then construct a POI strong dependency influence graph based on the high dependency influence nodes;

[0011] (3) A key sequence recognition model training module is used to obtain a trained key sequence recognition model. The key sequence recognition model training module performs the following operations:

[0012] (3-1) constructing and compressing a forward dependency graph based on a second database, where the second database includes kernel logs of systems that have not been attacked;

[0013] (3-2) Extracting a process-centered event sequence that increases in chronological order from the compressed forward dependency graph, and constructing a sequence pre-segmentation sentence based on the event sequence;

[0014] (3-3) Use the sequence pre-segmentation sentence to embed the BERT pre-trained model and obtain the embedding vector;

[0015] (3-4) Input the embedded vector into the OC-SVM model for training to obtain a trained key sequence recognition model;

[0016] (4) APT attack source tracing is performed through the key component identification module. The key component identification module performs the following operations:

[0017] The embedded vector obtained based on the POI strong dependency influence graph is input into the trained key sequence recognition model for identification. The identified processes and events are regarded as key processes and key events. The key processes and key events are combined into a key component graph, and APT attack tracing is achieved based on the key component graph.

[0018] Preferably, the POI event reverse dependency graph is constructed and compressed, or the forward dependency graph is constructed and compressed, as follows:

[0019] Dependency graph construction: extract three types of kernel objects and kernel object-related events from the corresponding database: files, networks, and processes, and represent each type of kernel object and kernel object-related event as a tuple to construct a corresponding dependency graph. Kernel objects are used as nodes in the corresponding dependency graph, and events are used as edges in the corresponding dependency graph.

[0020] Dependency graph compression: retain nodes with suspicious semantics and events with suspicious semantics in the corresponding dependency graph. Nodes with suspicious semantics refer to network nodes that are not in the whitelist, known suspicious process nodes or malicious file nodes, and nodes that can be reached by forward analysis from nodes with suspicious semantics. Events with suspicious semantics refer to events whose subjects or objects contain nodes with suspicious semantics. Delete events with the same operation and the same subject and object within the preset time range in the corresponding dependency graph. Delete temporary files and isolated nodes in the corresponding dependency graph. Isolated nodes refer to nodes without outgoing and incoming edges.

[0021] Preferably, each type of kernel object extracted and the events related to the kernel object are represented as tuples, as follows:

[0022] Each type of kernel object is represented as a two-tuple <unique identifier, type>, where the unique identifier of a file is represented as the absolute path of the file, and the type is file; the unique identifier of a process is represented as process PID_process name, and the type is process; the unique identifier of a network is represented as source IP address:source port number_destination IP address:destination port number, and the type is network; an event is represented as a four-tuple <subject, operation, object, timestamp>, where the operation represents the event type, and both the subject and the object are kernel objects, and are represented using the unique identifier of the kernel object.

[0023] Preferably, the event features are extracted from the compressed POI event reverse dependency graph, the dependency impact is calculated and propagated based on the extracted features, and nodes with a preset ratio of dependency impact rankings are selected as high dependency impact nodes. Then, a POI strong dependency impact graph is constructed based on the high dependency impact nodes, as follows:

[0024] (2-2-1) Feature extraction: Extract the features of each event from the compressed POI event reverse dependency graph. The event features are a four-dimensional feature matrix formed by the similarity with the data flow of the POI event, the similarity with the time of the POI event, the rarity of the destination node, and the in-and-out degree of the destination node;

[0025] (2-2-2) Edge weight calculation: Based on the four-dimensional feature matrix of each event, the K-medoids clustering algorithm is used to divide the events into two categories. Then, the four-dimensional projection vector is obtained by maximizing the difference between the two categories through the Fisher classifier. The four-dimensional feature matrix of each event is dot-multiplied by the four-dimensional projection vector to calculate the dependency weight of the corresponding event. Finally, the dependency weights of the outgoing edges of the nodes in the POI event reverse dependency graph are normalized to obtain the normalized edge dependency weights.

[0026] (2-2-3) Dependency influence calculation and propagation: According to the normalized edge dependency weight, the dependency influence of the node corresponding to the POI event is set to 1, and the dependency influence of other nodes is initialized to 0. Backward propagation and calculation of the dependency influence of other nodes are performed until the dependency influence of each node remains unchanged or the preset maximum propagation times are reached. The calculation formula for the dependency influence of other nodes is: ,in, represents the normalized edge dependency weight of the jth outgoing edge of the corresponding node, represents the dependency influence of the destination node of the jth outgoing edge of the corresponding node, and , All are positive numbers less than 1, j=1~n, n represents the number of outgoing edges of the corresponding node;

[0027] (2-2-4) High dependency impact node screening: Obtain the dependency impact of nodes and rank them by different types. For each type, select a preset proportion of nodes with a high ranking as high dependency impact nodes, and use the high dependency impact nodes as entry nodes.

