Attack pattern recognition method and device based on behavior graph, equipment and medium

Abstract

The invention discloses an attack pattern recognition method and device based on a behavior graph, equipment and a medium. The method comprises the following steps: collecting behavior data under various data sources in real time, and preprocessing the behavior data under each data source to obtain behavior characteristic data information corresponding to each data source; inputting each piece of behavior characteristic data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source; and respectively inputting each target behavior graph into a pre-constructed dual-mode recognition model for attack behavior recognition, searching a response measure matched with a recognition result in a preset attack response mapping library according to the recognition result, and automatically executing a system defense operation. According to the embodiment of the invention, by constructing the graph neural network model and introducing the dual-mode recognition model, the accuracy of attack mode recognition is improved, and the method has important significance for protecting enterprise sensitive information and maintaining network security and stability.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an attack pattern recognition method, device, equipment and medium based on a behavior graph. Background Art

[0002] In the current cybersecurity environment, attack behaviors are becoming increasingly complex, and traditional security protection measures are facing huge challenges. Attackers use multi-step attack chains, cross-platform and cross-device means to invade, making it difficult for a single data source and traditional rule matching technology to effectively identify complex attack behaviors. Therefore, attack behavior pattern recognition has become a key technology.

[0003] The rule-based detection method is the earliest and most widely used attack detection technology. Since it relies on predefined rules and signatures, it cannot identify new attack methods and unseen threats. At the same time, the accuracy of rule matching is limited, and it is easy to generate false positives due to noise data or deviations from normal operations. In terms of post-maintenance, the rules need to be continuously updated and optimized, which consumes a lot of human resources. Summary of the invention

[0004] Based on this, the present invention provides a behavior graph-based attack pattern recognition method, device, equipment and medium to solve the problem that rule-based attack behavior detection and recognition has limited accuracy and cannot identify unknown attacks.

[0005] In a first aspect, an embodiment of the present invention provides an attack pattern recognition method based on a behavior graph, the method comprising:

[0006] Collect behavioral data from multiple data sources generated by manual network operations in real time, and pre-process the behavioral data from each data source to obtain behavioral feature data information corresponding to each data source;

[0007] Inputting each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source;

[0008] Each of the target behavior graphs is input into a pre-built dual-mode recognition model to perform attack behavior recognition, and based on the recognition result, a response measure matching the recognition result is searched in a preset attack response mapping library to automatically execute system defense operations.

[0009] In a second aspect, an embodiment of the present invention provides an attack pattern recognition device based on a behavior graph, the device comprising:

[0010] The behavior feature extraction module is used to collect behavior data from multiple data sources generated by artificial network operations in real time, and pre-process the behavior data from each data source to obtain behavior feature data information corresponding to each data source;

[0011] A behavior graph construction module, used to input each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source;

[0012] The attack behavior identification module is used to input each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior identification, and based on the identification results, search for response measures matching the identification results in a preset attack response mapping library to automatically execute system defense operations.

[0013] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the attack pattern recognition method based on a behavior graph described in any embodiment of the present invention.

[0017] In a fourth aspect, a computer-readable storage medium is also provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement an attack pattern recognition method based on a behavior graph as described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention can more accurately capture abnormal behavior patterns in network traffic by constructing a graph neural network model to perform graph behavior modeling on network traffic data. At the same time, the introduction of a dual-mode recognition model can more comprehensively analyze the characteristics of network traffic compared to traditional rule-based or statistical methods, thereby improving the accuracy of attack pattern recognition, significantly improving network security protection capabilities, and timely discovering and preventing potential network attacks, which is of great significance for protecting sensitive enterprise information and maintaining network security and stability.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of an attack pattern recognition method based on a behavior graph provided according to Embodiment 1 of the present invention;

[0022] Figure 2 is a flow chart of another attack pattern recognition method based on behavior graph provided according to the second embodiment of the present invention;

[0023] Figure 3 is a structural schematic diagram of an attack pattern recognition device based on a behavior graph provided according to Embodiment 3 of the present invention;

[0024] Figure 4 It is a structural schematic diagram of an electronic device for implementing an attack pattern recognition method based on a behavior graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1This is a flow chart of a method for identifying attack patterns based on behavior graphs provided in the first embodiment of the present invention. This embodiment is applicable to the case of identifying attack patterns of multiple data sources. The method can be performed by an attack pattern identification device based on behavior graphs. The device can be implemented in the form of hardware and / or software. The device can be configured in a network security monitoring system. Figure 1 As shown, the method includes:

[0029] S110, collecting behavior data from multiple data sources generated by manual network operations in real time, and preprocessing the behavior data from each data source to obtain behavior feature data information corresponding to each data source.

