APT attack tracing method and system based on log graph representation method

Abstract

The present invention discloses an APT attack tracing method and system based on a log graph representation method. The method constructs a tracing graph according to a public attack log of an attack event; extracts an APT tracing graph with attack characteristics according to the tracing graph and constructs an APT tracing graph sample library; performs anomaly detection on log data before and after a time period in which an attack behavior corresponding to the APT tracing graph with attack characteristics is generated, extracts nodes that have set differences from normal logs, classifies statistical data corresponding to all nodes according to attack organizations, obtains behavioral characteristics of the APT attack organization, and constructs a behavioral characteristic sample library according to the behavioral characteristics of the APT attack organization; obtains an APT tracing graph with attack characteristics of an abnormal log to be detected, matches the APT tracing graph with attack characteristics with each sample in the APT tracing graph sample library, determines whether the abnormal log is an attack behavior according to the matching result, and identifies the organizational identity of the APT attack based on the characteristic sample library.

Description

Technical Field

[0001] The present invention relates to the field of computer security, and in particular to an APT attack tracing method and system based on a log graph representation method. Background Art

[0002] Advanced persistent threat (APT) attacks are complex, long-term cyberattacks characterized by high stealth and destructiveness. They are typically launched by organized attackers with the goal of stealing sensitive information, damaging critical infrastructure, or causing severe economic losses. APT attacks are unique in their persistence and targeted nature. Attackers can remain lurking within target networks for months or even years, gradually advancing through carefully designed attack chains to ultimately achieve their objectives. APT attacks are extremely destructive, often targeting key sectors such as government agencies, financial institutions, and the energy sector. They can steal large amounts of sensitive information, jeopardizing national security and economic interests.

[0003] Attackers typically employ multi-stage, multi-layered attack strategies, each step potentially involving different attack methods and techniques, increasing the complexity of attribution tracing. Attackers also employ various technical means to conceal their activities, such as encrypting communications, disguising network traffic, and deleting logs, making traditional attribution tracing difficult to effectively track. Furthermore, APT attackers typically possess advanced technical capabilities and abundant resources, enabling them to continuously combat and circumvent security measures, further complicating attribution tracing. Existing attribution tracing methods primarily rely on log analysis, traffic analysis, and behavioral analysis, but these methods often fall short in the face of complex APT attacks. Log analysis requires processing massive amounts of data, and logs are easily tampered with or deleted; traffic analysis struggles to identify malicious activity within encrypted traffic; and behavioral analysis struggles to distinguish APT attacks from normal operations. Summary of the Invention

[0004] In response to the problems in the existing technology of difficulty in identifying APT (advanced persistent threat) attacks, complex log processing, difficulty in learning the temporal correlation between data, high attack concealment leading to untimely detection, and inability to fully trace the entire event chain, the present invention provides an APT attack tracing method based on a log graph representation method. This method can review and detect APT attack behavior, identify APT attack characteristics, and find the organizational characteristics behind different APT incidents.

[0005] The present invention is achieved through the following technical solutions:

[0006] A method for tracing the source of an APT attack based on a log graph representation method includes the following steps:

[0007] Step 1: Build a traceability graph based on the public attack logs of the attack event;

[0008] Step 2: Extract APT tracing graphs with attack characteristics based on the tracing graphs, and build an APT tracing graph sample library based on the APT tracing graphs with attack characteristics;

[0009] Step 3: Perform anomaly detection on the log data before and after the time period when the attack behavior corresponding to the APT traceability diagram with attack characteristics occurs. Nodes with set differences from normal logs are extracted. The statistical data corresponding to all nodes are classified according to the attack organization to obtain the behavioral characteristics of the APT attack organization. A behavioral characteristic sample library is constructed based on the behavioral characteristics of the APT attack organization.

