Attack gang portrait analysis method and device, equipment and storage medium

Abstract

The invention discloses an attack gang portrait analysis method and device, equipment and a storage medium, and relates to the field of network security, and the method comprises the steps: carrying out the log fusion based on a plurality of to-be-processed logs collected from a data source; after vector conversion is carried out on nodes and edge tags in the constructed target heterogeneous attack behavior graph, key node enumeration, sub-graph construction and feature extraction are carried out based on obtained vector information, and target vector features are obtained; key node attack behavior pattern learning is carried out based on the Graph SAGE graph neural network and the target vector features, and obtained full node behavior feature vectors are inputted to a K-means model for distance clustering, so that training is completed; and in the process of carrying out portrait analysis on the stored key node behavior sub-graph based on the target attack gang identification model obtained after training, carrying out attack gang behavior pattern classification by utilizing a preset discrimination formula and a target probability matrix of a stored model output result. The analysis accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an attack group portrait analysis method, device, equipment and storage medium. Background Art

[0002] Attack group profile analysis can help security professionals better understand the behavior patterns, attack methods, targets and motivations of specific attack groups, and help formulate more effective defense strategies and countermeasures. Currently, there are many network traffic anomaly detection methods based on deep learning to choose from.

[0003] However, in real application scenarios, the first method proposes a data flow tagging and tracking system called RTAG (Real-Time Active Gateway). However, due to the poor group recognition ability of the RTAG system for different attack types adopted by different attack groups and the limited ability to interpret attack behavior patterns, the applicability of the RTAG system to alarm log data is low. In addition, the second method simply uses graph neural networks to build attack behavior graphs and uses timestamps to judge to screen different attack behavior patterns. It relies heavily on experience to define timestamps and cannot fully analyze the overall situation of the attack group behavior. The third method builds traceability graphs and heterogeneous graphs, but its neural network-based method has a strong dependence on data. In addition, since the quality of log data generated by different security devices in real scenarios is uneven, this will affect the accuracy of the information used to build traceability graphs or attack heterogeneous graphs, resulting in poor attack group identification and incomplete attack patterns in attack groups. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an attack group profile analysis method, device, equipment and storage medium, which can effectively improve the accuracy, comprehensiveness and interpretability of the analysis results, thereby reducing the manpower investment in enterprise security operations. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a method for analyzing an attack group profile, including:

[0006] Log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order;

[0007] After vector conversion of nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key node is an entity in the target heterogeneous attack behavior graph used for training or detection;

[0008] Based on the Graph SAGE neural network and the target vector features, the attack behavior patterns of key nodes are learned, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model;

[0009] In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using a preset discriminant formula and a target probability matrix that saves the model output results to obtain the corresponding attack group portrait analysis results.

[0010] Optionally, the log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph, including:

[0011] Log collection is performed based on the network intrusion detection system, full flow detection and network application protection system, and corresponding user behavior logs are collected to obtain a variety of logs to be processed;

[0012] Based on the preset data processing tool and the multiple logs to be processed, data extraction, data conversion and data preservation are performed to complete the corresponding log fusion operation and obtain the corresponding fused information;

[0013] A corresponding heterogeneous attack behavior graph is constructed using a preset simulation tool and the fused information to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IPs, memories, and processes.

[0014] Optionally, the using a preset simulation tool and the fused information to construct a corresponding heterogeneous attack behavior graph to obtain a target heterogeneous attack behavior graph includes:

[0015] In the process of constructing a target heterogeneous attack behavior graph using a preset simulation tool and the fused information, the process name or file name is mapped to the corresponding node ID based on fast hashing technology and directional indexing technology.

[0016] Optionally, the key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features, including:

[0017] Based on the obtained vector information, the key nodes in the target heterogeneous attack behavior graph are enumerated, and the neighbor nodes corresponding to each of the key nodes are determined; wherein the neighbor nodes are nodes interconnected with the corresponding key nodes within 2 hops;

[0018] The target heterogeneous attack behavior graph is divided based on each of the key nodes and the corresponding neighbor nodes to obtain a corresponding plurality of key node behavior subgraphs; wherein the key node behavior subgraphs include corresponding key nodes, corresponding neighbor nodes, and edges between nodes;

[0019] The key nodes and the neighbor nodes in each key node behavior subgraph are labeled, and vector conversion and subgraph vector feature aggregation are performed based on the obtained label information to complete the feature extraction operation and obtain the corresponding target vector feature.

