APT attack detection method based on traceability graph behavior information

Abstract

The invention belongs to the field of network attack detection, and particularly relates to an APT attack detection method based on traceability graph behavior information. The method comprises the following four steps: step 1, data preprocessing; step 2, generating a sub-graph; step 3, behavior feature extraction; performing feature extraction on each sub-graph, wherein the feature extraction comprises node feature extraction and edge feature extraction; 4, designing and training a classification model, and performing anomaly detection; and training and testing the classification model, sequentially classifying the type of each edge by using the trained model, and when a certain edge cannot be correctly classified by any existing sub-model, judging that the edge is abnormal, and outputting a behavior structure diagram of the edge. According to the method, behavior attributes and structural information thereof are introduced into the modeling of the traceability graph, and the category of traditionally paying attention to entity interaction relationships is exceeded; by introducing a pooling method and graph representation learning, the expression ability of the model is improved, important information in a behavior structure is more effectively captured, and continuous optimization is performed on the basis of initial structure information.

Description

Technical Field

[0001] The present invention belongs to the field of network attack detection, and in particular relates to an APT attack detection method based on source tracing graph behavior information. Background Art

[0002] In today's digital age, the popularity of the Internet and the advancement of technology have brought unprecedented convenience to people, but at the same time, the forms and scale of cyber attacks have continued to evolve, becoming a serious problem that threatens personal, corporate and even national security. Among them, APT (Advanced Persistent Threat) attacks have become one of the biggest threats to the security of modern computing environments. Its main characteristics are the "low and slow" attack mode and the frequent use of zero-day vulnerabilities.

[0003] APT attacks often originate from state-level or highly organized hacker groups, and their targets are usually important national infrastructure and organizations, such as energy, electricity, finance, defense, and other network infrastructures that govern the national economy and people's livelihood or national core interests, or large enterprises in related fields, posing a direct threat to national security and economic interests. These attacks use advanced technical means, through long-term infiltration and covert operations, to try to obtain key information and remain in the target system for a long time. Attackers usually sneak into the target system by exploiting zero-day vulnerabilities, social engineering, and other means, and then stay there for a long time to steal sensitive information without being detected.

[0004] APT attack mode is more secretive and targeted than traditional network attacks.

[0005] Traditional APT attack detection methods mainly rely on static feature matching, such as specific signatures, patterns or rules. This method is difficult to cope with the high variability and unknown nature of APT attacks, and the cost of maintaining and updating the feature library is high. In addition, the traditional method uses audit logs as the data source. The basic unit of data is the entries in the log. There is only a temporal relationship between them, which cannot directly and effectively represent the interaction relationship between entities in the system and lacks structural information. Therefore, the detection effect of APT attacks is not good. As an intuitive and efficient form of information expression, the traceability graph has strong semantic expression ability and attack history association ability, and has its unique advantages in the field of APT detection. The traceability graph shows the system execution process by representing the interaction relationship between system entities, which is convenient for causal association analysis during the detection process. The traceability graph saves all the execution history of the system, which can cope with the long duration of APT attacks.

[0006] APT attack detection methods based on provenance graphs can be further divided into anomaly-based, rule-based, and tag propagation-based methods.

[0007] Among them, the technical solution closest to the present invention is the anomaly-based detection method. This method first deploys appropriate monitoring tools, such as intrusion detection systems, traffic probes, etc., to collect network traffic and behavior data, and then uses the collected data to build a traceability graph to represent the various nodes in the network and the interactive relationships between them. Based on the historical traceability graph data, a machine learning method is used to learn the normal network behavior model, and finally this model is used to detect the deviation of the real-time traceability graph data. If the deviation exceeds a certain threshold, it is judged as abnormal behavior and there may be an APT attack.

[0008] In summary, anomaly-based detection methods learn models of benign behaviors and detect anomalies based on deviations from the models, and have the ability to adapt to new attack features and variant behaviors of APTs.

