Hidden attack behavior mining method

Abstract

The invention provides a hidden attack behavior mining method. The method comprises the following steps: carrying out data normalization processing on attack intelligence data and carrying out information extraction to obtain attack information; performing text vectorization processing on the attack information to obtain a fusion vector, and performing nonlinear conversion based on the fusion vector to obtain an intensity factor; determining related entities, and obtaining historical dependency information and non-historical dependency information of the related entities to calculate attention weights for selecting candidate entities; determining a concerned entity set from the candidate entities by using a binary classifier; and calculating a prediction probability of the attention entity set, regulating and controlling the prediction probability according to a classifier result of the binary classifier and the intensity factor to obtain a prediction entity, and obtaining an attack behavior corresponding to the prediction entity. By applying the method, the attention degree evaluation on related entities can be optimized, and the prediction precision is improved; the attack behavior change rule is deeply understood according to the attack information, the unobvious periodic characteristics are captured, and the attack means with high concealment can be found in time.

Description

Technical Field

[0001] The present invention relates to the field of network defense technology, and in particular to a method for mining covert attack behaviors. Background Art

[0002] In the field of network defense, as attack methods become increasingly covert and complex, traditional detection methods have become difficult to cope with new, zero-day attack behaviors. The detection technologies commonly used in the industry often have high false alarm rates, insufficient adaptability to new attack patterns, and limited ability to identify periodic attack behaviors when facing highly covert persistent threats. Especially for those attacks with low periodicity, or even if there are periodic characteristics, but their attack patterns and attack intensity evolve over time, existing detection technologies have problems such as low accuracy and slow response speed.

[0003] Existing network attack event detection methods are mainly divided into two categories: one is rule-based methods: signature-based detection methods, behavior-based detection methods; the other is based on traditional machine learning methods: supervised learning methods, unsupervised learning methods. However, these existing methods have the following disadvantages: they usually rely on static rules or models and cannot dynamically adapt to and identify the periodic changes of attack behaviors. Supervised learning and signature-based detection methods rely more on fixed patterns and feature matching, and cannot effectively cope with dynamic changes in time series; signature-based detection or behavior-based detection often only focuses on known attack patterns and specific IOCs. This method is easy for attackers to avoid signatures and attack through variant attacks or use unknown IOCs to evade detection.

[0004] Existing detection methods often use a single learner to model multiple types of attack methods as a single attack type model. The coarse-grained setting cannot effectively learn the characteristics of multiple types of attack behaviors, making the model unsuitable for multiple types of attack warnings. However, attack behaviors often do not occur in isolation, but are affected by the interaction between the attacker's previous behavior and the target entity. Attackers often sample mixed attack methods or deliberately imitate normal behavior to avoid model detection.

[0005] Therefore, it is necessary to provide a method for mining the hidden attack behaviors of network attackers that can improve the prediction accuracy of network attack events. Summary of the invention

[0006] The purpose of the present invention is to provide a covert attack behavior mining method for accurately mining the covert attack behavior of network attackers.

[0007] In a first aspect, the method for mining hidden attack behaviors provided by the present invention includes: acquiring attack intelligence data, normalizing the attack intelligence data to obtain a behavior event stream, extracting information from the behavior event stream to obtain attack information, wherein the attack information includes attack mode, TTPs and IOCs information; performing text vectorization processing on the attack information to obtain a corresponding spatial plane expression, performing vector projection according to the spatial plane expression to obtain a fusion vector of the attack information in the unit sphere space, and performing nonlinear transformation based on the fusion vector to obtain an intensity factor of the fusion vector; constructing an initial attack graph according to the attack intelligence data, determining related entities according to a target entity, obtaining historical dependency information of the related entities from the initial attack graph, normalizing the historical dependency information to obtain non-historical dependency information, calculating the attention weight of the related entities according to the historical dependency information and the non-historical dependency information, and selecting candidate entities from the related entities according to the attention weight; applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity to determine a set of focused entities from the candidate entities; calculating a predicted probability of the set of focused entities, regulating the predicted probability according to the classifier result and the intensity factor of the binary classifier to obtain a predicted entity, and obtaining the attack behavior corresponding to the predicted entity to obtain the hidden attack behavior of the mined target entity.

[0008] The beneficial effects of the hidden attack behavior mining method provided by the present invention are: introducing theories in the field of statistics, focusing on the relationship between historical dependency information and non-historical dependency information, optimizing the evaluation of the degree of attention to related entities through comprehensive analysis of historical dependency information and non-historical dependency information, improving the prediction accuracy, and being able to effectively reduce the false alarm rate, solving the problem that deep attack methods are difficult to capture in the field of network security. According to the attack information, the hidden attack behavior is deeply examined and mined from the perspective of representative advanced features such as attack modes and TTPs. It provides an in-depth understanding of the changing laws of attack behaviors, can capture the periodic characteristics of attack behaviors that are not obvious, and can promptly discover and respond to new and highly concealed attack methods.