[0020] Optionally, the attack behavior pattern of key nodes is learned based on the Graph SAGE neural network and the target vector features, and the obtained full node behavior feature vector is input into the K-means model for distance clustering to complete the corresponding model training operation, including:

[0021] In the process of learning the attack behavior pattern of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, the node ancestor information of the key nodes from the key node behavior subgraphs is aggregated based on a plurality of hidden layers pre-configured in the Graph SAGE graph neural network and a forward propagation algorithm to complete the corresponding attack behavior pattern learning operation;

[0022] Evaluate the effects of different numbers of clusters based on a preset formula to determine the target number of clusters, and determine the corresponding K-means model according to the target number of clusters;

[0023] The full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE neural network are obtained, and the full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0024] Optionally, in the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, attack group behavior pattern classification is performed using a preset discriminant formula and a target probability matrix that saves the model output result, including:

[0025] In the process of dynamically performing attack group portrait analysis based on the target attack group identification model through the flow execution mode, the obtained model output results are recorded using a probability matrix to obtain a corresponding target probability matrix; wherein the model output results include the attack group behavior pattern identification results corresponding to the key nodes in each of the key node behavior subgraphs that have been saved locally and the corresponding probabilities;

[0026] For each of the key nodes, the preset discriminant formula and the corresponding target probability matrix are used to classify the attack group behavior pattern to obtain the corresponding attack group portrait analysis results.

[0027] Optionally, for each of the key nodes, using a preset discriminant formula and the corresponding target probability matrix to classify the attack group behavior pattern includes:

[0028] For each of the key nodes, using the corresponding target probability matrix to obtain the corresponding maximum probability value and the second largest probability value;

[0029] Obtaining a corresponding preset threshold, and substituting the maximum probability value, the second largest probability value, and the preset threshold into the preset discrimination formula to obtain a corresponding discrimination result;

[0030] Based on the discrimination results, the target attack group behavior patterns corresponding to each of the key nodes and the corresponding target pattern categories are determined to obtain the attack group portrait analysis results.

[0031] In a second aspect, the present application provides an attack group profile analysis device, comprising:

[0032] A behavior graph construction module is used to collect logs based on a preset data source, and to perform log fusion and heterogeneous attack behavior graph construction in sequence based on the collected multiple logs to be processed and preset data processing rules, so as to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order;

[0033] A feature extraction module is used to perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules after performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, so as to obtain the corresponding target vector features; wherein the key node is an entity used for training or detection in the target heterogeneous attack behavior graph;

[0034] A model training module is used to learn the attack behavior patterns of key nodes based on the Graph SAGE graph neural network and the target vector features, and input the obtained full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model;

[0035] The analysis result acquisition module is used to classify the attack group behavior patterns using a preset discriminant formula and a target probability matrix that saves the model output results during the attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, so as to obtain the corresponding attack group portrait analysis results.

[0036] In a third aspect, the present application provides an electronic device, including:

[0037] Memory, used to store computer programs;

[0038] A processor is used to execute the computer program to implement the steps of the aforementioned attack group portrait analysis method.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned attack group portrait analysis method.

[0040] It can be seen that in the present application, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein, the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; after vector conversion of the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features; wherein, the key node is an entity in the target heterogeneous attack behavior graph used for training or detection; based on Graph The SAGE graph neural network and the target vector features are used to learn the attack behavior patterns of key nodes, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model; in the process of attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using the preset discriminant formula and the target probability matrix that saves the model output result to obtain the corresponding attack group portrait analysis result. That is, in this embodiment, the corresponding heterogeneous attack behavior graph construction operation is completed by collecting and integrating logs from various data sources. After that, the target vector features corresponding to the constructed target heterogeneous attack behavior graph are used to learn the attack behavior pattern through the graph neural network and distance clustering to obtain the target attack group identification model; after that, in the process of analyzing using the target attack group identification model, the attack group portrait analysis result is determined based on the probability matrix and the preset discriminant formula. In this way, the accuracy, comprehensiveness and interpretability of the analysis results can be effectively improved, thereby reducing the manpower investment in enterprise security operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0042] Figure 1 A flow chart of an attack group profiling method provided for this application;

[0043] Figure 2 A flow chart of a specific attack group profiling method provided for this application;

[0044] Figure 3A schematic diagram of a key node subgraph behavior pattern vector representation provided in this application;

[0045] Figure 4 A flowchart of a key node attack behavior pattern learning provided for this application;

[0046] Figure 5 A training flow chart of an attack group identification model provided for this application;

[0047] Figure 6 A schematic diagram of the structure of an attack group portrait analysis device provided in this application;

[0048] Figure 7 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] In the actual application scenario, the first method proposes a data stream marking and tracking system called RTAG, but because the RTAG system has poor group recognition capabilities for different attack types adopted by different attack groups, and its ability to interpret attack behavior patterns is also limited, the applicability of the RTAG system to alarm log data is low. In addition, the second method simply uses a graph neural network to construct an attack behavior graph, and uses timestamps for judgment to screen different attack behavior patterns. It relies heavily on empirical consciousness to define timestamps, and cannot fully analyze the overall situation of the attack group's behavior. The third method constructs a traceability graph and a heterogeneous graph, but its neural network-based method has a strong dependence on data. In addition, since the quality of log data generated by different security devices in real scenarios is uneven, this will affect the accuracy of the information used to construct a traceability graph or an attack heterogeneous graph, resulting in poor identification of attack groups and incomplete attack patterns in attack groups. To this end, the present application provides an attack group portrait analysis solution that can effectively improve the accuracy, comprehensiveness and interpretability of the analysis results, thereby reducing the manpower investment in enterprise security operations.