[0010] Step 4: Obtain an APT traceability graph with attack characteristics for the abnormal log to be detected according to the methods of steps 1 and 2, match the APT traceability graph with attack characteristics with each sample in the APT traceability graph sample library, determine whether the abnormal log is an attack behavior based on the matching result, and identify the organizational identity of the APT attack based on the feature sample library.

[0011] Preferably, in step 1, a traceability graph is constructed by analyzing the temporal relationship of the attack behavior based on the public attack log.

[0012] Preferably, the method for determining the timing relationship is as follows:

[0013] The public attack logs are converted into corresponding graph representations using the CamFlow tool, and the temporal connections between various attack behaviors are determined based on the graph representations.

[0014] Preferably, the method for extracting the APT tracing graph with attack characteristics in step 2 is as follows:

[0015] According to the whitelist behavior, the edges in the traceability graph that are completely unrelated to the attack node are deleted to generate isolated subgraphs and / or isolated nodes. The isolated nodes are removed and the isolated subgraphs are connected according to the access IP and timing relationship to obtain an APT traceability graph with attack characteristics.

[0016] Preferably, the isolated subgraphs are connected according to the access IP and time sequence relationship to obtain an APT tracing graph with attack characteristics, including:

[0017] Create a head node for the time segment of each isolated subgraph, and assign the head node attributes with IP and time sequence. Add directed edges to the head nodes with the same IP according to the time sequence relationship, so that the isolated subgraphs corresponding to the same IP are connected to obtain an APT tracing graph with attack characteristics.

[0018] Preferably, in step 4, a matching algorithm is used to match the APT source tracing graph with attack characteristics in the abnormal log with each sample in the APT source tracing graph sample library.

[0019] Preferably, the matching algorithm is a VF2 subgraph isomorphism matching algorithm.

[0020] Preferably, in step 4, when a corresponding sample is matched, the abnormal log is an attack behavior, and the attack node path of the abnormal log is located to complete the tracing of the APT attack.

[0021] Preferably, the method for identifying the identity of the organization behind the APT attack based on the signature sample library in step 4 is as follows:

[0022] The log data before and after the attack behavior corresponding to the node path is compared with the behavioral characteristics of the APT attack organization to identify the organization that carried out the APT attack.

[0023] A system for tracing the source of an APT attack based on a log graph representation method, comprising:

[0024] The collection module is used to build a traceability map based on the public attack logs of attack events;

[0025] The source tracing graph module is used to extract APT source tracing graphs with attack characteristics based on the source tracing graph, and build an APT source tracing graph sample library based on the APT source tracing graphs with attack characteristics;

[0026] The feature sample module is used to perform anomaly detection based on the log data before and after the time period of the attack behavior corresponding to the APT traceability diagram with attack characteristics, extract nodes that have set differences from normal logs, classify the statistical data corresponding to all nodes according to the attack organization, obtain the behavioral characteristics of the APT attack organization, and build a behavioral feature sample library based on the behavioral characteristics of the APT attack organization;

[0027] The identification module is used to obtain an APT traceability graph with attack characteristics of the abnormal log to be detected, match the APT traceability graph with attack characteristics with each sample in the APT traceability graph sample library, determine whether the abnormal log is an attack behavior based on the matching result, and identify the organizational identity of the APT attack based on the feature sample library.

[0028] Compared with the prior art, the present invention has the following beneficial technical effects:

[0029] The present invention provides an APT attack tracing method based on a log graph representation method. This method solves the problem of no direct behavioral relationship in the log template data by converting the APT attack log data into a graph representation. It can display the temporal connection between various behaviors and realize a comprehensive analysis and review of the attack behavior. Secondly, the method solves the problem of the infeasibility of large-scale graph matching calculations through graph matching technology and pruning strategies, effectively reduces the computational complexity, and ensures the feasibility and efficiency of the matching process. The system accurately matches the attack behavior on the layer plane, and uses the VF2 subgraph isomorphism algorithm to efficiently identify known attack patterns and quickly locate attack paths and key nodes. By performing statistical analysis on the extracted APT attack features, it can not only detect and trace APT attacks, but also identify the organizational characteristics of the attack, and provide accurate organizational identity identification. In summary, the present invention significantly improves the accuracy and efficiency of APT attack tracing, and provides strong technical support for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flowchart of the APT traceability graph extraction and attack detection of the present invention;

