A method of APT attack path reasoning based on attack technology identification

Abstract

The present invention belongs to the technical field of network security, and discloses an APT attack path reasoning method based on attack technology identification, including building an attack technology knowledge base, and mining a corresponding attack technology sequence pattern set; collecting system kernel event data, extracting an alarm event list from the system kernel event data, building a traceability graph according to the alarm event list, and extracting a traceability subgraph from the traceability graph based on each alarm event in the alarm event list; performing technology matching in the attack technology knowledge base based on the attributes of each node in the traceability subgraph, and setting the attack technology corresponding to each alarm event according to the technology matching result; building an attack technology sequence pattern matching tree based on the attack technology sequence pattern set; performing pattern matching on the alarm event after setting the attack technology and the attack technology sequence pattern matching tree, and outputting the APT attack path after pattern matching. The present invention has high reasoning accuracy, and the obtained APT attack path is more complete.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an APT attack path reasoning method based on attack technology identification. Background Art

[0002] Advanced Persistent Threat (APT) is a complex network attack strategy. Unlike traditional attacks, APT is a type of complex attack launched by attackers using a wide range of attack techniques and tools. APT attackers first destroy the host or server in the target environment, and then expand the scope of attack through lateral movement, conduct internal reconnaissance and data leakage. They carry out long-term and continuous penetration and attacks on specific targets, posing a serious threat. APT attacks are dangerous not only because of their technical complexity and concealment, but also because they can last for months or even years without being detected, which makes it difficult for traditional network security detection methods to achieve good defense effects.

[0003] Therefore, the cutting-edge security analysis technology of APT attack path reasoning was proposed. APT attack path reasoning is a method to trace and understand APT attacks throughout the entire process, from the initial reconnaissance stage to the final data leakage, and the subsequent process of cleaning up traces. By analyzing network logs, endpoint activities, traffic patterns, and system behaviors, we can identify and connect the clues left by attackers in the attacked target network to form a logically coherent attack path. By identifying early signs of APT attacks, such as abnormal network access patterns or unauthorized system activities, APT attack path reasoning helps organizations to provide early warnings and take timely defensive measures to prevent attackers from further infiltrating the network; APT attack path reasoning can help security teams reconstruct the complete attack chain, understand how attackers gradually gain control of the network, and which links are exploited. This is crucial for patching security vulnerabilities and strengthening defense systems; the results of APT attack path reasoning can be converted into threat intelligence and shared with other organizations to jointly improve the security protection level of the entire community.

[0004] Existing APT attack path reasoning technologies include rule-based reasoning, which extracts rules from known APT attack cases and threat intelligence, performs reasoning based on pattern matching data, and finally adjusts the rules based on the evaluation results, adds new rules or deletes invalid rules to improve the accuracy and efficiency of the system; methods based on deep learning and neural networks, collect data from network traffic logs and system logs, perform data preprocessing and feature engineering, divide the data into training sets, validation sets, and test sets, and learn the features of POI (Point of Interest) events by building models and training them to obtain predictions and classifications, and finally use dynamic path analysis to reason about the path; methods based on graph theory and network analysis, define entities in the network as nodes in the graph, and define interactions between entities as edges in the graph, and add attributes to each node and edge, and analyze and reason about the attack path through graph analysis and anomaly detection.

[0005] However, the existing APT attack path reasoning technology still has certain limitations. The existing technology often performs path reasoning based on predefined heuristic rules. These rules are usually formulated based on known attack modes and behaviors. Static rules cannot cover new attack modes in a timely manner. If the rules need to be dynamically updated and optimized, a large amount of manpower costs will be required. In addition, the existing technology lacks consideration of the overall tactical chain. Heuristic-based APT attack path reasoning usually focuses on specific attack stages or behaviors, and lacks global consideration of the entire APT tactical chain. In addition, the collected real network logs and system log data are often incomplete. In the case of missing or erroneous data, rule-based APT attack path reasoning is likely to produce misjudgments and missed judgments. In addition, the boundary between the normal behavior of legitimate users and the malicious behavior of attackers is sometimes blurred. When APT attackers imitate normal activities, rule-based methods find it difficult to distinguish ambiguous behaviors. Summary of the invention

[0006] The purpose of the present invention is to provide an APT attack path reasoning method based on attack technology identification, which has high reasoning accuracy and a more complete APT attack path.

