APT covert channel identification method and system for multimodal anomaly detection

Abstract

The present invention relates to the technical field of APT covert channel identification methods, and provides an APT covert channel identification method and system for multimodal anomaly detection, which aims to solve the problem of detecting covert channels in advanced persistent threat (APT) attacks. Through multimodal anomaly detection, the method can identify and analyze APT attacks in complex network environments, especially those using covert channels. The present invention provides an APT covert channel identification method for multimodal anomaly detection, which includes obtaining multimodal data, normal behavior modeling, joint representation learning, enhancing anomaly sensitivity, capturing time series anomaly patterns, optimizing anomaly features, updating anomaly detection models, APT covert channel identification, and generating detection reports. The present invention is used to improve the detection accuracy of APT covert channels, reduce false alarm rates, increase detection delays, enhance the adaptability of models, and reduce computing resource consumption, thereby providing enterprises with powerful network security protection measures.

Description

Technical Field

[0001] The present invention relates to the technical field of APT covert channel identification methods, and more specifically, to an APT covert channel identification method and system for multimodal anomaly detection. Background Art

[0002] With the rapid development of information technology and the continuous evolution of cybersecurity threats, Advanced Persistent Threats (APTs) have become one of the most thorny issues in the current cybersecurity landscape. APT attacks are characterized by their stealthiness, long duration, and targeted nature, making them difficult to effectively address with traditional cybersecurity measures.

[0003] In recent years, APT detection technology has evolved from single-modality, rule-based methods to multi-modality, machine learning-based methods. Currently, there are several major APT detection methods:

[0004] 1. Rule-based detection: This is the earliest APT detection method that uses a predefined set of rules to identify suspicious behavior. Although it is simple to implement and consumes low computing resources, it has the following problems:

[0005] a) Rules are difficult to maintain and respond to rapidly changing APT attack techniques;

[0006] b) High false alarm rate and weak detection capability for unknown attack patterns;

[0007] c) Unable to capture complex attack patterns and long-term behavioral anomalies.

[0008] 2. Single-modality detection methods based on machine learning: This type of method uses machine learning algorithms, such as support vector machines (SVMs) and random forests, to analyze a single data source (such as network traffic) to detect APTs. Although this method is an improvement over rule-based methods, it still has the following problems:

[0009] a) Reliance on a single data source limits the comprehensiveness of detection;

[0010] b) Difficulty capturing complex attack patterns across multiple data sources;

[0011] c) Feature engineering relies too much on expert experience and is difficult to automatically adapt to new attack patterns.

[0012] 3. Single-modality detection methods based on deep learning: These methods use deep neural networks, such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs), to automatically learn features and detect APTs. Although they have significantly improved feature learning capabilities, they still face the following challenges:

[0013] a) The model is highly complex and consumes large amounts of computing resources;

[0014] b) It is still limited to a single data source, making it difficult to fully grasp the full picture of APT attacks;

[0015] c) The model has poor interpretability and is difficult to provide meaningful insights for security analysts.

[0016] 4. Simple multimodal fusion APT detection methods: This type of method attempts to combine multiple data sources, such as network traffic, log data, and terminal behavior, to improve the comprehensiveness of detection. Although there has been some improvement in detection performance, the following problems still exist:

[0017] a) Multimodal data fusion methods are simple, often using simple feature splicing or weighted averaging, which makes it difficult to fully utilize the complementary information between different modalities;

[0018] b) There is a lack of a dynamic assessment mechanism for the importance of different modalities, making it difficult to adapt to the characteristics of different stages of APT attacks;

[0019] c) It does not take into account the timing and long-term nature of APT attacks, making it difficult to capture the complex evolution of attack patterns.

[0020] In summary, existing APT detection methods face widespread challenges in the face of increasingly complex and diverse APT attacks, including low accuracy, high false positive rates, extended detection times, and poor adaptability. In particular, they face significant deficiencies in multimodal data fusion, long-term behavioral analysis, and real-time self-adaptation, making them unable to meet the urgent needs of current network security protection. Summary of the Invention

[0021] The purpose of this invention is to solve the problem of detecting covert channels in advanced persistent threat (APT) attacks. Through multimodal anomaly detection, this method can identify and analyze APT attacks in complex network environments, especially those using covert channels.

[0022] In order to solve the above technical problems, the present invention provides a multimodal anomaly detection (APT) covert channel identification method and system.

[0023] The present invention provides an APT covert channel identification method for multimodal anomaly detection, comprising the following steps:

[0024] Obtain multimodal data, and based on the multimodal data, implement normal behavior modeling through a variational autoencoder to obtain a normal behavior model; use an adaptive multi-scale deep coupled autoencoder to perform joint representation learning on the multimodal data to obtain a joint representation; based on the joint representation, enhance abnormal sensitivity through contrastive learning to obtain an enhanced feature representation; use a long short-term memory network to process the enhanced feature representation, capture time series abnormality patterns, and obtain time series abnormality features; use reinforcement learning to adaptively sample the time series abnormality features to obtain optimized abnormal features; aggregate multi-party knowledge through federated learning to update the abnormality detection model; analyze the optimized abnormal features based on the updated abnormality detection model to realize the identification of APT covert channels; and generate an APT covert channel detection report based on the identification results.