[0031] Figure 2 This is an example diagram of the APT traceability graph pruning solution of the present invention;

[0032] Figure 3 This is the graph matching process used by the present invention to detect APT attacks;

[0033] Figure 4 This paper compares the performance of this solution with other existing solutions in APT tracing. DETAILED DESCRIPTION

[0034] The present invention will be further described in detail below with reference to the accompanying drawings, which are intended to explain rather than limit the present invention.

[0035] A method and system for tracing the source of an APT attack based on a log graph representation method, the specific steps are as follows:

[0036] Step 1: Obtain the public attack logs of the attack event, determine the temporal relationship of the attack behavior in the public attack logs, and build a traceability diagram based on the temporal relationship.

[0037] Collect public attack logs of various attack events, and convert the log data into corresponding graph representations using the CamFlow tool to show the temporal connections between various attack behaviors and construct a traceability graph based on the temporal connections.

[0038] Step 2: Extract APT tracing graphs with attack characteristics based on the tracing graphs, and build an APT tracing graph sample library based on the APT tracing graphs with attack characteristics. The specific method is as follows:

[0039] S2.1. Set a whitelist behavior and delete edges in the provenance graph that are completely unrelated to the attacking node based on the whitelist behavior, generating isolated subgraphs and / or isolated nodes.

[0040] S2.2. Remove isolated nodes to eliminate the interference of normal access behavior on graph data.

[0041] S2.3. Connect the isolated subgraphs based on the access IP and time sequence relationship to obtain an APT traceability graph with attack characteristics. The method is as follows:

[0042] Create a head node for the time segment of each isolated subgraph, and assign the head node attributes with IP and time sequence. Add directed edges to the head nodes with the same IP according to the time sequence relationship, so that the isolated subgraphs corresponding to the same IP are connected to obtain an APT tracing graph with attack characteristics.

[0043] S2.4. The extracted APT tracing graphs with attack characteristics are stored in the APT tracing graph sample library.

[0044] Step 3: Perform anomaly detection on the log data before and after the time period when the attack behavior corresponding to the APT tracing diagram with attack characteristics occurs, extract nodes that have set differences from normal logs, classify the statistical data corresponding to all nodes according to the attack organization, obtain the behavioral characteristics of the APT attack organization, and build a behavioral characteristic sample library based on the behavioral characteristics of the APT attack organization.

[0045] Step 4: Obtain an APT source tracing graph with attack characteristics for the abnormal log to be detected according to the methods of steps 1 and 2, match the APT source tracing graph with attack characteristics with each sample in the APT source tracing graph sample library, and determine whether the abnormal log is an attack behavior based on the matching result.

[0046] A matching algorithm is used to match the APT tracing graph with attack characteristics in the abnormal log with each sample in the APT tracing graph sample library.

[0047] In this embodiment, the VF2 subgraph isomorphism matching algorithm is used to match the APT traceability graph with attack characteristics of the abnormal log to be detected with the samples in the database. When the corresponding sample is matched, the abnormal log is an attack behavior, and the attack node path of the abnormal log is located to complete the tracing of the APT attack.

[0048] The log data before and after the attack behavior corresponding to the node path is compared with the behavioral characteristics of the APT attack organization to identify the organization that carried out the APT attack.

[0049] Example 1

[0050] A method and system for tracing the source of an APT attack based on a log graph representation method, the specific steps are as follows:

[0051] Step 1: Collect attack event logs. Collect public attack logs of various attack events and convert the log data into corresponding graph representations (GGG) using the CalmFlow tool to show the temporal connections between various behaviors and construct a traceability graph based on the temporal connections.

