A method for discovering APT malicious behavior based on hypergraph representation learning

Abstract

The present invention belongs to the field of network security technology, and specifically relates to a method for discovering APT malicious behaviors based on hypergraph representation learning. The present invention includes collecting kernel event logs to obtain a traceability graph, compressing the traceability graph, and constructing an operation behavior network graph; using an overlapping community discovery algorithm to obtain subcommunities of all processes in the operation behavior network graph, and each subcommunity forms a hyperedge; extracting the operation object of the process according to the operation behavior network graph, assigning the operation object to the corresponding hyperedge to form a hypergraph structure; training a hypergraph neural network based on the feature matrix of the hyperedge obtained from the hypergraph structure to obtain a hypergraph classifier; and using the hypergraph classifier to discover APT malicious behaviors. The present invention realizes high-order interaction capture of process behaviors through a process operation network, and realizes deep-level behavior pattern mining between process interactions based on the constructed hypergraph. The neural network based on the hypergraph can effectively identify and classify behaviors, and has a higher accuracy rate.

Description

Technical Field

[0001] The present invention belongs to the field of data mining and network security technology for kernel log analysis, and specifically relates to an APT malicious behavior discovery method based on hypergraph representation learning. Background Art

[0002] The development of digital technology has brought convenience but also brought network security issues such as advanced persistent threats, which has brought great challenges to the information security of enterprises, public institutions and individuals. Traditional security protection technologies have many limitations in dealing with APT attacks. Traditional detection methods mainly rely on known attack features and patterns, and it is often difficult to effectively identify APT attacks that use zero-day vulnerabilities, customized malware and multi-stage attack strategies. In addition, rule-based detection methods require real-time updates to the rule base, which lags behind in the face of new attacks.

[0003] Building traceability graphs based on kernel logs and conducting APT analysis has become the mainstream. However, traditional traceability graph models have certain limitations when representing complex system behaviors and relationships. For example, when dealing with many-to-many relationships, nested relationships, and complex hierarchical system behaviors, traditional traceability graphs are difficult to accurately and comprehensively describe these relationships. In addition, traditional traceability graph-based analysis methods often face problems such as high computational complexity and low efficiency when processing large-scale data.

[0004] As a generalized graph structure, hypergraph can better represent complex multi-entity relationships and hierarchical structures. Unlike traditional graph structures, a hyperedge in a hypergraph can connect multiple vertices, which can describe complex system behaviors and relationships more naturally and flexibly. Converting provenance graphs into hypergraphs and performing representation learning based on hypergraphs is expected to break through the limitations of traditional provenance graph models and improve the accuracy and efficiency of malicious behavior discovery in APT detection.

[0005] Currently, in the graph-based APT attack analysis methods, a lot of work converts system audit logs into traceability graphs with system context semantics as the data source for APT attack discovery. However, the traceability graph is a heterogeneous graph and cannot effectively mine multi-hop behaviors or represent higher-order behaviors. Therefore, fine-grained audit logs are limited in discovering APT attack behaviors. Summary of the invention

[0006] The purpose of the present invention is to solve the problems of the prior art and propose an APT malicious behavior discovery method based on hypergraph representation learning. The collected logs are used to build a provenance graph, and a process network based on the operation objects is built on the logs and converted into a hypergraph. The APT malicious behavior is discovered through hypergraph-based representation learning.

[0007] In order to achieve the above object, the technical solution provided by the present invention is:

[0008] A method for discovering APT malicious behavior based on hypergraph representation learning, including:

[0009] Collect kernel event logs to obtain a traceability graph, and compress the traceability graph;

[0010] Constructing a process-based operation behavior network diagram based on the compressed traceability diagram, wherein the operation behavior network diagram includes processes, events, time periods, and operation objects;

[0011] The overlapping community discovery algorithm is used to obtain the subcommunities of all processes in the operation behavior network graph, and each subcommunity forms a hyperedge;

[0012] Extract the operation object of the process according to the operation behavior network diagram, assign the operation object to the corresponding hyperedge to form a hypergraph structure, in which the process is a node of the hypergraph structure;

[0013] Based on the hypergraph structure, time periods, events and operation objects are embedded into the process to obtain the feature matrix of the hyperedge;

[0014] Based on the feature matrix of the hyperedge, the degree matrix of the hyperedge, the degree matrix of the node and the weight matrix are formed to train the hypergraph neural network and obtain the hypergraph classifier;

[0015] Using hypergraph classifier to discover APT malicious behavior.