[0025] Specifically, the adaptive multi-scale deep coupled autoencoder includes:

[0026] Multi-scale feature extraction module, used to extract multi-scale features of multimodal data;

[0027] Dynamic modal importance assessment module, used to assess the importance of different modes;

[0028] A sparse anomaly feature enhancement module for enhancing potential anomaly features; and

[0029] Adaptive feature fusion module, used to fuse multimodal features.

[0030] Specifically, the multi-scale feature extraction module is implemented using a spiral pyramid network, where:

[0031] F i =SPN(X i )=Concat[S1(X i ), S2(Xi),...,S K (X i )]

[0032]

[0033] Among them, F i is the extracted feature, X i is the input data, S k is the k-th layer spiral convolution operation, σ is the Mish activation function, W k is the convolution kernel, R θ is the rotation transformation, K is the total number of layers, D k It is a dilated convolution with a dilation rate of 2 k , Represents element-wise addition.

[0034] Specifically, the dynamic modal importance evaluation module is implemented based on quantum annealing, wherein:

[0035] α i =QA(Φ(F i ))Φ(x)=cos(πx)+i·sin(πx)

[0036] Among them, α i is the importance weight of mode i, QA represents the quantum annealing process, Φ is the complex mapping function, F i is the output of the multi-scale feature extraction module, and i is an imaginary unit.

[0037] Specifically, the sparse anomaly feature enhancement module is implemented based on fractional differentials, where:

[0038] E i =F i +λ·D α [SparseMask(F i )]

[0039]

[0040] Among them, E i is the enhanced feature, F i is the input feature, λ is the learnable parameter, D α represents the α-order fractional differential operator, α is the fractional order, Γ is the gamma function, SparseMask is the differentiable sparse mask based on Gumbel-Softmax, and t and τ are time variables.

[0041] Specifically, the adaptive feature fusion module is implemented using nonlinear harmonic averaging, where:

[0042]

[0043] Among them, Z is the final joint representation, α i is the modal importance weight, E i is the enhanced feature, p is a learnable parameter, and ∑ represents the sum of all modes.

[0044] Specifically, the long short-term memory network adopts an improved LSTM unit, including an attention mechanism and a residual connection, wherein:

[0045] f t =σ(W f ·[h t-1 , x t ]+b f )

[0046] i t=σ(W i ·[h t-1 ,x t ]+b i )

[0047] o t =σ(W o ·[h t-1 , x t ]+b o )

[0048]

[0049] a t =Attention(h t -1,x t )

[0050]

[0051] Among them, f t 、i t 、o t They are forget gate, input gate and output gate respectively, c t is the unit state, h t is the hidden state, a t is the attention weight, x t is the input, σ is the sigmoid function, tanh is the hyperbolic tangent function, W f 、W i ,W o 、W c is the weight matrix, b f 、b i 、b o 、b c is the bias term, is element-by-element multiplication, and Attention is the attention calculation function. The improved LSTM unit is designed to address the problem of forgetting the timing of abnormal packet transmission intervals in specific network environments. The input is the abnormal packet transmission interval; the weight matrix is ​​formed by quantizing the statistical average of the average packet transmission interval in a specific network environment over a certain period of time. It has certain memory properties, and the attention weights can be adjusted according to actual network conditions.

[0052] Specifically, the reinforcement learning adaptive sampling is implemented using DuelingDQN, where:

[0053]

[0054] Among them, Q(s,a) is the state-action value function, V(s) is the state value function, A(s,a) is the advantage function, s is the state, a is the current action, a′ is all possible actions, |A| is the size of the action space, and ∑ represents the sum of all actions.

[0055] Specifically, the federated learning multi-party knowledge aggregation is implemented using homomorphic encryption and secure multi-party computation, where:

[0056]

[0057] Among them, θ (t+1) is the global model parameter, is the local model parameter of participant i, t represents the number of iterations, N is the number of participants, HE represents the homomorphic encryption operation, η is the learning rate, is the gradient of the loss function, D i is the local data of participant i, N(0, σ 2 ) has a mean of 0 and a variance of σ 2 Gaussian noise.

[0058] Multimodal anomaly detection APT covert channel identification system, including:

[0059] A multimodal data acquisition module, used to obtain multimodal data;

[0060] a variational autoencoder module, configured to implement normal behavior modeling based on the multimodal data to obtain a normal behavior model;

[0061] An adaptive multi-scale deep coupled autoencoder module, configured to perform joint representation learning on the multimodal data to obtain a joint representation;

[0062] a contrastive learning module, configured to enhance abnormality sensitivity based on the joint representation to obtain an enhanced feature representation;

[0063] A long short-term memory network module is used to process the enhanced feature representation, capture time series anomaly patterns, and obtain time series anomaly features;

[0064] A reinforcement learning module is used to adaptively sample the time series anomaly features to obtain optimized anomaly features;

[0065] Federated learning module, used to aggregate multi-party knowledge and update anomaly detection models;

[0066] An APT covert channel identification module is configured to analyze the optimized anomaly features based on the updated anomaly detection model to identify APT covert channels; and

[0067] The report generation module is used to generate an APT covert channel detection report based on the identification results.