[0009] In a possible embodiment, the fusion vector includes multiple types of attack behaviors; performing nonlinear transformation based on the fusion vector to obtain the intensity factor of the fusion vector includes: determining the multi-scale spectrum function F(n,m,k,i,t) of the fusion vector according to the original text information of the attack information, wherein n represents the time interval of the occurrence of multiple types of attack behaviors, m represents the frequency component of the multiple types of attack behaviors in time, k represents the impact factor of the multiple types of attack behaviors on the network topology structure, i represents the attack entity index corresponding to the multiple types of attack behaviors, and t represents the attack event type of the multiple types of attack behaviors; according to the formula The intensity factor reflecting the periodic characteristics of the fusion vector intensity is calculated according to the formula The intensity factor reflecting the temporal periodic characteristics of the fusion vector is calculated, where x(n,m,k,t) represents the result of the nonlinear transformation of the fusion vector, N represents the time length of the time series corresponding to the multiple types of attack behaviors, j represents the imaginary unit, and e -j2mit / N represents the rotation factor that transforms the vector information in the fusion vector into the frequency domain, e j2πit / N Represents the rotation factor that transforms the frequency domain information of the fused vector into the time domain.

[0010] In another possible embodiment, related entities are determined based on the target entity, historical dependency information of the related entities is obtained from the initial attack graph, the historical dependency information is normalized and transformed to obtain non-historical dependency information, attention weights of the related entities are calculated based on the historical dependency information and the non-historical dependency information, and candidate entities are selected from the related entities based on the attention weights, including: determining related entities related to the entity information of the target entity; obtaining historical dependency information of the related entities from the initial attack graph, and normalizing and transforming the historical dependency information to obtain non-historical dependency information; calculating the attention weight of each related entity based on the historical dependency information and the non-historical dependency information, and selecting related entities whose attention weights are greater than a candidate threshold as candidate entities.

[0011] In other possible embodiments, a binary classifier for distinguishing similar samples and dissimilar samples of the target entity is applied to determine a focus entity set from candidate entities, including: dividing the candidate entities into a historical entity set and a non-historical entity set according to a timestamp associated with the target entity; applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity to determine whether the correct prediction result exists in the historical entity set or the non-historical entity set; when it is determined that the correct prediction result exists in the historical entity set, the historical entity set is determined to be the focus entity set, and when it is determined that the correct prediction result exists in the non-historical entity set, the non-historical entity set is determined to be the focus entity set.

[0012] Calculating the predicted probability of the focused entity set includes: generating a historical dependency vector and a non-historical dependency vector for the focused entity set; applying an activation function to integrate the historical dependency vector and the non-historical dependency vector to obtain the predicted probability of the focused entity set, satisfying the following formula: in, represents the predicted probability, T represents the timestamp, s represents the target entity, p represents the relationship type, represents the historical dependency vector, represents the non-historical dependency vector, and softmax represents the activation function.

[0013] The classifier result outputted by applying the binary classifier to distinguish similar samples and dissimilar samples of the target entity includes a classification value;

[0014] The prediction probability is regulated according to the classifier result and the intensity factor of the binary classifier to obtain a predicted entity, including: multiplying the classification value by the prediction probability to obtain an intermediate result; normalizing the intensity factor, and multiplying the normalized intensity factor by the intermediate result to obtain a regulated product; adding the regulated product to the set bias term to complete the regulation of the prediction probability to obtain the regulated probability; comparing the regulated probabilities corresponding to the entities in the attention entity set, and selecting the entity with the largest regulated probability as the predicted entity.

[0015] After obtaining the hidden attack behavior of the target entity to be mined, it also includes: comparing the hidden attack behavior of the target entity with the initial attack graph to determine whether there is new data different from the behavior event flow in the hidden attack behavior of the target entity; when it is determined that there is new data in the hidden attack behavior of the target entity, the new data is stored in a preset incremental database.

