Network security monitoring system for responding to APT (Advanced Persistent Threat) attack

Abstract

The invention belongs to the field of network attack detection, and particularly relates to a network security monitoring system for coping with APT (Advanced Persistent Threat) attacks. Comprising an industrial control network gateway security device, an industrial control network management system and an industrial control network security operation center, and the industrial control network gateway security device comprises a behavior data collection module which is used for collecting network traffic and system activity data of various devices including an intrusion detection system and a traffic probe; providing for an industrial control network management system; the industrial control network management system comprises a data preprocessing module, a subgraph generation module, a behavior feature extraction module and a model training and anomaly detection module. Preprocessing the original data, generating a traceability graph and a sub-graph, extracting behavior characteristics, and establishing a classification model for anomaly detection; and the industrial control network security operation center comprises a risk prompt reporting module which reports the detected risk to security operation personnel in a visual mode and generates a detailed analysis report.

Description

Technical Field

[0001] The invention belongs to the field of network attack detection, and in particular relates to a network security monitoring system for coping with APT attacks. Background Art

[0002] In today's digital age, the popularity of the Internet and the advancement of technology have brought unprecedented convenience to people, but at the same time, the forms and scale of cyber attacks have continued to evolve, becoming a serious problem that threatens the security of individuals, enterprises and even the country. Among them, APT (Advanced Persistent Threat) attacks have become one of the biggest threats to the security of modern computing environments. Its main characteristics are the "low and slow" attack mode and the frequent use of zero-day vulnerabilities.

[0003] APT attacks often originate from state-level or highly organized hacker groups, and their targets are usually important national infrastructure and organizations, such as energy, electricity, finance, defense, and other network infrastructures that govern the national economy and people's livelihood or national core interests, or large enterprises in related fields, posing a direct threat to national security and economic interests. These attacks use advanced technical means, through long-term infiltration and covert operations, to try to obtain key information and remain in the target system for a long time. Attackers usually sneak into the target system by exploiting zero-day vulnerabilities, social engineering, and other means, and then stay there for a long time to steal sensitive information without being detected.

[0004] APT attack mode is more secretive and targeted than traditional network attacks.

[0005] Traditional APT attack detection methods mainly rely on static feature matching, such as specific signatures, patterns or rules. This method is difficult to cope with the high variability and unknown nature of APT attacks, and the cost of maintaining and updating the feature library is high. In addition, the traditional method uses audit logs as the data source. The basic unit of data is the entries in the log. There is only a temporal relationship between them, which cannot directly and effectively represent the interaction relationship between entities in the system and lacks structural information. Therefore, the detection effect of APT attacks is not good. As an intuitive and efficient form of information expression, the traceability graph has strong semantic expression ability and attack history association ability, and has its unique advantages in the field of APT detection. The traceability graph shows the system execution process by representing the interaction relationship between system entities, which is convenient for causal association analysis during the detection process. The traceability graph saves all the execution history of the system, which can cope with the long duration of APT attacks.

[0006] Disadvantages of existing technology:

[0007] The main problem facing current technologies is that the APT attack detection system based on the provenance graph mainly focuses on the interaction between system entities and uses it for causal reasoning. Specifically, the interaction between entities in the provenance graph is simply represented as an edge. For example, process A accesses file B in the provenance graph as an edge from A to B. However, in this process, key behavioral information, such as the time of occurrence and the specific method of proceeding, is ignored or discarded. This simplified representation leads to the loss of behavioral information, reduces the accuracy of detection and increases the false alarm rate. Summary of the invention

[0008] In order to solve the technical problems existing in the prior art, the present invention provides a network security monitoring system for coping with APT attacks.

[0009] Technical solution of the present invention:

[0010] A network security monitoring system for responding to APT attacks is applied to actual industrial production environments, including industrial control network gateway security equipment, industrial control network management systems, and industrial control network security operation centers, where:

[0011] The industrial control network gateway security device includes a behavior data collection module for collecting network traffic and system activity data of various devices including intrusion detection systems (IDS) and traffic probes, forming an original system log database, and providing it to the industrial control network management system;

[0012] The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavior feature extraction module, a model training and anomaly detection module; completes the preprocessing of raw data, generates traceability graphs and subgraphs, extracts behavior features, establishes a classification model and uses it for anomaly detection.

[0013] The industrial control network security operation center includes a risk warning reporting module, which reports the detected risks to the security operation personnel in a visual manner and generates a detailed analysis report.