[0028] (2-2-5) Construction of POI strong dependency influence graph: First, add the outgoing edges of the high dependency influence nodes to the blank dependency influence graph; then, add the edges of the events that can be reached by forward analysis starting from the outgoing edges of the high dependency influence nodes to the blank dependency influence graph, until there are no edges that can be added, and then use the blank dependency influence graph after the addition as the POI strong dependency influence graph.

[0029] Preferably, the four-dimensional feature matrix is ​​calculated as follows:

[0030] 1) Similarity with the data flow of POI events

[0031] ;

[0032] In the formula, Indicates the similarity between the data flow of event e(u,v) and the data flow of POI event. Event e(u,v) is the event in the compressed POI event reverse dependency graph. u represents the source node of event e(u,v), that is, the subject in event e(u,v). v represents the destination node of event e(u,v), that is, the object in event e(u,v). Indicates the data flow of POI events. represents the data flow of event e(u,v), Represents a positive number less than or equal to 0.0001;

[0033] 2) Similarity with the time of the POI event

[0034] ;

[0035] In the formula, Indicates the similarity between the time of event e(u,v) and the time of POI event, Indicates the time of the POI event. represents the time of event e(u,v), Represents a positive number less than or equal to 0.0001;

[0036] 3) Rarity of the destination node

[0037] ;

[0038] In the formula, represents the rarity of the destination node of the event e(u,v), Represents the total number of time windows, which is a positive integer greater than 1. Indicates the number of times the destination node v of the event e(u,v) appears in the time window, which is a positive integer greater than or equal to 0;

[0039] 4) In-degree ratio of the destination node

[0040] ;

[0041] In the formula, It represents the in-degree ratio of the destination node of event e(u,v), InDegree(u) represents the in-degree of the destination node v of event e(u,v), and OutDegree(u) represents the out-degree of the destination node v of event e(u,v).

[0042] Preferably, a process-centered event sequence that increases in time order is extracted from the compressed forward dependency graph, and a sequence pre-segmentation sentence is constructed based on the event sequence, as follows:

[0043] (3-2-1) Sequence extraction: First, obtain all process nodes in the compressed forward dependency graph; then, obtain the input and output edges corresponding to each process node, and sort the output and input edges corresponding to each process node in order of increasing time to form a first sequence; then, divide the first sequence corresponding to each process node into several subsequences according to the preset time interval between adjacent events; finally, construct the events in the subsequence into a second sequence in order of increasing time sequence. The second sequence corresponding to all subsequences of each process node is the extracted process-centered event sequence in increasing time sequence;

[0044] (3-2-2) Sequence tokenization: First, obtain the set of unique identifiers and event types of all nodes in the compressed forward dependency graph. Then, perform tokenization based on the node type to obtain a token dictionary corresponding to the node's unique identifier or event type, and a vocabulary consisting of tokenization results of all node's unique identifiers and event types. Then, for each event sequence, use the tokenization dictionary to construct a sequence pre-segmentation statement.

[0045] Preferably, the BERT pre-trained model is embedded with the sequence pre-segmentation sentence to obtain the embedding vector, as follows:

[0046] First, the vocabulary is added to the vocabulary of the BERT pre-trained model to form a new vocabulary, and the embedding layer of the BERT pre-trained model is adjusted to adapt to the new vocabulary size; then, each sequence pre-segmented sentence is segmented by space, and the obtained words are converted into IDs according to the vocabulary to obtain the corresponding converted ID list; finally, the ID list of each sequence pre-segmented sentence is input into the BERT pre-trained model to obtain the embedding vector.

[0047] Preferably, word segmentation is performed according to the type of node, as follows:

[0048] For file types, word segmentation is performed according to each directory layer, file base name and file extension of the file; for network types, word segmentation is performed according to the number of each byte in dotted decimal representation of the IP address and the port number; for process nodes, word segmentation is performed according to each directory layer of the process's executable file, the executable file base name, the executable file extension and the process PID; for event types, word segmentation is performed directly; spaces within each word are removed during word segmentation.

[0049] Preferably, for each event sequence, a segmentation dictionary is used to construct a sequence pre-segmentation statement, as follows:

[0050] For the event of each element of the second sequence in the event sequence, an event segmentation statement is constructed according to the corresponding segmentation results of the subject, object and event type in the segmentation dictionary. Then, the event sequence segmentation statements of the corresponding elements are combined in increasing order of time, and all event sequence segmentation statements in the event sequence are deduplicated. Finally, '[CLS]' is added to the beginning of each event sequence segmentation statement after deduplication, and '[SEP]' is added to the end to obtain the corresponding sequence pre-segmentation statement.