[0068] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0069] 1. High Accuracy and Low False Alarm Rate: By effectively integrating multimodal data through an adaptive multi-scale deep coupled autoencoder, this method significantly improves the detection accuracy of APT covert channels while significantly reducing the false alarm rate. Experimental results show that this method achieves a detection accuracy of 97.8% and a false alarm rate of only 1.2%, far superior to existing methods.

[0070] 2. Rapid Response: This approach uses a reinforcement learning-based adaptive sampling strategy to significantly reduce the detection latency of APT attacks. Test results show that this approach has an average detection latency of only 2.3 hours, over eight times faster than traditional methods.

[0071] 3. Excellent Adaptability: By aggregating multi-party knowledge through federated learning and combining it with a dynamic modal importance assessment mechanism, the system can quickly adapt to diverse network environments and evolving attack patterns. Its performance variance is only 0.015, demonstrating exceptional stability.

[0072] 4. Comprehensive anomaly capture capability: Combining variational autoencoders, contrastive learning, and long short-term memory networks, this method can effectively capture short-term and long-term anomaly patterns, providing early detection of APT attacks.

[0073] Provided strong support.

[0074] 5. High resource utilization efficiency: Although a complex deep learning model is used, through careful algorithm design and optimization, this method maintains relatively moderate resource consumption while providing excellent performance, enabling it to operate stably for a long time in actual network environments.

[0075] 6. Strong explainability: By generating detailed APT covert channel detection reports, this method provides security analysts with clear attack insights, helping them to quickly develop effective defense strategies.

[0076] In summary, the method provided by this invention has achieved a significant technological breakthrough in APT covert channel detection, providing enterprises and organizations with an efficient, reliable, and highly adaptable network security protection solution, effectively addressing increasingly complex network security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 This is a flow chart of the APT covert channel identification method for multimodal anomaly detection of the present invention.

[0078] Figure 2This is a module composition diagram of the adaptive multi-scale deep coupling autoencoder module of the present invention.

[0079] Figure 3 This is a schematic diagram of the APT attack chain reconstruction and prediction system framework based on causal reasoning of the present invention. DETAILED DESCRIPTION

[0080] To further illustrate the technical means and effects employed by the present invention to achieve its intended objectives, the following detailed description, along with the accompanying drawings and preferred embodiments, includes a detailed description of the specific implementations, structures, features, and effects thereof. In the following description, references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0081] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0082] The present invention provides a multimodal anomaly detection APT covert channel identification method and system based on an adaptive multi-scale deep coupled autoencoder, which is used to identify covert channels used by advanced persistent threats (APTs) in complex network environments.

[0083] The present invention will be further described in detail below with reference to specific examples. The following examples are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0084] Please refer to Figure 1 In a typical application scenario, the method and system of the present invention are deployed in the network environment of a large multinational enterprise. This enterprise, with multiple offices and data centers worldwide, faces persistent advanced cyber threats from diverse regions and organizations. By analyzing multiple data sources within the enterprise network, the method and system of the present invention detect potential APT covert channels in real time, protecting the enterprise's sensitive data and intellectual property.

[0085] Specifically, the method of the present invention comprises the following steps:

[0086] 1. Obtain multimodal data. In this step, the system collects data from multiple data sources on the enterprise network. These data sources include but are not limited to:

[0087] Network traffic data: Use high-performance network probes (such as Gigamon GigaVUE-HC2) deployed at key nodes in the enterprise network to capture data from each layer of the TCP / IP protocol stack.

[0088] DNS request data: Obtained through the logs of the enterprise's DNS server (such as Microsoft DNS Server or BIND), including information such as request time, domain name, and request type.

[0089] Encrypted communication data: Use an SSL / TLS proxy server (such as Blue Coat SSL Visibility Appliance) to collect encrypted communication metadata, such as handshake information, cipher suites, etc.

[0090] These multimodal data are initially aggregated and pre-processed through the enterprise's security information and event management (SIEM) system (such as Splunk Enterprise Security).

[0091] 2. Based on the multimodal data, normal behavior modeling is implemented through a variational autoencoder to obtain a normal behavior model. In this step, the system uses a variational autoencoder (VAE) to model the normal network behavior of each modality.

[0092] The architecture design of VAE is as follows:

[0093] Encoder: 3-layer fully connected network, with 1024, 512, and 256 neurons in each layer, respectively, and LeakyReLU activation function (α=0.2);

[0094] Decoder: 3-layer fully connected network, with 256, 512, and 1024 neurons in each layer, respectively. The activation function is ELUVAE. The latent space dimension is dynamically adjusted by the following formula:

[0095] d=max(10,int(log2(n features )·k))

[0096] Among them, n features is the number of input features, k is an adjustable parameter, and its initial value is set to 2. In practice, we find that the value range of k between 1.5 and 2.5 works well.

[0097] The loss function of VAE is designed as follows:

[0098] L VAE =MSE(X,X′)+β·KL(q(z|X)||p(z))

[0099] The MSE(X, X′) mean squared error loss function is used to evaluate the difference between the encoder reconstructed data X and the original data X;

[0100] KL(q(z|X)||p(z)) is the KL divergence loss function, which measures the difference between the conditional distribution q(z|X) given by the encoder about the latent variable z and the prior distribution p(z). KL divergence is used to encourage the encoder to learn a distribution q(z|X) that is closer to the prior distribution p(z), thereby helping the model generate more realistic data.