[0007] To achieve the above object, the technical solution adopted by the present invention is:

[0008] An APT attack path reasoning method based on attack technology identification, the APT attack path reasoning method based on attack technology identification comprising:

[0009] Building an attack technology knowledge base based on the ATT&CK knowledge base, wherein the attack technology knowledge base includes several attack technologies;

[0010] Obtain the APT attack threat intelligence document set, match the attack technology knowledge base with each APT attack threat intelligence document, mine the corresponding attack technology sequence pattern, and obtain the attack technology sequence pattern set;

[0011] Collect system kernel event data, extract an alarm event list from the system kernel event data, build a traceability graph based on the alarm event list, and extract a traceability subgraph from the traceability graph based on each alarm event in the alarm event list. The alarm event list is the system kernel event data of the APT attack path to be determined;

[0012] Based on the attributes of each node in the tracing subgraph, technology matching is performed in the attack technology knowledge base, and the attack technology corresponding to each alarm event is set according to the technology matching results;

[0013] Construct an attack technology sequence pattern matching tree based on the attack technology sequence pattern set;

[0014] The alarm event after setting the attack technology is pattern matched with the attack technology sequence pattern matching tree, and the APT attack path is output after pattern matching.

[0015] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0016] Preferably, the attack techniques in the attack technique knowledge base are: ,in For the Attack techniques, For the The number of the attack technique. For the The name of the attack technique. For the The IoC list corresponding to each attack technique.

[0017] Preferably, the method of obtaining an APT attack threat intelligence document set, matching an attack technology knowledge base with each APT attack threat intelligence document, mining a corresponding attack technology sequence pattern, and obtaining an attack technology sequence pattern set includes:

[0018] Identify the attack techniques in an APT attack threat intelligence document and extract the identified attack techniques that also exist in the attack technology knowledge base;

[0019] Sort the extracted attack techniques according to the order in which they appear in the APT attack threat intelligence document to obtain an attack technique list;

[0020] Based on all APT attack threat intelligence documents in the APT attack threat intelligence document set, an attack technology list set is obtained;

[0021] A sequence pattern mining algorithm is used to mine attack technology sequence patterns from the attack technology list set, and all attack technology sequence patterns are combined to obtain the attack technology sequence pattern set.

[0022] Preferably, the conditions of the sequential pattern mining algorithm are set as follows:

[0023] The attack technique sequence pattern is continuous without gaps in the original attack technique list;

[0024] The number of occurrences of the attack technique sequence pattern in the attack technique list set cannot be less than the threshold;

[0025] The shorter attack technique sequence pattern of two attack technique sequence patterns having a containment relationship is filtered.

[0026] Preferably, extracting a traceability subgraph from the traceability graph based on each alarm event in the alarm event list comprises:

[0027] For an alarm event, first determine the target node pointed to by the source node in the alarm event list based on the process name and process number of the source node in the alarm event; then retrieve all source nodes corresponding to the target node in the tracing graph; finally, collect all neighbor nodes within 3 hops of each source node, and construct a tracing subgraph based on the collection structure of all source nodes.

[0028] Preferably, the method of performing technology matching in an attack technology knowledge base based on the attribute of each node in the tracing subgraph, and setting the attack technology corresponding to each alarm event according to the technology matching result, includes:

[0029] Match the attributes of all nodes in the tracing subgraph with the IoCs in the attack technology knowledge base one by one, and record the number of successfully matched IoCs as ;

[0030] if , then remove the alarm event corresponding to the traceability subgraph from the alarm event list; if , then the attack technology corresponding to the successfully matched IoC is set as the attack technology of the alarm event; if , then the mode of the attack technology corresponding to the successfully matched IoC is set as the attack technology of the alarm event.