[0051] Preferably, when combining event sequence participle statements of corresponding elements in increasing order of events in time, if the number of words in the event sequence participle statement exceeds a preset number after combining the participle statement of any event, the participle statements of the event and the event after the event are combined into a new participle statement. If the number of words in the new participle statement still exceeds the preset number, new participle statements continue to be combined, and so on.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] The method first constructs and compresses the POI event reverse dependency graph, obtains the POI strong dependency influence graph through causal analysis, then constructs and compresses the extracted process-centered event sequence in chronological order, uses the BERT pre-trained model for embedding training, and learns the embedding vector through the OC-SVM model to perform sequence learning to identify key sequences; secondly, constructs the POI strong dependency influence graph, and filters the nodes highly affected by POI events by calculating the dependency influence and propagating it; finally, extracts and embeds the event sequence on the POI strong dependency influence graph, uses the key sequence recognition model to identify the key sequences (key processes and key events), and combines the key processes and key events to output the key component graph containing the key sequences. The present invention can realize fine-grained APT attack tracing based on system kernel log data and POI events. At the same time, the BERT pre-training model and the OC-SVM model are used to learn the normal mode of the system, which solves the problem of lack of labeled data sets in the field of APT attack tracing, and can effectively learn the normal mode of the system and better identify key sequences. In addition, the dependency graph compression method and causal analysis (including forward analysis and reverse analysis) method are used to reduce the size of the dependency graph, alleviate the dependency explosion problem, and realize efficient and accurate APT attack tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 The figure is a flow chart of the APT attack tracing method integrating sequence learning and causal analysis of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] It should be noted that, unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art in the technical field of this application. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0057] like Figure 1 As shown in FIG. 1 , an APT attack tracing method integrating sequence learning and causal analysis includes the following steps:

[0058] (1) Obtain system kernel logs and POI events. System kernel logs include system kernel logs that have been attacked and system kernel logs that have not been attacked. POI events refer to point of interest events. In APT attack tracing, they are generally detected alarm events. They can be obtained by the APT attack detection system, or they can be directly obtained from the data set used for APT attack detection (such as from the label GroundTruth in the DARPA TCE3 data set).

[0059] (2) Construction of POI strong dependency impact module: Based on the kernel logs of the attacked system and POI events (the first database), a POI event reverse dependency graph is constructed and compressed to obtain a compressed POI event reverse dependency graph; then, based on the features of the events extracted from the compressed POI event reverse dependency graph, the dependency impact is calculated and propagated, and the nodes that are highly affected by the POI events are screened. Finally, a POI strong dependency impact graph is constructed. The details are as follows:

[0060] (2-1)Construction of the Reverse Dependence Graph of POI Events: Based on the system kernel logs and POI events of the attacked system, perform reverse analysis starting from the POI events, construct the reverse dependence graph of POI events, and compress the constructed reverse dependence graph of POI events. Finally, obtain a compressed reverse dependence graph of POI events, where kernel objects are used as nodes in the corresponding dependence graph and events are used as edges in the corresponding dependence graph. Among them, the reverse dependence graph of POI events in this embodiment mainly considers three types of kernel objects (files, networks, processes) and eight types of events related to kernel objects (process-related events: execute, clone, file-related events: write, read, read_vector, write_vector, network-related events: send, receive). Represent each type of kernel object as a binary tuple <unique identifier, type>, where the unique identifier of a file is represented as the absolute file path, and the type is file; the unique identifier of a process is represented as process PID_process name, and the type is process; the unique identifier of a network is represented as source IP address:source port number_destination IP address:destination port number, and the type is network; represent an event as a quadruple <subject, operation, object, timestamp>, where the operation represents the event type, that is, one of the eight types of events related to kernel objects, and both the subject and the object are kernel objects, and are represented using the unique identifier of the kernel object. Specifically, it can also be adjusted according to actual needs. Reverse analysis means that if two events, such as event e1(u1,op1, v1, t1) and event e2(u2, op2, v2, t2) have a reverse causal relationship (two events have a reverse causal relationship means that for event e1 and event e2, if v1 = u2 and t1 < t2, then e1 and e2 have a reverse causal relationship), then reverse analysis can be used to reach event e1 from event e2. Among them, u1 is the source node of event e1, u2 is the source node of event e2, v1 is the destination node of event e1, v2 is the destination node of event e2, op1 is the operation of event e1, op2 is the operation of event e2, t1 is the timestamp of event e1, and t2 is the timestamp of event e2. (u1, op1, v1, t1) represents the quadruple of event e1, and the same applies to others.

[0061] POI event reverse dependency graph compression: ① Only nodes with suspicious semantics (i.e., three types of kernel objects) and events with suspicious semantics are retained. Nodes with suspicious semantics refer to network nodes that are not in the whitelist, known suspicious process nodes or malicious file nodes, and nodes that can be reached by forward analysis from nodes with suspicious semantics. The whitelist is a file containing many IP addresses that are considered to be trustworthy. Events with suspicious semantics refer to events in which the subject or object contains nodes with suspicious semantics. For example, event e is represented as a four-tuple<A, op, B, t> , A is the subject (source node), op is the operation, B is the object (destination node), t is the timestamp, if at least one of the subject A and object B of event e is a node with suspicious semantics, then event e is considered to be an event with suspicious semantics; ② Delete events with the same operation and the same subject and object within a preset time range (such as 5~30 seconds, which can also be reduced or increased as appropriate); ③ Delete temporary files and isolated nodes (isolated nodes refer to nodes without outgoing and incoming edges).