[0016] In a second aspect, the present invention further provides a hidden attack behavior mining device, comprising:

[0017] The information extraction unit is used to obtain attack intelligence data, perform data normalization on the attack intelligence data to obtain a behavior event stream, and perform information extraction on the behavior event stream to obtain attack information, which includes attack mode, TTPs and IOCs information; the conversion unit is used to perform text vectorization processing on the attack information to obtain the corresponding spatial plane expression, perform vector projection based on the spatial plane expression to obtain a fusion vector of the attack information in the unit sphere space, and perform nonlinear transformation based on the fusion vector to obtain the strength factor of the fusion vector; the candidate entity selection unit is used to construct an initial attack graph based on the attack intelligence data, determine related entities based on the target entity, and obtain the candidate entity from the initial attack graph. The historical dependency information of the related entities is obtained, the historical dependency information is normalized and transformed to obtain non-historical dependency information, the attention weight of the related entities is calculated according to the historical dependency information and the non-historical dependency information, and candidate entities are selected from the related entities according to the attention weight; an attention entity set determination unit is used to determine the attention entity set from the candidate entities by applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity; a prediction unit is used to calculate the prediction probability of the attention entity set, adjust the prediction probability according to the classifier result and the strength factor of the binary classifier to obtain the predicted entity, and obtain the attack behavior corresponding to the predicted entity to obtain the hidden attack behavior of the mined target entity.

[0018] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the above-mentioned covert attack behavior mining method is implemented.

[0019] In a fourth aspect, the present invention also provides an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned covert attack behavior mining method.

[0020] For the beneficial effects of the second to fourth aspects, reference may be made to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of a process for mining covert attack behaviors provided by an embodiment of the present invention;

[0022] Figure 2 An example diagram of a model framework constructed for the application covert attack behavior mining method provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of attack information text vectorization provided by an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of a hidden attack behavior mining device provided by an embodiment of the present invention;

[0025] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0027] This embodiment provides a method for mining covert attack behaviors. Figures 1 to 3 , the method comprising:

[0028] S101: Acquire attack intelligence data, normalize the attack intelligence data to obtain a behavior event stream, extract information from the behavior event stream to obtain attack information, and the attack information includes attack mode, TTPs and IOCs information.

[0029] In a possible embodiment, acquiring attack intelligence data includes: collecting threat intelligence, traffic information, system log files, and alarm information generated by security devices, etc. Since the collected attack intelligence data is in the form of raw text, there is noise and irrelevant data, so the collected attack behavior data is normalized. Exemplarily, the data normalization can be performed by using stop word removal, semantic repetition elimination, wrong word recognition and other methods to obtain the behavior event stream.

[0030] In a possible embodiment, the operation of extracting information from the behavior event stream to obtain attack information is performed through a large language model. Specifically, by formulating an extraction prompt word template to guide GPT to extract information from the behavior event stream, the information to be extracted is attack information including attack mode, TTPs (tactics, techniques and procedures) and IOCs (indicator-type threat information). Specifically, the extraction prompt word template construction method includes the following elements: 1. Task description 2. Task context information 3. Specific instructions, including imperative language or question form 4. Output format description.

[0031] S102: Perform text vectorization processing on the attack information to obtain the corresponding space plane expression, perform vector projection based on the space plane expression to obtain the fusion vector of the attack information in the unit sphere space, and perform nonlinear transformation based on the fusion vector to obtain the intensity factor of the fusion vector.

[0032] Text vectorization (also called text embedding) is a method of converting text data from its original symbolic form into points or vectors in a numerical feature space. Each vector represents a text unit, and each dimension of the vector corresponds to a certain feature, including statistical word frequency, semantic relevance, etc. This method can effectively solve the problem that text data is difficult to efficiently input into machine learning algorithms. Figure 3 As shown in Figure 1, the goal of text vectorization is to represent a class of indicators with a single vector. This vector can be used to implement relationship mining at the text level. After the text is converted into vectors, these vectors can be explored and operated in multidimensional space.

[0033] In a possible embodiment, the attack information is vectorized to obtain the corresponding space plane expression, and the vector is projected into the unit sphere space according to the space plane expression using dimensionality reduction technology to find the corresponding space plane. In this embodiment, the planes of three types of indicators (attack mode, TTPs and IOCs) are obtained, and the intersection of multiple planes is the fusion vector, that is, the fusion vector of the attack information in the unit sphere space is obtained. The fusion vector comprehensively reflects the degree of effect of each of the three types of indicators.

[0034] In a possible embodiment, the method for concealing attack behavior utilizes the time sequence characteristics of the event stream and aggregates the time coding information in the fusion vector. The time coding information is obtained from the event stream sequence data, specifically mainly referring to the timestamp of the event stream occurrence time, the timestamp of the end time, and the timestamp of the critical time of the event periodic occurrence.

[0035] In a possible embodiment, the fusion vector that aggregates the time coding information is transformed nonlinearly, and with the significant advantage of spectral analysis theory in capturing inconspicuous periodic features in time series data streams, a strength factor variation law diagram that can keenly detect changes in three types of indicators (attack mode, TTPs, IOCs) and hidden periodic characteristics is constructed. The intensity factor variation law diagram takes time as the independent variable, intensity factor as the dependent variable, and records the evolution function of multiple attack entities. From the intensity factor variation law diagram, the intensity factor that reflects the periodic characteristics of the fusion vector intensity and the intensity factor that reflects the periodic characteristics of the fusion vector time can be analyzed.