[0030] The embodiment of the present invention continuously collects behavioral data from different data sources (such as network traffic, system logs, power failure detection data, and user behavior records) by deploying data collection agents. First, the collected raw data is formatted and converted into a unified structured data format, and then data cleaning is performed to filter out noise, invalid or duplicate data, and the cleaned data is normalized to ensure the consistency of the characteristics of different data sources.

[0031] Secondly, deep autoencoders or other machine learning methods can be used to automatically extract behavioral features, and dimension reduction can be performed through methods such as principal component analysis to extract key features and obtain feature data corresponding to each data source.

[0032] S120. Input each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source.

[0033] The graph neural network model is a deep learning model that can learn on graph structured data. The pre-trained enhanced graph neural network model can perform feature learning and information transmission between nodes and edges. Therefore, by using entities in the data source (such as hosts, users, and devices, etc.) as nodes of the graph and behaviors (such as process creation, network communication, and file access) as edges, a graph structure that reflects the actual behavioral relationship is constructed, which is the target behavior graph.

[0034] The core idea of ​​modeling behavioral graphs relies on CAM and graph embedding techniques, especially combined with graph neural networks, which can extract meaningful features from graph structured data and use them for attack behavior identification.

[0035] Optionally, before inputting each of the behavior feature data information into the pre-trained enhanced graph neural network model, the following steps may also be included:

[0036] Collect historical behavior data from multiple data sources within a set historical time interval, and construct a historical behavior graph for each data source based on the historical behavior data;

[0037] Extract the timestamps in the historical behavior data of each data source, and generate historical time series corresponding to each data source according to the timestamps;

[0038] Based on the historical time series of each data source, feature enhancement is performed on the historical behavior graph of each data source to obtain an enhanced behavior graph under each data source;

[0039] The enhanced behavior graph under each data source is used as a training set and input into the initial graph neural network model for pre-training to obtain an enhanced graph neural network model.

[0040] For the training of the initial graph neural network model, we first collect historical behavior data and use the historical behavior data to build a corresponding historical behavior graph for each data source. At the same time, based on the construction of the behavior graph, we extract time series information from each data source, assign weights to each corresponding node and edge in the historical behavior graph, and combine the time attenuation coefficient to obtain an enhanced graph neural network model with time context.

[0041] S130, inputting each of the target behavior graphs into a pre-built dual-mode recognition model to perform attack behavior recognition, and based on the recognition result, searching for a response measure matching the recognition result in a preset attack response mapping library, and automatically executing a system defense operation.

[0042] The dual-mode recognition model includes two recognition results: known attack behavior recognition and unknown attack behavior recognition. Different processing procedures are corresponding to known attack behaviors and unknown attack behaviors. Among them, the attack response mapping library provides a mapping relationship between known attack behaviors and response measures, and automatically executes related defense operations by matching the response measures corresponding to the known attack behaviors.

[0043] Furthermore, before inputting each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior recognition, the method may further include:

[0044] Associating the predefined rule base with the specified rule engine to construct a rule recognition model;

[0045] The rule recognition model is combined with a preset deep learning model for extracting time series to construct an initial dual-mode recognition model;

[0046] The enhanced behavior graph under each data source is used as a training set and input into the initial dual-mode recognition model. The weight ratio of the rule recognition model and the deep learning model in the initial dual-mode recognition model is adjusted to obtain a dual-mode recognition model with the optimal weight ratio.

[0047] In the embodiment of the present invention, the rule recognition module can use the predefined rule engine and Bayesian network to quickly match the target behavior graph and identify the behavior that conforms to the known attack pattern. The rule engine is pre-associated with a rule base, and the rule pairs in the rule base contain mapping pairs of feature information and attack behaviors. By extracting the feature information in the target behavior graph and matching it with the attack behavior, it is possible to quickly determine whether the attack is a known attack.