[0062] (2-2) Extract event features from the compressed POI event reverse dependency graph, calculate and propagate dependency influences based on the extracted features, select nodes with a preset proportion of dependency influence rankings as high dependency influence nodes, and then construct a POI strong dependency influence graph based on the high dependency influence nodes.

[0063] (2-2-1) Feature extraction: From the compressed POI event reverse dependency graph (2-1), four features are extracted: the similarity of data flow of all events corresponding to POI events, the similarity of time with POI events, the rarity of destination nodes, and the in-and-out ratio of destination nodes (see Table 1 for feature calculation formula), and a four-dimensional feature matrix of each event consisting of four features is obtained.

[0064] Table 1 Characteristic calculation formula table

[0065]

[0066] (2-2-2) Edge weight calculation: Based on the four-dimensional feature matrix extracted in (2-2-1), the K-medoids clustering algorithm is used to divide the events into two categories. Then, the four-dimensional projection vector is obtained by maximizing the difference between the two categories through the Fisher classifier to calculate the dependency weight of the event (that is, the edge in the POI event reverse dependency graph). For example, the dependency weight is obtained by calculating the dot multiplication of the four-dimensional feature matrix of each event by the four-dimensional projection vector. Finally, the dependency weights of the outgoing edges of the nodes in the POI event reverse dependency graph are normalized to obtain the normalized edge dependency weight.

[0067] (2-2-3) Dependency influence propagation: According to the normalized edge dependency weights calculated in (2-2-2), set the dependency influence of the node corresponding to the POI event to 1, and initialize the dependency influence of other nodes to 0. Propagate backward and calculate the dependency influence of other nodes until the dependency influence of each node remains unchanged or reaches the preset maximum number of propagation times. The calculation formula for the dependency influence of other nodes is , where represents the normalized edge dependency weight of the j-th out-edge of the corresponding node, represents the dependency influence of the destination node of the j-th out-edge of the corresponding node, and , are all positive numbers less than 1, j = 1~n, and n represents the number of out-edges of the corresponding node. For example, for a source node, if the normalized edge dependency weights of its out-edges for events e1(u1, op1, v1, t1) and e2 (u2, op2, v2, t2) are a and b respectively, and the dependency influences of the destination nodes v1 of event e1 and v2 of event e2 are c and d respectively (a, b, c, d are all positive numbers less than 1), then the dependency influence of this source node is a×c + b×d, where events e1 and e2 have the same source node, that is, u1 and u2 are the same source node.

[0068] (2-2-4) Screening of high-dependency influence nodes: Obtain the dependency influence of nodes according to the type of nodes (i.e., the three types of files, networks, and processes in (2-1)), and rank them. Select the nodes with higher rankings as high-dependency influence nodes, that is, entry nodes (generally, the proportion does not exceed 30% of all nodes).

[0069] (2-2-5) Construction of the POI strong dependency influence graph: Through the high-dependency influence nodes selected in (2-2-4), perform forward analysis in the reverse dependency graph of the POI events compressed in (2-1) to obtain the POI strong dependency influence graph. Among them, forward analysis means that if two events, such as event e1(u1, v1, op1, t1) and event e2(u2, v2, op2, t2), have a forward causal relationship (two events have a forward causal relationship means that for events e1 and e2, if v1 = u2 and t1 < t2, then e1 and e2 have a forward causal relationship), then forward analysis can be used to reach event e2 from event e1. When constructing the POI strong dependency influence graph, first add the out-edges of the high-dependency influence nodes to the blank dependency influence graph. Then, add the edges of the events that can be reached through forward analysis to the blank dependency influence graph until there are no more edges to add, that is, use the blank dependency influence graph after addition as the POI strong dependency influence graph.

[0070] (3) Use the key sequence recognition model training module to obtain a trained key sequence recognition model: Based on the kernel log of the system that has not been attacked, a compressed forward dependency graph is constructed; then, a sequence of events centered on the process and increasing in time order is extracted and converted into a natural language form; then, the BERT pre-trained model is used for embedding training to obtain an embedding vector; finally, the embedding vector is learned through the OC-SVM model (OC-SVM classification model) to obtain a trained key sequence recognition model. The details are as follows:

[0071] (3-1) Forward dependency graph construction and compression: Different from the POI event reverse dependency graph, here we use the kernel logs of the system that has not been attacked (the second database) and also use the kernel objects and kernel object-related events considered in (2-1) to construct a forward dependency graph and compress it.

[0072] (3-2) Extract a process-centered event sequence that increases in chronological order from the compressed forward dependency graph, and construct a sequence pre-segmentation sentence based on the event sequence.