[0036] In a specific embodiment, the fusion vector includes multiple types of attack behaviors. Nonlinear transformation is performed based on the fusion vector to obtain the intensity factor of the fusion vector, including: determining the multi-scale spectrum function F(n,m,k,i,t) of the fusion vector according to the original text information of the attack information, and each part of the information of the multi-scale spectrum function specifically comes from the original text information of the attack mode, TTPs and IOCs. Among them, n represents the time interval between the occurrence of multiple types of attack behaviors, which is derived from the serialized data of the network event stream; m represents the frequency component of multiple types of attack behaviors in time, which is related to the frequency characteristics of the attack behavior, and is derived from the Fourier transform of the time series data to capture the periodicity of the attack behavior; k represents the impact factor of multiple types of attack behaviors on the network topology structure, which is determined by the number of attack activities launched within a fixed time range and the number of affected nodes; i represents the attack entity index corresponding to the multiple types of attack behaviors, and t represents the attack event type of the multiple types of attack behaviors, which is automatically labeled with reference to the attack pattern library ATT&CK.

[0037] According to the formula The intensity factor reflecting the periodic characteristics of the fusion vector intensity is calculated according to the formula The intensity factor reflecting the temporal periodic characteristics of the fusion vector is calculated, where x(n,m,k,t) represents the result of nonlinear transformation of the fusion vector for a certain attack event type, N represents the time length of the time series corresponding to multiple types of attack behaviors, j represents the imaginary unit, and e -j2πit / N represents the rotation factor that transforms the vector information in the fusion vector into the frequency domain, e j2πit / N represents the rotation factor that transforms the frequency domain information of the fusion vector into the time domain. Specifically, e -j2πit / N With e j2πit / Nis the rotation factor (also called phase factor), which represents a vector on the complex plane with a rotation angle of j2πit / N, which corresponds to the basis function in discrete Fourier transform and is used to transform the vector information in the fusion vector into different domains.

[0038] It should be noted that the intensity factor of the fusion vector obtained by nonlinear transformation based on the fusion vector will be used for subsequent concealed attack behavior mining, and there is no unique way to obtain the intensity factor. For example, the intensity factor can be obtained by direct calculation for subsequent concealed attack behavior mining; or by constructing an intensity factor change law diagram that can be used to assist in understanding and displaying the trend of intensity factor changes over time, and analyzing the intensity factor change law diagram to obtain the intensity factor for subsequent concealed attack behavior mining.

[0039] S103: Construct an initial attack graph according to the attack intelligence data, determine related entities according to the target entity, obtain historical dependency information of the related entities from the initial attack graph, normalize the historical dependency information to obtain non-historical dependency information, calculate attention weights of the related entities according to the historical dependency information and the non-historical dependency information, and select candidate entities from the related entities according to the attention weights.

[0040] In a possible embodiment, constructing the initial attack graph according to the attack intelligence data includes: constructing the initial attack graph according to a behavior event stream obtained by normalizing the acquired attack intelligence data.

[0041] In one possible embodiment, the initial attack graph divides the attack situations in different situations by timestamps, so the object during processing is a graph set, and there may be too much noise between different nodes, which requires noise cleaning. After completing the statistical historical dependency, in order to avoid the graph being too large, the initial attack graph is automatically screened for nodes so that each node is connected to 3-hop neighbors as much as possible.

[0042] In a possible embodiment, related entities are determined based on the target entity, historical dependency information of the related entities is obtained from the initial attack graph, the historical dependency information is normalized and transformed to obtain non-historical dependency information, attention weights of the related entities are calculated based on the historical dependency information and the non-historical dependency information, and candidate entities are selected from the related entities based on the attention weights, including: determining related entities related to the entity information of the target entity; obtaining historical dependency information of the related entities from the initial attack graph, normalizing and transforming the historical dependency information to obtain non-historical dependency information; calculating the attention weight of each related entity based on the historical dependency information and the non-historical dependency information, and selecting related entities whose attention weights are greater than a candidate threshold as candidate entities.

[0043] In a specific embodiment, entities that are directly or indirectly related to the target entity whose hidden attack behavior is to be mined are all related entities, and the historical dependency information of the related entities is obtained based on the initial attack graph. Exemplarily, the historical dependency information includes the historical frequency of occurrence of the related entity, the 3-hops neighborhood subgraph information of the related entity, the entity information closest in time and space, etc. The historical dependency information is normalized and transformed to obtain the corresponding non-historical dependency information. For each related entity, the attention weight of the related entity is calculated according to the corresponding historical dependency information and non-historical dependency information. Specifically, the attention weight of each related entity is obtained by calculating the comprehensive score of its historical dependency information and non-historical dependency information, and the comprehensive score is processed by a normalization function (oftmax function). The attention weight of each related entity represents the degree of attention that should be given to each entity when predicting hidden attack behaviors. Since there are a large number of related entities that are directly or indirectly related to the target entity, it is difficult to consider all of these related entities. Therefore, in this embodiment, the candidate entity is screened by the attention weight of the related entity, specifically by setting a candidate threshold. When the attention weight of the related entity is greater than the candidate threshold, the related entity is retained as a candidate entity.