[0051] See also Figure 1 As shown, the embodiment of the present invention discloses a method for analyzing an attack group profile, including:

[0052] Step S11, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order.

[0053] Combination Figure 2 As shown, in this embodiment, logs are first collected from multiple data sources and a heterogeneous attack behavior graph is constructed, that is, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph, including: log collection is performed based on a network intrusion detection system (IDS / IPS, Intrusion Detection System / Intrusion Prevention System, also known as an intrusion detection system / intrusion prevention system), full flow detection and a network application protection system (Web Application Firewall, i.e. WAF), and corresponding user behavior logs are collected to obtain multiple logs to be processed; data extraction, data conversion and data preservation are performed based on a preset data processing tool and the multiple logs to be processed to complete corresponding log fusion operations and obtain corresponding fused information; a corresponding heterogeneous attack behavior graph is constructed using a preset simulation tool and the fused information to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IP (Internet Protocol), memory and processes. It can be understood that the logs to be processed to be collected in this embodiment include but are not limited to traffic detection logs containing traffic log information, intrusion detection logs containing intrusion information, and user behavior logs containing user behavior information.

[0054] It should be pointed out that in this embodiment, in order to realize data integration based on log fusion, an ETL (ExtractTransform Load) tool is used, through which log data from different preset data sources can be extracted, converted and loaded into a unified data warehouse. In addition, during the data conversion process, operations such as data format standardization, field mapping and data cleaning are also required to ensure data consistency and accuracy.

[0055] Afterwards, an external tool Camflow is used to construct a heterogeneous attack behavior graph arranged in chronological order. In the constructed target heterogeneous attack behavior graph, nodes include system entities such as processes, files, IP addresses and memory (the system is the attack group portrait analysis system corresponding to this embodiment), and edges include attack actions such as compatible system calls. Among them, the edge represents the direction of information flow and the causal relationship between nodes. In order to achieve efficient search on the graph, fast hashing technology and reverse indexing methods can be used to map the process / file name to a unique node ID (Identity document, identity information), thereby improving search efficiency and ensuring accuracy. That is, the use of the preset simulation tool and the fused information to construct the corresponding heterogeneous attack behavior graph to obtain the target heterogeneous attack behavior graph includes: in the process of using the preset simulation tool and the fused information to construct the target heterogeneous attack behavior graph, the process name or file name is mapped to the corresponding node ID based on the fast hashing technology and the direction indexing technology.

[0056] In addition, when storing the target heterogeneous attack behavior graph to the memory, this embodiment will maintain it in the form of a key node behavior subgraph, and a key node behavior subgraph consists of a key node, a neighbor node, and the edges between them. Here, the key node is an entity in the graph used for training or detection. Nodes that can be connected to the key node within 2 hops are called neighbor nodes, and the neighbor nodes contain historical information used for training or detection.

[0057] Step S12: After performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key node is an entity in the target heterogeneous attack behavior graph used for training or detection.

[0058] In this embodiment, since the traditional attack group portrait recognition task usually uses alarm log data to train the supervised attack group analysis model, it is impossible to accurately distinguish the attack group behavior pattern from the benign user behavior pattern when the benign user data behavior pattern is missing during the training phase. In order to solve this problem, this embodiment customizes a key node attack behavior pattern feature extraction and label assignment method, and uses a supervised mode training model to learn the local structure information of each node.

[0059] It should be understood that in this embodiment, the label of the node is set to the node type, and the quantity distribution of different edge types related to it is extracted as the feature of the node. Then, by using labeled data for supervised training, the Graph SAGE model (Graph SAmple Aggre GatE, a graph neural network model) can learn the different behavior patterns of the nodes. That is, the Graph SAGE model uses the extracted features to learn the hidden distribution of different nodes. In this way, if a node is misclassified by the trained Graph SAGE model during the execution phase, it means that its underlying distribution is different from the behavior patterns of other nodes learned during the training phase, which means that it may be an abnormal node with an attack behavior pattern different from that of the node.

[0060] Specifically, in this embodiment, regarding the extraction of features, the key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and the preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features, including: enumerating the key nodes in the target heterogeneous attack behavior graph based on the obtained vector information, and determining the neighbor nodes corresponding to each of the key nodes; wherein the neighbor nodes are nodes interconnected with the corresponding key nodes within 2 hops; dividing the target heterogeneous attack behavior graph based on each of the key nodes and the corresponding neighbor nodes to obtain corresponding multiple key node behavior subgraphs; wherein the key node behavior subgraph includes corresponding key nodes, corresponding neighbor nodes, and edges between nodes; by labeling the key nodes and neighbor nodes in each of the key node behavior subgraphs, and performing vector conversion and subgraph vector feature aggregation based on the obtained label information, the feature extraction operation is completed, and the corresponding target vector features are obtained. In other words, in order to better perform attack group portrait analysis in the future, it is necessary to vectorize the node and edge labels in the target heterogeneous attack behavior graph. Since the behavior of a node is usually reflected in the system call operations represented by the edges associated with it, we can learn the distribution of behavioral features of different nodes by extracting these features, thereby better understanding the attacker's behavior pattern. Secondly, we need to enumerate the key nodes in the entire target heterogeneous attack behavior graph and label these key nodes and their neighboring nodes (within 2 hops). The key node behavior subgraph formed in this way can be used as a training vector feature to learn the local behavior of each subgraph. The specific details are as follows Figure 3 shown. Figure 3 The label, type, and edge in represent label, type, and edge respectively.