[0014] Beneficial Effects

[0015] The edge feature extraction module in the present invention is used to map the relationship between behavior attributes into the graph structure information of the behavior structure graph (BSG) to capture the hidden threat patterns and correlations in the behavior; by analyzing the behavior structure graph of each edge in the subgraph, the corresponding feature vector is constructed; the behavior structure graph is composed of the various behavior attributes of a single behavior and the connection between them, wherein each behavior attribute is mapped to a node in the behavior structure graph, and the connection between the behavior attributes is mapped to the edge between the corresponding nodes in the behavior structure graph. The behavior attributes and their structural information are introduced in the modeling of the provenance graph, which goes beyond the traditional scope of focusing on the interaction relationship between entities. In addition to capturing the basic interaction relationship between entities, the present invention also considers the behavior attributes, that is, the key features such as the time and mode of the behavior. Furthermore, the present invention takes the relationship between the behavior attributes into consideration and constructs the behavior structure information. By examining the association between different behavior attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects more detailed contextual background into each behavior entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0016] The edge feature vector module in the present invention extracts the final edge feature vector from the behavior structure graph; a pooling method based on multiple node discarding is used for the behavior structure graph, and the pooling method is divided into multiple pooling steps, by gradually discarding non-important nodes and aggregating the information of the remaining important nodes based on the graph structure, to obtain the feature vector of the entire behavior structure graph. By introducing the pooling method and graph representation learning, the expressive power of the model is improved, so that it can more effectively capture important information in the behavior structure and continuously optimize based on the initial structure information. The present invention uses the ER random graph model to initialize the behavior structure information. Ensuring that the initial behavior structure graph (BSG) is a connected graph ensures that each behavior attribute has a potential association path, avoiding the premature exclusion of certain attribute associations from the analysis in the initial stage.

[0017] The network security monitoring system of the present invention introduces more detailed and comprehensive behavior attributes and their structural information. These behavior attributes form a multi-level and multi-dimensional information structure in the model, making the information level of the traceability graph rich and diverse. The model can more carefully distinguish the characteristics of normal behavior and APT attack behavior during the learning process, thereby improving the overall judgment accuracy.

[0018] The edge feature extraction module of the network security monitoring system of the present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack positioning shortens the time for the industrial control network management system to detect and respond, can locate the specific location and time when the attack behavior occurs, and improves the real-time perception capability of the network security monitoring system to threats.

[0019] When the industrial control network management system of the network security monitoring system of the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationship between them, and then explains the key behavior information for determining the APT attack behavior, so that the determination criteria are easier to be understood by the industrial control network security operation center. The APT attack behavior attributes and the relationship between them can also be displayed to the industrial control network security operation center in a graphical form, and the risk warning reporting module of the industrial control network security operation center enables security analysts to understand abnormal behaviors more intuitively in a visual way. By clearly presenting these key attributes, the network security monitoring system of the present invention provides security analysts with a more detailed description of APT attack activities, making the results more explainable. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The schematic diagram of the system module division of the present invention is shown;

[0021] Figure 2 Shows Figure 1 The middle line is a schematic diagram of the division of feature extraction modules;

[0022] Figure 3 Shows Figure 1 The middle line is a schematic diagram of the working mechanism of the feature extraction module;

[0023] Figure 4 A schematic diagram of the processing flow of the industrial control network management system of the present invention is shown. DETAILED DESCRIPTION

[0024] The technical solution provided by the present application will be further described below in conjunction with specific embodiments and accompanying drawings. The advantages and features of the present application will become more apparent with the following description.

[0025] A network security monitoring system for responding to APT attacks is applied to actual industrial production environments, including industrial control network gateway security equipment, industrial control network management systems, and industrial control network security operation centers, where:

[0026] The industrial control network gateway security device includes a behavior data collection module for collecting network traffic and system activity data of various devices including intrusion detection systems (IDS) and traffic probes, forming an original system log database, and providing it to the industrial control network management system;

[0027] The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavior feature extraction module, a model training and anomaly detection module; completes the preprocessing of raw data, generates traceability graphs and subgraphs, extracts behavior features, establishes a classification model and uses it for anomaly detection.

[0028] The industrial control network security operation center includes a risk warning reporting module, which reports the detected risks to the security operation personnel in a visual manner and generates a detailed analysis report.

[0029] Furthermore, the modules of the industrial control network management system are divided as follows:

[0030] 1. Data preprocessing module

[0031] It includes data cleaning module and traceability graph generation module, as follows:

[0032] 1.1 Data cleaning module

[0033] Considering that the original system log data provided by the behavior data collection module may come from multiple different data sources, the log formats of different systems may be different, thus there is heterogeneity. In order to facilitate subsequent analysis and processing, the data cleaning module: first, identifies the entities and events in the log and records them according to a unified identifier; second, standardizes all information fields, such as a unified timestamp format, IP address representation, etc., to ensure that all data are comparable.