[0044] S104: Determine a set of focused entities from candidate entities by applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity.

[0045] In one possible embodiment, a supervised learning method is used to construct positive examples similar to the target entity and negative examples dissimilar to the target entity. The positive examples and negative examples are input into a binary classifier for training using a contrastive learning method to compare the differences between the positive examples and the negative examples to learn the differences between different types of entities. After training, a binary classifier is obtained that can distinguish between relevant entities and irrelevant entities of the target entity. Using the above method to train a binary classifier can overcome the problem of a small amount of training data.

[0046] In a specific embodiment, a binary classifier for distinguishing similar samples and dissimilar samples of a target entity is applied to determine a focus entity set from candidate entities, including: dividing the candidate entities into a historical entity set and a non-historical entity set according to a timestamp associated with the target entity; applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity to determine whether a correct prediction result exists in the historical entity set or the non-historical entity set; determining the historical entity set as the focus entity set when it is determined that the correct prediction result exists in the historical entity set, and determining the non-historical entity set as the focus entity set when it is determined that the correct prediction result exists in the non-historical entity set.

[0047] In a possible embodiment, dividing the candidate entities into historical entity sets and non-historical entity sets according to the timestamp associated with the target entity includes: dividing the candidate entities according to the timestamp T associated with the target entity, wherein the object entities in all events before the timestamp T are divided into the historical entity set, and the rest are divided into the non-historical entity set. Exemplarily, when dividing, a query (s, p, ?, T) is given, wherein s represents the target entity, p represents the relationship type, ? represents the candidate entity, and T represents the timestamp, and the historical entity set and the non-historical entity set are divided according to the query.

[0048] The historical entity set and the non-historical entity set are input into the trained binary classifier that can be used to distinguish the similar samples and dissimilar samples of the target entity, and the judgment result of whether the predicted entity related to the target entity exists in the historical entity set or the non-historical entity set can be obtained. According to the judgment result, the entity set where the correct prediction result exists is determined as the focus entity set. The determination of the focus entity set is used to regulate the scope of candidate entities and help eliminate entities that do not need to be paid attention to.

[0049] S105: Calculate the prediction probability of each focus entity in the focus entity set, adjust the prediction probability according to the classifier result and the strength factor of the binary classifier to obtain the predicted entity, obtain the attack behavior corresponding to the predicted entity to obtain the hidden attack behavior of the mined target entity.

[0050] In a possible embodiment, calculating the predicted probability of the focused entity set includes: generating a historical dependency vector and a non-historical dependency vector for the focused entity set; and applying an activation function to integrate the historical dependency vector and the non-historical dependency vector to obtain the predicted probability of the focused entity, which satisfies the following formula: in, represents the predicted probability, T represents the timestamp, s represents the target entity, p represents the relationship type, Indicates historical dependence, represents non-historical dependency, and softmax represents the activation function.

[0051] In a specific embodiment, two context vectors (historical dependency and non-historical dependencies ) to reflect the historical relevance and non-historical relevance of the target entity and the focused entity respectively. Specifically, the historical dependency context vector is generated by the following formula: Among them, W his and b hisrepresents the training parameters, ⊕ represents the connection operation, E represents the embedding matrix of all entities in the focused entity set, r1 represents the parameter used to improve the historical entity score, s represents the target entity, p represents the relationship type between the target entity and the entity in the focused entity set, and T represents the timestamp associated with the target entity. The non-historical dependent context vector is generated by the following formula: Among them, W nhis and b nhis represents the training parameter, and r2 represents the parameter used to reduce the score of non-historical entities. The predicted probability calculation formula of the focused entity set obtained after integration of the activation function is as follows: in, represents the predicted probability, and softmax represents the activation function.

[0052] For example, assume that the target entity s calculates the historical dependency of all relations pi in the 3-hop neighborhood in turn and non-historical dependencies After applying the activation function softmax, two probability distributions will be obtained, and then the average of the two probability distributions will be taken as the probability. For example: if The result is [0.2, 0.1, 0.7], The result is [0.4, 0.4, 0.2], then will be [0.3, 0.25, 0.45].