[0061] This will allow us to more accurately identify the attackers, understand their attack strategies, targets, and attack timing, and better predict and prevent future attacks. This will help us better understand the attackers’ behavior patterns, thereby improving the accuracy and robustness of the model.

[0062] Step S13, based on the Graph SAGE graph neural network and the target vector features, the key node attack behavior pattern learning is performed, and the obtained full node behavior feature vector is input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0063] Combination Figure 2 It can be seen that in this embodiment, after obtaining the features, it is necessary to use the extracted features to use the GraphSAGE graph neural network to learn the behavior patterns of key node subgraphs, and use the clustering method to characterize the local details of the attack behavior model. That is, the attack behavior pattern of key nodes is learned based on the Graph SAGE graph neural network and the target vector features, and the obtained full node behavior feature vector is input into the K-means model for distance clustering to complete the corresponding model training operation, including: in the process of learning the attack behavior pattern of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, the node ancestor information of the key nodes from the key node behavior subgraph is aggregated based on several hidden layers pre-configured in the Graph SAGE graph neural network and the forward propagation algorithm to complete the corresponding attack behavior pattern learning operation; the effect of different clustering numbers is evaluated based on a preset formula to determine the target clustering number, and the corresponding K-means model is determined according to the target clustering number; the full node behavior feature vector corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network is obtained, and the full node behavior feature vector is input into the K-means model for distance clustering to complete the corresponding model training operation, and a target attack group identification model is obtained. It is important to understand that during the training phase, the entire training graph, i.e., the target heterogeneous attack behavior graph, is divided into multiple key node behavior subgraphs, and each subgraph (i.e., the key node behavior subgraph) is trained in sequence (which may be chronological order). The advantage of this is that only a limited size of subgraphs need to be stored in memory, thus ensuring scalability.

[0064] Combination Figure 4As shown, specifically, in each subgraph, a set of random active nodes and nodes related to them are selected, and the edges between them are considered, where the active node sets of each subgraph are disjoint. Then, the information from the node ancestors is aggregated through the forward propagation algorithm. In the Graph SAGE graph neural network, K-1 hidden layers are set, where the first aggregation occurs from the input layer to the hidden layer, and the second aggregation occurs from the hidden layer to the output layer. Through the iterative process, the cross entropy loss between the true value and the predicted value is calculated, and the weight matrix W is adjusted. k , where W k ∈{1,…,K}, K is the number of hops. In this way, Graph SAGE graph neural network can learn the attack behavior patterns of different categories of nodes and explore their characteristics and local structures.

[0065] It should be noted that the choice of batch size (batch_size) affects the runtime overhead, and the number of hops K represents the size of the ancestors from which each node aggregates information. In order to balance the representation capability and runtime overhead, this embodiment sets K to 2, which is also the reason why the relevant nodes are defined as active nodes that can be reached in two hops. Through the forward propagation and tuning process of the Graph SAGE graph neural network model, we can better understand the behavior patterns of the attack group and identify the attack behaviors of different categories of nodes. This modeling method can help us improve our ability to analyze the portraits of the attack group, thereby strengthening information security protection.

[0066] Further, regarding the K-means model, the local details of the attack behavior pattern are better characterized by a clustering method, thereby detecting potential intrusion behaviors. Specifically, the K-means algorithm is an unsupervised learning algorithm that can divide a data set into K clusters, each cluster containing the data point closest to its centroid. In this embodiment, the K-means algorithm is used to cluster the full node feature vector output by the Graph SAGE graph neural network to detect the behavior pattern of the attack group. It should be noted that before enabling the K-means algorithm, an appropriate number of clusters k needs to be selected. The clustering effect under different numbers of clusters can be evaluated by a heuristic method (Elbow Method (EM) or Silhouette Coefficient (AC) and the optimal k value can be selected. The elbow method can be obtained as formula (1), and the silhouette coefficient can be obtained as formula (2). The relevant details of formulas (1) and (2) are shown in Tables 1 and 2, respectively.

[0067] (1);

[0068] (2);

[0069] Table 1

[0070] Related parameters definition J Clustering coefficient <![CDATA[u k ]]> Cluster center location k Number of cluster categories

[0071] Table 2

[0072] Silhouette coefficient definition 1 It indicates that the samples are clustered reasonably, the distance within the cluster is small and the distance between clusters is large. 0 Indicates sample cluster overlap -1 Indicates that the sample is incorrectly assigned to an adjacent cluster.