[0073] (3-2-1) Sequence Extraction: Extract a process-centered event sequence that increases in chronological order from the forward dependency graph after (3-1) compression. Specifically, first, obtain all the process nodes in the compressed forward dependency graph. Then, obtain the incoming edges and outgoing edges corresponding to each process node, and sort the outgoing edges and incoming edges corresponding to each process node as a whole in ascending order of time to form a first sequence. After that, divide the first sequence corresponding to a process node into several subsequences (which can be one or more) according to a preset time interval between adjacent events (usually set to a relatively small value, such as within 10 seconds). For example, for the process node p11, its incoming edges are e11(u11, op11, p11, t11), e21(u21,op21, p11, t21), and its outgoing edges are e31(p11,op31, v11, t31), e41(p11, op41, v21, t41), where t11 < t21 < t31 < t41 and t31 - t21 > 10s, t21 - t11 < 10s, t41 - t31 < 10s (unit: second). Assuming the time interval set here is 10s, the first sequence is [e11,e21,e31,e41], and the divided subsequences are [e11,e21], [e31,e41]. The edges are events. Among them, the source nodes of events e11, e21, e31, e41 correspond to u11, u21, p11, p11 in sequence, the operations correspond to op11, op21, op31, op41 in sequence, the destination nodes correspond to p11, p11, v11, v21 in sequence, and the timestamps correspond to t11, t21, t31, t41 in sequence. Then, construct the events in the subsequence into a second sequence in ascending chronological order. For example, construct the subsequence [e11,e21] into the second sequence [e11], [e11,e21], and construct the subsequence [e31,e41] into the second sequence [e31], [e31,e41]. Specifically, for the subsequence, combine the current event and all the events that occurred before it to form an element in the second sequence. For example, each content in square brackets such as [e11], [e11,e21] is an element, and all the elements constructed in the subsequence are the event sequence (the second sequence) that increases in chronological order in the subsequence. Finally, the event sequence (the second sequence) that increases in chronological order in all the subsequences of each process node is the process-centered event sequence that increases in chronological order, simply referred to as the event sequence. For example, the event sequence of the above process node is represented as [e11], [e11,e21], [e31], [e31,e41].

[0074] (3-2-2) Serialization: To facilitate the subsequent word segmentation operation of the BERT pre-trained model, first, in the compressed forward dependency graph of (3-1), the set of unique identifiers and event types of all nodes is obtained. Then, word segmentation is performed according to the node type to obtain a word segmentation dictionary corresponding to the unique identifier or event type of each node (i.e., a key-value pair, where the key is the unique identifier or event type of the node, and the value is the word segmentation result) and a vocabulary consisting of the word segmentation results of the unique identifiers and event types of all nodes (i.e., the set of values ​​of the word segmentation dictionary, that is, the set of word segmentation structures). Specifically, for file types, word segmentation is performed according to each layer of the file's directory, file base name, and file extension. For example, the unique identifier of the file node '\\Device\\HarddiskVolume2\\Program Files\\Mozilla Firefox\\add-on\\passwordfile.dat' is segmented into 'Device', 'HarddiskVolume2', 'Program Files','Mozilla Firefox', 'add-on', 'passwordfile', 'dat'; for network types, word segmentation is performed according to the number of each byte in dotted decimal representation of the IP address and the port number. For example, the unique identifier of the network node '121.55.12.67:61082_130.67.15.39:3039' is segmented into 121, 55, 12, 67, 61082, 130,67, 15, 39, 3039; For the process node, the word segmentation is performed according to each directory of the executable file of the process, the basic name of the executable file, the extension of the executable file and the process PID. For example, for the unique identifier of the process node '8664_C:\WINDOWS\system32\backgroundTaskHost.exe', it is segmented into '8664', 'C:', 'WINDOWS', 'system32', 'backgroundTaskHost', 'exe'; for the event type, it is used directly; for the convenience of word segmentation, the spaces in each word are removed.

[0075] Afterwards, for the event sequence extracted in (3-2-1), the word segmentation dictionary is used to construct sequence pre-segmentation statements in order of increasing time. Specifically, for the event of each element of the second sequence in the event sequence, the event segmentation statement is constructed according to the corresponding segmentation results of its subject, object and event type in the word segmentation dictionary. For example, for the event ('8664_C:\WINDOWS\system32\backgroundTaskHost.exe', 'write', '\\Device\\HarddiskVolume2\\Program Files\\Mozilla Firefox\\add-on\\passwordfile.dat',time1), the constructed segmentation statement is '8664 C: WINDOWS system32 backgroundTaskHost exe writeDevice HarddiskVolume2 ProgramFiles MozillaFirefox add-on passwordfile dat'. All event segmentation statements of each element are combined into event sequence segmentation statements in the order of increasing event time. When the number of words in the event sequence segmentation statement exceeds 510, a new event sequence segmentation statement is constructed from the 511th segmentation. If the number of words in the new event sequence segmentation statement still exceeds 510, a new event sequence segmentation statement is created, and so on. In order to prevent duplication, the event sequence segmentation statements constructed by each event sequence are deduplicated. Then, add '[CLS]' at the beginning of each event sequence segmentation statement after deduplication, and add '[SEP]' at the end. For example, for the previous example, after adding, it is '[CLS] 8664 C: WINDOWS system32backgroundTaskHost exe write Device HarddiskVolume2 ProgramFilesMozillaFirefox add-on passwordfile dat [SEP]'. Finally, the sequence pre-segmentation statement corresponding to each event sequence segmentation statement after deduplication is obtained.