[0053] In a possible embodiment, a binary classifier is applied to distinguish similar samples and dissimilar samples of a target entity, and the output classifier result includes a classification value; the prediction probability is adjusted according to the classifier result of the binary classifier and the intensity factor to obtain a predicted entity, including: multiplying the classification value by the prediction probability to obtain an intermediate result; normalizing the intensity factor, and multiplying the normalized intensity factor by the intermediate result to obtain a control product; adding the control product to a set bias term to complete the control of the prediction probability to obtain a control probability; comparing the control probabilities corresponding to entities in the entity set, and selecting the entity with the largest control probability as the predicted entity.

[0054] Among them, the training goal of the binary classifier is to predict whether the missing entity under the given target entity and relationship exists in the historical entity set. After applying the trained binary classifier for judgment, a value will be returned, that is, the result obtained by applying the binary classifier to distinguish similar samples and dissimilar samples of the target entity includes the returned classification value.

[0055] Normalization of the intensity factor is to enable variables of different scales (attack mode, tactics, techniques and procedures, and attack intensity, etc.) to be compared and processed on the same scale. Through normalization, the intensity information of different attack behaviors can be unified into a standard range, so that spectrum analysis and other mathematical operations can be performed more accurately, thereby effectively identifying hidden attack behaviors. In this field, the methods used for normalization include but are not limited to Min-Max Normalization, Z-score normalization, and decimal calibration normalization.

[0056] The set bias term is a parameter that can be obtained by applying the hidden attack behavior mining method of the present invention. It is to minimize the gap between the predicted result (predicted entity) and the actual label (target entity), and can be learned through an optimization algorithm (such as gradient descent, etc.). The set bias term can be obtained by designing training data, applying the hidden attack behavior mining method of the present invention to build a corresponding model, and training based on the training data using the model. It will be continuously adjusted during training until the optimal or relatively good value is found.

[0057] In a possible embodiment, after obtaining the hidden attack behavior of the target entity to be mined, it also includes: comparing the hidden attack behavior of the target entity with the initial attack graph to determine whether there is new data different from the behavior event stream in the hidden attack behavior of the target entity; when it is determined that there is new data in the hidden attack behavior of the target entity, the new data is stored in a preset incremental database.

[0058] In a specific embodiment, determining whether there is new data different from the behavior event stream in the hidden attack behavior of the target entity includes: comparing the hidden attack behavior of the mined target entity with the data of the existing attack graph (i.e., the initial attack graph applied when mining the hidden attack behavior), and confirming whether there are identical data entries based on identifiers (such as timestamps, attack modes, TTPs, IOCs, etc.) during the comparison. If the hidden attack behavior of the mined target entity does not exist in the existing attack graph, it is considered to be new data. The new data is stored in an incremental database, and the new data at different times is divided by timestamps.

[0059] The preset incremental database is a database for storing new data obtained after performing covert attack behavior mining, that is, when a covert attack behavior mining is completed, it is determined whether the information obtained by mining includes new data, and when new data exists, the new data is stored in the incremental database. When the method of the present invention is applied for the first time to perform covert attack behavior mining, there is no data stored in the incremental database, and the initial attack graph constructed for the first time is an attack graph constructed by the behavioral event stream obtained after data normalization based on the attack intelligence data. When it is not the first time to construct the initial attack graph, that is, when there is an existing attack graph, constructing the initial attack graph based on the attack intelligence data includes: obtaining the existing attack graph, supplementing the graph data of the existing attack graph based on the data stored in the incremental database, so as to realize the construction of a new attack graph as the initial attack graph for performing covert attack behavior mining. The newly obtained attack graph is an attack subgraph at a certain moment, and performing covert attack behavior mining based on the new attack graph can achieve a comprehensive consideration of the data and avoid repeated statistics of huge old data sets.

[0060] In a possible embodiment, after supplementing the graph data of the existing attack graph with the data stored in the incremental database, the hidden attack behavior mining can obtain new hidden attack behavior mining results, and the new hidden attack behavior mining results will be combined with the original mining results. Specifically, by comparing the new hidden attack behavior mining results with the original mining results, it can be determined which new hidden attack behaviors obtained by mining are previously unrecognized, and these new behaviors are added to the existing hidden attack behavior list. If the new attack behavior conflicts with the original attack behavior, the old behavior is replaced with the new attack behavior for updating.

[0061] The covert attack behavior mining method provided by the present invention introduces theories in the field of statistics, focuses on the relationship between historical dependency information and non-historical dependency information, optimizes the evaluation of the degree of attention to related entities through comprehensive analysis of historical dependency information and non-historical dependency information, improves prediction accuracy, can effectively reduce the false alarm rate, and solves the problem that deep attack methods are difficult to capture in the field of network security.