[0073] In formula (2), a represents the average distance between a sample and other samples in its cluster, reflecting the cohesion of the cluster; b represents the average distance between a sample and all samples in its nearest neighbor cluster, reflecting the separation between clusters.

[0074] It is understandable that in this embodiment, after selecting an appropriate number of clusters k, k centroids are randomly initialized and each data point is assigned to the cluster where the centroid closest to it is located. Then, for each cluster, its centroid is recalculated, and the above steps are repeated until convergence. Ultimately, the obtained clustering results can help us understand the behavior patterns of the attack group and identify potential intrusion behaviors.

[0075] In this way, by combining the Graph SAGE neural network and the K-means clustering algorithm, we can model and analyze attack behaviors from both global and local perspectives, obtain a target attack group identification model, and improve the ability to profile attack groups, so as to better identify potential network security threats. At the same time, it is necessary to continuously optimize the target attack group identification model to improve its accuracy and robustness, so as to better protect information security.

[0076] Step S14: In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using a preset discriminant formula and a target probability matrix that saves the model output results to obtain the corresponding attack group portrait analysis results.

[0077] Combination Figure 2As shown, in this embodiment, a method based on the probability matrix discriminant method is proposed, which is combined with the output of the target attack group identification model to classify the attack group behavior pattern. That is, in the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using the preset discriminant formula and the target probability matrix that saves the model output result, including: in the process of dynamically performing attack group portrait analysis based on the target attack group identification model through the flow execution mode, the obtained model output result is recorded using the probability matrix to obtain the corresponding target probability matrix; wherein the model output result includes the attack group behavior pattern recognition result and the corresponding probability corresponding to the key node in each key node behavior subgraph that has been saved locally; for each key node, the attack group behavior pattern is classified using the preset discriminant formula and the corresponding target probability matrix to obtain the corresponding attack group portrait analysis result.

[0078] It is further necessary to understand that, in the present embodiment, a key node behavior subgraph G is maintained in memory. Graph G is initially empty, and newly arrived nodes and edges are continuously added. The edges and points of the incoming edges and outgoing edges and their 2-hop descendants are defined as active nodes. The descendants and related nodes are obtained from the entire target heterogeneous attack behavior graph on disk. Specifically, a parameter can be set, called the subgraph size. When the number of newly arrived edges in graph G reaches SS, graph G is used for detection, and a new subgraph is started to be built in memory. Note that SS is not the number of edges in graph G, because some additional edges from other subgraphs are added. Through the stream execution mode, the attack behavior pattern of the current node can be dynamically detected and long-term scalability can be guaranteed.

[0079] At the same time, in order to achieve accurate attack group classification, this embodiment also proposes a probability-based method in the category discrimination stage. For unrecognized nodes v, iterative detection is performed in the sub-model corresponding to the target attack group identification model, and the probability list Mv given by each sub-model is obtained, which is the model output result. Then the nodes v with the largest and second largest probabilities are marked as C respectively. v and Since nodes with similar but different attack behavior patterns may not be classified into any category with high probability in each sub-model, there is a risk of correctly classifying them into the dominant label L(v) of a sub-model, which is undesirable because it is not desirable to correctly classify abnormal nodes. Therefore, in the execution phase, a threshold R is also used, and the node is considered to be correctly classified only when the following conditions are met. The discriminant formula is shown in (3).

[0080] (3);

[0081] That is, for each of the key nodes, the attack group behavior pattern classification is performed using the preset discriminant formula and the corresponding target probability matrix, including: for each of the key nodes, the corresponding target probability matrix is ​​used to obtain the corresponding maximum probability and the second largest probability; the corresponding preset threshold is obtained, and the maximum probability, the second largest probability and the preset threshold are substituted into the preset discriminant formula to obtain the corresponding discrimination result; based on the discrimination result, the target attack group behavior pattern corresponding to each of the key nodes and the corresponding target pattern category are determined to obtain the attack group portrait analysis result. In this way, different attack group behavior patterns and their categories can be determined more accurately, thereby improving the practicality and effectiveness in the field of attack group portrait identification. This optimization method plays an important role in the model training and detection stages. The probability matrix discrimination method is used to record the situations in which nodes may be judged as different attack groups, and is classified according to the size relationship between the maximum value and the second largest value. The feature output of the Graph SAGE and K-means models provides richer information to distinguish different attack group behavior patterns. By combining these methods, we are able to more accurately classify and identify attack groups, enhancing the accuracy and reliability of the model.