[0009] The disadvantages of the above prior art are:

[0010] The main problem facing current technologies is that the APT attack detection method based on the provenance graph mainly focuses on the interaction between system entities and uses it for causal reasoning. Specifically, the interaction between entities in the provenance graph is simply represented as an edge. For example, process A accesses file B in the provenance graph as an edge from A to B. However, in this process, key behavioral information, such as the time of occurrence and the specific method of proceeding, is ignored or discarded. This simplified representation leads to the loss of behavioral information, reduces the accuracy of detection and increases the false alarm rate.

[0011] Secondly, the current technology is relatively coarse in terms of detection granularity, mainly performing detection at the graph level, or at most at the node level, which makes the response speed slow. Specifically, the output of the detection usually indicates which graph or node has the possibility of APT attack. Considering that a graph may contain thousands of nodes, and a node may issue thousands of behaviors, this coarse detection granularity makes it difficult for the information returned to the security analyst to quickly and accurately locate the specific activity steps of the attack even if the detection result is correct, which makes the time from the discovery of the attack to the response longer.

[0012] Finally, current technologies have poor interpretability of detection results. This is mainly due to the use of highly abstract features to represent entities or behaviors in the detection process. Detection results usually only show whether an APT attack exists, which increases the difficulty for security analysts to understand the reasons for the judgment.

[0013] Traditional APT attack detection methods often rely on static feature matching, which has high maintenance and update costs for feature libraries and makes it difficult to detect unknown threats. Existing APT attack detection methods based on traceability graphs cannot utilize information about the interaction between entities and perform poorly in terms of detection accuracy, efficiency, and interpretability. Summary of the invention

[0014] In order to solve the technical problems existing in the prior art, the present invention provides an APT attack detection method based on tracing graph behavior information.

[0015] Technical solution of the present invention:

[0016] An APT attack detection method based on traceability graph behavior information is divided into four steps as follows:

[0017] Step 1: Data preprocessing

[0018] Step 1.1: Data cleaning

[0019] Identify entities and events in the logs and record them with unified identifiers; standardize all information fields, such as unified timestamp format, IP address representation, etc., to ensure that all data is comparable;

[0020] Step 1.2: Generate a traceability graph

[0021] By structuring the input data into a graph, the correlation of system behavior is presented.

[0022] Step 2: Subgraph generation

[0023] In order to control the space cost in actual application, the original traceability graph is divided into several subgraphs of controllable size for subsequent steps; each event of the complete traceability graph is retrieved in chronological order. If the subject and object of the retrieved event have not been added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the new nodes, and the timestamps of the behavior are assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only their timestamps are updated to ensure that the timestamps are consistent with the latest behavior time.

[0024] Step 3: Behavioral feature extraction

[0025] After the subgraphs are generated, feature extraction is performed on each subgraph, including node feature extraction and edge feature extraction.

[0026] Step 4: Classification model design, training, and anomaly detection

[0027] The subgraph with node features and edge features output in step 3 is used for training and testing the classification model. In the anomaly detection stage, the trained model is used to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing sub-model, it is judged as an anomaly and its behavior structure graph (BSG) is output.

[0028] Beneficial Effects

[0029] The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, which goes beyond the traditional focus on entity interactions. In addition to capturing the basic interactive relationships between entities, the present invention also takes into account behavioral attributes, namely key features such as the time and manner of the behavior. Furthermore, the present invention takes into account the relationship between behavioral attributes and constructs behavioral structural information. By examining the associations between different behavioral attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects a more detailed contextual background into each behavioral entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0030] By introducing pooling methods and graph representation learning, the expressiveness of the model is improved, enabling it to more effectively capture important information in the behavioral structure and continuously optimize based on the initial structural information.

[0031] The present invention innovatively adopts a random method, specifically, an ER random graph model, to initialize the behavior structure information. Ensuring that the initial behavior structure graph (BSG) is a connected graph ensures that each behavior attribute has a potential association path, avoiding premature exclusion of certain attribute associations from analysis in the initial stage.