[0076] (3-3) Word embedding: Use the sequence pre-segmentation sentence to embed the BERT pre-trained model and obtain the embedding vector. First, add the vocabulary constructed in step (3-2-2) to the vocabulary of the BERT pre-trained model, and adjust the embedding layer of the BERT pre-trained model to adapt to the new vocabulary size. The size of the embedding layer of the BERT pre-trained model can be adjusted according to actual needs, such as using the following python language modification: ①tokenizer.add_tokens(vocabs), ②model.resize_token_embeddings(len(tokenizer)); Then, for the sequence pre-segmentation sentence constructed in step (3-2-2), segment the words by spaces, convert the obtained words into IDs according to the vocabulary, and obtain the ID list converted into the segmentation sentence; Finally, input the ID list of each sequence pre-segmentation sentence into the BERT pre-trained model to obtain the embedding vector;

[0077] (3-4) Model training: Input the embedding vector obtained in (3-3) into the OC-SVM model to learn the normal pattern of the system kernel log, and finally obtain a trained key sequence recognition model.

[0078] (4) Key component identification: APT attack tracing is performed through the key component identification module. That is, the embedding vector corresponding to the POI strong dependency influence diagram is obtained by the same method as in (3-2) and (3-3). The key sequence identification model that has been trained is used to identify the key sequence. Finally, a key component diagram containing the key sequence (i.e., key processes and key events) is output to help security analysts conduct more specific APT attack investigations.

[0079] (4-1) Sequence extraction, lexicalization and embedding: In the POI strong dependency influence graph extracted in (2-2), the event sequence is extracted according to the method in (3), the vocabulary is constructed, the word segmentation is performed, and finally the BERT pre-trained model is input to obtain the embedding vector;

[0080] (4-2) Key sequence identification: The embedding vector corresponding to the POI strong dependency influence diagram is input into the trained key sequence identification model (3-4) to identify abnormal sequences, thereby identifying the processes and events corresponding to the abnormal sequences, and treating the identified processes and events as key processes and key events.

[0081] (4-3) Key component graph output: Combine key processes and key events to obtain a key component graph containing key processes and key events, and implement APT attack tracing based on the key component graph.

[0082] Furthermore, the performance of the method of the present invention was compared with that of the Depimpact method (reference: Fang P, Gao P, Liu C, et al. Back-Propagating System Dependency Impact for Attack Investigation[J]. 2021. DOI: 10.5281 / ZENODO.5559214.), such as using part of the attack log data used in the Depimpact method, as shown in Table 2.

[0083] Table 2

[0084]

[0085] In the table, FP represents false positives (i.e., the number of normal events included in the key component graph), FN represents false negatives (i.e., the number of attack events not included in the key component graph), and the number of edges represents the number of edges in the key component graph obtained. Among them, various types of attacks, such as Hide File, refer to the attacker's goal to hide malicious files in the user's normal files. The attacker downloads malicious scripts and hides it by changing its file name and location; Steal Information refers to the attacker stealing the user's sensitive information and writing the information into a hidden file; Backdoor Download refers to the malicious insider using the ping command to connect to the malicious server, then downloading the backdoor script from the server and hiding the script by renaming it. Shellshock, Dataleak, and VPN Filter are multi-host intrusion attacks, among which the first one is the Shellshock (vulnerability penetration) attack: the attacker exploits the Shellshock vulnerability to invade the host, downloads an image containing the server IP through the cloud service to bypass detection, uses the server IP to download malware to the host, scans and discovers other hosts in the network, and then steals their passwords. After that, a Dataleak attack occurs: based on the Shellshock attack, the attacker sends malware to other hosts, scans and compresses sensitive files, and uploads them to the Internet after encryption to achieve data leakage. Finally, a VPN Filter attack occurs: using the VPN Filter malware, the attacker attempts to establish a direct connection between the server and the victim host. Through multi-stage download and execution, VPNFilter spreads between hosts, collects and steals sensitive data. The above are all well-known technologies for those skilled in the art and will not be repeated here. The above experimental results show that the average FP number and the number of edges of the key component graph obtained by the method of the present invention are much lower than those of the Depimpact method, and are more effective and accurate in tracing the source of APT attacks.

[0086] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0087] The above-described embodiments only express the more specific and detailed embodiments described in this application, but they cannot be understood as limiting the scope of the patent application. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of this application, which all belong to the protection scope of this application. Therefore, the protection scope of the patent application shall be based on the attached claims.