[0082] In summary, this application proposes an attack group portrait analysis method and system based on SAGE graph neural network and distance clustering, which analyzes the portraits of different attacker groups. In view of the fact that the existing attack detection equipment lacks the ability to analyze the association of log alarm events, which leads to high false alarm problems, and secondly, the alarm logs generated by the detection equipment are usually low-level and isolated. To this end, an attack group portrait analysis method based on graph neural network and distance clustering is proposed. A heterogeneous attack behavior graph is constructed through the collected logs or device alarms. In order to focus on the node behavior pattern, nodes and edges are selected for fine-grained feature extraction and key node subgraph feature aggregation, and then the SAGE graph neural network model is combined to learn the entire graph node behavior pattern; through the SAGE graph neural network, for different attacker group portraits, distance clustering is used to associate the attack groups with similar behavior patterns of the heterogeneous attack graph, thereby portraying different attacker group portraits. By extracting the attack behavior-related features of the attack group, constructing a graph describing the heterogeneous attack behavior, and associating different log information, richer security semantics can be obtained. Using representation learning methods to achieve attacker threat assessment provides security operations personnel with more accurate results, thereby reducing manpower investment in enterprise security operations.

[0083] It can be seen that in the present application, log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein, the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; after vector conversion of the nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain the corresponding target vector features; wherein, the key node is an entity in the target heterogeneous attack behavior graph used for training or detection; based on Graph The SAGE graph neural network and the target vector features are used to learn the attack behavior patterns of key nodes, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model; in the process of attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using the preset discriminant formula and the target probability matrix that saves the model output result to obtain the corresponding attack group portrait analysis result. That is, in this embodiment, the corresponding heterogeneous attack behavior graph construction operation is completed by collecting and integrating logs from various data sources. After that, the target vector features corresponding to the constructed target heterogeneous attack behavior graph are used to learn the attack behavior pattern through the graph neural network and distance clustering to obtain the target attack group identification model; after that, in the process of analyzing using the target attack group identification model, the attack group portrait analysis result is determined based on the probability matrix and the preset discriminant formula. In this way, the accuracy, comprehensiveness and interpretability of the analysis results can be effectively improved, thereby reducing the manpower investment in enterprise security operations.

[0084] See also Figure 5 As shown, the embodiment of the present invention discloses a method for analyzing an attack group profile, including:

[0085] Step S21: In the process of learning the attack behavior pattern of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, the node ancestor information of the key nodes from the key node behavior subgraph is aggregated based on several hidden layers pre-configured in the Graph SAGE graph neural network and the forward propagation algorithm to complete the corresponding attack behavior pattern learning operation.

[0086] Step S22: Evaluate the effects of different numbers of clusters based on a preset formula to determine a target number of clusters, and determine a corresponding K-means model according to the target number of clusters.

[0087] Step S23, obtaining the full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE neural network, and inputting the full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0088] Among them, the specific process of the above steps S21 to S23 can refer to the corresponding content disclosed in the above embodiments, and will not be repeated here.

[0089] It can be seen that in the embodiment of the present application, the extracted features are used to learn the behavior patterns of the key node subgraphs using the Graph SAGE neural network, and the clustering method is used to characterize the local details of the attack behavior model. In this way, the attack behavior is modeled and analyzed from both global and local perspectives by combining the Graph SAGE neural network and the K-means clustering algorithm, thereby improving the accuracy of the target attack group identification model.

[0090] See also Figure 6 As shown, the embodiment of the present application also discloses a device for analyzing the portrait of an attacking group, including:

[0091] The behavior graph construction module 11 is used to collect logs based on a preset data source, and to perform log fusion and heterogeneous attack behavior graph construction in sequence based on the collected multiple logs to be processed and preset data processing rules, so as to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order;

[0092] The feature extraction module 12 is used to perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules after performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, so as to obtain the corresponding target vector features; wherein the key node is an entity used for training or detection in the target heterogeneous attack behavior graph;

[0093] The model training module 13 is used to learn the attack behavior pattern of key nodes based on the Graph SAGE graph neural network and the target vector features, and input the obtained full node behavior feature vector into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model;

[0094] The analysis result acquisition module 14 is used to classify the attack group behavior patterns using a preset discriminant formula and a target probability matrix that stores the model output results during the attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, so as to obtain the corresponding attack group portrait analysis results.

[0095] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0096] It can be seen that in this application, the corresponding heterogeneous attack behavior graph construction operation is completed by collecting and integrating logs from various data sources. Then, the target vector features corresponding to the constructed target heterogeneous attack behavior graph are used to learn the attack behavior pattern through graph neural network and distance clustering to obtain the target attack group identification model; then, in the process of using the target attack group identification model for analysis, the attack group portrait analysis results are determined based on the probability matrix and the preset discriminant formula. In this way, the accuracy, comprehensiveness and interpretability of the analysis results can be effectively improved, thereby reducing the manpower investment in enterprise security operations.

[0097] In some specific embodiments, the behavior graph construction module 11 may specifically include:

[0098] The log collection unit is used to collect logs based on the network intrusion detection system, full flow detection and network application protection system, and collect corresponding user behavior logs to obtain a variety of logs to be processed;

[0099] A log fusion unit, used to extract, convert and save data based on a preset data processing tool and the plurality of logs to be processed, so as to complete corresponding log fusion operations and obtain corresponding fused information;

[0100] A heterogeneous attack behavior graph construction unit is used to use a preset simulation tool and the fused information to construct a corresponding heterogeneous attack behavior graph to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IPs, memories, and processes.