[0032] The present invention introduces more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-level and multi-dimensional information structure in the model, making the information level of the traceability graph rich and diverse. The model can more carefully distinguish the characteristics of normal behavior and APT attack behavior during the learning process, improving the overall judgment accuracy.

[0033] The present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack positioning shortens the time from detection to response, can locate the specific location and time when the attack behavior occurs, and improves the system's real-time perception of threats.

[0034] When the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationship between them, and then explains the key behavior information for determining the APT attack behavior, so that the determination criteria are easier to understand. The APT attack behavior attributes and the relationship between them can also be displayed in a graphical form, so that security analysts can more intuitively understand abnormal behavior in a visual way. By clearly presenting these key attributes, the system provides security analysts with a more detailed description of APT attack activities, making the results more explainable. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1A schematic diagram of the steps of an edge-level APT detection method based on traceability graph behavior information of the present invention is shown;

[0036] Figure 2 A schematic diagram of the process of an edge-level APT detection method based on traceability graph behavior information of the present invention is shown;

[0037] Figure 3 Shows Figure 1 The middle line is a schematic diagram of the feature extraction process. DETAILED DESCRIPTION

[0038] The technical solution provided by the present application will be further described below in conjunction with specific embodiments and accompanying drawings. The advantages and features of the present application will become more apparent with the following description.

[0039] An APT attack detection method based on traceability graph behavior information is divided into four steps: data preprocessing step, subgraph generation step, behavior feature extraction step and classification model design, training and anomaly detection step.

[0040] Step 1: Data preprocessing

[0041] Step 1.1: Data cleaning

[0042] First, considering that the original system log data may come from multiple different data sources, the log formats of different systems may be different, thus there is heterogeneity. In order to facilitate subsequent analysis and processing, the present invention first identifies the entities and events in the log and records them according to a unified identifier. Secondly, all information fields are standardized, such as a unified timestamp format, IP address representation, etc., to ensure that all data are comparable.

[0043] Step 1.2: Generate a traceability graph

[0044] By structuring the input data into a graph, the correlation of system behavior is presented. The details are as follows:

[0045] First, the cleaned data in step 1.1 is mapped according to entities and events, with each entity regarded as a node in the graph and events as edges connecting nodes. Then, after all entities are mapped to nodes, edges are added in sequence according to the causal relationship between events (for example, if entity A initiates an interaction with entity B, a directed edge from A to B is added), thereby constructing a traceability graph that can reflect the interactions between entities in the system and their evolution paths.

[0046] Step 2: Subgraph generation

[0047] In practical applications, as the system runs, the size of the system log continues to increase, which also means that the corresponding traceability graph generated in step 1.2 will become larger and larger. In order to control the space overhead in the actual application process, the present invention divides the original traceability graph into several subgraphs of controllable size for subsequent steps.

[0048] Specifically, the present invention stores the complete provenance graph generated in step 1.2 in the system disk, and maintains a cache graph in the system memory. The present invention retrieves each event of the complete provenance graph in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the pair of new nodes, and the timestamp of the behavior is assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only their timestamps are updated to ensure that the timestamps are consistent with the latest behavior time.

[0049] Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, the cached graph at this time is saved as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the i-th cached graph reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S i Repeat until all the data in the provenance graph on disk is processed.

[0050] After the above processing for each traceability graph, we can get the subgraph set {S0, S1, ...S n}. In subsequent training, each subgraph is trained. In this way, during training, the present invention only needs to store a subgraph of a limited size in the memory, thereby ensuring scalability.

[0051] Step 3: Behavioral feature extraction

[0052] After the subgraphs are generated, feature extraction is performed on each subgraph, which is divided into node feature extraction and edge feature extraction.

[0053] Step 3.1 Node feature extraction

[0054] For the characteristics of nodes in the subgraph, first count the number of node types and edge types in the graph as N n and N e . Set function X v and X e Map each node and edge to its type as follows. Σ V and Σ E Represents a collection of node types and edge types respectively.

[0055] X v :V→ΣV

[0056] X e :E→Σ E

[0057] Set the mapping function M v and M e Map node types and edge types to 0 to N respectively n -1 and 0~N e An integer between -1.

