A method for APT anomaly detection based on lifelong learning and suspicious semantic transfer

Abstract

The present invention discloses an APT anomaly detection method based on lifelong learning and suspicious semantic transmission, including: S1, collecting system log data of the current period as current data and preprocessing; S2, establishing an anomaly detection model; S3, taking the nodes and the relationship between the nodes of the extracted benign system log data as the input of the anomaly detection model, calculating the reconstruction loss and updating the model parameters by the gradient descent method to obtain a trained anomaly detection model; S4, taking the system log data of the next period as the current data and using the trained anomaly detection model for detection, and repeating step S4 with the input of the newly generated system log data for lifelong learning, and obtaining the corresponding APT attack anomaly detection result. The method can improve the accuracy and efficiency of APT anomaly detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of APT detection, and in particular relates to an APT anomaly detection method based on lifelong learning and suspicious semantic transmission. Background Art

[0002] APT (Advanced Persistent Threat) attack is a covert, technologically advanced and persistent network attack against a specific target, aiming to lurk for a long time and obtain sensitive information or resources. As its complexity continues to increase, existing research has begun to use the rich contextual information in the origin graph to detect complex APT attacks. Among them, the anomaly intrusion detection method based on the origin graph has attracted increasing attention due to its characteristics of not relying on attack knowledge and being able to combat zero-day vulnerabilities. Compared with the high latency and cost of offline systems, the detection method that can process dynamically evolving origin graphs in a streaming manner is more suitable for the real-time and cost-effective requirements of current host-based detection.

[0003] However, most current provenance graph-based anomaly intrusion detection methods avoid a key issue: concept drift. Concept drift describes unforeseen changes in the underlying parts of data flows over time, which can lead to model performance degradation and high false positives (because the features and patterns learned during training are no longer applicable during testing). In real-world situations, this common phenomenon corresponds to changes in user behavior at endpoints, such as switching to a different production environment or deploying new software.

[0004] Current anomaly intrusion detection methods follow the traditional anomaly detection paradigm: training on limited-size data collected offline to identify anomalies in test data. However, this paradigm does not work well due to the concept drift phenomenon. To combat concept drift within this traditional paradigm, it is often necessary to infinitely expand the training data or strictly restrict user behavior, both of which are difficult to implement and have great limitations. Therefore, a method with a new anomaly detection paradigm is proposed to alleviate the high false positive problem caused by concept drift. Summary of the invention

[0005] The purpose of the present invention is to address the above problems and propose an APT anomaly detection method based on lifelong learning and suspicious semantic transfer, which can improve the accuracy and efficiency of APT anomaly detection.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] The present invention proposes an APT anomaly detection method based on lifelong learning and suspicious semantic transfer, comprising the following steps:

[0008] S1. Collect the system log data of the current period as current data and perform preprocessing. The system log data of the current period is benign system log data. The preprocessing includes:

[0009] S1.1. Feature extraction and traceability graph construction: Extract the nodes and relationships between nodes of the current data. The relationships between nodes are events. Then, construct a traceability graph based on the extracted nodes and relationships between nodes. Events are edges in the traceability graph.

[0010] S2. Establish an anomaly detection model. The anomaly detection model performs the following operations:

[0011] S2.1, initialization embedding: Encode the features of the nodes at time t, the states of the nodes, and the relationships between the nodes, respectively, and obtain feature encoding, state encoding, and relationship encoding between the nodes, where t is the time point of the current data;

[0012] S2.2, Node Embedding: For each node, the feature code at time t, the state code at time t-1, and the memory vector generated by the GRU model at time t-1 are synthesized as the corresponding node embedding vector. The node embedding vector of node i at time t is , node i is the node in the current data;

[0013] S2.3, Relationship Embedding: According to the node embedding vectors of two nodes at time t, the relationship encoding between nodes and the time characteristics of events, the corresponding edge embedding vector is obtained. The edge embedding vector of node i and node j at time t is recorded as , node j is the node in the current data;

[0014] S2.4, state transfer: transfer suspicious states between nodes according to preset transfer rules. Suspicious states indicate the degree of suspicion of nodes related to APT attacks.

[0015] S2.5, model output: Use the GRU model to update the memory vector of the node, and input the edge embedding vector at time t and the corresponding node embedding vector into the GNN model to generate the corresponding final edge vector, and then input the final edge vector at time t and the corresponding node embedding vector into the MLP model to obtain the corresponding predicted relationship vector;

[0016] S3, using the nodes and the relationships between the nodes of the extracted benign system log data as the input of the anomaly detection model to obtain a trained anomaly detection model;

[0017] S4. Use the system log data of the next period as the current data to perform detection using the trained anomaly detection model, and repeat step S4 for lifelong learning as the newly generated system log data is input to obtain the corresponding APT attack anomaly detection results.

[0018] Preferably, the nodes include processes, files and networks; the relationships between nodes include the derivation relationship between processes, the reading relationship between processes and files, the creation relationship between processes and files, and the access relationship between processes and networks;

[0019] The features of the nodes at time t, the states of the nodes, and the relationships between the nodes are encoded respectively, and the feature encoding, state encoding, and relationship encoding between the nodes are obtained accordingly, as follows:

[0020] The features of the nodes are encoded using hierarchical feature hashing to map high-dimensional features into a hash space of a preset size to obtain feature encoding;

[0021] Encode the state of the node using the suspicious state to obtain the state code;

[0022] The relationship between nodes is encoded using one-hot encoding to obtain the relationship encoding between nodes.

