A method for detecting APT attacks based on malicious intent representation graph

Abstract

The present invention belongs to the field of network security technology, and specifically relates to an APT attack detection method based on a malicious intent representation graph. The present invention includes collecting system tracing event streams, constructing a knowledge graph, and using the knowledge graph and labels to construct a malicious intent representation graph; using the WL graph kernel method to extract the structural features of the nodes, and extracting the malicious intent features of the nodes according to the labels; inputting the fusion features of the structural features and the malicious intent features into the variational autoencoder model to obtain reconstructed features; comparing the fusion features with the reconstructed features to detect whether the node is an abnormal node. The present invention detects APT attacks by constructing a malicious intent representation graph, and integrates more features compared to traditional APT attack detection. More features make the detection effect better and further reduce false alarms. This is because the change in structural features has a smaller impact on the model. The model not only focuses on the changes in structural features, but also pays attention to the changes in the malicious behavior tendencies of the nodes.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an APT attack detection method based on a malicious intent representation graph. Background Art

[0002] In recent years, security threats targeting large enterprises have escalated, typified by advanced persistent threats (APTs), carried out by skilled attackers with sophisticated network capabilities. These attacks are highly organized and targeted, frequently exploiting zero-day vulnerabilities and employing a "slow and stealthy" attack model. Successful attacks can result in financial losses.

[0003] Traditional attack investigation methods often struggle to determine an attack due to insufficient evidence. To combat these threats, attack incidents must be accurately located for investigation. Researchers have developed data provenance technology, which uses provenance graphs to explore audit records, describing the execution history of a system. The rich context within provenance data enables analysts to perform causal analysis of system activities to detect intrusions, track interdependencies, and understand security incidents. Numerous detection systems have emerged based on provenance graphs. Currently, these can be categorized into two main types: rule-based IDS and learning-based IDS. Rule-based detection systems employ rule-based detection. Their key concept is to leverage threat knowledge to formulate rules, and any behavior that violates these rules is considered an anomaly. Learning-based detection systems detect anomalies by learning from benign behavior patterns within the system. Their key concept is that malicious behavior often differs significantly from benign behavior within the system. By modeling the system's benign behavior, they detect deviations from it and deem those deviations to be anomalies if they exceed a given threshold. While learning-based detection methods have achieved significant success in detecting unknown zero-day vulnerabilities, they are prone to generating a high number of false positives and are susceptible to copycat attacks.

[0004] To enable provenance graphs to be applied to machine learning modeling, most current detection systems encode graphs, paths, and nodes into fixed-length vector representations based on their surrounding structural information. This approach detects anomalies by modeling the system's benign behavior patterns. The fundamental principle of this detection approach is that the behavioral characteristics of attack graphs, attack paths, and attack nodes must be distinct from those of benign graphs, benign paths, and benign nodes. From a modeling perspective, this also means that the structural characteristics of the associated attack graphs, attack paths, and attack nodes must also be distinct from those of benign nodes. However, it is well known that normal behavior cannot be fully learned. If unlearned benign behavior occurs, the detection system will trigger an alarm. This is why traditional intrusion detection methods often generate false alarms. Summary of the Invention

[0005] The purpose of the present invention is to solve the problems of high false alarm rate and missed alarm rate in traditional detection methods, and propose an APT attack detection method based on malicious intent characterization graph.

[0006] In order to achieve the above object, the technical solution provided by the present invention is:

[0007] A method for detecting APT attacks based on a malicious intent representation graph includes:

[0008] Collect system traceability event streams, convert them into nodes and edges, and build a knowledge graph. Based on the node behavior and label transfer rules, assign corresponding malicious intent labels to the nodes. Use the knowledge graph and malicious intent labels to build a malicious intent representation graph.

[0009] The WL graph kernel method is used to extract the structural features of the nodes, and the malicious intention features of the nodes are extracted based on the malicious intention labels;

[0010] The structural features and malicious intent features of each node are normalized and concatenated to obtain fused features. The fused features are then input into the variational autoencoder model to obtain reconstructed features.

[0011] The fused features are compared with the reconstructed features using cosine similarity. When the difference is greater than the preset anomaly threshold, the current node is an anomaly node. When the difference is less than or equal to the preset anomaly threshold, the current node is a benign node.

[0012] Furthermore, the system traceability event stream is collected, converted into nodes and edges, and a knowledge graph is constructed. Corresponding malicious intent labels are assigned to nodes according to the node behavior and label transfer rules, and a malicious intent representation graph is constructed using the knowledge graph and labels, including:

[0013] Collect system traceability event streams to build a knowledge graph. When an event has not been recorded, add the source and target nodes to the knowledge graph as new nodes, assign corresponding timestamps and attribute information to the new nodes, and create an edge for the new nodes.