[0058] M v :Σ V →N

[0059] M e :Σ E →N

[0060] Nodes in a subgraph The eigenvector of is set to:

[0061] [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 , …, a Ne*2-1 ]

[0062] where a i The calculation formula is as follows:

[0063]

[0064] To put it in a more vivid way, the feature vector of a node is evenly divided into two parts, each dimension of the first half corresponds to the in-degree of a certain type of edge on the node, and each dimension of the second half corresponds to the out-degree of a certain type of edge on the node. It is believed that by using the degree distribution of a node as a feature vector, the interactive behavior characteristics of the node can be statistically represented.

[0065] Step 3.2 Edge feature extraction

[0066] An edge in the subgraph represents an interaction event between entities, that is, a behavior. Behavior includes four main attributes: the subject that performs the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each of the main attributes can be divided into more specific attributes, and these attribute information constitutes the behavior attribute.

[0067] In previous APT attack detection work, behavioral attribute information is often ignored, or each behavioral attribute is analyzed independently. However, the present invention believes that there is an important correlation between behavioral attributes, and this correlation plays a key role in APT attack detection. For example, an abnormal process reads system files late at night. If only its running time attribute (such as running late at night) or only its behavior type attribute (such as reading system files) is considered, important contextual information will be lost. Only by combining the time attribute with the behavior type attribute for comprehensive analysis can potential threat behaviors be accurately identified. This multi-dimensional correlation analysis helps to improve the accuracy and precision of detection, thereby more effectively responding to complex APT attacks.

[0068] Therefore, the present invention proposes a new concept of behavior structure graph (BSG) for the first time. The behavior structure graph (BSG) is composed of various behavior attributes of a single behavior and the connections between them, where each behavior attribute is mapped to a node in the behavior structure graph (BSG), and the connections between the behavior attributes are mapped to edges between corresponding nodes in the behavior structure graph (BSG). By constructing a behavior structure graph (BSG), the present invention can map the relationship between behavior attributes into the graph structure information of the behavior structure graph (BSG), and more effectively capture the threat patterns and correlations hidden in the behavior. By analyzing the behavior structure graph (BSG) of each edge in the subgraph, the present invention constructs its corresponding feature vector. The process is as follows: Figure 3 shown.

[0069] Step 3.2.1 Initialize Behavior Structure Graph (BSG)

[0070] For each edge in the subgraph, that is, each behavior, its behavior attribute information is identified and recorded. The behavior structure graph (BSG) is initially a zero graph with 0 nodes. Whenever a behavior attribute of the behavior is identified, a new node is added to the behavior structure graph (BSG), and the node corresponds to this behavior attribute. Assuming that a behavior has x behavior attributes, the corresponding behavior structure graph (BSG) is constructed as an undirected graph with x nodes and 0 edges.

[0071] Step 3.2.2 Construct semantic and structural information of behavior structure graph (BSG)

[0072] Step 3.2.2.1 Build semantic information

[0073] Traverse each node in the behavior structure graph (BSG) in turn, and convert the behavior attribute corresponding to the node into a sentence in a unified format. Specifically, the embodiment converts non-alphanumeric symbols of the behavior attribute text into spaces, for example: converting the file path " / etc / tmp / log.txt" into the sentence "etc tmp log txt". For each such sentence, use FastText to embed it into a numerical vector. Specifically, FastText is a word vector and text classification tool open sourced by Facebook, which can convert words into numerical vectors, that is, extract semantic information from the text. The present invention uses FastText to convert each word in the sentence into a numerical vector, and then adds and averages the numerical vectors of all words to obtain the feature vector of the sentence. The feature vector of this sentence is used as the feature vector of the corresponding node in the behavior structure graph (BSG).

[0074] Step 3.2.2.2 Build structure information

[0075] Considering the various uncertainties between behavior attributes in reality, and inspired by the practice of adding random features to each node in rGINs (graph isomorphism networks with random features) to enhance the expression ability of gnn, this paper adopts the ER random graph model to randomly initialize the structure information of the behavior structure graph (BSG). Specifically, by traversing each node pair in the behavior structure graph (BSG) to generate edges with a random probability p, the structure information of the behavior structure graph (BSG) is finally obtained.