[0048] At the same time, deep learning technology is introduced into the dual-mode recognition model, which mainly analyzes abnormal behaviors through deep learning models and identifies unknown new attacks. In an embodiment of the present invention, the selected deep learning model (such as long short-term memory network or Transformer) is used for the model of time series and anomaly detection. The above model can learn the implicit patterns in the behavior sequence and judge whether there is an attack behavior through the anomaly score.

[0049] Optionally, using the enhanced behavior graph under each data source as a training set, inputting it into the initial dual-mode recognition model, adjusting the weight ratio of the rule recognition model and the deep learning model in the initial dual-mode recognition model, and obtaining the dual-mode recognition model with the optimal weight ratio may include:

[0050] The enhanced behavior graph under each data source is input into the initial dual-mode recognition model respectively, and the rule matching task and the new attack recognition task are performed in sequence by using the rule recognition model and the deep learning model;

[0051] Generate loss functions for the rule matching task and the new attack identification task respectively, and calculate the first loss function and the second loss function;

[0052] According to the first loss function and the second loss function, the weights of the rule matching task and the new attack identification task are adaptively adjusted to obtain a dual-mode recognition model with optimal weight ratio.

[0053] Specifically, in order to optimize the fused dual-mode recognition model, when the time-enhanced behavior graph is input into the dual-mode recognition model, the loss functions of the rule matching task performed by the rule matching model and the new attack recognition task performed by the deep learning model are calculated respectively, and the weights of the two tasks are adaptively adjusted to obtain the optimal loss combination, that is, the dual-mode recognition model with the optimal weight ratio.

[0054] Furthermore, after inputting each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior recognition, the following may also be included:

[0055] If it is determined that the dual-mode recognition model outputs a target attack behavior for the current target behavior graph, then the recognition deviation is calculated according to the attack type of the target attack behavior, the target time series corresponding to the current target behavior graph, and the current system time;

[0056] If the recognition deviation exceeds a preset alarm threshold, an alarm is issued for the target attack behavior.

[0057] An embodiment of the present invention also provides an adaptive alarm mechanism, that is, for a certain type of attack behavior, the deviation can be calculated by obtaining the time series in the target behavior data corresponding to the target behavior graph and the current system time to generate an accurate anomaly score to measure the degree of deviation from normal behavior, and reduce false positives and missed negatives of the alarm by comparing with the set alarm threshold.

[0058] The embodiment of the present invention can more accurately capture abnormal behavior patterns in network traffic by constructing a graph neural network model and performing graph behavior modeling on network traffic data. At the same time, the introduction of a dual-mode recognition model can more comprehensively analyze the characteristics of network traffic compared to traditional rule-based or statistical methods, thereby improving the accuracy of attack pattern recognition, significantly improving network security protection capabilities, and timely discovering and preventing potential network attacks, which is of great significance for protecting sensitive enterprise information and maintaining network security and stability.

[0059] Embodiment 2

[0060] Figure 2 A flowchart of another attack pattern recognition method based on a behavior graph provided in Embodiment 2 of the present invention is provided. This embodiment is refined based on the above embodiment. Figure 2 As shown, the method specifically includes:

[0061] S210, collecting behavior data from multiple data sources generated by manual network operations in real time, and preprocessing the behavior data from each data source to obtain behavior feature data information corresponding to each data source.

[0062] S220. Input each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source.

[0063] S230: Input the current target behavior graph into the rule recognition model in the dual-mode recognition model.

[0064] S240: Perform a first round of rule matching with the current target behavior graph through the predefined rules stored in the rule base in the rule recognition model.

[0065] S250: If the current target behavior graph successfully matches the predefined rule in the rule recognition model, the target attack behavior is directly output as the recognition result.

[0066] The dual-mode recognition model combines rule matching and deep learning technology. The input target behavior graph is first matched with known attack patterns by the rule recognition model. If the features in the target behavior graph match the attack features in the rule library in the rule recognition model, the current attack behavior is identified as a known attack. The rule library includes feature signatures, behavior patterns, and threshold judgments.

[0067] S260: If the current target behavior graph does not successfully match the predefined rules in the rule recognition model, the current target behavior graph is transmitted to the deep learning model in the dual-mode recognition model.

[0068] S270. Perform abnormality identification on the current target behavior graph through the deep learning model, and output the abnormality identification result obtained by the deep learning model.