[0023] Preferably, the preset transfer rule satisfies the following formula:

[0024] (1);

[0025] In the formula, is the suspicious state of node i at time t, is the suspicious state of node i at time t-1, is the suspicious state of node j at time t-1, are all neighboring nodes of node i, is the attenuation factor.

[0026] Preferably, the initial state value of the suspicious state is a real number between 0 and 1, and it is stipulated that the initial state values ​​of the nodes of all socket objects are 1, and the others are 0, wherein 0 indicates completely benign and 1 indicates highly suspicious.

[0027] Preferably, the GRU model is used to update the memory vector of the node, as follows:

[0028] (2);

[0029] (3);

[0030] (4);

[0031] (5);

[0032] In the formula, is the reset gate of node i at time t, is the update gate of node i at time t, is the candidate memory vector of node i at time t, is the memory vector of node i at time t, is the node embedding vector of node i at time t, that is, the input of node i at time t in the GRU model, is the memory vector of node i at time t-1, is the weight matrix of the node embedding vector of node i at time t in the update gate, is the weight matrix of the memory vector of node i in the update gate at time t-1, is the weight matrix of the node embedding vector of node i in the reset gate at time t, is the weight matrix of the memory vector of node i in the reset gate at time t-1, is the weight matrix of the node embedding vector of node i at time t when calculating the candidate memory vector, is the weight matrix of the memory vector of node i at time t-1 when calculating the candidate memory vector, is the bias term for the reset gate, is the bias term of the update gate, is the bias term of the candidate memory vector, is the sigmoid activation function, is the Hadamard product, tanh is the hyperbolic tangent activation function, and the memory vector corresponding to the new node of the GRU model is initially a zero vector.

[0033] Preferably, the edge embedding vector between node i and node j at time t is , the formula is as follows:

[0034] (6);

[0035] In the formula, is the node embedding vector of node i at time t, is the node embedding vector of node j at time t, is the relationship encoding between nodes i and j at time t, and tanh is the hyperbolic tangent activation function;

[0036] The edge embedding vector at time t and the corresponding node embedding vector are input into the GNN model to generate the corresponding final edge vector, and then the final edge vector at time t and the corresponding node embedding vector are input into the MLP model to obtain the corresponding predicted relationship vector, as follows:

[0037] Generate the final edge vector using the GNN model , the formula is as follows:

[0038] (7);

[0039] In the formula, It is a GNN model;

[0040] Get the predicted relationship vector between node i and node j at time t , the formula is as follows:

[0041] (8);

[0042] Where h(·) is the learnable function of the MLP model.

[0043] Preferably, the pre-processing further comprises:

[0044] S1.2, rehearsal node pool initialization: create and initialize a rehearsal node pool, the rehearsal node pool is used to place a number of rehearsal nodes and edges of rehearsal nodes, and the rehearsal nodes are nodes in the current data;

[0045] The nodes and relationships between nodes of the extracted benign system log data are used as the input of the anomaly detection model. When the trained anomaly detection model is obtained, the cross entropy loss between the output predicted relationship vector and the edge embedding vector of the actual relationship is calculated as the reconstruction loss, and the model parameters are updated by the gradient descent method.

[0046] The system log data of the next period is used as the current data to be detected using the trained anomaly detection model, and step S4 is repeated with the input of the newly generated system log data to perform lifelong learning, and the corresponding APT attack anomaly detection results are obtained, as follows:

[0047] S4.1, data preprocessing: when a new node appears in the current data, embed the new node, when a new event occurs, embed the new event, regenerate the corresponding edge embedding vector and memory vector, and update the suspicious status and traceability graph of the relevant nodes;

[0048] S4.2, Relationship matching: Pair the nodes of the new edges in the updated traceability graph with the nodes of the edges in the rehearsal node pool to obtain corresponding relationship pairs;

[0049] S4.3, pseudo-edge connection: evaluate the reachability between the node of each new edge and the rehearsal nodes in the rehearsal node pool. If there is a node on the new edge that is reachable to any rehearsal node, connect the node of the new edge and the corresponding rehearsal node to form a pseudo-edge;

[0050] S4.4, abnormal node identification: Use the trained anomaly detection model to identify the predicted relationship vectors of the rehearsal nodes and the nodes of the new edge, calculate the reconstruction loss between the predicted relationship vector and the edge embedding vector of the actual relationship according to the relationship pair, and use the reconstruction loss to evaluate the matching degree between the edge embedding vector of the current pseudo edge and the corresponding actual relationship, and select the nodes of the new edge connected by the pseudo edge whose reconstruction loss exceeds the first preset threshold α as abnormal nodes, and the abnormal nodes are the APT attack anomaly detection results;

[0051] S4.5. Update the rehearsal node pool and model parameters according to the abnormal nodes and the rehearsal nodes in the rehearsal node pool, and repeat step S4 for lifelong learning as the newly generated system log data is input to realize APT attack anomaly detection and obtain the corresponding APT attack anomaly detection results.