[0101] β is a dynamically adjusted weight parameter: is the current training step number. This design allows the model to focus more on the reconstruction error in the early stages of training, and then gradually increase the weight of the KL divergence. The anomaly score is calculated as follows:

[0102] AS=α·MSE(X,X′)+(1-α)·KL(q(z|X)||p(z))

[0103] α is a learnable parameter with an initial value of 0.5. In practice, we find that the value of α usually converges to between 0.3 and 0.7 during training.

[0104] 3. Using an adaptive multi-scale deep coupled autoencoder to learn a joint representation of the multimodal data. This step of obtaining a joint representation is one of the core innovations of the present invention. The adaptive multi-scale deep coupled autoencoder includes the following modules:

[0105] 3.1 Multi-scale feature extraction module 31, which is implemented using an innovative spiral pyramid network (SPN):

[0106] F i =SPN(X i )=Concat[S1(X i ), S2(X i ), ..., S K (X i )]

[0107]

[0108] Among them, F i is the extracted feature, X i is the input data (such as network traffic feature vector), S k is the k-th layer spiral convolution operation, σ is the Mish activation function, W k is the convolution kernel, R θ is the rotation transformation, K is the total number of layers (in practice we use K = 5), D k It is a dilated convolution with a dilation rate of 2 k , This design allows the network to extract features at different scales and directions, and is particularly suitable for capturing multi-scale patterns in network traffic and DNS requests.

[0109] 3.2 Dynamic modal importance evaluation module 32, which is implemented based on quantum annealing:

[0110] α i =QA(Φ(F j ))

[0111] Φ(x)=Cos(πx)+i.sin(πx)

[0112] Among them, α i is the importance weight of mode i, QA represents the quantum annealing process, Φ is the complex mapping function, F i is the output of the multi-scale feature extraction module, and i is an imaginary unit. The quantum annealing process simulates the following Hamiltonian:

[0113]

[0114] Among them, J ij encodes the correlation between modes; Γ is the annealing parameter, represents the Pauli Z operator, acting on the i-th quantum bit; represents the Pauli Z operator, acting on the j-th quantum bit; It is represented by the Pauli X operator, which acts on the i-th quantum bit; H represents the Hamiltonian of the system, which describes the total energy of the system; ∑ is the summation symbol, which means the summation of all possible i and j; J ij is the coupling strength, which represents the correlation between the quantum bit i modes. ij The value of can be positive or negative, with a positive value indicating ferromagnetic coupling (tending to the same state) and a negative value indicating antiferromagnetic coupling (tending to the opposite state). At the beginning of the annealing process, the value of Γ is large, and as the annealing process proceeds, v gradually decreases to close to zero. i, i is the index of the quantum bit. In our application, each i or j can represent a specific data mode. D-Wave quantum annealer, which is a quantum computing device specially designed to execute quantum annealing algorithms. It solves the optimization problem by physically implementing the above Hamiltonian. The annealing time is set to 20μs (microseconds) in this application. This is the duration of the entire quantum annealing process, during which the system evolves from the initial state to the final state.

[0115] In the APT detection application proposed in this patent, this quantum annealing process is used to dynamically evaluate the importance of different data modalities. Specifically, J ijThe value of is set according to the correlation between different data modalities (such as network traffic, DNS requests, encrypted communications, etc.). These values ​​can be obtained through correlation analysis in the preprocessing step. Each qubit represents a data modality. At the end of the annealing process, the final state of the qubit is used to determine the importance weight of the corresponding modality. The Γ parameter gradually decreases from a large initial value (such as 2.0) to close to 0 (such as 0.01) during the annealing process. This process simulates the transition from a quantum superposition state to a classical state. The annealing time of 20μs was obtained through experimental optimization. Within this time range, the system can fully explore the solution space and converge to a good solution. In this way, we use the advantages of quantum computing to efficiently solve the complex combinatorial optimization problem of modal importance evaluation, thereby improving the accuracy and responsiveness of APT detection.

[0116] In practical applications, we use a D-Wave quantum annealer to implement this process, with the annealing time set to 20 μs.

[0117] 3.3 Sparse abnormal feature enhancement module 33, which is implemented based on fractional differential:

[0118] E i =F i +λ·D α [SparseMask(F i )]

[0119]

[0120] Among them, E i is the enhanced feature, F i is the input feature, λ is a learnable parameter (the initial value is set to 0.1), D α represents the α-order fractional differential operator, α is the fractional order (we found that α = 0.5 works well), Γ is the gamma function, SparseMask is a differentiable sparse mask based on Gumbel-Softmax, and t and τ are time variables.

[0121] This design can effectively enhance sparse anomaly features and is particularly suitable for detecting subtle anomalies in APT attacks.

[0122] 3.4 Adaptive feature fusion module 34, which is implemented using nonlinear harmonic averaging:

[0123]

[0124] Among them, Z is the final joint representation, α i is the modal importance weight, E iis the enhanced feature, p is a learnable parameter (initial value is set to -1) ∑ represents the sum of all modal i. In practice, we find that the value of p usually converges to between -2 and 2, which allows the model to dynamically adjust between the arithmetic mean and the geometric mean.