Claims

1. A method for tracing the source of APT attacks by integrating sequence learning and causal analysis, characterized by: The APT attack tracing method integrating sequence learning and causal analysis comprises the following steps: (1) Obtaining system kernel logs and POI events, wherein the system kernel logs include system kernel logs that have been attacked and system kernel logs that have not been attacked; (2) Constructing a POI strong dependency impact module, wherein the POI strong dependency impact module performs the following operations: (2-1) constructing and compressing a POI event reverse dependency graph based on a first database, wherein the first database includes kernel logs of the attacked system and POI events; (2-2) Extract event features from the compressed POI event reverse dependency graph, calculate and propagate dependency influences based on the extracted features, select nodes with a preset proportion of dependency influence rankings as high dependency influence nodes, and then construct a POI strong dependency influence graph based on the high dependency influence nodes; (3) A key sequence recognition model training module is used to obtain a trained key sequence recognition model. The key sequence recognition model training module performs the following operations: (3-1) constructing and compressing a forward dependency graph according to a second database, where the second database includes kernel logs of a system that has not been attacked; (3-2) Extracting a process-centered event sequence that increases in chronological order from the compressed forward dependency graph, and constructing a sequence pre-segmentation sentence based on the event sequence; (3-3) Use the sequence pre-segmentation sentence to embed the BERT pre-trained model and obtain the embedding vector; (3-4) Input the embedded vector into the OC-SVM model for training to obtain a trained key sequence recognition model; (4) Tracing the source of the APT attack through the key component identification module, which performs the following operations: The embedded vector obtained based on the POI strong dependency influence graph is input into the trained key sequence recognition model for recognition. The identified processes and events are regarded as key processes and key events. The key processes and key events are combined into a key component graph, and the APT attack source is traced based on the key component graph. The POI event reverse dependency graph is constructed and compressed, or the forward dependency graph is constructed and compressed, as follows: Dependency graph construction: extract three types of kernel objects and kernel object-related events from the corresponding database: files, networks, and processes, and represent each type of kernel object and kernel object-related event as a tuple to construct a corresponding dependency graph. Kernel objects are used as nodes in the corresponding dependency graph, and events are used as edges in the corresponding dependency graph. Dependency graph compression: retain nodes with suspicious semantics and events with suspicious semantics in the corresponding dependency graph. The nodes with suspicious semantics refer to network nodes that are not in the whitelist, known suspicious process nodes or malicious file nodes, and nodes that can be reached by forward analysis from nodes with suspicious semantics. The events with suspicious semantics refer to events in which the subject or object contains nodes with suspicious semantics. Delete the events with the same operation and the same subject and object within the preset time range in the corresponding dependency graph; Delete temporary files and isolated nodes in the corresponding dependency graph, where the isolated nodes represent nodes without outgoing and incoming edges; The feature of the event is extracted from the compressed POI event reverse dependency graph, the dependency influence is calculated and propagated according to the extracted feature, and the nodes with a preset proportion of dependency influence rankings are selected as high dependency influence nodes, and then the POI strong dependency influence graph is constructed according to the high dependency influence nodes, as follows: (2-2-1) Feature extraction: extracting the features of each event from the compressed POI event reverse dependency graph, wherein the event features are a four-dimensional feature matrix formed by the similarity with the data flow of the POI event, the similarity with the time of the POI event, the rarity of the destination node, and the in-and-out degree of the destination node; (2-2-2) Edge weight calculation: Based on the four-dimensional feature matrix of each event, the K-medoids clustering algorithm is used to divide the events into two categories. Then, the four-dimensional projection vector is obtained by maximizing the difference between the two categories through the Fisher classifier. The four-dimensional feature matrix of each event is dot-multiplied by the four-dimensional projection vector to calculate the dependency weight of the corresponding event. Finally, the dependency weights of the outgoing edges of the nodes in the POI event reverse dependency graph are normalized to obtain the normalized edge dependency weights. (2-2-3) Dependency influence calculation and propagation: According to the normalized edge dependency weight, the dependency influence of the node corresponding to the POI event is set to 1, and the dependency influence of other nodes is initialized to 0. Backward propagation and calculation of the dependency influence of other nodes are performed until the dependency influence of each node remains unchanged or the preset maximum propagation times are reached. The dependency influence calculation formula of the other nodes is: ,in, represents the normalized edge dependency weight of the jth outgoing edge of the corresponding node, represents the dependency influence of the destination node of the jth outgoing edge of the corresponding node, and , All are positive numbers less than 1, j=1~n, n represents the number of outgoing edges of the corresponding node; (2-2-4) High dependency impact node screening: Obtain the dependency impact of nodes and rank them by different types. For each type, select a preset proportion of nodes with a high ranking as high dependency impact nodes, and use the high dependency impact nodes as entry nodes. (2-2-5) POI strong dependency influence graph construction: first add the outgoing edges of the high dependency influence nodes to the blank dependency influence graph; then, add the edges of the events that can be reached by forward analysis starting from the outgoing edges of the high dependency influence nodes to the blank dependency influence graph, until there are no edges that can be added, and then use the blank dependency influence graph after the addition as the POI strong dependency influence graph; The process-centered event sequence that increases in time order is extracted from the compressed forward dependency graph, and a sequence pre-segmentation sentence is constructed based on the event sequence, as follows: (3-2-1) Sequence extraction: First, obtain all process nodes in the compressed forward dependency graph; then, obtain the input and output edges corresponding to each process node, and sort the output and input edges corresponding to each process node in order of increasing time to form a first sequence; then, divide the first sequence corresponding to each process node into several subsequences according to the preset time interval between adjacent events; finally, construct the events in the subsequence into a second sequence in order of increasing time sequence. The second sequence corresponding to all subsequences of each process node is the extracted process-centered event sequence in increasing time sequence; (3-2-2) Sequence tokenization: First, in the compressed forward dependency graph, obtain the set of unique identifiers and event types of all nodes. Then, perform tokenization according to the node type to obtain a tokenization dictionary corresponding to the unique identifier of the node or the event type, and a vocabulary consisting of the tokenization results of the unique identifiers and event types of all nodes. Then, for each event sequence, use the tokenization dictionary to construct a sequence pre-segmentation sentence. The BERT pre-training model is embedded and trained using sequence pre-segmentation sentences to obtain an embedding vector, as follows: First, the vocabulary is added to the vocabulary of the BERT pre-trained model to form a new vocabulary, and the embedding layer of the BERT pre-trained model is adjusted to adapt to the new vocabulary size; then, each sequence pre-segmented sentence is segmented by space, and the obtained words are converted into IDs according to the vocabulary to obtain the corresponding converted ID list; finally, the ID list of each sequence pre-segmented sentence is input into the BERT pre-trained model to obtain the embedding vector.