[0052] Preferably, the rehearsal node pool and model parameters are updated according to the abnormal nodes and the rehearsal nodes in the rehearsal node pool, as follows:

[0053] S4.5.1. Rehearsal node screening: select the nodes whose suspicious status exceeds the second preset threshold among the identified abnormal nodes Nodes whose suspicious status does not exceed the second preset threshold are considered malicious nodes and alarmed. The node is used as the new rehearsal node, and the new rehearsal node is an abnormal but non-malicious node;

[0054] S4.5.2, pseudo-edge connection: connect the new rehearsal node with the rehearsal nodes in the rehearsal node pool through pseudo-edges, and add the new rehearsal node to the rehearsal node pool to update the rehearsal node pool;

[0055] S4.5.3. Model update: Use the new rehearsal node pool to retrain the trained anomaly detection model and update the model parameters.

[0056] Preferably, the actual relationship is the relationship between the corresponding nodes extracted from the current data, and the relationship pair is obtained as follows:

[0057] Pair the new node with the node in the rehearsal node pool, calculate the Manhattan distance between the two paired nodes, and select the node pair with the closest distance (N p ,RN q );

[0058] is the new node N that is filtered out p Neighboring nodes N u In the rehearsal node RN q Select the nearest node RN from the neighbor nodes v , and obtain the four-tuple (N p ,N u ,RN q ,RNv ) represents a relationship pair, which consists of the actual relationship and the corresponding relationship in the rehearsal node pool. p 、N u is the node in the current data, p,u is the node number in the current data, RN q , RN v is the node in the rehearsal node pool, q, v are the node numbers in the rehearsal node pool.

[0059] Preferably, the initialization of the rehearsal node pool is as follows:

[0060] Based on the K-means algorithm, the nodes with similar behaviors in the traceability graph composed of benign system log data are divided into a cluster. The nodes with similar behaviors are the same type of events.

[0061] Calculate the corresponding Katz Centrality score for each node in each cluster, and select the node with the highest Katz Centrality score as the benign key node of the cluster;

[0062] In the traceability graph composed of benign system log data, the shortest edge connecting the benign key nodes is found, the benign key nodes and the neighbor nodes corresponding to the shortest edges of the benign key nodes are used as rehearsal nodes, and the rehearsal nodes and the edges of the rehearsal nodes are put into the rehearsal node pool.

[0063] Compared with the prior art, the present invention has the following beneficial effects:

[0064] The present invention preprocesses the collected benign system log data and trains an anomaly detection model. The established anomaly detection model can obtain a prediction relationship vector. When new system log data is generated, the trained anomaly detection model is used to perform anomaly detection, identify abnormal nodes and transfer suspicious semantics at the same time, and merge completely unsuspicious abnormal nodes into a rehearsal node pool to help the anomaly detection model remember key scenarios and update model parameters. Through continuous learning of the model, the problem of concept drift can be alleviated, and by applying pseudo-edge connections in the rehearsal node pool, the problem of catastrophic forgetting caused by continuous learning of the model can be effectively solved. The preset transfer rules of suspicious states can avoid selecting malicious data during retraining, solve the problem of recognition paradox, and improve the accuracy and efficiency of APT anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a flow chart of the APT anomaly detection method based on lifelong learning and suspicious semantic transmission of the present invention;

[0066] Figure 2 It is a flow chart of the initialization phase of the APT anomaly detection method based on lifelong learning and suspicious semantic transfer of the present invention;

[0067] Figure 3 The flowchart of the detection phase of the APT anomaly detection method based on lifelong learning and suspicious semantic transfer of the present invention. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0069] It should be noted that, unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art in the technical field of this application. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0070] like Figure 1-Figure 3 As shown, an APT anomaly detection method based on lifelong learning and suspicious semantic transfer includes the following steps:

[0071] S1. Collect the system log data of the current period as current data and perform preprocessing. The system log data of the current period is benign system log data. The preprocessing includes:

[0072] S1.1. Feature extraction and provenance graph construction: Extract the nodes of the current data and the relationships between them. The relationships between nodes are events, and construct a provenance graph based on the extracted nodes and the relationships between them. Events are edges in the provenance graph.

[0073] In one embodiment, nodes include processes, files, and networks; the relationships between nodes include the derivation relationship between processes, the reading relationship between processes and files, the creation relationship between processes and files, and the access relationship between processes and networks.

[0074] S1.2. Rehearsal node pool initialization: Create and initialize a rehearsal node pool. The rehearsal node pool is used to place several rehearsal nodes and edges of rehearsal nodes. The rehearsal nodes are nodes in the current data.

[0075] In one embodiment, the initialization of the rehearsal node pool is as follows:

[0076] Based on the K-means algorithm, the nodes with similar behaviors in the traceability graph composed of benign system log data are divided into a cluster. The nodes with similar behaviors are the same type of events.

[0077] Calculate the corresponding Katz Centrality score for each node in each cluster, and select the node with the highest Katz Centrality score as the benign key node of the cluster;

[0078] In the traceability graph composed of benign system log data, the shortest edge connecting the benign key nodes is found, the benign key nodes and the neighbor nodes corresponding to the shortest edges of the benign key nodes are used as rehearsal nodes, and the rehearsal nodes and the edges of the rehearsal nodes are put into the rehearsal node pool.

[0079] By defining the system behaviors involved in the current data, it is convenient to embed nodes and edges on this basis to train the anomaly detection model.