[0034] 1.2. Provenance graph generation module

[0035] By structuring the input data into a graph, the correlation of system behavior is presented.

[0036] First, the data output by the data cleaning module is mapped according to entities and events, with each entity regarded as a node in the graph and events as edges connecting nodes. After all entities are mapped to nodes, edges are added in sequence according to the causal relationship between events (for example, if entity A initiates an interaction with entity B, a directed edge from A to B is added), thereby constructing a traceability graph that can reflect the interactions between entities in the system and their evolution paths.

[0037] 2. Subgraph generation module

[0038] In actual applications, as the system runs, the size of the monitoring system logs continues to increase, which also means that the traceability graph output by its corresponding traceability graph generation module will become larger and larger. In order to control the space overhead in actual application, the subgraph generation module divides the original traceability graph into several subgraphs of controllable size for subsequent steps.

[0039] Specifically, the processing process of the subgraph generation module is as follows:

[0040] The complete traceability graph of the traceability graph generation module is stored on the disk of the industrial control network management system server, and a cache graph is maintained in the memory of the industrial control network management system. Each event of the complete traceability graph is retrieved in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the new nodes, and the timestamps of the behaviors are assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only their timestamps are updated to ensure that the timestamps are consistent with the latest behavior time.

[0041] Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, the cached graph at this time is saved as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the i-th cached graph reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S i Repeat until all the data in the provenance graph on disk is processed.

[0042] After the above processing for each traceability graph, we can get the subgraph set {S0, S1, ...S n}. In subsequent training, each subgraph is trained. In this way, during training, the present invention only needs to store a subgraph of a limited size in the memory, thereby ensuring scalability.

[0043] 3. Behavior feature extraction module (key innovative part of the present invention)

[0044] like Figure 2 ,The behavior feature extraction module includes a node feature extraction module and an edge ,feature extraction module, which is used to extract features from each ,subgraph.

[0045] 3.1 Node feature extraction module

[0046] For the features of nodes in the subgraph, first count the number of node types and edge types in the graph as Nn and Ne. Set the functions Xv and Xe as follows to map each node and edge to its type. ΣV and ΣE represent the set of node types and edge types, respectively.

[0047] X v :V→Σ V

[0048] X e :E→Σ E

[0049] Set the mapping function M v and Me Map node types and edge types to 0 to N respectively n -1 and 0~N e An integer between -1.

[0050] M v :Σ V →N

[0051] M e :Σ E →N

[0052] Nodes in a subgraph The eigenvector of is set to:

[0053] [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 , …, a Ne*2-1 ]

[0054] where a i The calculation formula is as follows:

[0055]

[0056] To put it in a more vivid way, the feature vector of a node is evenly divided into two parts, each dimension of the first half corresponds to the in-degree of a certain type of edge on the node, and each dimension of the second half corresponds to the out-degree of a certain type of edge on the node. It is believed that by using the degree distribution of a node as a feature vector, the interactive behavior characteristics of the node can be statistically represented.

[0057] 3.2 Edge Feature Extraction Module

[0058] An edge in the subgraph represents an interaction event between entities, that is, a behavior. Behavior includes four main attributes: the subject that performs the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each of the main attributes can be divided into more specific attributes, and these attribute information constitutes the behavior attribute.

[0059] In previous APT attack detection work, behavioral attribute information is often ignored, or each behavioral attribute is analyzed independently. However, the present invention believes that there is an important correlation between behavioral attributes, and this correlation plays a key role in APT attack detection. For example, an abnormal process reads system files late at night. If only its running time attribute (such as running late at night) or only its behavior type attribute (such as reading system files) is considered, important contextual information will be lost. Only by combining the time attribute with the behavior type attribute for comprehensive analysis can potential threat behaviors be accurately identified. This multi-dimensional correlation analysis helps to improve the accuracy and precision of detection, thereby more effectively responding to complex APT attacks.

[0060] Therefore, the present invention proposes a new concept of behavior structure graph (BSG) for the first time. The behavior structure graph (BSG) is composed of various behavior attributes of a single behavior and the connections between them, where each behavior attribute is mapped to a node in the behavior structure graph (BSG), and the connections between the behavior attributes are mapped to edges between corresponding nodes in the behavior structure graph (BSG). By constructing a behavior structure graph (BSG), the present invention can map the relationship between behavior attributes into the graph structure information of the behavior structure graph (BSG), and more effectively capture the threat patterns and correlations hidden in the behavior. By analyzing the behavior structure graph (BSG) of each edge in the subgraph, the present invention constructs its corresponding feature vector. The process is as follows: Figure 3 shown.