[0016] Furthermore, the overlapping community discovery algorithm is used to obtain subcommunities of all processes in the operation behavior network graph, and each subcommunity forms a hyperedge, including:

[0017] The process network is extracted from the operation behavior network graph, where the process is the node of the process network. The overlapping community discovery algorithm is used to divide each process in the process network to obtain the subcommunities of the process network, and each subcommunity forms a hyperedge.

[0018] Furthermore, the overlapping community discovery algorithm is an LFM-based overlapping community discovery algorithm, and the steps of dividing each process in the process network by the LFM-based overlapping community discovery algorithm are as follows:

[0019] Treat each node as an independent subcommunity;

[0020] Traverse each node and calculate the modularity gain when the current node joins the subcommunity where the neighbor node is located. If the modularity gain is positive, the current node is added to the corresponding subcommunity. If the modularity gain is negative, the current node is not added to the corresponding subcommunity until the modularity gain is 0.

[0021] The calculation formula of modularity gain is as follows:

[0022] ;

[0023] in, represents the modularity gain, Is a node i The degree of is the sum of the node degrees within the current subcommunity, is the sum of the degrees of nodes connected to the current subcommunity, Is a node i The sum of the degrees between the nodes in the adjacent subcommunities, m is the total degree of the subcommunity.

[0024] Furthermore, the step of assigning the operation object to the corresponding hyperedge includes:

[0025] If the current operation object has been accessed by a process and a child process of the process, the current operation object is assigned to the hyperedge corresponding to the process;

[0026] If the current operation object and the process corresponding to the current operation object have a temporal relationship in an allocated operation object of a hyperedge, the current operation object is allocated to the hyperedge;

[0027] If the current operation object does not match a hyperedge, the current operation object is assigned to the hyperedge where the corresponding process is located.

[0028] Furthermore, embedding time periods, events, and operation objects into processes based on a hypergraph structure includes:

[0029] Arrange the attributes of processes, events, time periods, and operation objects into text and encode them through word2vec to form representation vectors;

[0030] The representation vectors are aggregated through time attributes to form the feature matrix of the hyperedge.

[0031] Furthermore, the update formula of the hypergraph neural network is as follows:

[0032] ;

[0033] in, Indicates l +1 layer of hypergraph neural network input features, Indicates l The hypergraph neural network input features of the layer, H represents the adjacency matrix of the hypergraph, express H The transpose of represents the degree matrix of the hyperedge, represents the degree matrix of the node, and represents the parameters to be trained, represents the weight matrix.

[0034] Compared with the prior art, the present invention has the following significant advantages: 1. For the collected fine-grained semantic logs, the high-order interactive capture of process behaviors is realized through the process operation network. 2. Based on the constructed hypergraph, the deep-level behavioral pattern mining between process interactions is realized. 3. By learning the hidden behavioral patterns, the hypergraph-based neural network can effectively identify and classify behaviors with higher accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The operation behavior network diagram constructed by the present invention through the collected audit logs;

[0036] Figure 2 A schematic diagram of constructing a hyperedge for a process node according to the present invention;

[0037] Figure 3 This is a diagram of the method for allocating operation objects of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0039] The present invention provides an APT malicious behavior discovery method based on hypergraph representation learning, which specifically includes the following process:

[0040] Step 1: Collect kernel event logs based on kernel log collection tools and convert them into traceability graphs. Use published log collection tools (such as the log collection tool disclosed in patent number 2022110610516) to collect system logs. System logs include all operation behavior events of processes, files, networks, and registries. Compress the traceability graph based on semantics to form a simplified traceability graph with key behaviors. The compression rules can be achieved through the following methods:

[0041] (1) Deleting benign semantic behaviors: Delete process events with benign access behaviors based on expert experience.

[0042] (2) Merging repeated behaviors: Due to fine-grained semantics, many semantic events with the same behavior will be generated. For example, deleting a file will generate dozens or even hundreds of identical logs. Such logs should be merged.

[0043] Step 2: Based on the compressed traceability graph, construct a process-based operation behavior network graph. Figure 1 As shown in the figure, the operation behavior network diagram is divided into four layers, namely process, event, time slot and operation object, where the operation object can be a file, registry and network socket. Figure 1 In the figure, P1 represents a process, T1, T2, and T3 represent time periods, F1 and F2 represent files, and S1 represents a network socket. According to the traceability diagram, the solid lines and dashed lines of different forms in the figure represent the semantic association and expression of different processes based on the four-layer network diagram. For example, the semantics of the solid line means that process P1 reads file F1 in time period T1. The arrows between processes P represent the creation relationship of the processes. The length of the T1 time period can be set by the user, such as 10 seconds, that is, events starting from t1 and occurring 10 seconds later to t2.