[0080] Define nodes based on current data, such as processes, files, networks, etc. Different node types contain different attributes, such as file names, process names, etc. Then, define the relationship between nodes based on the interaction between nodes, such as the derivation relationship between processes, the reading relationship between processes and files, the creation relationship between processes and files, the access relationship between processes and networks, etc. The specifics can also be adjusted according to actual needs.

[0081] In addition, the rehearsal node refers to a representative benign node. The specific initialization steps of the rehearsal node pool are: use the K-means algorithm to divide the nodes with similar behaviors in the current data into the same cluster, and then calculate the Katz Centrality score of each node in all clusters (clusters), and select the one with the highest score as the representative node of the cluster, that is, the benign key node.

[0082] S2. Establish an anomaly detection model. The anomaly detection model performs the following operations:

[0083] S2.1. Initialize embedding: Encode the features of the nodes at time t, the states of the nodes, and the relationships between the nodes respectively, and obtain feature encoding, state encoding, and relationship encoding between the nodes accordingly, where t is the time point of the current data.

[0084] In one embodiment, the features of the nodes, the states of the nodes, and the relationships between the nodes at time t are encoded respectively, and feature codes, state codes, and relationship codes between the nodes are obtained accordingly, as follows:

[0085] The features of the nodes are encoded using hierarchical feature hashing to map high-dimensional features into a hash space of a preset size to obtain feature encoding;

[0086] Encode the state of the node using the suspicious state to obtain the state code;

[0087] The relationship between nodes is encoded using one-hot encoding to obtain the relationship encoding between nodes.

[0088] Specifically, the collected benign system log data is encoded from three perspectives: the relationship between nodes, the characteristics of nodes, and the status of nodes. The embedding of the relationship between nodes uses one-hot encoding to embed the relationship type, helping the anomaly detection model to distinguish different types of relationships in a flat label space. The embedding of node features is encoded using hierarchical feature hashing to map high-dimensional features to a fixed-size hash space. The embedding of the node status is encoded from the perspective of information / control flow, that is, the suspicious status is used to indicate the degree of suspicion that the node may be related to the attack. For example, an initial state value is assigned to each node. The initial state value is a real number between 0 and 1, where 0 represents completely benign and 1 represents highly suspicious. It is stipulated that the initial state value of the node status of all socket objects is 1, and the others are 0. At the same time, the timestamp of each event can be further converted into a vector through the linspace function or the datetime function and then spliced ​​and integrated into the node status. For example, the socket object is mainly in the form of IP address: port number.

[0089] S2.2, Node Embedding: For each node, the feature code at time t, the state code at time t-1, and the memory vector generated by the GRU model at time t-1 are synthesized as the corresponding node embedding vector. The node embedding vector of node i at time t is , node i is the node in the current data.

[0090] S2.3, Relationship Embedding: According to the node embedding vectors of two nodes at time t, the relationship encoding between nodes and the time characteristics of events, the corresponding edge embedding vector is obtained. The edge embedding vector of node i and node j at time t is recorded as , node j is the node in the current data.

[0091] S2.4, state transfer: The suspicious state between nodes is transferred according to the preset transfer rules. The suspicious state indicates the degree of suspicion of the node related to the APT attack.

[0092] In one embodiment, the transfer rule is preset to satisfy the following formula:

[0093] (1);

[0094] In the formula, is the suspicious state of node i at time t, is the suspicious state of node i at time t-1, is the suspicious state of node j at time t-1, are all neighboring nodes of node i, is the attenuation factor.

[0095] In one embodiment, the initial state value of the suspicious state is a real number between 0 and 1, and it is stipulated that the initial state values ​​of the nodes of all socket objects are 1, and the others are 0, wherein 0 indicates completely benign and 1 indicates highly suspicious.

[0096] The preset transfer rule reflects the rule for transferring part of the node's state from one node to another, and in order to prevent excessive transfer from losing its meaning, an attenuation factor is introduced , so that the state value gradually decays with the increase of transmission distance.

[0097] S2.5, model output: Use the GRU model to update the memory vector of the node, and input the edge embedding vector at time t and the corresponding node embedding vector into the GNN model to generate the corresponding final edge vector, and then input the final edge vector at time t and the corresponding node embedding vector into the MLP model to obtain the corresponding predicted relationship vector.

[0098] In one embodiment, the memory vector of a node is updated using the GRU model as follows:

[0099] (2);

[0100] (3);

[0101] (4);

[0102] (5);

[0103] In the formula, is the reset gate of node i at time t, is the update gate of node i at time t, is the candidate memory vector of node i at time t, is the memory vector of node i at time t, is the node embedding vector of node i at time t, that is, the input of node i at time t in the GRU model, is the memory vector of node i at time t-1, is the weight matrix of the node embedding vector of node i at time t in the update gate, is the weight matrix of the memory vector of node i in the update gate at time t-1, is the weight matrix of the node embedding vector of node i in the reset gate at time t, is the weight matrix of the memory vector of node i in the reset gate at time t-1, is the weight matrix of the node embedding vector of node i at time t when calculating the candidate memory vector, is the weight matrix of the memory vector of node i at time t-1 when calculating the candidate memory vector, is the bias term for the reset gate, is the bias term of the update gate, is the bias term of the candidate memory vector, is the sigmoid activation function, is the Hadamard product (element-wise product), tanh is the hyperbolic tangent activation function, and the memory vector corresponding to the new node of the GRU model is initially a zero vector.