[0014] When the number of nodes in the knowledge graph reaches a first preset number, the construction of the knowledge graph is completed;

[0015] Continue to collect system traceability event streams. If the source node or target node of a new event is a node connected to a node in the knowledge graph, add the source node or target node to the knowledge graph and assign the corresponding malicious intent label to the source node or target node of the new event according to the label transfer rules. If the source node or target node of the new event is a node not connected to a node in the knowledge graph, use it to construct a new knowledge graph.

[0016] When the number of nodes in the knowledge graph reaches a second preset number, a malicious intent representation graph is generated.

[0017] Furthermore, the WL graph kernel method is used to extract the structural features of the nodes, including:

[0018] The node type is used as the node type label, and the event type is used as the edge type label;

[0019] For each node, the WL graph kernel method is used to combine the type label of the current node and the type labels of the edges and nodes connected to the current node in chronological order to obtain the new type label of the current node, and update the type label of each node a preset number of times;

[0020] Based on the updated type labels, the Skip-Gram model of doc2vec is used to generate the structural features of the nodes.

[0021] Furthermore, extracting the malicious intent feature of the node according to the malicious intent label includes:

[0022] Calculate the number of different malicious intent labels, recorded as ;

[0023] Set the type mapping function for malicious intent labels to , mapping the type of malicious intent label to The integer range of ;

[0024] Calculate the number of labels of each type for each node and get the Dimensional node malicious intention characteristics.

[0025] Compared with the existing technology, the present invention has the following significant advantages: (1) By constructing a malicious intent representation graph, APT attacks are detected from a new perspective. Compared with traditional APT attack detection, this method integrates structural features and malicious intent features. (2) The integration of structural features and malicious intent features improves detection results. Changes in structural features have a smaller impact on the model. The model not only focuses on changes in structural features, but also on changes in the malicious behavior tendencies of nodes, further reducing false positives. (3) The VAE model is used for model training and detection. This model is lightweight and has higher detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of an APT attack detection method based on a malicious intent representation graph of the present invention;

[0027] Figure 2 This is an example diagram of the malicious intent characterization diagram of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0029] like Figure 1 As shown, the present invention provides an APT attack detection method based on a malicious intent representation graph, and the specific steps are as follows:

[0030] (1) Constructing a malicious intent representation graph: Receive the system traceability event stream collected from the agent installed on the monitoring host, build a knowledge graph (KG) in memory, and construct a malicious intent representation graph based on pre-defined label transfer rules.

[0031] (1-1) Knowledge graph construction:

[0032] Receive the system traceability event stream collected from the agent installed on the monitoring host to build a knowledge graph. Through a set of nodes V={v1,v2,v3,.....,v n} and edge E={e1,e2,e3,...,e m}Define a knowledge graph KG, where v n represents the nth node, e m Represents the mth edge. KG is a triple<srcid,dstid,attr> Each edge in the KG is stored in the form of , where the edge represents the type of event, srcid and dstid are the IDs of the source and target nodes of the edge, respectively. The source node represents the subject of the event, which is usually a node of type Process, and the target node represents the object being operated on. Attr is an attribute of the edge, containing the operation type and timestamp. The KG also stores necessary node attributes: such as the process name and the associated command line. Table 1 shows the considered subject and object types and the relationships between them, as well as the corresponding considered node attributes.

[0033] Table 1 Subject and event types

[0034]

[0035] (1-2) Malicious intention construction:

[0036] In order to obtain the malicious intention of each node, the present invention constructs a malicious intention representation graph by defining a series of malicious intention labels. For example, the attacker's intentions are generally known to be: obtaining sensitive data, running attacker code, replacing important files, etc. Therefore, the malicious tendency of the node can be defined by this. For example, when a file involves sensitive data, a dedicated malicious intention label Sensitive_data is defined for it. When the node accesses the sensitive data (Sensitive_data), a dedicated malicious intention label Acc_sen_data is defined for the node. Here, only the specific ideas of the definition are given. How to define it can be different according to different needs. You can refer to the label transfer rules disclosed in the document "Zhu T, Yu J, Xiong C, et al. Aptshield: A stable, efficient and real-time apt detection system for linux hosts[J]. IEEE Transactions on Dependable and Secure Computing, 2023, 20(6): 5247-5264.". Generally speaking, it is believed that the more malicious intention labels a node has, the more malicious behavior tendencies the node has.