[0052] The nodes V in the graph representation G represent attack events, and the edges E represent the relationship between events. For example, suppose the log data includes the following lines:

[0053] 2023-07-01 12:00:00,IP:192.168.0.1,Action:Login

[0054] 2023-07-01 12:05:00,IP:192.168.0.1,Action:File Access

[0055] 2023-07-01 12:10:00,IP:192.168.0.2,Action:Login

[0056] 2023-07-01 12:15:00,IP:192.168.0.1,Action:Data Transfer

[0057] Using the CalmFlow tool, these log data are converted into the following graph representation:

[0058] Node set V = {v1,v2,v3,v4}

[0059] Edge set E = {(v1, v2), (v2, v3), (v3, v4)}, where nodes represent specific log events and edges represent the temporal relationship between events.

[0060] Step 2: Extract the APT source map with attack characteristics based on the source map. Figure 2 , the specific steps are as follows:

[0061] Eliminate irrelevant edges and nodes: Delete all edges and nodes from graph G that are not in the edge set of query graph Q, such as Figure 2(b). Suppose the initial graph G contains the node set V = {v1, v2, v3, v4} and the edge set E = {(v1, v2), (v2, v3), (v3, v4). The query graph Q contains the node set VQ = {v1, v2, v3} and the edge set EQ = {(v1, v2), (v2, v3)}. Using the formula E′ = E∩EQ, we obtain the optimized edge set E′ = {(v1, v2), (v2, v3) and node set V′ = {v1, v2, v3}.

[0062] Cut off isolated nodes, such as Figure 2 (c) Based on V′ and E′ obtained in the previous step, assuming V′ = {v1, v2, v3, v5} and E′ = {(v1, v2), (v2, v3)}, the isolated node v5 will be removed, and V″ = {v1, v2, v3} will be obtained.

[0063] Connecting isolated subgraphs: Connecting isolated subgraphs based on access IP and timing relationships, such as Figure 2 (d) For example, for each time segment ti, create a head node Hi and connect it to Vti. Suppose t1 contains v1 and v2, and t2 contains v3. Then create head nodes H1 and H2 and connect them to v1, v2, and v3, respectively. The final graph is represented as V = {H1, H2, v1, v2, v3} and E = {(H1, v1), (H1, v2), (H2, v3)}.

[0064] Step 3: Extract the collected APT attack log data with organizational characteristics from step 2, perform anomaly detection on the log data before and after the time period when the main attack behavior occurred, compare the differences between each behavior, statistically analyze the attack characteristics of a certain organization, and extract the identity of the organization.

[0065] Anomaly detection: This function detects anomalies within a time window W of log data D. For example, consider a 5-minute window and detect anomalies within that window. For example, a Bayesian inference algorithm can be used to calculate the probability of behavior and identify anomalous behavior.

[0066] P(A|B)=P(B|A)·P(A)P(B)

[0067] Feature extraction: Perform statistical analysis on the detection results R and extract tissue features F.

[0068] F = statistical analysis (R)

[0069] Identity: Extract the feature identifier anomaly detection model ID from feature F.

[0070] ID = Extract Identity (F)

[0071] Step 4: Abnormal log detection and matching. Perform steps 1 and 2 on the abnormal logs to be detected, and perform VF2 subgraph isomorphism matching algorithm on the obtained graph G′ and the graph Q in the sample library. The effect is as follows: Figure 3 .

[0072] Subgraph isomorphism matching: Use the VF2 algorithm to match the graph G′ and the query graph Q. The specific steps of the VF2 algorithm are as follows:

[0073] Initialization state Recursively expand state Si until a complete match M is found

[0074] Where Si represents the matching status and M represents the complete matching result. The matching conditions are:

[0075] Make label (u) = label (u′) and label (v) = label (v′) Match result analysis: If the match is successful, the attack-related node path P is located.