[0101] In some specific embodiments, the heterogeneous attack behavior graph construction unit may specifically include:

[0102] The name mapping subunit is used to map the process name or file name to the corresponding node ID based on the fast hashing technology and the direction indexing technology in the process of constructing the target heterogeneous attack behavior graph using the preset simulation tool and the fused information.

[0103] In some specific embodiments, the feature extraction module 12 may specifically include:

[0104] A key node enumeration unit, used to enumerate the key nodes in the target heterogeneous attack behavior graph based on the obtained vector information, and determine the neighbor nodes corresponding to each of the key nodes; wherein the neighbor nodes are nodes interconnected with the corresponding key nodes within 2 hops;

[0105] A key node behavior subgraph acquisition unit, used to divide the target heterogeneous attack behavior graph based on each of the key nodes and the corresponding neighbor nodes to obtain a corresponding plurality of key node behavior subgraphs; wherein the key node behavior subgraph includes the corresponding key nodes, the corresponding neighbor nodes and the edges between the nodes;

[0106] The feature acquisition unit is used to label the key nodes and the neighbor nodes in each key node behavior subgraph, and perform vector conversion and subgraph vector feature aggregation based on the obtained label information to complete the feature extraction operation and obtain the corresponding target vector feature.

[0107] In some specific embodiments, the model training module 13 may specifically include:

[0108] An information aggregation unit is used to aggregate node ancestor information of the key nodes in the key node behavior subgraph based on a plurality of hidden layers pre-configured in the Graph SAGE neural network and a forward propagation algorithm in the process of learning attack behavior patterns for the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE neural network, so as to complete the corresponding attack behavior pattern learning operation;

[0109] A model determination unit, used to evaluate the effects of different numbers of clusters based on a preset formula to determine a target number of clusters, and determine a corresponding K-means model according to the target number of clusters;

[0110] The distance clustering unit is used to obtain the full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE graph neural network, and input the full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

[0111] In some specific embodiments, the analysis result acquisition module 14 may specifically include:

[0112] A target probability matrix acquisition unit is used to record the obtained model output results using the probability matrix in the process of dynamically performing attack group portrait analysis based on the target attack group identification model through the flow execution mode to obtain the corresponding target probability matrix; wherein the model output results include the attack group behavior pattern recognition results corresponding to the key nodes in each of the key node behavior subgraphs saved locally and the corresponding probabilities;

[0113] The analysis result acquisition unit is used to classify the attack group behavior pattern for each of the key nodes using a preset discriminant formula and the corresponding target probability matrix to obtain a corresponding attack group portrait analysis result.

[0114] In some specific embodiments, the analysis result acquisition unit may specifically include:

[0115] A value acquisition subunit, used for acquiring the corresponding maximum probability value and the second largest probability value for each of the key nodes using the corresponding target probability matrix;

[0116] A discrimination result acquisition subunit is used to acquire a corresponding preset threshold value, and substitute the maximum probability value, the second largest probability value and the preset threshold value into the preset discrimination formula to obtain a corresponding discrimination result;

[0117] The pattern determination subunit is used to determine the target attack group behavior pattern corresponding to each of the key nodes and the corresponding target pattern category based on the discrimination result, so as to obtain the attack group portrait analysis result.

[0118] Furthermore, the present application also discloses an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0119] Figure 7 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the attack group profile analysis method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0120] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0121] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0122] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the attack group profile analysis method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0123] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned attack group profile analysis method is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0124] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0125] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0126] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0127] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0128] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for analyzing an attack group profile, characterized in that: include: Log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; After vector conversion of nodes and edge labels in the target heterogeneous attack behavior graph, key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features; wherein the key node is an entity in the target heterogeneous attack behavior graph used for training or detection; Based on the Graph SAGE neural network and the target vector features, the attack behavior patterns of key nodes are learned, and the obtained full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model; In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern is classified using a preset discriminant formula and a target probability matrix that saves the model output results to obtain the corresponding attack group portrait analysis results.

2. The attack group profile analysis method according to claim 1 is characterized in that: The log collection is performed based on a preset data source, and log fusion and heterogeneous attack behavior graph construction are performed in sequence based on the collected multiple logs to be processed and preset data processing rules to obtain the corresponding target heterogeneous attack behavior graph, including: Log collection is performed based on the network intrusion detection system, full flow detection and network application protection system, and corresponding user behavior logs are collected to obtain a variety of logs to be processed; Based on the preset data processing tool and the multiple logs to be processed, data extraction, data conversion and data preservation are performed to complete the corresponding log fusion operation and obtain the corresponding fused information; A corresponding heterogeneous attack behavior graph is constructed using a preset simulation tool and the fused information to obtain a target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph includes entities as nodes and attack behaviors as edges, and the entities include files, IPs, memories, and processes.