[0125] 4. Based on the joint representation, enhance the abnormal sensitivity through contrastive learning to obtain the enhanced feature representation. In this step, we use the improved InfoNCE loss function:

[0126]

[0127] Among them, s is the cosine similarity, τ is the temperature parameter, which is dynamically adjusted:

[0128]

[0129] The initial value of τ0 is 0.07, and T is the total number of training steps. This design allows the model to pay more attention to obvious differences in the early stages of training, and then gradually increase its sensitivity to subtle differences.

[0130] 5. Use a long short-term memory network to process the enhanced feature representation, capture the abnormal time series pattern, and obtain the abnormal time series features. This step uses an improved LSTM unit, including an attention mechanism and residual connection:

[0131] f t =σ(W f ·[h t-1 , x t ]+b f )

[0132] i t =σ(W i ·[h t-1 ,x t ]+b i )

[0133] o t =σ(W o ·[h t-1 , x t ]+b o )

[0134]

[0135] a t =Attention(h t -1,x t )

[0136]

[0137] Among them, f t 、it 、o t They are forget gate, input gate and output gate respectively, c t is the unit state, h t is the hidden state, a t is the attention weight, x t is the input, σ is the sigmoid function, tanh is the hyperbolic tangent function, W f 、W i 、W o 、W c is the weight matrix, b f 、b i 、b o 、b c is the bias term, is element-by-element multiplication, and Attention is the attention calculation function.

[0138] In practice, we use a three-layer stacked LSTM with 256 hidden units in each layer. This design can effectively capture long-term dependencies and is particularly suitable for detecting long-term abnormal patterns in APT attacks.

[0139] 6. Use reinforcement learning to adaptively sample the time series anomaly features to obtain optimized anomaly features. This step is implemented using DuelingDQN:

[0140]

[0141] Where Q(s,α) is the state-action value function, V(s) is the state value function, A(s,a) is the advantage function, s is the state, a is the current action, a′ is all possible actions, |A| is the size of the action space, and ∑ represents the sum of all actions. The state space is designed as follows:

[0142] S t =[CPU t ,Mem t ,Net t ,AS t-1 ,AS t-2 ,…,AS t-k ]

[0143] Among them, CPU t ,Mem t ,Net t Respectively represent the current CPU usage, memory usage and network load, AS t-i represents the anomaly score of the past i time steps. In practice, we use k = 10, that is, considering the anomaly scores of the past 10 time steps. The action space includes 5 different sampling frequencies: [1s, 5s, 10s, 30s, 60s].

[0144] The reward function is designed as follows:

[0145] R t =w1·Detection_Rate-W2·False_Alarm_Rate-W3·Resource_Usage

[0146] Among them, W1, w2, w3 are weight parameters, and we determine the optimal value through grid search;

[0147] Detection Rate: This is the detection rate, that is, the proportion of APT attacks detected in a given period of time;

[0148] False_Alarm_Rate: This is the false alarm rate, that is, the proportion of normal behaviors that are mistakenly identified as APT attacks within a given period of time;

[0149] Resource_Usage: This is the resource usage rate, that is, the proportion of resources (such as computing resources, storage resources, etc.) consumed by the system in a given time. 7. Aggregate multi-party knowledge through federated learning and update the anomaly detection model. This step is implemented using homomorphic encryption and secure multi-party computation:

[0150]

[0151] Among them, θ (t+1) is the global model parameter, is the local model parameter of participant i, t represents the number of iterations, N is the number of participants, HE represents the homomorphic encryption operation, η is the learning rate (initial value is set to 0.001, and dynamically adjusted using the Adam optimizer), is the gradient of the loss function, D i is the local data of participant i, N(0, σ 2 ) has a mean of 0 and a variance of σ 2 Gaussian noise.

[0152] In practical applications, we use the Paillier homomorphic encryption scheme with a key length of 2048 bits. 2 It is dynamically adjusted according to the differential privacy budget ∈, and the initial ∈ is set to 0.1.

[0153] 8. Based on the updated anomaly detection model, the optimized anomaly features are analyzed to identify APT covert channels. In this step, we use the Dempster-Shafer evidence theory to perform multi-source information fusion:

[0154]

[0155] in, m1,m2,……,m n , which is the support of hypothesis A from n sources of evidence, each source of evidence has its own support m i , X i : This is the set of hypotheses supported by evidence source i, m i (X i ) represents the i-th evidence source for event X i The basic belief assignment of A represents a composite event. In this system, we use network traffic analysis, DNS request analysis, and encrypted communication analysis as the three main evidence sources.

[0156] The decision threshold is dynamically adjusted using the Youden index based on the ROC curve:

[0157] threshold=argmax t (TPR(t)-FPR(t))

[0158] Among them, TPR is the true positive rate and FPR is the false positive rate. This method can achieve a good balance between detection rate and false alarm rate, argmax t (*) The maximum value operation function.

[0159] 9. Generate an APT covert channel detection report based on the identification results. In this final step, the system generates a detailed APT covert channel detection report. We use a sequence-to-sequence model based on the attention mechanism to generate a natural language report.