[0076] P={(u′,v′)∈G′|(u,v)∈Q satisfies the matching condition}

[0077] Attack tracing and organization identification: Restore the extracted graph to the log tracing base map, perform statistical analysis on the data within the corresponding time window, and compare it with the organization identity identification model ID extracted in step 3 to identify the organization that carried out the APT attack.

[0078] Identify the organization O = compare (ID, P)

[0079] Example 2

[0080] An APT attack tracing system based on a log graph representation method includes:

[0081] The collection module is used to build a traceability map based on the public attack logs of attack events;

[0082] The source tracing graph module is used to extract APT source tracing graphs with attack characteristics based on the source tracing graph, and build an APT source tracing graph sample library based on the APT source tracing graphs with attack characteristics;

[0083] The feature sample module is used to perform anomaly detection based on the log data before and after the time period of the attack behavior corresponding to the APT traceability diagram with attack characteristics, extract nodes that have set differences from normal logs, classify the statistical data corresponding to all nodes according to the attack organization, obtain the behavioral characteristics of the APT attack organization, and build a behavioral feature sample library based on the behavioral characteristics of the APT attack organization;

[0084] The identification module is used to obtain an APT traceability graph with attack characteristics of the abnormal log to be detected, match the APT traceability graph with attack characteristics with each sample in the APT traceability graph sample library, determine whether the abnormal log is an attack behavior based on the matching result, and identify the organizational identity of the APT attack based on the feature sample library.

[0085] The present invention solves the problem of infeasible large-scale graph matching calculations in APT attack tracing by introducing graph representation and graph matching strategies, and significantly improves the efficiency of APT attack detection and tracing. By using Bayesian reasoning for anomaly detection, it is possible to accurately identify abnormal behaviors in log data, and comprehensively review the attack process through graph operation methods to achieve fine tracking at the node level. Combined with the subgraph isomorphism matching of the VF2 algorithm, the present invention can efficiently identify known attack patterns, quickly locate attack paths and key nodes, and accurately identify APT attack organizations through the extracted organizational features through statistical analysis. The present invention has good scalability and adaptability in large-scale network environments, and provides strong technical support for network security protection.

[0086] Compared with the existing technology, the APT attack tracing method based on graph operation of the present invention has significant advantages. The graph representation method can comprehensively review the entire attack process. By constructing an APT tracing graph, each event in the attack chain is used as a node, and the causal relationship between events is used as an edge to form an overall graph structure. This graph structure can intuitively display the attacker's action path and strategy, helping security analysts to fully understand the attack process. The graph operation method can also achieve node-level tracking. By performing fine-grained operations and analysis on the graph, key nodes and events in the attack chain can be accurately located, such as the initial intrusion point, privilege escalation operations, and lateral movement paths. Graph matching technology can efficiently identify known attack patterns. By matching known attack patterns with graph isomorphism algorithms, potential attack paths and steps can be quickly identified. Combined with pruning strategies, the matching process is optimized, computational complexity is reduced, and matching efficiency is improved. In addition, the graph operation method also has good scalability and adaptability. Whether facing complex attack chains or large-scale network environments, graph representation and matching technologies can effectively process large amounts of data and complex relationships, providing efficient and reliable tracing results. By applying the sophisticated graph operations and pruning strategies in the CPG (Code Property Graph) to the APT traceability graph, we can efficiently identify and track APT attack paths in large-scale network environments. This approach not only improves the efficiency and accuracy of APT attack traceability, but also enables a comprehensive review of the attack process and detailed node-level tracking, providing strong support for network security protection.

[0087] The above content is only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A method for tracing the source of an APT attack based on a log graph representation method, characterized in that: The following steps are involved: Step 1: Build a traceability graph based on the public attack logs of the attack event; Step 2: Extract APT tracing graphs with attack characteristics based on the tracing graphs, and build an APT tracing graph sample library based on the APT tracing graphs with attack characteristics; Step 3: Perform anomaly detection on the log data before and after the time period when the attack behavior corresponding to the APT traceability diagram with attack characteristics occurs. Nodes with set differences from normal logs are extracted. The statistical data corresponding to all nodes are classified according to the attack organization to obtain the behavioral characteristics of the APT attack organization. A behavioral characteristic sample library is constructed based on the behavioral characteristics of the APT attack organization. Step 4: Obtain an APT traceability graph with attack characteristics for the abnormal log to be detected according to the methods of steps 1 and 2, match the APT traceability graph with attack characteristics with each sample in the APT traceability graph sample library, determine whether the abnormal log is an attack behavior based on the matching result, and identify the organizational identity of the APT attack based on the feature sample library.