[0104] Among them, the GRU model is a gated recurrent unit, which is responsible for updating the memory vector at the current time point based on the new message (i.e., the newly input system log data) and the memory vector at the previous time point. The GRU model updates the memory vector of the node as follows: using the current input (the data at the current time point being processed) and the memory vector at the previous time point, the update gate is calculated through the sigmoid activation function, as shown in formula (2), to determine how much past information will be retained; the reset gate is also calculated through the sigmoid activation function, as shown in formula (3), to determine how to combine the newly input system log data with the old memory vector. Then, the memory vector at the previous time point is adjusted by combining the current input and the reset gate to calculate the candidate memory vector, as shown in formula (4). Finally, according to the value of the update gate, the candidate memory vector is combined with the memory vector at the previous time point to generate the final memory vector at the current time point, as shown in formula (5).

[0105] In one embodiment, the edge embedding vector between node i and node j at time t is , the formula is as follows:

[0106] (6);

[0107] In the formula, is the node embedding vector of node i at time t, is the node embedding vector of node j at time t, is the relationship encoding between nodes i and j at time t, and tanh is the hyperbolic tangent activation function;

[0108] The edge embedding vector at time t and the corresponding node embedding vector are input into the GNN model to generate the corresponding final edge vector, and then the final edge vector at time t and the corresponding node embedding vector are input into the MLP model to obtain the corresponding predicted relationship vector, as follows:

[0109] Generate the final edge vector using the GNN model , the formula is as follows:

[0110] (7);

[0111] In the formula, It is a GNN model;

[0112] Get the predicted relationship vector between node i and node j at time t , the formula is as follows:

[0113] (8);

[0114] Where h(·) is the learnable function of the MLP model.

[0115] Among them, the GRU model is used to update the node's memory vector (historical information) to capture the changes in node status over time. At the same time, the GNN model (graph neural network) based on the attention mechanism is used to generate the edge embedding representation (final edge vector) to capture the edge's domain structure information. Finally, the MLP model (multi-layer perceptron) is used to convert the final edge vector and the corresponding node embedding vector into a predicted event vector (predicted relationship vector).

[0116] S3. Using the nodes and the relationships between the nodes of the extracted benign system log data as the input of the anomaly detection model to obtain a trained anomaly detection model.

[0117] In one embodiment, the nodes and relationships between nodes of the extracted benign system log data are used as the input of the anomaly detection model. When the trained anomaly detection model is obtained, the cross entropy loss between the output predicted relationship vector and the edge embedding vector of the actual relationship is calculated as the reconstruction loss, and the model parameters are updated by the gradient descent method.

[0118] Specifically, Figure 2 As shown, the initialization phase is to train the anomaly detection model through the extracted nodes and the relationship between nodes of the benign system log data to obtain a trained anomaly detection model. At this time, the current data in the initialization phase is the system log data of the T period, which is the benign system log data.

[0119] S4: Use the system log data of the next period as the current data to perform detection using the trained anomaly detection model, and repeat step S4 for lifelong learning with the input of newly generated system log data to obtain the corresponding APT attack anomaly detection results, as follows:

[0120] S4.1. Data preprocessing: When new nodes appear in the current data, perform node embedding on the new nodes; when new events occur, perform relation embedding on the new events; regenerate the corresponding edge embedding vectors and memory vectors; and update the suspicious status and traceability graph of the relevant nodes.

[0121] Use the trained anomaly detection model to detect the newly generated system log data to determine whether it is abnormal, such as Figure 3 As shown, the current data of the detection phase is the system log data of the T+1 period. It is easy to understand that as new system log data is generated, the current data is updated accordingly. For example, at the next moment, the system log data of the T+2 period is detected. When a new node appears, the node embedding in step S2.2 is performed on it; when a new event occurs, in addition to the relationship embedding in step S2.3, the corresponding edge embedding vector and memory vector are regenerated, and the suspicious status and traceability graph of the relevant nodes are updated.

[0122] S4.2, Relationship matching: Pair the nodes of the new edges in the updated traceability graph with the nodes of the edges in the rehearsal node pool to obtain corresponding relationship pairs.

[0123] S4.3, Pseudo-edge connection: Evaluate the reachability between the nodes of each new edge and the rehearsal nodes in the rehearsal node pool. If there is a node on the new edge that is reachable to any rehearsal node, connect the node of the new edge and the corresponding rehearsal node to form a pseudo-edge.

[0124] When a new event occurs, the reachability between the node of the new edge and the existing RN (rehearsal node) in the rehearsal node pool is evaluated. If the node of the new edge is reachable to any RN, a pseudo edge is constructed between the node of the new edge and the RN. Through the pseudo edge, the information of the RN is played back to the context of the new edge, so that the anomaly detection model can reconsider the old and important scene information when processing new events, which helps to improve the accuracy of detection. Figure 3 As shown, a pseudo edge relationship is formed by pseudo edge connection.