[0031] Preferably, the step of constructing an attack technology sequence pattern matching tree based on the attack technology sequence pattern set includes:

[0032] Create a root node to initialize the attack technique sequence pattern matching tree;

[0033] For each attack technology sequence pattern in the attack technology sequence pattern set, a search is performed in the current attack technology sequence pattern matching tree. If any prefix of the attack technology sequence pattern cannot match any branch in the attack technology sequence pattern matching tree except the root node, the attack technology sequence pattern is inserted as a new branch under the root node; if the attack technology sequence pattern has a prefix that can match a branch in the attack technology sequence pattern matching tree, the part of the attack technology sequence pattern without the prefix is ​​inserted at the end of the branch.

[0034] Preferably, pattern matching is performed on the alarm event after setting the attack technology with the attack technology sequence pattern matching tree, and the attack path is determined according to the pattern matching result, including:

[0035] Take the first alarm event in the alarm event list as the current alarm event, and initialize the search node to be the root node in the attack technology sequence pattern matching tree;

[0036] Search the attack technology corresponding to the current alarm event in all child nodes of the search node; if the search fails, delete the current alarm event in the alarm event list, and take the next alarm event in sequence as the current alarm event to restart the search; otherwise, mark the attack technology that is currently searched successfully, and update the search node to the node that is searched for the attack technology that is currently searched successfully in the attack technology sequence pattern matching tree;

[0037] The next alarm event in the alarm event list is taken in sequence as the current alarm event, and the search is restarted until all alarm events in the alarm event list are searched. The marked attack technology sequence is output as the pattern matching result, and the remaining alarm events in the alarm event list are taken in chronological order to form an APT attack path.

[0038] The APT attack path reasoning method based on attack technology identification provided by the present invention has the following beneficial effects compared with the prior art:

[0039] (1) By analyzing a large amount of APT attack threat intelligence, a set of attack technology sequence patterns that can be updated regularly and automatically is established to facilitate the response to the constantly updated APT attack strategies. By mining the attack technology sequence patterns and performing correlation analysis on alarm events, a large number of false alarm events can be filtered out, reducing the burden of APT attack path reasoning and effectively reducing the time consumption of reasoning. (2) Based on the attack technology identification and reasoning attack path, the scattered alarm events are connected in series into a path. As a complete attack chain, it can help security managers quickly restore the attack scene, improve the efficiency of APT attack defense work, and improve the accuracy of rule-based reasoning and the restoration of APT attack paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flowchart of an APT attack path reasoning method based on attack technology identification of the present invention;

[0041] Figure 2 The figure is a schematic diagram of the construction process of the attack technology sequence pattern matching tree of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0044] In order to overcome the defects of the prior art, this embodiment provides an APT attack path reasoning method based on attack technology identification, such as Figure 1 As shown, the specific steps include:

[0045] (1) Mining attack technology sequence patterns: Initially, we mine attack technology sequence patterns from the attack technology knowledge base by analyzing a large number of APT attack threat intelligence documents. We also obtain new APT attack threat intelligence documents during the regular update cycle to supplement the attack technology sequence pattern set of the update rules in real time to solve the problem of effective reasoning for new attack patterns.

[0046] (1-1) Construction of attack technology knowledge base: Build an attack technology knowledge base based on the ATT&CK knowledge base.

[0047] ATT&CK (MITRE Adversarial Tactics, Techniques and Common Knowledge) knowledge base contains a complete list of all attack techniques. Each attack technique has a name and number, and each attack technique provides multiple cases (Procedure Example), such as cases T1204.002-5 and T1204.001-5, where T1204 represents the attack technique, 001 / 002 represents the sub-technique of the attack technique, and each case contains multiple IoCs (Indicators of Compromise). IoC refers to suspicious IP (Internet Protocol) addresses, suspicious files, suspicious processes, malware signatures, and other traceable and identifiable information related to attackers. Collect this knowledge from the ATT&CK knowledge base and build an attack technique knowledge base that contains all attack techniques. Each attack technique included is ,in For the Attack techniques, For the The number of the attack technique. For the The name of the attack technique. For the The IoC list obtained by combining all IoCs under the attack technology.