[0037] (1-3) Malicious Intent Representation Graph Construction:

[0038] In order to process data efficiently, the incoming system traceability event stream is processed in chronological order, and a fixed-size knowledge graph is built in memory (i.e., step 1-1). For each incoming system traceability event stream, when the event in the system traceability event stream has not been recorded, the source node and target node of the event are added to the KG as new nodes, and the corresponding timestamp and related attribute information are assigned to the node, and an edge is created for the new node, which represents the specific type of the event. The newly added subjects, objects, and events are marked as recorded. At the same time, the label transfer rules defined by the malicious intent construction are applied to assign corresponding malicious intent labels to the nodes: when the number of nodes reaches a fixed size j, it is recorded as graph a. At this time, graph a is not rushed to the next step (node ​​feature extractor), but is retained until the number of nodes in the graph reaches j (1+f s )(f sis a given learning rate). During this process, for each newly arrived system tracing event stream x, and the corresponding source node and target node, observe whether the source node and target node in the event stream are nodes connected to the nodes in Figure a. If the source node or target node is a node connected to the node in Figure a, then add the source node or target node to Figure a, and assign the corresponding malicious intent label to the source node or target node according to the label transfer rule, that is, add the corresponding attribute to the source node or target node in Figure a. If neither the source node nor the target node is connected to the node in Figure a, then construct a new knowledge graph according to the method of step (1-1), and generate the corresponding malicious intent representation graph b. This step ensures that the transmitted malicious behavior tendency is obtained. It alleviates the problem of node information disconnection in the traditional graph processing process. The specific algorithm flow is as follows:

[0039] Input: Event Stream E, MIR-Graph size n, rate f s

[0040] Output: MIR-Graph MIRG_Seq={}

[0041] MIRG_Seq = {}

[0042] K = 0

[0043] G = Graph()

[0044] While catching e from E:

[0045] If len(G.nodes()) > n and len(G.nodes()) < j(1+f s ) :

[0046] KG = G.copy()

[0047] MIRG_Seq[k] = KG

[0048] K = K+1

[0049] If len(G.nodes()) > j(1+f s ):

[0050] older = sort(G.nodes,G.timestamps)[: j]

[0051] G.remove_nodes(older)

[0052] G.add_node(e.src)

[0053] G.add_node(e.dst)

[0054] G.add_edge(e)

[0055] G.add_sign(e.src) ##label assignment

[0056] G.add_sign(e.dst) ##label assignment

[0057] G.convey_sign(e) ##label transfer

[0058] (2) Node feature extraction: The node feature extractor receives the malicious intent representation graph, extracts the structural feature vector representation of the node (structural feature) and the malicious behavior tendency feature vector representation of the node (malicious intent feature), and generates the final node feature vector representation based on the above two features.

[0059] (2-1) Node structure feature extraction:

[0060] To obtain the structural features of nodes and further improve the algorithm's runtime performance, the Weisfeiler-Lehman (WL) graph kernel method is used to extract node structural features. Specifically, the WL graph kernel captures node label information and generates a structural feature vector representation of the node using doc2vec. The specific process is shown below.

[0061] Step 1 (initialization): The types of subjects and objects are used as type labels of nodes (as shown in Table 1), and the types of events are used as type labels of edges (as shown in Table 1).

[0062] Step 2 (iterative process): For each node v, the WL graph kernel method updates its own type label based on the neighbor information of node v (the type labels of surrounding nodes and the type labels of edges). In each iteration, the new type label of the node is composed of the type label of the node and the type labels of the edges and nodes connected to it in chronological order. The new type label is iteratively generated using the node's latest type label.

[0063] Step 3 (feature vector construction): Based on the node type labels generated above, use the Skip-Gram model of doc2vec to generate the structural features of the nodes.

[0064] (2-2) Node malicious intent feature extraction:

[0065] Each node in the malicious intent representation graph obtained in step (1) has its corresponding malicious intent label, which is represented here in the form of malicious intent labels. In the feature extraction process, the number of different malicious intent label types is first calculated and recorded as . Set the type mapping function of the malicious intent label to , mapping malicious intent labels from 0 to At the same time, the number of labels of each type is calculated for node v, and the features of node v are assigned as a dimensional feature vector, ultimately forming a The malicious intention features of the nodes in the dimension are extracted. After the malicious intention features are extracted, they are added to the malicious intention representation graph. The example of the malicious intention representation graph is shown in the figure below. Figure 2 As shown in the figure, the ellipses connected by dotted lines are the malicious intention features of the nodes.