[0160] The model structure is as follows:

[0161] Encoder: Bidirectional LSTM with self-attention

[0162] Decoder: LSTM with attention over encoded states

[0163] Pointer-generatornetwork: used to process unregistered words

[0164] The loss function is designed as follows:

[0165] L=λ1·L ce +λ2·L coverage +λ3·L abstractive

[0166] Among them, L c e is the cross entropy loss, L c overage is the coverage loss, L abstractive is the abstract generation loss. λ1, λ2, and λ3 are weight parameters, and the optimal values ​​are determined through cross-validation.

[0167] In actual applications, both the encoder and decoder use 3-layer LSTM with 512 hidden units. The attention mechanism uses scaled dot-product attention.

[0168] This design generates accurate and easy-to-understand detection reports, including key information such as the type of APT covert channel detected, possible attack sources, affected systems, and recommended mitigation measures.

[0169] Please refer to Figure 3 Based on the above method, the present invention also provides a multimodal anomaly detection APT covert channel identification system. The system includes the following modules:

[0170] Multimodal Data Acquisition Module 1: This module collects data from multiple data sources within the enterprise network. It includes high-performance network probes (such as the Gigamon GigaVUE-HC2), DNS server log collectors, and SSL / TLS proxy servers (such as the BlueCoat SSL Visibility Appliance). All data is initially aggregated and pre-processed using the enterprise's SIEM system (such as Splunk Enterprise Security).

[0171] Variational Autoencoder Module 2: This module implements the VAE architecture described above to model the normal behavior of each data modality. It uses NVIDIA Tesla V100 GPUs for accelerated computing, ensuring real-time processing of large amounts of data.

[0172] Adaptive Multi-Scale Deeply Coupled Autoencoder Module 3: This is the core module of the system, implementing the Spiral Pyramid Network (SPN), quantum annealing-based dynamic modal importance assessment, fractional-order differentiation-based sparse outlier feature enhancement, and nonlinear harmonic mean-based adaptive feature fusion described above. The quantum annealing process is implemented using a D-Wave2000Q quantum computer.

[0173] Contrastive Learning Module 4: This module implements an improved InfoNCE loss function to enhance anomaly sensitivity. It is tightly integrated with the Adaptive Multi-Scale Deeply Coupled Autoencoder module and shares the same NVIDIA Tesla V100 GPU.

[0174] Long Short-Term Memory Network Module 5: This module implements an improved LSTM unit to capture abnormal time series patterns. It uses NVIDIA Tesla T4 GPUs for accelerated computing.

[0175] Reinforcement Learning Module 6: This module implements the Dueling DQN algorithm for adaptive sampling. It uses the Intel Xeon Platinum 8280 processor for computing to ensure real-time performance.

[0176] Federated Learning Module 7: This module implements a federated learning algorithm based on homomorphic encryption and secure multi-party computation. It uses Intel SGX (Software Guard Extensions) technology to protect sensitive data and computing processes.

[0177] APT Covert Channel Identification Module 8: This module implements a multi-source information fusion algorithm based on the Dempster-Shafer evidence theory. It uses the Intel Xeon Gold 6248 processor for high-speed computing.

[0178] Report Generation Module 9: This module implements a sequence-to-sequence model based on the attention mechanism to generate natural language detection reports. It uses the NVIDIA Tesla T4 GPU for accelerated computing.

[0179] All of these modules are integrated into a high-performance server cluster, using Kubernetes for container orchestration and management to ensure high system availability and scalability. The system integrates with an enterprise's existing security infrastructure, such as firewalls, intrusion detection systems, and security information and event management (SIEM) systems, via a RESTful API.

[0180] In actual deployments, the system is capable of processing massive amounts of multimodal data in enterprise networks in real time, accurately identifying various complex APT covert channels. For example, in one real-world detection, the system successfully identified an APT attack leveraging DNS tunneling, which bypasses traditional network security measures by encoding data within DNS requests. The system not only detected the anomalous DNS request pattern but also confirmed the existence of a data breach by analyzing network traffic and encrypted communication data. It also generated a detailed detection report, enabling the security team to take swift action to prevent the attack.

[0181] In summary, the method and system provided by the present invention, through innovative algorithm design and advanced hardware implementation, greatly improve the accuracy and efficiency of APT covert channel detection, providing enterprises with a powerful network security protection measure.

[0182] In order to verify the superiority of the present invention, we conducted a series of comparative experiments. The following is a detailed comparison of Example 1 of the present invention and three comparative examples:

[0183] Example 1: Multimodal anomaly detection (APT) covert channel identification method based on adaptive multi-scale deep coupled autoencoder of the present invention

[0184] Comparative Example 1: Traditional single-modality rule-based APT detection method

[0185] Comparative Example 2: Single-modality APT detection method based on deep learning

[0186] Comparative Example 3: APT Detection Method Based on Simple Multimodal Fusion

[0187] Test indicators and detection methods:

[0188] 1. Detection accuracy (Accuracy): the number of correctly identified samples divided by the total number of samples.

[0189] 2. False Positive Rate (FPR): The number of normal samples that are mistakenly identified as APT attacks divided by the total number of normal samples.