[0061] The edge feature extraction module includes: a behavior structure graph (BSG) initialization module, a behavior structure graph (BSG) semantic information and structure information module, and an edge feature vector module. As follows:

[0062] 3.2.1 Behavior Structure Graph (BSG) Initialization Module

[0063] For each edge in the subgraph, that is, each behavior, its behavior attribute information is identified and recorded. The behavior structure graph (BSG) is initially a zero graph with 0 nodes. Whenever a behavior attribute of the behavior is identified, a new node is added to the behavior structure graph (BSG), and the node corresponds to this behavior attribute. Assuming that a behavior has x behavior attributes, the corresponding behavior structure graph (BSG) is constructed as an undirected graph with x nodes and 0 edges.

[0064] 3.2.2 Semantic and structural information modules of behavior structure graph (BSG)

[0065] 3.2.2.1 Semantic Information Module

[0066] Traverse each node in the behavior structure graph (BSG) in turn, and convert the behavior attribute corresponding to the node into a sentence in a unified format. Specifically, the embodiment converts non-alphanumeric symbols of the behavior attribute text into spaces, for example: converting the file path " / etc / tmp / log.txt" into the sentence "etc tmp log txt". For each such sentence, use FastText to embed it into a numerical vector. Specifically, FastText is a word vector and text classification tool open sourced by Facebook, which can convert words into numerical vectors, that is, extract semantic information from the text. The present invention uses FastText to convert each word in the sentence into a numerical vector, and then adds and averages the numerical vectors of all words to obtain the feature vector of the sentence. The feature vector of this sentence is used as the feature vector of the corresponding node in the behavior structure graph (BSG).

[0067] 3.2.2.2 Structural Information Module

[0068] Considering the various uncertainties between behavior attributes in reality, and inspired by the practice of adding random features to each node in rGINs (graph isomorphism networks with random features) to enhance the expression ability of gnn, this paper adopts the ER random graph model to randomly initialize the structure information of the behavior structure graph (BSG). Specifically, by traversing each node pair in the behavior structure graph (BSG) to generate edges with a random probability p, the structure information of the behavior structure graph (BSG) is finally obtained.

[0069] It is worth noting that here p is set to a constant value greater than log(x) / x, which theoretically ensures that the behavior structure graph (BSG) is a connected graph. The connectivity between any two nodes in the connected graph ensures that the potential relationship between any two behavior attributes will not be ignored during initialization.

[0070] 3.2.3 Edge feature vector module

[0071] The final edge feature vector is extracted from the behavior structure graph (BSG).

[0072] In order to integrate the semantic information and structural information in the behavior structure graph (BSG) into the final edge feature vector, the present invention applies a pooling method based on multiple node discarding to the behavior structure graph (BSG). The pooling method is divided into multiple pooling steps. By gradually discarding non-important nodes and aggregating the information of the remaining important nodes based on the graph structure, the feature vector of the entire behavior structure graph (BSG) is obtained.

[0073] Specifically, the importance of the node is first evaluated in each pooling step, and the weight value of each node is calculated based on the node's position in the entire graph structure, the connection relationship, and the attribute characteristics of the node. Through this evaluation mechanism, unimportant nodes will be gradually discarded. These nodes are usually nodes that play a secondary role in the graph and have little impact on the global characteristics of the graph. After discarding unimportant nodes, information aggregation will be performed between the remaining nodes, so that the remaining graph can simplify the computational complexity while maintaining key structures and information. The pooling process is progressive. As the steps proceed, the number of nodes in the graph gradually decreases, and finally the feature vector of the entire graph is obtained. This feature vector is then used as the edge feature vector of its corresponding edge, thereby more comprehensively reflecting the semantic and structural information in the behavior structure graph (BSG).

[0074] 4. Model training and anomaly detection module

[0075] After the behavior feature extraction module outputs the subgraph with node features and edge features, the model training and anomaly detection module completes the training and testing of the classification model. The details are as follows:

[0076] 4.1 Design Model

[0077] The model design of the present invention is based on GraphSAGE (existing technology) and compositely introduces Residual GatedGraph ConvNets (existing technology) to better cope with the challenge of APT attack detection. Specifically, by combining the high efficiency of GraphSAGE and the deep modeling capability of Residual Gated Graph ConvNets, the model designed by the present invention can not only efficiently process large-scale traceability graphs, but also more comprehensively capture the complex dependencies in the graph, improve the overall representation capability, and provide stronger support for APT attack detection.