[0066] (3) Model training and anomaly detection: The node feature vectors from step (2) are fed into the VAE model to generate new data instances by learning the potential representation of the input data. The VAE model is used to perform reconstruction loss and obtain an anomaly threshold. When performing detection, if the reconstruction loss of a node is higher than the anomaly threshold, the node is considered an anomaly.

[0067] The variational autoencoder (VAE) model is used. The VAE model is favored for its lightweight and efficient performance. The encoder maps input data to a low-dimensional latent space, and the decoder reconstructs the data. In applications, the encoder part of the VAE model is used to extract feature vectors for nodes, while the decoder part is used to reconstruct these feature vectors to assess data abnormalities.

[0068] Specifically, for a node v, the structural features of the node are first extracted and the malicious intent characteristics of nodes , normalize the two to eliminate the dimensionality effect between different features, and then concatenate the two normalized feature vectors to form a new fusion feature , as the input of the VAE model, its formal expression is as follows:

[0069] (1)

[0070] (2)

[0071] Here, x represents a single data point, which is a dimension value of the feature vector, and X represents all data points, which is all dimension values ​​in the feature vector.

[0072] Afterwards, the fusion features Send it to the VAE model and get the reconstructed features of the fusion features Then, use cosine similarity to and Compare. If and When the difference between is greater than the preset abnormal threshold, node v is an abnormal node. and When the difference is less than or equal to the preset abnormal threshold, the node v is a benign node. The principle based on this is that abnormal nodes are more difficult to accurately represent in the vector space, so when trying to reconstruct them, they will have a larger loss value.

[0073] The above-described embodiments merely represent one or several implementations of the present invention. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make various modifications and improvements without departing from the spirit of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A method for detecting APT attacks based on a malicious intent representation graph, characterized in that: The APT attack detection method based on the malicious intent representation graph includes: Collect system traceability event streams, convert them into nodes and edges, and build a knowledge graph. Based on the node behavior and label transfer rules, assign corresponding malicious intent labels to the nodes. Use the knowledge graph and malicious intent labels to build a malicious intent representation graph. The WL graph kernel method is used to extract the structural features of the nodes, and the malicious intention features of the nodes are extracted based on the malicious intention labels; The structural features and malicious intent features of each node are normalized and concatenated to obtain fused features. The fused features are then input into the variational autoencoder model to obtain reconstructed features. The fusion feature is compared with the reconstructed feature using cosine similarity. When the difference is greater than the preset abnormality threshold, the current node is an abnormal node. When the difference is less than or equal to the preset abnormality threshold, the current node is a benign node. in, The WL graph kernel method is used to extract the structural features of the nodes, including: The node type is used as the node type label, and the event type is used as the edge type label; For each node, the WL graph kernel method is used to combine the type label of the current node and the type labels of the edges and nodes connected to the current node in chronological order to obtain the new type label of the current node, and update the type label of each node a preset number of times; Based on the updated type labels, the Skip-Gram model of doc2vec is used to generate the structural features of the nodes.

2. The APT attack detection method based on malicious intent representation graph according to claim 1 is characterized in that: The system traceability event stream is collected, converted into nodes and edges, and a knowledge graph is constructed. The nodes are assigned corresponding malicious intent labels according to the node behavior and label transfer rules, and a malicious intent representation graph is constructed using the knowledge graph and labels, including: Collect system traceability event streams to build a knowledge graph. When an event has not been recorded, add the source and target nodes to the knowledge graph as new nodes, assign corresponding timestamps and attribute information to the new nodes, and create an edge for the new nodes. When the number of nodes in the knowledge graph reaches a first preset number, the construction of the knowledge graph is completed; Continue to collect system traceability event streams. If the source node or target node of a new event is a node connected to a node in the knowledge graph, add the source node or target node to the knowledge graph and assign the corresponding malicious intent label to the source node or target node of the new event according to the label transfer rules. If the source node or target node of the new event is a node not connected to a node in the knowledge graph, use it to construct a new knowledge graph. When the number of nodes in the knowledge graph reaches a second preset number, a malicious intent representation graph is generated.

3. The APT attack detection method based on malicious intent representation graph according to claim 1 is characterized in that: Extracting the malicious intent feature of the node according to the malicious intent label includes: Calculate the number of different malicious intent labels, recorded as ; Set the type mapping function for malicious intent labels to , mapping the type of malicious intent label to The integer range of ; Calculate the number of labels of each type for each node and get the Dimensional node malicious intention characteristics.

Images