[0125] S4.4. Abnormal node identification: Use the trained anomaly detection model to identify the predicted relationship vectors of the rehearsal nodes and the nodes of the new edges, calculate the reconstruction loss between the predicted relationship vector and the edge embedding vector of the actual relationship based on the relationship pair, and use the reconstruction loss to evaluate the matching degree between the edge embedding vector of the current pseudo-edge and the corresponding actual relationship, and screen out the nodes of the new edges connected by the pseudo-edges whose reconstruction loss exceeds the first preset threshold α as abnormal nodes. The abnormal nodes are the APT attack anomaly detection results.

[0126] Among them, using the information of RN and the nodes of the new edge, a new predicted relationship vector is generated through the trained anomaly detection model, and the reconstruction loss is used to evaluate the matching degree between the current predicted relationship vector and the actual relationship. The nodes of the new edge connected by the pseudo-edge whose reconstruction loss exceeds the first preset threshold α are considered to be abnormal nodes. Specifically, Figure 3As shown, the new predicted relationship vector is generated by executing steps S2.1 to S2.5 of the trained anomaly detection model, that is, the corresponding edge embedding vector is obtained according to the corresponding node embedding vector, the relationship encoding between nodes (referred to as relationship encoding) and the time feature of the event (referred to as time feature), and the memory vector of the node is updated using the GRU model. At the same time, the edge embedding vector at time t and the corresponding node embedding vector are input into the GNN model to generate the corresponding final edge vector, and then the final edge vector at time t and the corresponding node embedding vector are input into the MLP model to obtain the corresponding predicted relationship vector, and then the cross entropy loss is used to calculate the loss between the predicted relationship vector and the observed event type (the edge embedding vector of the actual relationship) as the reconstruction loss. Figure 3 It is easy to understand that pseudo edges are constructed in the detection stage, so that the relationship embedding in the detection stage includes two parts: original relationship embedding and pseudo edge relationship embedding. Among them, the original relationship embedding is the relationship embedding of the new event, which is the embedding of the actual event. The new event corresponds to the new edge, that is, the original edge embedding vector is formed by the corresponding node embedding vector, the original relationship encoding (that is, the relationship encoding between the nodes of the new edge) and the time feature; and the pseudo edge relationship embedding is the edge embedding vector (that is, the pseudo edge embedding vector) of the pseudo edge is formed by the corresponding node embedding vector, the pseudo edge relationship encoding (that is, the relationship encoding between the nodes of the pseudo edge) and the time feature. Then the pseudo edge embedding vector and the corresponding node embedding vector are input into the GNN model to obtain the final pseudo edge vector. If the predicted relationship vector obtained by the final pseudo edge vector is similar to the original edge embedding vector (the reconstruction loss is less than or equal to the first preset threshold α), the original relationship is considered to be benign and the corresponding node is also a non-abnormal node.

[0127] In one embodiment, the actual relationship is the relationship between corresponding nodes extracted from the current data, and the relationship pair is obtained as follows:

[0128] Pair the new node with the node in the rehearsal node pool, calculate the Manhattan distance between the two paired nodes, and select the node pair with the closest distance (N p ,RN q );

[0129] is the new node N that is filtered out p Neighboring nodes N u In the rehearsal node RN q Select the nearest node RN from the neighbor nodes v , and obtain the four-tuple (N p ,N u ,RN q ,RN v ) represents a relationship pair, which consists of the actual relationship and the corresponding relationship in the rehearsal node pool. p 、N uis the node in the current data, p,u is the node number in the current data, RN q , RN v is the node in the rehearsal node pool, q, v are the node numbers in the rehearsal node pool.

[0130] S4.5. Update the rehearsal node pool and model parameters according to the abnormal nodes and the rehearsal nodes in the rehearsal node pool, and repeat step S4 for lifelong learning as the newly generated system log data is input to realize APT attack anomaly detection and obtain the corresponding APT attack anomaly detection results.

[0131] In one embodiment, the rehearsal node pool and model parameters are updated according to the abnormal nodes and the rehearsal nodes in the rehearsal node pool, as follows:

[0132] S4.5.1. Rehearsal node screening: select the nodes whose suspicious status exceeds the second preset threshold among the identified abnormal nodes Nodes whose suspicious status does not exceed the second preset threshold are considered malicious nodes and alarmed. The node is used as the new rehearsal node, and the new rehearsal node is an abnormal but non-malicious node;

[0133] S4.5.2, pseudo-edge connection: connect the new rehearsal node with the rehearsal nodes in the rehearsal node pool through pseudo-edges, and add the new rehearsal node to the rehearsal node pool to update the rehearsal node pool;

[0134] S4.5.3. Model update: Use the new rehearsal node pool to retrain the trained anomaly detection model and update the model parameters.

[0135] Among them, after the suspicious state is transferred, the unsuspicious abnormal nodes (new rehearsal nodes) are merged into the new rehearsal node pool of the retrained model, and the model parameters are updated. Specifically, according to the detected abnormal node AN, the rehearsal node pool and model parameters are updated as follows:

[0136] RN screening: Among the identified abnormal nodes AN, further select those whose suspicious degree does not exceed the second preset threshold As new RNs, these nodes exhibit abnormal behaviors but are not considered malicious.

[0137] Pseudo-edge connection: Pseudo-edge connection is used to connect the newly selected RN and the nodes in the rehearsal node pool. Through pseudo-edge connection, the anomaly detection model can accumulate and integrate information in each learning cycle instead of learning from scratch every time, which helps to improve detection efficiency.