[0048] (1-2) Attack technology sequence extraction: Obtain the APT attack threat intelligence document set, match the attack technology knowledge base with each APT attack threat intelligence document, mine the corresponding attack technology sequence pattern, and obtain the attack technology sequence pattern set.

[0049] Given a set of APT attack threat intelligence documents An APT attack threat intelligence document First, we need to analyze the APT attack threat intelligence document. The attack technology is identified based on the data in the APT attack threat intelligence document. middle.

[0050] Then search for APT attack threat intelligence documents The attack technique knowledge base contained in The name or number of the attack technology in the APT attack threat intelligence document is extracted, that is, the identified attack technology that also exists in the attack technology knowledge base is extracted; then the extracted attack technology is The attack techniques are sorted in the order in which they appear, and repeated attack techniques are removed to obtain an attack technique list represented as ,in For the list of attack techniques, This is the first in the list of attack techniques. The name or number of an attack technique, The attack technology list set extracted from a large number of APT attack threat intelligence documents is recorded as .

[0051] (1-3) Attack technology sequence pattern mining: Use sequence pattern mining algorithms (such as PrefixSpan (Prefix-Projected Patten Growth) algorithm, GSP (Generalized Sequential Pattern mining algorithm) algorithm) to extract attack technology list The attack technology sequence pattern is mined out. Three conditional restrictions are set in the process of attack technology sequence pattern mining. First, the attack technology sequence pattern must be continuous and without gaps in the original attack technology list. Second, the number of occurrences of the attack technology sequence pattern in the attack technology list cannot be less than the threshold (for example, set to 7 times, which can be adjusted according to actual conditions). Third, filter out the shorter attack technology sequence pattern of two attack technology sequence patterns with inclusion relationships. The combination of all attack technology sequence patterns finally mined is used as the attack technology sequence pattern set. .

[0052] Here is an example: Assume that the attack technology list set Contains 3 lists of attack techniques , , , among which is the serial value of the attack technology, then the attack technology sequence pattern mined is ,in, exist It is not continuous without gaps. Included in Therefore, none of them are used as attack technology sequence patterns.

[0053] (2) Attack technology identification: given a list of alarm events , based on the attack technology knowledge base Identify the attack technique corresponding to each alarm event. Alarm event list That is, the system kernel event data of the APT attack path to be determined.

[0054] (2-1) Construction of traceability graph: Collect system kernel event data, extract alarm event list from the system kernel event data, and construct a traceability graph based on the alarm event list.

[0055] Use operating system kernel event collection tools (such as ETW (Event Tracing for Windows), Auditd) to collect system kernel event data, and extract the system kernel event data of the APT attack path to be determined from the original collected system kernel event data, and then build a traceability graph based on the system kernel event data of the APT attack path to be determined ,in, is the node set of the traceability graph, each node Represents system entities (such as processes and files); is the edge set of the source graph, each edge Represents interaction events between system entities (such as creating processes, reading and writing files).

[0056] (2-2) Sampling of traceability subgraphs: Extracting traceability subgraphs from the traceability graph based on each alarm event in the alarm event list. Each alarm event in First, according to the alarm event The process name and process number of the source node in the alarm event list are used to determine the target node pointed to by the source node; then all source nodes corresponding to the target node are retrieved in the traceability graph; finally, all neighbor nodes within 3 hops of each source node are collected, and a traceability subgraph is constructed based on the collection structure of all source nodes, which is recorded as . Indicates the alarm event list The The attributes of the nodes in the traceability subgraph include process name, process number, file name, IP address and other information. The attributes of the node are determined according to the type of the node. For example, if the type of the node is process, the attributes of the node include process name and process number.

[0057] (2-3) Attack technology classification: Based on the attributes of each node in the tracing subgraph, technology matching is performed in the attack technology knowledge base, and the attack technology corresponding to each alarm event is set according to the technology matching results.