[0044] Step 3: Construct a hypergraph based on the process. Based on the operation behavior network diagram, through the analysis of the process, the process behavior is aggregated to form a hypergraph.

[0045] Step 3-1: Divide the process-based sub-communities to form hyperedges. Figure 2 As shown, the process network is extracted from the original operation behavior network diagram , where the node is the process P and the edge is the relationship between processes. For each process, the overlapping community discovery algorithm based on LFM (Local Fitness Maximization) is used to divide the process network and find a set of processes that can be aggregated to form a behavior, namely the process community { },in k is the number of subcommunities, It is the first k There are overlapping communities in the subcommunities of process p, that is, P1 belongs to community 1 or community 2. A subcommunity is a hyperedge, which is represented by HE .

[0046] The main steps of partitioning the process network based on the LFM algorithm are as follows: (1) Treat each process node as an independent subcommunity. (2) Traverse each node and try to join the subcommunity where the neighboring node is located, and calculate the modularity gain. The formula is as follows. If the modularity gain is positive, join the corresponding subcommunity until the modularity no longer changes.

[0047] The calculation process of modularity gain is as follows:

[0048] ;

[0049] in, represents the modularity gain, Is a node i The degree of is the sum of the node degrees within the current subcommunity, is the sum of the degrees of nodes connected to the current subcommunity, Is a node i The sum of the degrees between the nodes in the adjacent subcommunities, m is the total degree of the subcommunity.

[0050] The overlapping community discovery algorithm may be replaced by conventional overlapping community discovery algorithms such as LinkComm and Lemon.

[0051] Step 3-2: Operation object allocation. Figure 3 As shown, the operation object of the process is extracted, the correlation between the process and the operation object is analyzed, and the operation object is associated with the process network. The operation object node is allocated mainly through the following steps:

[0052] (1) Joint operation: If an operation object has been accessed by a process and its child processes, the operation object is assigned to the corresponding process. HE Super edge. Figure 3 As shown in part ①, P3 is a child process of P2, and F1 is accessed by P2 and P3, so F1 belongs to HE 1 Hyperedge. The actual behavior semantics is as follows: a malicious process accesses a configuration file, creates a process, and reads the same configuration file to obtain information.

[0053] (2) Timing order: If an operation object has a timing relationship with the process corresponding to the operation object in a certain hyperedge, it will be assigned to the hyperedge. Figure 3 As shown in part ②, after process P3 operates F1, time t When accessing F2, F1 and F2 are semantically related, then F2 belongs to HE 1 super edge, where time t It can be a user-determined time interval, such as 10 seconds. The actual behavior semantics is as follows: a process accesses a file and reads the content, and then writes it to another file.

[0054] (3) Category matching: For the operation objects that are not matched by the first two, they are assigned to the hyperedge where the process is located according to the process. Figure 3 As shown in part ③, F3 is accessed by process P7, but F3 does not meet the above conditions (1) and (2), so it belongs to the hyperedge where P7 is located, that is, HE 2 super edge.

[0055] The allocation relationship is prioritized in the order of (1), (2), and (3).

[0056] At this point, the operation objects are assigned to the hyperedges, forming a complete hypergraph structure.

[0057] Step 4: Representation of hyperedge behavior: Based on the process-based hypergraph structure formed above, a modeling method is used to extract hyperedge features for representation.

[0058] Step 4-1, attribute aggregation of process nodes. Based on the hypergraph structure of the process, the time period, event and operation object are embedded to form representation aggregation into the process node. The operation objects include files and network sockets, including inherent attributes such as file name, file type, file path, socket type, etc. The attributes of the process, event, time period and operation object are arranged into text and encoded by word2vec to form a representation vector, and the feature matrix of the hyperedge is formed by time attribute aggregation. At the same time, according to the definition and concept of the hypergraph, the degree matrix of the hyperedge, the degree matrix of the node and the weight matrix are formed.

[0059] Step 5: Use Hypergraph Neural Nerworks (HGNN) to discover APT malicious behavior. The update formula of Hypergraph Neural Nerworks is as follows:

[0060] ;

[0061] Among them, the hypergraph neural network is a multi-layer network architecture. Indicates l +1 layer of hypergraph neural network input features, Indicates l The hypergraph neural network input features of the layer, H represents the adjacency matrix of the hypergraph, express H The transpose of represents the degree matrix of the hyperedge, indicating the number of nodes contained in the hyperedge, represents the degree matrix of a node, indicating the number of edges associated with the node, and is a trainable parameter, represents the weight matrix. Indicates that Aggregate all the neighbor nodes of the hyperedge to the hyperedge, update the node features by multiplying them with H, and use Complete the normalization operation.