[0190] 3. False Negative Rate (FNR): The number of undetected APT attack samples divided by the total number of APT attack samples.

[0191] 4.F1 score: The harmonic mean of precision and recall, which comprehensively measures detection performance.

[0192] 5. Detection latency: The average time from the start of an APT attack to its detection by the system.

[0193] 6. Computing resource consumption: average values ​​of CPU usage, memory usage, and GPU utilization.

[0194] 7. Model adaptability: Performance stability under different network environments, expressed as performance variance.

[0195] Test environment:

[0196] We conducted a 30-day test in a simulated large-scale enterprise network environment consisting of 100 workstations, 10 servers, and five network switches. We simulated various APT attack types, including DNS tunneling, encrypted C&C communications, and data exfiltration. We also simulated normal network activity to test the system's false positive rate.

[0197] The test results are shown in the following table:

[0198] index Example 1 Comparative Example 1 Comparative Example 2 Comparative Example 3 Detection accuracy 97.8％ 82.3％ 89.5％ 93.2％ False alarm rate 1.2％ 8.7％ 5.3％ 3.8％ False negative rate 2.1％ 12.5％ 7.8％ 5.6％ F1 score 0.976 0.845 0.912 0.945 Detection delay 2.3 hours 18.7 hours 9.5 hours 6.2 hours CPU usage 45％ 25％ 60％ 55％ Memory usage 16 GB 4GB 24GB 20GB GPU utilization 70％ N / A 85％ 80％ Model fitness (variance) 0.015 0.089 0.042 0.031

[0199] According to the test results in the above table, it can be seen that Example 1 is the best embodiment. The above results are analyzed and explained as follows:

[0200] 1. Detection Accuracy: Our method achieved a high accuracy of 97.8%, significantly outperforming other methods. This is primarily due to the powerful feature extraction and fusion capabilities of the adaptive multi-scale deep coupled autoencoder, as well as the comprehensive utilization of multimodal data.

[0201] 2. False Alarm and False Negative Rates: Our method performed well on both metrics, with a false alarm rate of only 1.2% and a false negative rate of 2.1%. This demonstrates that our method can effectively distinguish between normal behavior and APT attacks, reducing the risk of false alarms and false negatives.

[0202] 3. F1 score: The high F1 score of 0.976 further demonstrates the balanced performance of the proposed method in terms of precision and recall, which is crucial for APT detection in practical applications.

[0203] 4. Detection Latency: The average detection latency of our method is only 2.3 hours, significantly lower than other methods. This is due to our adaptive sampling strategy and real-time processing capabilities, enabling the system to more quickly identify potential APT attacks.

[0204] 5. Computational resource consumption: Although the resource consumption of the method of the present invention is slightly higher than that of the rule-based method (Comparative Example 1), this is acceptable considering the performance improvement. Compared with other deep learning methods, the resource utilization of the present invention is more efficient.

[0205] 6. Model Adaptability: Our method demonstrated the best adaptability, with a performance variance of only 0.015. This demonstrates that our method can maintain stable performance across diverse network environments and attack patterns, which is crucial for addressing the ever-changing APT threat landscape.

[0206] The method of the present invention significantly outperforms the comparative methods across all key metrics. In particular, it demonstrates clear advantages in core metrics such as detection accuracy, false positive rate, false negative rate, and detection latency. These results fully demonstrate the effectiveness of the innovative features of the present invention, such as the adaptive multi-scale deep coupled autoencoder, multimodal data fusion, and reinforcement learning adaptive sampling.

[0207] High accuracy and low false positive rates demonstrate that this method can more accurately identify APT covert channels, reducing the workload of security teams dealing with false alarms. Shorter detection latency means security teams can respond to potential threats more quickly, minimizing the damage caused by attacks.

[0208] Furthermore, the excellent adaptability demonstrated by the proposed method demonstrates its ability to effectively counter the evolving APT attack techniques, which is crucial for maintaining long-term network security. While the proposed method consumes relatively high computational resources, this is a perfectly acceptable trade-off given the significant performance improvements it brings.

[0209] In general, these test results fully demonstrate the innovation and practicality of this invention in the field of APT covert channel detection, and provide enterprises and organizations with a more effective and reliable network security protection solution.

[0210] It should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multimodal anomaly detection APT covert channel identification method, characterized in that: The following steps are involved: obtaining multimodal data, and implementing normal behavior modeling through a variational autoencoder based on the multimodal data to obtain a normal behavior model; Performing joint representation learning on the multimodal data using an adaptive multi-scale deep coupled autoencoder to obtain a joint representation; The adaptive multi-scale deep coupled autoencoder comprises: Multi-scale feature extraction module, used to extract multi-scale features of multimodal data; Dynamic modal importance assessment module, used to assess the importance of different modes; Sparse abnormal feature enhancement module, used to enhance potential abnormal features; Adaptive feature fusion module, used to fuse multimodal features; Based on the joint representation, enhancing abnormality sensitivity through contrastive learning to obtain an enhanced feature representation; Using a long short-term memory network to process the enhanced feature representation, capture the time series abnormal pattern, and obtain the time series abnormal feature; Adaptively sampling the time series anomaly features using reinforcement learning to obtain optimized anomaly features; Aggregate multi-party knowledge through federated learning and update the anomaly detection model; Based on the updated anomaly detection model, the optimized anomaly features are analyzed to identify APT covert channels; And based on the identification results, generate an APT covert channel detection report.