[0058] The traceability subgraph The attributes of all nodes contained in are respectively related to the attack technology knowledge base The IoCs in the .txt file are matched one by one, and the number of successfully matched IoCs is recorded as When matching, each field in the node's attributes is compared with the attack technology knowledge base A node can match one or more IoCs. , then the tracing subgraph Corresponding alarm events From the alarm event list Removed; if , then the attack technology corresponding to the successfully matched IoC is set as an alarm event attack technique; if , then the majority of attack technologies corresponding to the successfully matched IoC is set as an alarm event The alarm event list that is finally retained after setting the attack technology is recorded as .

[0059] (3) Attack path reasoning: List of alarm events after setting the attack technology Sequence pattern set with attack techniques Perform pattern matching and determine the APT attack path based on the matching results.

[0060] (3-1) Construct an attack technology sequence pattern matching tree based on the attack technology sequence pattern set: Given an attack technology sequence pattern set First, create a root node to initialize the attack technology sequence pattern matching tree Then, the attack technique sequence pattern set Each attack technique sequence pattern in , in the current If Any prefix of Any branch (except the root node) in Insert it as a new branch under the root node; if A prefix of If a branch in The part without the prefix is ​​inserted at the end of the branch. Attack Technique Sequence Pattern Set The An attack technique sequence pattern.

[0061] Here is an example: Assume that the attack technology sequence pattern set Contains 4 attack technique sequence modes , , , , then the attack technology sequence pattern matching tree constructed The process is as follows Figure 2 As shown: First take the attack technology sequence pattern , any of its prefixes cannot match Any branch except the root node in the attack technique Insert it as a new branch under the root node; then take the attack technique sequence pattern , whose prefix and Branches in In If it matches, The prefix in Remove and insert into the matching branch At the end of; take the attack technique sequence mode , any of its prefixes cannot match Any branch except the root node in the attack technique Insert as a new branch under the root node; take the attack technology sequence pattern , whose prefix , and Branches in In , If it matches, The prefix in , Remove and insert into the matching branch The end of .

[0062] (3-2) Attack technology sequence pattern matching: set the alarm event list after the attack technology is set Pattern matching tree with attack technique sequence Perform pattern matching and output the APT attack path after pattern matching.

[0063] (3-2-1) Get the alarm event list after setting the attack technology The first alarm event in is taken as the current alarm event, and the search node is set to the attack technology sequence pattern matching tree The root node in the search node searches for the attack technology corresponding to the current alarm event in all child nodes of the search node. If the search fails, delete the alarm event list. The current alarm event in the alarm list, and get the alarm event list in order The next alarm event in the attack technology sequence pattern matching tree is used as the current alarm event, and then step (3-2-1) is re-executed to start the search; otherwise, Mark the currently searched successful attack technology (also understood as marking the node), and update the search node to the node searched for the currently searched successful attack technology in the attack technology sequence pattern matching tree, and then execute step (3-2-2).

[0064] (3-2-2) List of alarm events after setting attack technology The subsequent alarm events in the search node are selected in order as the current alarm event, and the attack technology corresponding to the current alarm event is searched in all the child nodes of the search node. If the search fails, the alarm event list is deleted. The current alarm event in the alarm list, and get the alarm event list in order The next alarm event in the attack technology sequence pattern matching tree is used as the current alarm event, and then step (3-2-2) is re-executed to start the search; otherwise, Mark the currently searched successful attack technology (also understood as marking the node), and update the search node to the node searched for the currently searched successful attack technology in the attack technology sequence pattern matching tree, and then execute step (3-2-3).

[0065] (3-2-3) Get the alarm event list in order Execute step (3-2-2) for the next alarm event in the alarm event list until the alarm event list After all alarm events in the alarm event list are searched, the alarm event sequence corresponding to the PaTree branch that is finally matched is the attack path. The marked attack technology sequence is output as the pattern matching result, and the remaining alarm events in the alarm event list are taken in chronological order to form the APT attack path.