[0062] Since malicious behavior is a small sample, benign behavior is used for training to obtain a hypergraph classifier for benign behavior. The degree matrix of the hyperedges, the degree matrix of the nodes, and the weight matrix of the kernel event log to be detected are input into the hypergraph classifier, and the hypergraph classifier outputs the probability of whether it is malicious. If the output probability is greater than the preset threshold, it is considered that malicious behavior exists. If the output probability is less than or equal to the preset threshold, it is considered that there is no malicious behavior, and the discovery of APT malicious behavior is realized.

[0063] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for discovering APT malicious behavior based on hypergraph representation learning, characterized in that: The APT malicious behavior discovery method based on hypergraph representation learning includes: Collect kernel event logs to obtain a traceability graph, and compress the traceability graph; Based on the compressed traceability graph, a process-based operation behavior network graph is constructed, wherein the operation behavior network graph includes four layers, the first layer includes vertices and directed edges, wherein the vertices are processes, and the directed edges are creation relationships of processes, the second layer includes vertices, wherein the vertices are events, the third layer includes vertices, wherein the vertices are time periods, and the fourth layer includes vertices, wherein the vertices are operation objects, and the events, time periods, and operation objects corresponding to the operation behaviors of the processes are represented by edge connections between the layers; Extract the process network from the operation behavior network graph, where nodes are processes and edges are the relationships between processes. Use the overlapping community discovery algorithm to divide each process in the process network, find the set of processes that aggregate with the current process to form a behavior, and obtain the subcommunities of the process network. Each subcommunity forms a hyperedge. Extract the operation object of the process according to the operation behavior network diagram, assign the operation object to the corresponding hyperedge to form a hypergraph structure, in which the process is a node of the hypergraph structure; Based on the hypergraph structure, time periods, events and operation objects are embedded into the process to obtain the feature matrix of the hyperedge; Based on the feature matrix of the hyperedge, the degree matrix of the hyperedge, the degree matrix of the node and the weight matrix are formed to train the hypergraph neural network and obtain the hypergraph classifier; Using hypergraph classifier to discover APT malicious behavior.

2. The APT malicious behavior discovery method based on hypergraph representation learning according to claim 1 is characterized in that: The overlapping community discovery algorithm is an LFM-based overlapping community discovery algorithm. The steps of dividing each process in the process network by the LFM-based overlapping community discovery algorithm are as follows: Treat each node as an independent subcommunity; Traverse each node and calculate the modularity gain when the current node joins the subcommunity where the neighbor node is located. If the modularity gain is positive, the current node is added to the corresponding subcommunity. If the modularity gain is negative, the current node is not added to the corresponding subcommunity until the modularity gain is 0. The calculation formula of modularity gain is as follows: ； in, represents the modularity gain, Is a node i The degree of is the sum of the node degrees within the current subcommunity, is the sum of the degrees of nodes connected to the current subcommunity, Is a node i The sum of the degrees between the nodes in the adjacent subcommunities, m is the total degree of the subcommunity.

3. The APT malicious behavior discovery method based on hypergraph representation learning according to claim 1 is characterized in that: The step of assigning the operation object to the corresponding hyperedge comprises: If the current operation object has been accessed by a process and a child process of the process, the current operation object is assigned to the hyperedge corresponding to the process; If the current operation object and the process corresponding to the current operation object have a temporal relationship in an allocated operation object of a hyperedge, the current operation object is allocated to the hyperedge; If the current operation object does not match a hyperedge, the current operation object is assigned to the hyperedge where the corresponding process is located.

4. The APT malicious behavior discovery method based on hypergraph representation learning according to claim 1 is characterized in that: The method of embedding time periods, events and operation objects into a process based on a hypergraph structure includes: Arrange the attributes of processes, events, time periods, and operation objects into text and encode them through word2vec to form representation vectors; The representation vectors are aggregated through time attributes to form the feature matrix of the hyperedge.

5. The APT malicious behavior discovery method based on hypergraph representation learning according to claim 1 is characterized in that: The update formula of the hypergraph neural network is as follows: ； in, Indicates l +1 layer of hypergraph neural network input features, Indicates l The hypergraph neural network input features of the layer, H represents the adjacency matrix of the hypergraph, express H The transpose of represents the degree matrix of the hyperedge, represents the degree matrix of the node, and represents the parameters to be trained, represents the weight matrix.

Images