[0076] It is worth noting that here p is set to a constant value greater than log(x) / x, which theoretically ensures that the behavior structure graph (BSG) is a connected graph. The connectivity between any two nodes in the connected graph ensures that the potential relationship between any two behavior attributes will not be ignored during initialization.

[0077] Step 3.2.3 Extract the final edge feature vector from the behavior structure graph (BSG)

[0078] In order to integrate the semantic information and structural information in the behavior structure graph (BSG) into the final edge feature vector, the present invention applies a pooling method based on multiple node discarding to the behavior structure graph (BSG). The pooling method is divided into multiple pooling steps. By gradually discarding non-important nodes and aggregating the information of the remaining important nodes based on the graph structure, the feature vector of the entire behavior structure graph (BSG) is obtained.

[0079] Specifically, the importance of the node is first evaluated in each pooling step, and the weight value of each node is calculated based on the node's position in the entire graph structure, the connection relationship, and the attribute characteristics of the node. Through this evaluation mechanism, unimportant nodes will be gradually discarded. These nodes are usually nodes that play a secondary role in the graph and have little impact on the global characteristics of the graph. After discarding unimportant nodes, information aggregation will be performed between the remaining nodes, so that the remaining graph can simplify the computational complexity while maintaining key structures and information. The pooling process is progressive. As the steps proceed, the number of nodes in the graph gradually decreases, and finally the feature vector of the entire graph is obtained. This feature vector is then used as the edge feature vector of its corresponding edge, thereby more comprehensively reflecting the semantic and structural information in the behavior structure graph (BSG).

[0080] Step 4: Classification model design, training, and anomaly detection

[0081] The subgraph with node features and edge features output in step 3 is used for training and testing of the classification model.

[0082] Step 4.1 Model design

[0083] The model design of the present invention is based on GraphSAGE (existing technology) and compositely introduces Residual GatedGraph ConvNets (existing technology) to better cope with the challenge of APT attack detection. Specifically, by combining the high efficiency of GraphSAGE and the deep modeling capability of Residual Gated Graph ConvNets, the model designed by the present invention can not only efficiently process large-scale traceability graphs, but also more comprehensively capture the complex dependencies in the graph, improve the overall representation capability, and provide stronger support for APT attack detection.

[0084] As is well known in the art, GraphSAGE is a simple and efficient graph neural network that aggregates and updates the representation of the target node by sampling the features of neighboring nodes. Its local aggregation strategy enables GraphSAGE to effectively capture neighbor information and extract local structural features of nodes. At the same time, it reduces computational complexity through sampling to ensure efficient performance when processing large-scale provenance graphs. However, in the provenance graph scenario of this problem, GraphSAGE itself has limitations in processing edge features and long-range dependencies.

[0085] To solve this problem, the present invention introduces Residual Gated Graph ConvNetss, which can effectively capture the long-range dependencies in the traceability graph through its gating mechanism and accurately depict the complex interactions between nodes, which is highly consistent with the characteristics of long latency and complex attack methods in APT attacks. In addition, Residual Gated Graph ConvNets can process and integrate edge features, so that the model not only pays attention to node features in the graph representation learning process, but also utilizes edge information, further improving the accuracy and reliability of APT detection.

[0086] Step 4.2 Model training

[0087] The model of the present invention is trained using the subgraph with node features and edge features outputted from step 3.

[0088] Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels.

[0089] One training will generate vector representations of all nodes and edges. The vector representations of node v and edge e are Z v and Z e . Where Z v is an N v dimensional vector, Z e is an N e dimensional vector.

[0090] Combine the vector representations of all edges in the subgraph after a round of training to get a matrix Z. Assuming there are N edges in the subgraph, the dimension of the matrix Z is N×N e Similarly, the one-hot encoding vector L of all edge labels in the subgraph can be e Put them together to get the matrix L.