3. The attack group portrait analysis method according to claim 2 is characterized in that: The using of the preset simulation tool and the fused information to construct a corresponding heterogeneous attack behavior graph to obtain a target heterogeneous attack behavior graph includes: In the process of constructing a target heterogeneous attack behavior graph using a preset simulation tool and the fused information, the process name or file name is mapped to the corresponding node ID based on fast hashing technology and directional indexing technology.

4. The attack group profile analysis method according to any one of claims 1 to 3, characterized in that: The key node enumeration, subgraph construction, and feature extraction are performed based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules to obtain corresponding target vector features, including: Based on the obtained vector information, the key nodes in the target heterogeneous attack behavior graph are enumerated, and the neighbor nodes corresponding to each of the key nodes are determined; wherein the neighbor nodes are nodes interconnected with the corresponding key nodes within 2 hops; The target heterogeneous attack behavior graph is divided based on each of the key nodes and the corresponding neighbor nodes to obtain a corresponding plurality of key node behavior subgraphs; wherein the key node behavior subgraphs include corresponding key nodes, corresponding neighbor nodes, and edges between nodes; The key nodes and the neighbor nodes in each key node behavior subgraph are labeled, and vector conversion and subgraph vector feature aggregation are performed based on the obtained label information to complete the feature extraction operation and obtain the corresponding target vector feature.

5. The attack group profile analysis method according to claim 4 is characterized in that: The attack behavior pattern of key nodes is learned based on the Graph SAGE neural network and the target vector features, and the obtained full node behavior feature vector is input into the K-means model for distance clustering to complete the corresponding model training operation, including: In the process of learning the attack behavior pattern of the target vector features corresponding to each of the key node behavior subgraphs based on the Graph SAGE graph neural network, the node ancestor information of the key nodes from the key node behavior subgraphs is aggregated based on a plurality of hidden layers pre-configured in the Graph SAGE graph neural network and a forward propagation algorithm to complete the corresponding attack behavior pattern learning operation; Evaluate the effects of different numbers of clusters based on a preset formula to determine the target number of clusters, and determine the corresponding K-means model according to the target number of clusters; The full node behavior feature vectors corresponding to each of the key node behavior subgraphs output by the Graph SAGE neural network are obtained, and the full node behavior feature vectors are input into the K-means model for distance clustering to complete the corresponding model training operation and obtain the target attack group identification model.

6. The attack group profile analysis method according to claim 4 is characterized in that: In the process of performing attack group portrait analysis on the saved key node behavior subgraph based on the target attack group identification model, the attack group behavior pattern classification is performed using a preset discriminant formula and a target probability matrix that saves the model output result, including: In the process of dynamically performing attack group portrait analysis based on the target attack group identification model through the flow execution mode, the obtained model output results are recorded using a probability matrix to obtain a corresponding target probability matrix; wherein the model output results include the attack group behavior pattern identification results corresponding to the key nodes in each of the key node behavior subgraphs that have been saved locally and the corresponding probabilities; For each of the key nodes, the preset discriminant formula and the corresponding target probability matrix are used to classify the attack group behavior pattern to obtain the corresponding attack group portrait analysis results.

7. The attack group profile analysis method according to claim 6 is characterized in that: For each of the key nodes, the attack group behavior pattern classification is performed using a preset discriminant formula and the corresponding target probability matrix, including: For each of the key nodes, using the corresponding target probability matrix to obtain the corresponding maximum probability value and the second largest probability value; Obtaining a corresponding preset threshold, and substituting the maximum probability value, the second largest probability value, and the preset threshold into the preset discrimination formula to obtain a corresponding discrimination result; Based on the discrimination results, the target attack group behavior patterns corresponding to each of the key nodes and the corresponding target pattern categories are determined to obtain the attack group portrait analysis results.

8. A device for analyzing attack group portraits, characterized in that: include: A behavior graph construction module is used to collect logs based on a preset data source, and to perform log fusion and heterogeneous attack behavior graph construction in sequence based on the collected multiple logs to be processed and preset data processing rules, so as to obtain a corresponding target heterogeneous attack behavior graph; wherein the target heterogeneous attack behavior graph is an attack behavior graph arranged in chronological order; A feature extraction module is used to perform key node enumeration, subgraph construction, and feature extraction based on the obtained vector information and preset key node behavior subgraph vector feature extraction rules after performing vector conversion on the nodes and edge labels in the target heterogeneous attack behavior graph, so as to obtain the corresponding target vector features; wherein the key node is an entity used for training or detection in the target heterogeneous attack behavior graph; A model training module is used to learn the attack behavior patterns of key nodes based on the Graph SAGE graph neural network and the target vector features, and input the obtained full node behavior feature vectors into the K-means model for distance clustering to complete the corresponding model training operation and obtain a target attack group identification model; The analysis result acquisition module is used to classify the attack group behavior patterns using a preset discriminant formula and a target probability matrix that saves the model output results during the attack group portrait analysis of the saved key node behavior subgraph based on the target attack group identification model, so as to obtain the corresponding attack group portrait analysis results.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, used to execute the computer program to implement the attack group portrait analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the attack group portrait analysis method as described in any one of claims 1 to 7.

Images