[0138] Model update: Use the data stream (current data) in the current time window to update the model parameters and obtain the latest anomaly detection model, that is, use the reconstruction loss calculated by the newly selected RN to adjust the model weight parameters through the gradient descent method. Save the updated model parameters, and repeat the above step S4 as new system log data continues to arrive, so as to continuously adapt to new data streams in subsequent lifelong learning cycles to complete real-time detection. Continuously updating the model through lifelong learning helps reduce false positives.

[0139] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The above-described embodiments only express the more specific and detailed embodiments described in this application, but they cannot be understood as limiting the scope of the patent application. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of this application, which all belong to the protection scope of this application. Therefore, the protection scope of the patent application shall be based on the attached claims.

Claims

1. An APT anomaly detection method based on lifelong learning and suspicious semantic transfer, characterized by: The APT anomaly detection method based on lifelong learning and suspicious semantic transfer includes the following steps: S1. Collect system log data of the current period as current data and perform preprocessing, wherein the system log data of the current period is benign system log data, and the preprocessing includes: S1.1, feature extraction and traceability graph construction: extract the nodes of the current data and the relationship between the nodes, the relationship between the nodes is the event, and construct a traceability graph based on the extracted nodes and the relationship between the nodes, the event is the edge in the traceability graph; S2. Establish an anomaly detection model, which performs the following operations: S2.1, initialization embedding: Encode the features of the nodes at time t, the states of the nodes, and the relationships between the nodes, respectively, and obtain feature encoding, state encoding, and relationship encoding between the nodes, where t is the time point of the current data; S2.2, Node Embedding: For each node, the feature code at time t, the state code at time t-1, and the memory vector generated by the GRU model at time t-1 are synthesized as the corresponding node embedding vector. The node embedding vector of node i at time t is , node i is the node in the current data; S2.3, Relationship Embedding: According to the node embedding vectors of two nodes at time t, the relationship encoding between nodes and the time characteristics of events, the corresponding edge embedding vector is obtained. The edge embedding vector of node i and node j at time t is , node j is the node in the current data; S2.4, state transfer: transfer suspicious states between nodes according to preset transfer rules, where the suspicious states indicate the degree of suspicion of the nodes with respect to APT attacks; The preset transfer rule satisfies the following formula: (1)； In the formula, is the suspicious state of node i at time t, is the suspicious state of node i at time t-1, is the suspicious state of node j at time t-1, are all neighboring nodes of node i, is the attenuation factor; S2.5, model output: Use the GRU model to update the memory vector of the node, and input the edge embedding vector at time t and the corresponding node embedding vector into the GNN model to generate the corresponding final edge vector, and then input the final edge vector at time t and the corresponding node embedding vector into the MLP model to obtain the corresponding predicted relationship vector; S3, using the nodes and the relationships between the nodes of the extracted benign system log data as the input of the anomaly detection model to obtain a trained anomaly detection model; S4. Use the system log data of the next period as the current data to perform detection using the trained anomaly detection model, and repeat step S4 for lifelong learning as the newly generated system log data is input to obtain the corresponding APT attack anomaly detection results.

2. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 1, characterized in that: The nodes include processes, files and networks; the relationships between the nodes include the derivation relationship between processes, the reading relationship between processes and files, the creation relationship between processes and files, and the access relationship between processes and networks; The features of the nodes at time t, the states of the nodes and the relationships between the nodes are encoded respectively, and feature encoding, state encoding and relationship encoding between the nodes are obtained accordingly, as follows: The features of the nodes are encoded using hierarchical feature hashing to map high-dimensional features into a hash space of a preset size to obtain feature encoding; Encode the state of the node using the suspicious state to obtain the state code; The relationship between nodes is encoded using one-hot encoding to obtain the relationship encoding between nodes.

3. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 1 or 2, characterized in that: The initial state value of the suspicious state is a real number between 0 and 1, and it is stipulated that the initial state values ​​of the nodes of all socket objects are 1, and the others are 0, wherein 0 indicates completely benign and 1 indicates highly suspicious.

4. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 1, characterized in that: The memory vector of the node is updated using the GRU model as follows: (2)； (3)； (4)； (5)； In the formula, is the reset gate of node i at time t, is the update gate of node i at time t, is the candidate memory vector of node i at time t, is the memory vector of node i at time t, is the node embedding vector of node i at time t, that is, the input of node i at time t in the GRU model, is the memory vector of node i at time t-1, is the weight matrix of the node embedding vector of node i at time t in the update gate, is the weight matrix of the memory vector of node i in the update gate at time t-1, is the weight matrix of the node embedding vector of node i in the reset gate at time t, is the weight matrix of the memory vector of node i in the reset gate at time t-1, is the weight matrix of the node embedding vector of node i at time t when calculating the candidate memory vector, is the weight matrix of the memory vector of node i at time t-1 when calculating the candidate memory vector, is the bias term for the reset gate, is the bias term of the update gate, is the bias term of the candidate memory vector, is the sigmoid activation function, is the Hadamard product, tanh is the hyperbolic tangent activation function, and the memory vector corresponding to the new node of the GRU model is initially a zero vector.

5. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 1, characterized in that: The edge embedding vector between node i and node j at time t , the formula is as follows: (6)； In the formula, is the node embedding vector of node i at time t, is the node embedding vector of node j at time t, is the relationship encoding between nodes i and j at time t, and tanh is the hyperbolic tangent activation function; The edge embedding vector at time t and the corresponding node embedding vector are input into the GNN model to generate the corresponding final edge vector, and then the final edge vector at time t and the corresponding node embedding vector are input into the MLP model to obtain the corresponding predicted relationship vector, as follows: Generate the final edge vector using the GNN model , the formula is as follows: (7)； In the formula, It is a GNN model; Get the predicted relationship vector between node i and node j at time t , the formula is as follows: (8)； Where h(·) is the learnable function of the MLP model.

6. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 1, characterized in that: The pre-processing further comprises: S1.

2. Initialize the rehearsal node pool: create and initialize a rehearsal node pool, the rehearsal node pool is used to place a number of rehearsal nodes and edges of rehearsal nodes, the rehearsal nodes are nodes in the current data; The nodes and relationships between nodes of the extracted benign system log data are used as inputs of the anomaly detection model. When the trained anomaly detection model is obtained, the cross entropy loss between the output predicted relationship vector and the edge embedding vector of the actual relationship is calculated as the reconstruction loss, and the model parameters are updated by the gradient descent method; The system log data of the next period is used as the current data to detect using the trained anomaly detection model, and step S4 is repeated with the input of the newly generated system log data to perform lifelong learning to obtain the corresponding APT attack anomaly detection results, as follows: S4.1, data preprocessing: when a new node appears in the current data, embed the new node, when a new event occurs, embed the new event, regenerate the corresponding edge embedding vector and memory vector, and update the suspicious status and traceability graph of the relevant nodes; S4.2, Relationship matching: Pair the nodes of the new edges in the updated traceability graph with the nodes of the edges in the rehearsal node pool to obtain corresponding relationship pairs; S4.3, pseudo-edge connection: evaluate the reachability between the node of each new edge and the rehearsal nodes in the rehearsal node pool. If there is a node on the new edge that is reachable to any rehearsal node, connect the node of the new edge and the corresponding rehearsal node to form a pseudo-edge; S4.4, abnormal node identification: Use the trained anomaly detection model to identify the predicted relationship vectors of the rehearsal nodes and the nodes of the new edge, calculate the reconstruction loss between the predicted relationship vector and the edge embedding vector of the actual relationship according to the relationship pair, and use the reconstruction loss to evaluate the matching degree between the edge embedding vector of the current pseudo edge and the corresponding actual relationship, and select the nodes of the new edge connected by the pseudo edge whose reconstruction loss exceeds the first preset threshold α as abnormal nodes, and the abnormal nodes are the APT attack anomaly detection results; S4.

5. Update the rehearsal node pool and model parameters according to the abnormal nodes and the rehearsal nodes in the rehearsal node pool, and repeat step S4 for lifelong learning as the newly generated system log data is input to realize APT attack anomaly detection and obtain the corresponding APT attack anomaly detection results.

7. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 6, characterized in that: The rehearsal node pool and model parameters are updated according to the abnormal nodes and the rehearsal nodes in the rehearsal node pool, as follows: S4.5.

1. Rehearsal node screening: select the nodes whose suspicious status exceeds the second preset threshold among the identified abnormal nodes Nodes whose suspicious status does not exceed the second preset threshold are considered malicious nodes and alarmed. The node is used as a new rehearsal node, and the new rehearsal node is an abnormal but non-malicious node; S4.5.2, pseudo-edge connection: connect the new rehearsal node with the rehearsal nodes in the rehearsal node pool through pseudo-edges, and add the new rehearsal node to the rehearsal node pool to update the rehearsal node pool; S4.5.

3. Model update: Use the new rehearsal node pool to retrain the trained anomaly detection model and update the model parameters.

8. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 6, characterized in that: The actual relationship is the relationship between the corresponding nodes extracted from the current data, and the relationship pair is obtained as follows: Pair the new node with the node in the rehearsal node pool, calculate the Manhattan distance between the two paired nodes, and select the node pair with the closest distance (N p ,RN q ); is the new node N that is filtered out p Neighboring nodes N u In the rehearsal node RN q Select the nearest node RN from the neighbor nodes v , and obtain the four-tuple (N p ,N u ,RN q ,RN v ) represents a relationship pair, the relationship pair consists of an actual relationship and a corresponding relationship in the rehearsal node pool, where N p 、N u is the node in the current data, p,u is the node number in the current data, RN q , RN v is the node in the rehearsal node pool, q, v are the node numbers in the rehearsal node pool.

9. The APT anomaly detection method based on lifelong learning and suspicious semantic transfer as claimed in claim 6, characterized in that: The initialization of the rehearsal node pool is as follows: Based on the K-means algorithm, nodes with similar behaviors in the traceability graph composed of benign system log data are divided into a cluster, and the similar behaviors are the same type of events; Calculate the corresponding Katz Centrality score for each node in each cluster, and select the node with the highest Katz Centrality score as the benign key node of the cluster; In the traceability graph composed of benign system log data, the shortest edge connecting the benign key nodes is found, the benign key nodes and the neighbor nodes corresponding to the shortest edges of the benign key nodes are used as rehearsal nodes, and the rehearsal nodes and the edges of the rehearsal nodes are put into the rehearsal node pool.

Images