[0066] Here is an example: Assume that the alarm event list after setting the attack technology for , which is Figure 2 The attack technique sequence pattern matching tree shown To perform pattern matching, first take the alarm event The corresponding attack technology number is , at this time the search node is the attack technology sequence pattern matching tree The root node in the search node has the attack technology number value of all child nodes. and , then search in all child nodes of the search node The result is that the search is not found, so the alarm event is Delete, the alarm event list Updated to ;

[0067] Get alarm events The corresponding attack technology number is At this time, the search node is still the attack technology sequence pattern matching tree The root node in the search node has the attack technology number value of all child nodes. and , then search in all child nodes of the search node The result is found in the attack technology sequence pattern matching tree. Mark the attack technique that is currently searched successfully , and update the search node to attack technology The corresponding node;

[0068] Continue to retrieve alarm events The corresponding attack technology number is , at this time the search node is the attack technology sequence pattern matching tree Medium attack technique The corresponding node, the attack technology number value of all child nodes of the search node is and , then search in all child nodes of the search node The result is found in the attack technology sequence pattern matching tree. Mark the attack technique that is currently searched successfully , and update the search node to attack technology The corresponding node;

[0069] Continue to retrieve alarm events The corresponding attack technology number is , at this time the search node is the attack technology sequence pattern matching tree Medium attack technique The corresponding node, the attack technology number value of all child nodes of the search node is and , then search in all child nodes of the search node The result is that the search is not found, so the alarm event Delete, the alarm event list Updated to ;

[0070] Continue to retrieve alarm events The corresponding attack technology number is At this time, the search node is still the attack technology sequence pattern matching tree Medium attack technique The corresponding node, the attack technology number value of all child nodes of the search node is and , then search in all child nodes of the search node The result is found in the attack technology sequence pattern matching tree. Mark the attack technique that is currently searched successfully , and update the search node to attack technology The corresponding node;

[0071] Determine alarm events List of alarm events The last alarm event in the attack technique sequence pattern matching tree ends. The attack techniques marked in are , , , then the output matching result is , and the remaining alarm events in the alarm event list form the APT attack path in chronological order: .

[0072] Based on the APT attack path reasoning method of the present invention, the attack technology sequence pattern is mined through the PrefixSpan algorithm, and the attack path reasoning is performed on the system kernel event data sample containing real APT attacks sampled by kellect (Kernel-based Efficient and Lossless Event Log Collector). After testing the attack path reasoning results of 300 attack samples and comparing them with the real attack path, the average correct rate of attack path reasoning is 77%, and the average attack reasoning time is 1.48 seconds. It can be seen that the APT attack path reasoning method provided by the present invention has higher accuracy and faster reasoning speed in rule-based reasoning.

[0073] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0074] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A method for reasoning APT attack paths based on attack technology identification, characterized in that: The APT attack path reasoning method based on attack technology identification includes: Building an attack technology knowledge base based on the ATT&CK knowledge base, wherein the attack technology knowledge base includes several attack technologies; Obtain the APT attack threat intelligence document set, match the attack technology knowledge base with each APT attack threat intelligence document, mine the corresponding attack technology sequence pattern, and obtain the attack technology sequence pattern set; Collect system kernel event data, extract an alarm event list from the system kernel event data, build a traceability graph based on the alarm event list, and extract a traceability subgraph from the traceability graph based on each alarm event in the alarm event list. The alarm event list is the system kernel event data of the APT attack path to be determined; Based on the attributes of each node in the tracing subgraph, technology matching is performed in the attack technology knowledge base, and the attack technology corresponding to each alarm event is set according to the technology matching results; Construct an attack technology sequence pattern matching tree based on the attack technology sequence pattern set; The alarm event after setting the attack technology is pattern matched with the attack technology sequence pattern matching tree, and the APT attack path is output after pattern matching, including: Take the first alarm event in the alarm event list as the current alarm event, and initialize the search node to be the root node in the attack technology sequence pattern matching tree; Search the attack technology corresponding to the current alarm event in all child nodes of the search node; if the search fails, delete the current alarm event in the alarm event list, and take the next alarm event in sequence as the current alarm event to restart the search; otherwise, mark the attack technology that is currently searched successfully, and update the search node to the node that is searched for the attack technology that is currently searched successfully in the attack technology sequence pattern matching tree; The next alarm event in the alarm event list is taken in sequence as the current alarm event, and the search is restarted until all alarm events in the alarm event list are searched. The marked attack technology sequence is output as the pattern matching result, and the remaining alarm events in the alarm event list are taken in chronological order to form an APT attack path.