[0062] Through semantic analysis technology, multiple semantic information is integrated for multiple types of attack behaviors, and multiple types of learning functions are set from the perspective of spectral analysis to improve the model's learning and perception capabilities for complex attack behaviors. Identifying attack events with high similarity in multiple semantic spaces can achieve the search for potential attack events with high credibility of the target attack entity, solving the problem of difficult mining and poor accuracy in the existing network security field.

[0063] In the face of massive multi-dimensional and sparse data, the attack chain in the graph is completed through a hidden attack behavior mining method based on multi-scale spectrum analysis, and the hidden attack behavior is deeply examined and mined from the perspective of representative advanced features such as attack mode and TTPs according to the attack information. It provides an in-depth understanding of the changing rules of attack behavior, can capture the periodic characteristics of attack behavior that are not obvious, and can timely discover and respond to new and highly concealed attack methods.

[0064] The covert attack behavior mining method of the present invention combines the traditional spectrum analysis process with deep learning, improves accuracy, has high efficiency, and has strong subsequent scalability. After implementation, it also reduces the daily operation and maintenance threshold for operation and maintenance personnel.

[0065] See the instruction manual Figure 4 This embodiment also provides a hidden attack behavior mining device, which is used to implement the above method embodiment. The device includes:

[0066] The information extraction unit 201 is used to obtain attack intelligence data, perform data normalization on the attack intelligence data to obtain a behavior event stream, and perform information extraction on the behavior event stream to obtain attack information, where the attack information includes attack mode, TTPs and IOCs information.

[0067] The conversion unit 202 is used to perform text vectorization processing on the attack information to obtain a corresponding space plane expression, perform vector projection according to the space plane expression to obtain a fusion vector of the attack information in the unit sphere space, and perform nonlinear transformation based on the fusion vector to obtain an intensity factor of the fusion vector.

[0068] The candidate entity selection unit 203 is used to construct an initial attack graph based on the attack intelligence data, determine related entities based on the target entity, obtain historical dependency information of the related entities from the initial attack graph, normalize the historical dependency information to obtain non-historical dependency information, calculate the attention weights of the related entities based on the historical dependency information and the non-historical dependency information, and select candidate entities from the related entities based on the attention weights.

[0069] The focused entity set determining unit 204 is configured to determine a focused entity set from candidate entities by using a binary classifier for distinguishing similar samples from dissimilar samples of a target entity.

[0070] The prediction unit 205 is used to calculate the prediction probability of the focused entity set, adjust the prediction probability according to the classifier result and the strength factor of the binary classifier to obtain the predicted entity, and obtain the attack behavior corresponding to the predicted entity to obtain the hidden attack behavior of the mined target entity.

[0071] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0072] In other embodiments of the present application, the present application discloses an electronic device, such as Figure 5 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the following: Figure 1 , Figure 4 And each step in the corresponding embodiment.

[0073] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0074] Each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0075] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk.

[0076] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims

1. A method for mining covert attack behaviors, characterized in that: include: Acquire attack intelligence data, perform data normalization on the attack intelligence data to obtain a behavior event stream, and perform information extraction on the behavior event stream to obtain attack information, wherein the attack information includes attack mode, TTPs, and IOCs information; Performing text vectorization processing on the attack information to obtain a corresponding space plane expression, performing vector projection according to the space plane expression to obtain a fusion vector of the attack information in the unit sphere space, and performing nonlinear transformation based on the fusion vector to obtain an intensity factor of the fusion vector; Constructing an initial attack graph according to the attack intelligence data, determining related entities according to the target entity, obtaining historical dependency information of the related entities from the initial attack graph, normalizing the historical dependency information to obtain non-historical dependency information, calculating attention weights of the related entities according to the historical dependency information and the non-historical dependency information, and selecting candidate entities from the related entities according to the attention weights; Determine a set of entities of interest from the candidate entities by applying a binary classifier for distinguishing similar samples from dissimilar samples of the target entity; The predicted probability of the entity set of interest is calculated, the predicted probability is adjusted according to the classifier result of the binary classifier and the strength factor to obtain the predicted entity, and the attack behavior corresponding to the predicted entity is obtained to obtain the hidden attack behavior of the mined target entity.

2. The method according to claim 1, characterized in that The fusion vector includes multiple types of attack behaviors; Performing a nonlinear transformation based on the fusion vector to obtain a strength factor of the fusion vector includes: Determine the multi-scale spectrum function F(n,m,k,i,t) of the fusion vector according to the original text information of the attack information, wherein n represents the time interval of occurrence of multiple types of attack behaviors, m represents the frequency component of multiple types of attack behaviors in time, k represents the impact factor of multiple types of attack behaviors on the network topology structure, i represents the attack entity index corresponding to the multiple types of attack behaviors, and t represents the attack event type of the multiple types of attack behaviors; According to the formula The intensity factor reflecting the periodic characteristics of the fusion vector intensity is calculated according to the formula The intensity factor reflecting the temporal periodic characteristics of the fusion vector is calculated, where x(n,m,k,t) represents the result of the nonlinear transformation of the fusion vector, N represents the time length of the time series corresponding to the multiple types of attack behaviors, j represents the imaginary unit, and e -j2πit / N represents the rotation factor that transforms the vector information in the fusion vector into the frequency domain, e j2πit / N Represents the rotation factor that transforms the frequency domain information of the fusion vector into the time domain.