2. The APT attack tracing method integrating sequence learning and causal analysis as claimed in claim 1 is characterized by: The extracted kernel objects of various types and kernel object-related events are represented as tuples, as follows: Each type of kernel object is represented as a two-tuple <unique identifier, type>, where the unique identifier of a file is represented as the absolute path of the file, and the type is file; the unique identifier of a process is represented as process PID_process name, and the type is process; the unique identifier of a network is represented as source IP address:source port number_destination IP address:destination port number, and the type is network; an event is represented as a four-tuple <subject, operation, object, timestamp>, where the operation represents the event type, and both the subject and the object are kernel objects, and are represented using the unique identifier of the kernel object.

3. The APT attack tracing method integrating sequence learning and causal analysis as claimed in claim 1 is characterized in that: The four-dimensional feature matrix is ​​calculated as follows: 1) Similarity with the data flow of POI events ； In the formula, Indicates the similarity between the data flow of event e(u,v) and the data flow of POI event. Event e(u,v) is the event in the compressed POI event reverse dependency graph. u represents the source node of event e(u,v), that is, the subject in event e(u,v). v represents the destination node of event e(u,v), that is, the object in event e(u,v). Indicates the data flow of POI events. represents the data flow of event e(u,v), Represents a positive number less than or equal to 0.0001; 2) Similarity with the time of the POI event ； In the formula, Indicates the similarity between the time of event e(u,v) and the time of POI event, Indicates the time of the POI event. represents the time of event e(u,v), Represents a positive number less than or equal to 0.0001; 3) Rarity of the destination node ； In the formula, represents the rarity of the destination node of the event e(u,v), Represents the total number of time windows, which is a positive integer greater than 1. Indicates the number of times the destination node v of the event e(u,v) appears in the time window, which is a positive integer greater than or equal to 0; 4) In-degree ratio of the destination node ； In the formula, It represents the in-degree ratio of the destination node of event e(u,v), InDegree(u) represents the in-degree of the destination node v of event e(u,v), and OutDegree(u) represents the out-degree of the destination node v of event e(u,v).

4. The APT attack tracing method integrating sequence learning and causal analysis as claimed in claim 1 is characterized in that: The word segmentation is performed according to the type of node, as follows: For file types, word segmentation is performed according to each directory layer, file base name and file extension of the file; for network types, word segmentation is performed according to the number of each byte in dotted decimal representation of the IP address and the port number; for process nodes, word segmentation is performed according to each directory layer of the process's executable file, the executable file base name, the executable file extension and the process PID; for event types, word segmentation is performed directly; spaces within each word are removed during word segmentation.

5. The APT attack tracing method integrating sequence learning and causal analysis as claimed in claim 1, characterized in that: For each event sequence, a segmentation dictionary is used to construct a sequence pre-segmentation statement, as follows: For the event of each element of the second sequence in the event sequence, an event segmentation statement is constructed according to the corresponding segmentation results of the subject, object and event type in the segmentation dictionary. Then, the event sequence segmentation statements of the corresponding elements are combined in increasing order of time, and all event sequence segmentation statements in the event sequence are deduplicated. Finally, '[CLS]' is added to the beginning of each event sequence segmentation statement after deduplication, and '[SEP]' is added to the end to obtain the corresponding sequence pre-segmentation statement.

6. The APT attack tracing method integrating sequence learning and causal analysis as claimed in claim 5 is characterized by: When the event sequence participle statements of the corresponding elements are combined in the order of increasing time of the events, if the number of words in the event sequence participle statement exceeds the preset number after combining the participle statement of any event, the event participle statements of the event and the event after the event are combined into a new event sequence participle statement. If the number of words in the new event sequence participle statement still exceeds the preset number, new event sequence participle statements are continued to be combined, and so on.

Images