2. The APT attack path reasoning method based on attack technology identification according to claim 1 is characterized in that: The attack techniques in the attack technique knowledge base are: ,in For the Attack techniques, For the The number of the attack technique. For the The name of the attack technique. For the The IoC list corresponding to each attack technique.

3. The APT attack path reasoning method based on attack technology identification according to claim 1 is characterized in that: The APT attack threat intelligence document set is obtained, the attack technology knowledge base is matched with each APT attack threat intelligence document, and the corresponding attack technology sequence pattern is mined to obtain the attack technology sequence pattern set, including: Identify the attack techniques in an APT attack threat intelligence document and extract the identified attack techniques that also exist in the attack technology knowledge base; Sort the extracted attack techniques according to the order in which they appear in the APT attack threat intelligence document to obtain an attack technique list; Based on all APT attack threat intelligence documents in the APT attack threat intelligence document set, an attack technology list set is obtained; A sequence pattern mining algorithm is used to mine attack technology sequence patterns from the attack technology list set, and all attack technology sequence patterns are combined to obtain the attack technology sequence pattern set.

4. The APT attack path reasoning method based on attack technology identification according to claim 3 is characterized in that: The conditions of the sequential pattern mining algorithm are set as follows: The attack technique sequence pattern is continuous without gaps in the original attack technique list; The number of occurrences of the attack technique sequence pattern in the attack technique list set cannot be less than the threshold; The shorter attack technique sequence pattern of two attack technique sequence patterns having a containment relationship is filtered.

5. The APT attack path reasoning method based on attack technology identification according to claim 1 is characterized in that: The extracting of a traceability subgraph from the traceability graph based on each alarm event in the alarm event list includes: For an alarm event, first determine the target node pointed to by the source node in the alarm event list based on the process name and process number of the source node in the alarm event; then retrieve all source nodes corresponding to the target node in the traceability graph; finally, collect all neighbor nodes within 3 hops of each source node, and construct a traceability subgraph based on the collection structure of all source nodes.

6. The APT attack path reasoning method based on attack technology identification according to claim 2 is characterized in that: The method of performing technology matching in the attack technology knowledge base based on the attributes of each node in the tracing subgraph, and setting the attack technology corresponding to each alarm event according to the technology matching result, includes: Match the attributes of all nodes in the tracing subgraph with the IoCs in the attack technology knowledge base one by one, and record the number of successfully matched IoCs as ; if , then remove the alarm event corresponding to the traceability subgraph from the alarm event list; if , then the attack technology corresponding to the successfully matched IoC is set as the attack technology of the alarm event; if , then the mode of the attack technology corresponding to the successfully matched IoC is set as the attack technology of the alarm event.

7. The APT attack path reasoning method based on attack technology identification according to claim 1 is characterized in that: The step of constructing an attack technology sequence pattern matching tree based on the attack technology sequence pattern set includes: Create a root node to initialize the attack technique sequence pattern matching tree; For each attack technology sequence pattern in the attack technology sequence pattern set, a search is performed in the current attack technology sequence pattern matching tree. If any prefix of the attack technology sequence pattern cannot match any branch in the attack technology sequence pattern matching tree except the root node, the attack technology sequence pattern is inserted as a new branch under the root node; if the attack technology sequence pattern has a prefix that can match a branch in the attack technology sequence pattern matching tree, the part of the attack technology sequence pattern without the prefix is ​​inserted at the end of the branch.

Images