2. The APT attack tracing method based on the log graph representation method according to claim 1 is characterized in that: In step 1, the temporal relationship of the attack behavior is analyzed based on the public attack logs to construct a traceability graph.

3. The APT attack tracing method based on the log graph representation method according to claim 2 is characterized in that: The method for determining the timing relationship is as follows: The public attack logs are converted into corresponding graph representations using the CamFlow tool, and the temporal connections between various attack behaviors are determined based on the graph representations.

4. The APT attack tracing method based on log graph representation method according to claim 1 is characterized in that: The method for extracting the APT source traceability graph with attack characteristics described in step 2 is as follows: According to the whitelist behavior, the edges in the traceability graph that are completely unrelated to the attack node are deleted to generate isolated subgraphs and / or isolated nodes. The isolated nodes are removed and the isolated subgraphs are connected according to the access IP and timing relationship to obtain an APT traceability graph with attack characteristics.

5. The APT attack tracing method based on the log graph representation method according to claim 4 is characterized in that: Connect the isolated subgraphs based on the access IP and timing relationships to obtain an APT traceability graph with attack characteristics, including: Create a head node for the time segment of each isolated subgraph, and assign the head node attributes with IP and time sequence. Add directed edges to the head nodes with the same IP according to the time sequence relationship, so that the isolated subgraphs corresponding to the same IP are connected to obtain an APT tracing graph with attack characteristics.

6. The APT attack tracing method based on log graph representation method according to claim 1 is characterized in that: In step 4, a matching algorithm is used to match the APT source tracing graph with attack characteristics in the abnormal log with each sample in the APT source tracing graph sample library.

7. The APT attack tracing method based on log graph representation method according to claim 6 is characterized in that: The matching algorithm is a VF2 subgraph isomorphism matching algorithm.

8. The APT attack tracing method based on the log graph representation method according to claim 1 or 7, characterized in that: In step 4, when the corresponding sample is matched, the abnormal log is an attack behavior, and the attack node path of the abnormal log is located to complete the tracing of the APT attack.

9. The APT attack tracing method based on log graph representation method according to claim 8 is characterized in that: The method for identifying the organization behind the APT attack based on the signature sample library in step 4 is as follows: The log data before and after the attack behavior corresponding to the node path is compared with the behavioral characteristics of the APT attack organization to identify the organization that carried out the APT attack.

10. A system for executing the APT attack tracing method based on the log graph representation method according to any one of claims 1 to 9, characterized in that: include: The collection module is used to build a traceability map based on the public attack logs of attack events; The source tracing graph module is used to extract APT source tracing graphs with attack characteristics based on the source tracing graph, and build an APT source tracing graph sample library based on the APT source tracing graphs with attack characteristics; The feature sample module is used to perform anomaly detection based on the log data before and after the time period of the attack behavior corresponding to the APT traceability diagram with attack characteristics, extract nodes that have set differences from normal logs, classify the statistical data corresponding to all nodes according to the attack organization, obtain the behavioral characteristics of the APT attack organization, and build a behavioral feature sample library based on the behavioral characteristics of the APT attack organization; The identification module is used to obtain an APT traceability graph with attack characteristics of the abnormal log to be detected, match the APT traceability graph with attack characteristics with each sample in the APT traceability graph sample library, determine whether the abnormal log is an attack behavior based on the matching result, and identify the organizational identity of the APT attack based on the feature sample library.

Images