[0069] Optionally, performing abnormality identification on the current target behavior graph by using the deep learning model may include:

[0070] Extracting the target time series under the data source corresponding to the current target behavior graph through the deep learning model, and calculating the anomaly score based on the target time series;

[0071] The deep learning model compares the abnormality score with a preset standard threshold. If the abnormality score is greater than the standard threshold, the recognition result is determined to be a new type of attack behavior; otherwise, the recognition result is determined to be a non-attack behavior.

[0072] Furthermore, it may also include:

[0073] If it is determined that the recognition result is a new attack behavior, the new attack feature is added to the rule base according to the target behavior data that matches the current target behavior graph.

[0074] If the features in the target behavior graph do not match the attack features in the rule library in the rule recognition model, the unknown attack mode is detected through the deep learning model. Specifically, the deep model can learn the implicit patterns in the behavior sequence and determine whether there is an attack behavior through the anomaly score. When the anomaly score exceeds the standard threshold, it can be determined as a new attack behavior under the unknown attack mode.

[0075] S280. According to the identification result, a response measure matching the identification result is searched in a preset attack response mapping library, and a system defense operation is automatically performed.

[0076] Generate alerts based on identified attack patterns, record attack details and impact scope, and trigger corresponding defense measures based on the severity of the attack, such as isolating the attacked host, blocking the attack source IP, and disabling high-risk accounts.

[0077] The technical solution of the embodiment of the present invention, by refining the overall solution, mainly explains the recognition process of the rule recognition model and the deep learning model respectively. Specifically, for data of an attack type to be identified, the rule recognition model is first used to match the rules of the known attack pattern. If the match is successful, while determining the attack type, a defense operation corresponding to the attack behavior is generated; if the match fails, the deep learning model is used to identify the anomaly of the unknown attack pattern, and it is determined whether it is a new type of attack behavior based on the anomaly score. Overall, the embodiment of the present invention combines rule matching and deep learning technology to achieve accurate identification of known and unknown attack behaviors, and achieves comprehensive detection and response to complex attacks and new threats, effectively improving the efficiency and accuracy of network security protection.

[0078] Embodiment 3

[0079] Figure 3 The following is a schematic diagram of the structure of an attack pattern recognition device based on a behavior graph provided in the third embodiment of the present invention. Figure 3 As shown, the device comprises:

[0080] The behavior feature extraction module 310 is used to collect behavior data from multiple data sources generated by artificial network operations in real time, and pre-process the behavior data from each data source to obtain behavior feature data information corresponding to each data source;

[0081] A behavior graph construction module 320 is used to input each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source;

[0082] The attack behavior identification module 330 is used to input each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior identification, and based on the identification results, search for response measures matching the identification results in a preset attack response mapping library to automatically execute system defense operations.

[0083] In the embodiment of the present invention, by constructing a graph neural network model and performing graph behavior modeling on network traffic data, abnormal behavior patterns in network traffic can be captured more accurately. At the same time, the introduction of a dual-mode recognition model can more comprehensively analyze the characteristics of network traffic compared to traditional rule-based or statistical methods, thereby improving the accuracy of attack pattern recognition, significantly improving network security protection capabilities, and timely discovering and preventing potential network attacks, which is of great significance for protecting sensitive enterprise information and maintaining network security and stability.

[0084] Optionally, on the basis of the above embodiments, it further includes a graph neural network model enhancement unit, which is used to collect historical behavior data from multiple data sources within a set historical time interval before inputting each of the behavior feature data information into the pre-trained enhanced graph neural network model, and construct a historical behavior graph for each data source according to the historical behavior data;

[0085] Extract the timestamps in the historical behavior data of each data source, and generate historical time series corresponding to each data source according to the timestamps;

[0086] Based on the historical time series of each data source, feature enhancement is performed on the historical behavior graph of each data source to obtain an enhanced behavior graph under each data source;

[0087] The enhanced behavior graph under each data source is used as a training set and input into the initial graph neural network model for pre-training to obtain an enhanced graph neural network model.

[0088] Optionally, on the basis of the above embodiments, it further includes a dual-mode recognition model optimization unit, which is used to associate the predefined rule base with the specified rule engine to construct a rule recognition model before inputting each of the target behavior graphs into the pre-built dual-mode recognition model for attack behavior recognition;

[0089] The rule recognition model is combined with a preset deep learning model for extracting time series to construct an initial dual-mode recognition model;

[0090] The enhanced behavior graph under each data source is used as a training set and input into the initial dual-mode recognition model. The weight ratio of the rule recognition model and the deep learning model in the initial dual-mode recognition model is adjusted to obtain a dual-mode recognition model with the optimal weight ratio.