3. The method according to claim 1, characterized in that: Determining related entities according to the target entity, obtaining historical dependency information of the related entities from the initial attack graph, normalizing the historical dependency information to obtain non-historical dependency information, calculating attention weights of the related entities according to the historical dependency information and the non-historical dependency information, and selecting candidate entities from the related entities according to the attention weights, including: Determining related entities related to the entity information of the target entity; Acquire historical dependency information of the relevant entities from the initial attack graph, and normalize and transform the historical dependency information to obtain non-historical dependency information; The attention weight of each of the related entities is calculated according to the historical dependency information and the non-historical dependency information, and the related entities whose attention weight is greater than the candidate threshold are selected as candidate entities.

4. The method according to claim 1, characterized in that: Applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity to determine a set of entities of interest from the candidate entities comprises: dividing the candidate entities into a historical entity set and a non-historical entity set according to a timestamp associated with the target entity; Applying a binary classifier for distinguishing similar samples from dissimilar samples of the target entity to determine whether a correct prediction result exists in the historical entity set or the non-historical entity set; When it is determined that the correct prediction result exists in the historical entity set, the historical entity set is determined to be the entity set of interest; when it is determined that the correct prediction result exists in the non-historical entity set, the non-historical entity set is determined to be the entity set of interest.

5. The method according to claim 1, characterized in that Calculate the predicted probability of the entity set of interest, including: Generate historical dependency vectors and non-historical dependency vectors for the set of entities of interest; The activation function is applied to integrate the historical dependency vector and the non-historical dependency vector to obtain the predicted probability of the focused entity set, which satisfies the following formula: in, represents the predicted probability, T represents the timestamp, s represents the target entity, p represents the relationship type, represents the historical dependency vector, represents the non-historical dependency vector, and softmax represents the activation function.

6. The method according to claim 1, characterized in that The classifier result outputted by applying the binary classifier to distinguish similar samples and dissimilar samples of the target entity includes a classification value; Adjusting the prediction probability according to the classifier result of the binary classifier and the strength factor to obtain a predicted entity comprises: Multiplying the classification value by the predicted probability to obtain an intermediate result; Normalizing the intensity factor, and multiplying the normalized intensity factor by the intermediate result to obtain a control product; Adding the control product to the set bias term to complete the control of the prediction probability to obtain the control probability; The control probabilities corresponding to the entities in the focus entity set are compared, and the entity with the largest control probability is selected as the predicted entity.

7. The method according to claim 1, characterized in that After obtaining the hidden attack behavior of the target entity, it also includes: Comparing the hidden attack behavior of the target entity with the initial attack graph, and determining whether there is new data different from the behavior event stream in the hidden attack behavior of the target entity; When it is determined that there is new data in the covert attack behavior of the target entity, the new data is stored in a preset incremental database.

8. A device for mining hidden attack behaviors, characterized in that: The device comprises: An information extraction unit, used to obtain attack intelligence data, perform data normalization on the attack intelligence data to obtain a behavior event stream, and perform information extraction on the behavior event stream to obtain attack information, wherein the attack information includes attack mode, TTPs and IOCs information; a conversion unit, configured to perform text vectorization processing on the attack information to obtain a corresponding space plane expression, perform vector projection according to the space plane expression to obtain a fusion vector of the attack information in the unit sphere space, and perform nonlinear conversion based on the fusion vector to obtain an intensity factor of the fusion vector; A candidate entity selection unit, configured to construct an initial attack graph according to the attack intelligence data, determine related entities according to the target entity, obtain historical dependency information of the related entities from the initial attack graph, normalize the historical dependency information to obtain non-historical dependency information, calculate the attention weight of the related entity according to the historical dependency information and the non-historical dependency information, and select a candidate entity from the related entities according to the attention weight; A focus entity set determination unit, configured to determine a focus entity set from the candidate entities by applying a binary classifier for distinguishing similar samples and dissimilar samples of the target entity; A prediction unit is used to calculate the prediction probability of the entity set of interest, adjust the prediction probability according to the classifier result of the binary classifier and the strength factor to obtain the predicted entity, and obtain the attack behavior corresponding to the predicted entity to obtain the hidden attack behavior of the mined target entity.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the covert attack behavior mining method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device executes the covert attack behavior mining method according to any one of claims 1 to 7.

Images