[0078] As is well known in the art, GraphSAGE is a simple and efficient graph neural network that aggregates and updates the representation of the target node by sampling the features of neighboring nodes. Its local aggregation strategy enables GraphSAGE to effectively capture neighbor information and extract local structural features of nodes. At the same time, it reduces computational complexity through sampling to ensure efficient performance when processing large-scale provenance graphs. However, in the provenance graph scenario of this problem, GraphSAGE itself has limitations in processing edge features and long-range dependencies.

[0079] To solve this problem, the present invention introduces Residual Gated Graph ConvNetss, which can effectively capture the long-range dependencies in the traceability graph through its gating mechanism and accurately depict the complex interactions between nodes, which is highly consistent with the characteristics of long latency and complex attack methods in APT attacks. In addition, Residual Gated Graph ConvNets can process and integrate edge features, so that the model not only pays attention to node features in the graph representation learning process, but also utilizes edge information, further improving the accuracy and reliability of APT detection.

[0080] 4.2 Model Training

[0081] The above model is trained using the subgraph with node features and edge features output by the behavior feature extraction module.

[0082] Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels.

[0083] One training will generate vector representations of all nodes and edges. The vector representations of node v and edge e are Z v and Z e . Where Z v is an N v dimensional vector, Z e is an N e dimensional vector.

[0084] Combine the vector representations of all edges in the subgraph after a round of training to get a matrix Z. Assuming there are N edges in the subgraph, the dimension of the matrix Z is N×N e Similarly, the one-hot encoding vector L of all edge labels in the subgraph can be e Put them together to get the matrix L.

[0085] The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows:

[0086]

[0087] Where L ic represents the element in the i-th row and c-th column of the matrix L, Z ic Represents the element in the i-th row and c-th column of the matrix Z.

[0088] Then, through the back-propagation algorithm, the loss value is used to adjust the weight matrix and pooling parameters.

[0089] For each round of training, the edge of the classification subgraph is used. Specifically, when the vector Z e With vector L eWhen the distance ds is lower than the threshold d, the classification is considered correct. ds takes the L2 distance, and the calculation formula is as follows:

[0090] ds=||Z e -L e ||2

[0091] The correctly classified edges are removed from the detection edge set, and the corresponding edges in the subgraph are also eliminated synchronously. The model at this time is saved. The new model is trained again with the remaining data in the subgraph, and this process is repeated until the training subgraph is empty. In this way, the present invention can obtain multiple models.

[0092] Note that at the beginning of subsequent subgraph training, the present invention first verifies the subgraph in the existing model and removes correctly classified edges from it.

[0093] This is based on a strategy that the previous model has learned the representations of the deleted edges, and the present invention does not need to retrain them. By applying this pre-filtering strategy, the present invention reduces the number of initial edges in the subgraph, thereby further reducing the number of models. More generally, the present invention uses the subgraph for training only when there are edges in the subgraph that all current models cannot correctly classify. This is an incremental work that prevents the generation of "redundant" models.

[0094] 4.3 Anomaly Detection Module

[0095] Use the model trained in 4.2 to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing sub-model, it is judged as an anomaly and its behavior structure graph (BSG) is output.

[0096] Figure 4 Process management for industrial control network management systems.

[0097] The key points, innovations and advantages of the above technical solutions are:

[0098] 1. Utilization of Behavioral Attributes and Their Structural Information

[0099] The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, which goes beyond the traditional focus on entity interactions. In addition to capturing the basic interactive relationships between entities, the present invention also takes into account behavioral attributes, namely key features such as the time and manner of the behavior. Furthermore, the present invention takes into account the relationship between behavioral attributes and constructs behavioral structural information. By examining the associations between different behavioral attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects a more detailed contextual background into each behavioral entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0100] 2. Optimized Behavior Structure of Pooling and Graph Representation Learning

[0101] By introducing pooling methods and graph representation learning, the present invention optimizes the behavior structure information. The pooling method obtains the feature vector of the entire behavior structure graph (BSG) by discarding nodes multiple times, retaining the attributes and their relationships that contribute more to the discrimination of normal or abnormal behaviors. The introduction of this step improves the expressiveness of the model, enabling it to more effectively capture important information in the behavior structure and continuously optimize based on the initial structure information.