[0091] Optionally, based on the above embodiments, the dual-mode recognition model optimization unit can also be used to input the enhanced behavior graph under each data source into the initial dual-mode recognition model respectively, and use the rule recognition model and the deep learning model to perform the rule matching task and the new attack recognition task in sequence;

[0092] Generate loss functions for the rule matching task and the new attack identification task respectively, and calculate the first loss function and the second loss function;

[0093] According to the first loss function and the second loss function, the weights of the rule matching task and the new attack identification task are adaptively adjusted to obtain a dual-mode recognition model with optimal weight ratio.

[0094] Optionally, based on the above embodiments, the attack behavior identification module 330 may further include:

[0095] A first model recognition unit, used for inputting the current target behavior graph into the rule recognition model in the dual-mode recognition model;

[0096] A rule matching unit, used to perform a first round of rule matching with the current target behavior graph through the predefined rules stored in the rule base in the rule recognition model;

[0097] A first result output unit, configured to directly output the target attack behavior as a recognition result if the current target behavior graph successfully matches the predefined rule in the rule recognition model;

[0098] a second model recognition unit, configured to transmit the current target behavior graph to the deep learning model in the dual-mode recognition model if the current target behavior graph fails to match the predefined rule in the rule recognition model;

[0099] An abnormality identification unit is used to identify abnormalities of the current target behavior graph through the deep learning model, and output the abnormality identification result obtained by the deep learning model.

[0100] Optionally, based on the above embodiments, the anomaly identification unit may also be used to extract the target time series under the data source corresponding to the current target behavior graph through the deep learning model, and calculate the anomaly score based on the target time series;

[0101] The deep learning model compares the abnormality score with a preset standard threshold. If the abnormality score is greater than the standard threshold, the recognition result is determined to be a new type of attack behavior; otherwise, the recognition result is determined to be a non-attack behavior.

[0102] Optionally, based on the above embodiments, it further includes a rule base updating unit, which is used to add new attack features to the rule base according to target behavior data matching the current target behavior graph if the identification result is determined to be a new attack behavior.

[0103] Optionally, on the basis of the above embodiments, it further includes an adaptive alarm unit, which is used to, after inputting each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior recognition, if it is determined that the dual-mode recognition model outputs a target attack behavior for the current target behavior graph, calculate the recognition deviation according to the attack type of the target attack behavior, the target time series corresponding to the current target behavior graph, and the current system time;

[0104] If the recognition deviation exceeds a preset alarm threshold, an alarm is issued for the target attack behavior.

[0105] An attack pattern recognition device based on a behavior graph provided in an embodiment of the present invention can execute an attack pattern recognition method based on a behavior graph provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0106] Embodiment 4

[0107] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0108] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0109] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as an attack pattern recognition method based on a behavior graph.

[0111] That is: collect the behavior data from multiple data sources generated by artificial network operations in real time, and pre-process the behavior data from each data source to obtain the behavior feature data information from each data source;

[0112] Inputting each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source;

[0113] Each of the target behavior graphs is input into a pre-built dual-mode recognition model to perform attack behavior recognition, and based on the recognition result, a response measure matching the recognition result is searched in a preset attack response mapping library to automatically execute system defense operations.

[0114] In some embodiments, a behavior graph-based attack pattern recognition method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the behavior graph-based attack pattern recognition method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a behavior graph-based attack pattern recognition method in any other appropriate manner (e.g., by means of firmware).

[0115] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0117] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0118] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0119] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0120] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0121] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0122] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A behavior graph-based attack pattern recognition method, It is characterized in that include: Collect behavioral data from multiple data sources generated by manual network operations in real time, and pre-process the behavioral data from each data source to obtain behavioral feature data information corresponding to each data source; Inputting each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source; Each of the target behavior graphs is input into a pre-built dual-mode recognition model to perform attack behavior recognition, and based on the recognition result, a response measure matching the recognition result is searched in a preset attack response mapping library to automatically execute system defense operations.