2. The APT covert channel identification method for multimodal anomaly detection according to claim 1 is characterized in that: The multi-scale feature extraction module is implemented using a spiral pyramid network, where: F i =SPN(X i )=Concat[S1(X i ),S2(X i ),...,S K (X i )] S k (X)=σ(W k *(R θ (X)⊕D k (X))) Among them, F i is the extracted feature, X i is the input data, S k is the k-th layer spiral convolution operation, σ is the Mish activation function, W k is the convolution kernel, R θ is the rotation transformation, K is the total number of layers, D k It is a dilated convolution with a dilation rate of 2 k ,⊕ represents element-wise addition.

3. The APT covert channel identification method for multimodal anomaly detection according to claim 2 is characterized in that: The dynamic modal importance evaluation module is implemented based on quantum annealing, where: α i =QA(Φ(F i )) Φ(x)=cos(πx)+i·sin(πx) Among them, α i is the importance weight of mode i, QA represents the quantum annealing process, Φ is the complex mapping function, F i is the feature extracted by the multi-scale feature extraction module, and i is an imaginary unit.

4. The APT covert channel identification method for multimodal anomaly detection according to claim 3 is characterized in that: The sparse anomaly feature enhancement module is implemented based on fractional differentials, where: E i =F i +λ·D α [SparseMask(F i )] Among them, E i is the enhanced feature, F i is the feature extracted by the multi-scale feature extraction module of the input, λ is a learnable parameter, and D α represents the α-order fractional differential operator, α is the fractional order, Γ is the gamma function, SparseMask is the differentiable sparse mask based on Gumbel-Softmax, and t and τ are time variables.

5. The APT covert channel identification method for multimodal anomaly detection according to claim 4 is characterized in that: The adaptive feature fusion module is implemented using nonlinear harmonic averaging, where: Among them, Z is the final joint representation, α i is the modal importance weight, E i is the enhanced feature, p is a learnable parameter, and ∑ represents the sum of all modes.

6. The APT covert channel identification method for multimodal anomaly detection according to claim 1 is characterized in that: The long short-term memory network adopts an improved LSTM unit, including an attention mechanism and residual connections, where: f t =σ(W f ·[h t-1 ,x t ]+b f ) i t =σ(W i ·[h t-1 ,x t ]+b i ) the t =σ(W o ·[h t-1 ,x t ]+b o ) a t =Attention(h t -1,x t ) Among them, f t 、i t 、o t They are forget gate, input gate and output gate respectively, c t is the unit state, h t is the hidden state, a t is the attention weight, x t is the input, σ is the sigmoid function, tanh is the hyperbolic tangent function, W f 、W i ,W o 、W c is the weight matrix, b f 、b i 、b o 、b c is the bias term, is element-by-element multiplication, and Attention is the attention calculation function.

7. The APT covert channel identification method for multimodal anomaly detection according to claim 1 is characterized in that: The reinforcement learning adaptive sampling is implemented using DuelingDQN, where: Among them, Q(s,a) is the state-action value function, V(s) is the state value function, A(s,a) is the advantage function, s is the state, a is the current action, and a ′ are all possible actions, |A| is the size of the action space, and ∑ represents the sum of all actions.

8. The APT covert channel identification method for multimodal anomaly detection according to claim 1 is characterized in that: The federated learning multi-party knowledge aggregation is implemented using homomorphic encryption and secure multi-party computation, where: Among them, θ (t+1) is the global model parameter, is the local model parameter of participant i, t represents the number of iterations, N is the number of participants, HE represents the homomorphic encryption operation, η is the learning rate, is the gradient of the loss function, D i is the local data of participant i, N(0,σ 2 ) has a mean of 0 and a variance of σ 2 Gaussian noise.

9. Multimodal anomaly detection APT covert channel identification system, characterized by: include: A multimodal data acquisition module, used to obtain multimodal data; A variational autoencoder module, configured to implement normal behavior modeling based on the multimodal data to obtain a normal behavior model; An adaptive multi-scale deep coupled autoencoder module, configured to perform joint representation learning on the multimodal data to obtain a joint representation; The adaptive multi-scale deep coupled autoencoder comprises: Multi-scale feature extraction module, used to extract multi-scale features of multimodal data; Dynamic modal importance assessment module, used to assess the importance of different modes; Sparse abnormal feature enhancement module, used to enhance potential abnormal features; Adaptive feature fusion module, used to fuse multimodal features; a contrastive learning module, configured to enhance abnormality sensitivity based on the joint representation to obtain an enhanced feature representation; A long short-term memory network module is used to process the enhanced feature representation, capture time series anomaly patterns, and obtain time series anomaly features; A reinforcement learning module is used to adaptively sample the time series anomaly features to obtain optimized anomaly features; Federated learning module, used to aggregate multi-party knowledge and update anomaly detection models; An APT covert channel identification module is configured to analyze the optimized anomaly features based on the updated anomaly detection model to identify APT covert channels; and The report generation module is used to generate an APT covert channel detection report based on the identification results.

Images