[0102] 3. Random method to initialize behavior structure information

[0103] The present invention innovatively adopts a random method, specifically, an ER random graph model to initialize the behavior structure information. This design takes into account the various uncertain associations between behavior attributes in reality, introduces a certain probability for the relationship between each pair of behavior attributes, and helps to cover a wider information space in the initial stage from the perspective of information theory. Ensuring that the initial behavior structure graph (BSG) is a connected graph ensures that each behavior attribute has a potential association path, avoiding the premature exclusion of certain attribute associations from the analysis in the initial stage.

[0104] 4. Improved judgment accuracy

[0105] The traditional provenance graph modeling method mainly focuses on the basic interaction relationship between entities, while the present invention introduces more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-level and multi-dimensional information structure in the model, making the information level of the provenance graph rich and diverse.

[0106] The behavior attributes include key features such as the time and method of the behavior, which are often ignored in traditional methods. By describing each behavior attribute in detail, the system can more comprehensively understand the behavior between entities during the modeling and training phases. For example, it is not only possible to know that process A accessed file B, but also when and how this operation occurred, thus providing a more detailed context.

[0107] The relationship between behavior attributes forms behavior structural information. By considering the relationship between behavior attributes, the model can capture more complex and in-depth behavior patterns. This structural information not only provides cognition of potential associations between behaviors, but also enables the model to better understand the differences between normal behavior patterns and APT attack behavior patterns during training.

[0108] The richness of the structural information directly affects the accuracy of the determination.

[0109] By introducing more behavioral attributes and structural information, the model can more carefully distinguish the characteristics of normal behavior and APT attack behavior during the learning process. This detailed behavioral description enables the system to more accurately identify potential threats and APT attack behaviors, improving the overall judgment accuracy.

[0110] 5. Finer determination granularity

[0111] Traditional traceability graph detection methods perform APT attack detection at the graph level or node level. After detecting an APT attack, security analysts are still required to specifically locate the attack activity, which reduces processing efficiency. Edge-level judgment helps to quickly discover APT attack activities. That is, when an APT attack activity occurs, the present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack location shortens the time from detection to response, can locate the specific location and time of the attack behavior, and improves the system's real-time perception of threats.

[0112] 6. Explainability

[0113] When the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationship between them. For example, the output result shows that the interaction between a specific process and a file may be an APT attack, and then explains the key behavior information for determining the APT attack behavior, so that the determination criteria are easier to understand. The APT attack behavior attributes and the relationship between them can also be displayed in a graphical form, so that security analysts can more intuitively understand abnormal behavior in a visual way. By clearly presenting these key attributes, the system provides security analysts with a more detailed description of APT attack activities, making the results more explainable.

[0114] Explanation of terms in this article:

[0115] APT: Advanced Persistent Threat (APT) is a form of attack that uses advanced attack methods to carry out long-term persistent network attacks on specific targets. It contains three elements: advanced, long-term, and threatening.

[0116] Behavior: refers to the operations between entities in the system, which can be expressed as a four-tuple<subject,object,time,operation> Representation, that is, the subject of the behavior, the object of the behavior, the time of the behavior, and the content of the behavior. Behavior subject and behavior object: The behavior subject (subject) refers to the entity in the system that performs operations on another entity called the behavior object (object). The subject and the object are relative, and the subject of one behavior can be the object of another behavior. The subject can be a process, thread, etc.; the object can be a file, socket, etc. For different operating systems, the types of subject and object may be different.

[0117] Provenance Graph: A provenance graph is a collection of all subjects, objects, and behaviors, which can be represented by G=<S,O,E> In the provenance graph, S represents the set of subjects, O represents the set of objects, and E represents the set of behaviors. In the provenance graph, subjects and objects are represented as nodes, while behaviors are represented as edges. There may be multiple edges between two nodes, with different times or operations.

[0118] ER Random Graph: Erdos-Renyi Random Graph is named after two famous Hungarian mathematicians Paul The simplest and most commonly used method for generating random undirected graphs is named after A. Rényi and includes the following two closely related variants:

[0119] ●G np : An undirected graph with n nodes and edges (u,v) generated with independent and identically distributed probability p

[0120] ●G nm : An undirected graph with n nodes and m edges sampled from a uniform distribution.

[0121] GNN: Graph Neural Network (GNN) is a general term for algorithms that use neural networks to learn graph structured data, extract and discover features and patterns in graph structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0122] NLP: Natural Language Processing (NLP) is an important field in the fields of computer science and artificial intelligence. It studies various theories and methods that can enable effective communication between humans and computers using natural language. For example, FastText.