2. The method according to claim 1, It is characterized in that Before inputting each of the behavior feature data information into the pre-trained enhanced graph neural network model, the method further includes: Collect historical behavior data from multiple data sources within a set historical time interval, and construct a historical behavior graph for each data source based on the historical behavior data; Extract the timestamps in the historical behavior data of each data source, and generate historical time series corresponding to each data source according to the timestamps; Based on the historical time series of each data source, feature enhancement is performed on the historical behavior graph of each data source to obtain an enhanced behavior graph under each data source; The enhanced behavior graph under each data source is used as a training set and input into the initial graph neural network model for pre-training to obtain an enhanced graph neural network model.

3. The method according to claim 2, It is characterized in that Before inputting each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior recognition, the method further includes: Associating the predefined rule base with the specified rule engine to construct a rule recognition model; The rule recognition model is combined with a preset deep learning model for extracting time series to construct an initial dual-mode recognition model; The enhanced behavior graph under each data source is used as a training set and input into the initial dual-mode recognition model. The weight ratio of the rule recognition model and the deep learning model in the initial dual-mode recognition model is adjusted to obtain a dual-mode recognition model with the optimal weight ratio.

4. The method according to claim 3, It is characterized in that The enhanced behavior graph under each data source is used as a training set and input into the initial dual-mode recognition model, and the weight ratio of the rule recognition model and the deep learning model in the initial dual-mode recognition model is adjusted to obtain a dual-mode recognition model with an optimal weight ratio, including: The enhanced behavior graph under each data source is input into the initial dual-mode recognition model respectively, and the rule matching task and the new attack recognition task are performed in sequence by using the rule recognition model and the deep learning model; Generate loss functions for the rule matching task and the new attack identification task respectively, and calculate the first loss function and the second loss function; According to the first loss function and the second loss function, the weights of the rule matching task and the new attack identification task are adaptively adjusted to obtain a dual-mode recognition model with optimal weight ratio.

5. The method according to claim 3, It is characterized in that Inputting each of the target behavior graphs into a pre-built dual-mode recognition model to perform attack behavior recognition, including: Inputting the current target behavior graph into the rule recognition model in the dual-mode recognition model; Performing a first round of rule matching with the current target behavior graph through the predefined rules stored in the rule base in the rule recognition model; If the current target behavior graph successfully matches the predefined rules in the rule recognition model, the target attack behavior is directly output as the recognition result; If the current target behavior graph fails to match the predefined rule in the rule recognition model, the current target behavior graph is transmitted to the deep learning model in the dual-mode recognition model; The deep learning model is used to identify abnormalities in the current target behavior graph, and the abnormality identification results obtained by the deep learning model are output.

6. The method according to claim 5, It is characterized in that Performing abnormal identification on the current target behavior graph by using the deep learning model includes: Extracting the target time series under the data source corresponding to the current target behavior graph through the deep learning model, and calculating the anomaly score based on the target time series; The deep learning model is used to compare the abnormality score with a preset standard threshold, and if the abnormality score is greater than the standard threshold, the recognition result is determined to be a new type of attack behavior; otherwise, the recognition result is determined to be a non-attack behavior; The method further comprises: If it is determined that the recognition result is a new attack behavior, the new attack feature is added to the rule base according to the target behavior data that matches the current target behavior graph.

7. The method according to any one of claims 1 to 6, It is characterized in that After inputting each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior recognition, the method further includes: If it is determined that the dual-mode recognition model outputs a target attack behavior for the current target behavior graph, then the recognition deviation is calculated according to the attack type of the target attack behavior, the target time series corresponding to the current target behavior graph, and the current system time; If the recognition deviation exceeds a preset alarm threshold, an alarm is issued for the target attack behavior.

8. An attack pattern recognition device based on behavior graph, It is characterized in that include: The behavior feature extraction module is used to collect behavior data from multiple data sources generated by artificial network operations in real time, and pre-process the behavior data from each data source to obtain behavior feature data information corresponding to each data source; A behavior graph construction module, used to input each of the behavior feature data information into a pre-trained enhanced graph neural network model to obtain a target behavior graph corresponding to each data source; The attack behavior identification module is used to input each of the target behavior graphs into a pre-built dual-mode recognition model for attack behavior identification, and based on the identification results, search for response measures matching the identification results in a preset attack response mapping library to automatically execute system defense operations.

9. An electronic device, It is characterized in that The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute an attack pattern recognition method based on a behavior graph as described in any one of claims 1 to 7.

10. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement an attack pattern recognition method based on a behavior graph according to any one of claims 1 to 7 when executed.

Images