[0123] One-hot encoding: One-hot encoding, also known as one-bit effective encoding, uses an N-bit state register to encode N states. Each state has its own independent register bit, and at any time, only one of them is valid.

Claims

1. A network security monitoring system for responding to APT attacks, applied in actual industrial production environment, characterized in that: It includes industrial control network gateway security equipment, industrial control network management system, and industrial control network security operation center, including: The industrial control network gateway security device includes a behavior data collection module for collecting network traffic and system activity data of various devices including intrusion detection systems and traffic probes, forming an original system log database, and providing it to the industrial control network management system; The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavior feature extraction module, a model training and anomaly detection module; completes the preprocessing of raw data, generates traceability graphs and subgraphs, extracts behavior features, establishes a classification model and uses it for anomaly detection; The industrial control network security operation center includes a risk warning reporting module, which reports the detected risks to the security operation personnel in a visual manner and generates a detailed analysis report.

2. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: The industrial control network management system, wherein the data preprocessing module includes a data cleaning module and a traceability diagram generation module, wherein: The data cleaning module is used to identify entities and events in the log and record unified identifiers; it is used to standardize all information fields, and the information fields unify the timestamp format and IP address representation method to ensure that all data are comparable; The traceability graph generation module is used to structure the input data into a graph to present the correlation of system behavior: the data output by the data cleaning module is mapped according to entities and events, each entity is regarded as a node in the graph, and the event is used as an edge connecting the nodes; after all entities are mapped to nodes, edges are added in sequence according to the causal relationship between events to construct a traceability graph reflecting the interaction between entities in the system and their evolution path, and the traceability graph is completely stored on the disk of the industrial control network management system server.

3. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: Under the condition that the traceability graph is completely stored on the disk of the industrial control network management system server, and a cache graph is maintained in the memory of the industrial control network management system server, the subgraph generation module is used to: Retrieve each event in the complete traceability graph in chronological order. If the subject and object of the retrieved event have not been added to the cache graph in the system memory, add them as new nodes to the cache graph, add an edge between the new nodes, and assign the timestamp of the behavior to these new nodes. If the subject and object of the retrieved event already exist in the cache map, only the timestamp is updated to ensure that the timestamp is consistent with the latest behavior time; Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, save the cached graph at this time as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the cached graph for the i-th time reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S. i Repeat until the data of the traceability graph on the disk is processed; For each traceability graph, after being processed by the subgraph generation module in the above process, a subgraph set {S0, S1, ... S n }.

4. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: The industrial control network management system, wherein the behavior feature extraction module is used to extract features from each subgraph, including a node feature extraction module and an edge feature extraction module, wherein: For the features of the nodes in the subgraph, the node feature extraction module is used to count the number of node types and edge types in the graph as Nn and Ne, set functions Xv and Xe, map each node and edge to its type, and ΣV and ΣE represent the sets of node types and edge types respectively; X v :V→Σ V X e :E→Σ E Used to set the mapping function M v and M e Map node types and edge types to 0 to N respectively n -1 and 0~N e Integer between -1; M v :S V →N M e :S E →N Nodes in a subgraph The eigenvector of is set to: [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a Ne*2-1 ] where a i The calculation formula is as follows: The node's feature vector is evenly divided into two parts, each dimension of the first half corresponds to the in-degree of a certain type of edge on the node, and each dimension of the second half corresponds to the out-degree of a certain type of edge on the node. The degree distribution of the same node is used as a feature vector to represent the interactive behavior characteristics of the node in a statistical sense. For edge features in a subgraph, the edge feature extraction module: an edge in the subgraph represents an interaction event between entities, that is, a behavior; a behavior includes four main attributes: the subject performing the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior; each main attribute is further divided into more specific attributes, and these attribute information constitutes the behavior attribute; The edge feature extraction module is used to map the relationship between behavior attributes into the graph structure information of the behavior structure graph (BSG) to capture the threat patterns and correlations hidden in the behavior; by analyzing the behavior structure graph of each edge in the subgraph, the corresponding feature vector is constructed; the behavior structure graph is composed of the various behavior attributes of a single behavior and the connections between them, where each behavior attribute is mapped to a node in the behavior structure graph, and the connections between the behavior attributes are mapped to the edges between the corresponding nodes in the behavior structure graph.

5. A network security monitoring system for responding to APT attacks according to claim 4, characterized in that: The edge feature extraction module includes: a behavior structure graph initialization module, a behavior structure graph semantic information and structure information module and an edge feature vector module; wherein: In the behavior structure graph initialization module: for each edge in the subgraph, that is, each behavior, its behavior attribute information is identified and recorded; the behavior structure graph is initially a zero graph with 0 nodes, and each time a behavior attribute of the behavior is identified, a new node is added to the behavior structure graph, and the node corresponds to the behavior attribute; assuming that a certain behavior has x behavior attributes, the corresponding behavior structure graph is constructed as an undirected graph with x nodes and 0 edges; The semantic information and structural information modules of the behavior structure graph include a semantic information module and a structural information module. The semantic information module sequentially traverses each node in the behavior structure graph and converts the behavior attribute corresponding to the node into a sentence in a unified format. The structural information module uses an ER random graph model to randomly initialize structural information for the behavior structure graph. Specifically, by traversing each node pair in the behavior structure graph and generating edges with a random probability p, the structural information of the behavior structure graph is finally obtained. The edge feature vector module extracts the final edge feature vector from the behavior structure graph; a pooling method based on multiple node discarding is used for the behavior structure graph, and the pooling method is divided into multiple pooling steps. The feature vector of the entire behavior structure graph is obtained by gradually discarding non-important nodes and aggregating information of remaining important nodes based on the graph structure.

6. A network security monitoring system for responding to APT attacks according to claim 5, characterized in that: The edge feature vector module is used to extract the final edge feature vector from the behavior structure graph: In each pooling step, the importance of the node is evaluated, and the weight value of each node is calculated based on the node's position in the entire graph structure, the connection relationship and the node's attribute characteristics. Unimportant nodes will be gradually discarded; after discarding unimportant nodes, information aggregation is performed between the remaining nodes so that the remaining graph maintains key structure and information; the pooling process is progressive, and the feature vector of the entire graph is obtained; the feature vector is then used as the edge feature vector of its corresponding edge, reflecting the semantic and structural information in the behavior structure graph.

7. A network security monitoring system for responding to APT attacks according to claim 1, characterized in that: The industrial control network management system, wherein the model training and anomaly detection module includes a classification model, a model training module, and an anomaly detection module: The model training and anomaly detection module inputs the subgraph with node features and edge features output by the behavior feature extraction module: The classification model is based on GraphSAGE and introduces Residual Gated Graph ConvNets; adopting a local aggregation strategy, the GraphSAGE captures neighbor information and extracts local structural features of nodes, while reducing computational complexity through sampling to cope with high performance when processing large-scale traceability graphs; introducing the Residual Gated Graph ConvNetss, through its gating mechanism, capturing long-range dependencies in the traceability graph, characterizing the complex interactions between nodes, and matching APT attacks; processing and integrating edge features through the Residual Gated Graph ConvNets, the model takes into account both node features and edge information in the graph representation learning process, so as to improve the accuracy and reliability of APT detection; The model training module trains each subgraph during training and only needs to store a subgraph of limited size in memory, thereby ensuring scalability; specifically, the subgraph with node features and edge features output by the behavior feature extraction module is used to train the above model: Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels; One training will generate vector representations of all nodes and edges; the vector representations of node v and edge e are Z v and Z e ; where Z v is an N v dimensional vector, Z e is an N e dimensional vector; Combine the vector representations of all edges in the subgraph after a round of training to get a matrix Z; assuming there are N edges in the subgraph, the dimension of the matrix Z is N×N e ; One-hot encoding vector L of all edge labels in the subgraph e Put them together to get the matrix L; The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows: Where L ic represents the element in the i-th row and c-th column of the matrix L, Z ic represents the element in the i-th row and c-th column of the matrix Z; Then, through the back-propagation algorithm, the loss value is used to adjust the weight matrix and pooling parameters; For each round of training, the edge of the classification subgraph is used; specifically, when the vector Z e With vector L e When the distance ds is lower than the threshold d, the classification is considered correct; ds takes the L2 distance, and the calculation formula is as follows: ds=||Z e -L e ||2 Remove the correctly classified edges from the detection edge set, and simultaneously eliminate the corresponding edges in the subgraph; save the model at this time; use the remaining data in the subgraph to train a new model again, and repeat this process until the training subgraph is empty, and obtain multiple models; At the beginning of subsequent subgraph training, the subgraph is first verified in the existing model and the correctly classified edges are removed from it; by applying this pre-filtering strategy, the number of initial edges in the subgraph is reduced, thereby further reducing the number of models; The anomaly detection module uses the trained model to classify the type of each edge in turn; when an edge cannot be correctly classified by any existing sub-model, it is determined to be an anomaly and its behavior structure diagram is output.

Images