[0091] The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows:

[0092]

[0093] Where L ic represents the element in the i-th row and c-th column of the matrix L, Z ic Represents the element in the i-th row and c-th column of the matrix Z.

[0094] Then, through the back-propagation algorithm, the loss value is used to adjust the weight matrix and pooling parameters.

[0095] For each round of training, the edge of the classification subgraph is used. Specifically, when the vector Z e With vector L eWhen the distance ds is lower than the threshold d, the classification is considered correct. ds takes the L2 distance, and the calculation formula is as follows:

[0096] ds=||Z e -L e ||2

[0097] The correctly classified edges are removed from the detection edge set, and the corresponding edges in the subgraph are also eliminated synchronously. The model at this time is saved. The new model is trained again with the remaining data in the subgraph, and this process is repeated until the training subgraph is empty. In this way, the present invention can obtain multiple models.

[0098] Note that at the beginning of subsequent subgraph training, the present invention first verifies the subgraph in the existing model and removes correctly classified edges from it.

[0099] This is based on a strategy that the previous model has learned the representations of the deleted edges, and the present invention does not need to retrain them. By applying this pre-filtering strategy, the present invention reduces the number of initial edges in the subgraph, thereby further reducing the number of models. More generally, the present invention uses the subgraph for training only when there are edges in the subgraph that all current models cannot correctly classify. This is an incremental work that prevents the generation of "redundant" models.

[0100] Step 4.3 Anomaly Detection

[0101] In the anomaly detection stage, the present invention uses the model trained in step 4.2 to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing sub-model, it is determined to be an anomaly and its behavior structure graph (BSG) is output.

[0102] The key points, innovations and advantages of the above technical solutions are:

[0103] 1. Utilization of Behavioral Attributes and Their Structural Information

[0104] The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, which goes beyond the traditional focus on entity interactions. In addition to capturing the basic interactive relationships between entities, the present invention also takes into account behavioral attributes, namely key features such as the time and manner of the behavior. Furthermore, the present invention takes into account the relationship between behavioral attributes and constructs behavioral structural information. By examining the associations between different behavioral attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects a more detailed contextual background into each behavioral entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0105] 2. Optimized Behavior Structure of Pooling and Graph Representation Learning

[0106] By introducing pooling methods and graph representation learning, the present invention optimizes the behavior structure information. The pooling method obtains the feature vector of the entire behavior structure graph (BSG) by discarding nodes multiple times, retaining the attributes and their relationships that contribute more to the discrimination of normal or abnormal behaviors. The introduction of this step improves the expressiveness of the model, enabling it to more effectively capture important information in the behavior structure and continuously optimize based on the initial structure information.

[0107] 3. Random method to initialize behavior structure information

[0108] The present invention innovatively adopts a random method, specifically, an ER random graph model to initialize the behavior structure information. This design takes into account the various uncertain associations between behavior attributes in reality, introduces a certain probability for the relationship between each pair of behavior attributes, and helps to cover a wider information space in the initial stage from the perspective of information theory. Ensuring that the initial behavior structure graph (BSG) is a connected graph ensures that each behavior attribute has a potential association path, avoiding the premature exclusion of certain attribute associations from the analysis in the initial stage.

[0109] 4. Improved judgment accuracy

[0110] The traditional provenance graph modeling method mainly focuses on the basic interaction relationship between entities, while the present invention introduces more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-level and multi-dimensional information structure in the model, making the information level of the provenance graph rich and diverse.

[0111] The behavior attributes include key features such as the time and method of the behavior, which are often ignored in traditional methods. By describing each behavior attribute in detail, the system can more comprehensively understand the behavior between entities during the modeling and training phases. For example, it is not only possible to know that process A accessed file B, but also when and how this operation occurred, thus providing a more detailed context.

[0112] The relationship between behavior attributes forms behavior structural information. By considering the relationship between behavior attributes, the model can capture more complex and in-depth behavior patterns. This structural information not only provides cognition of potential associations between behaviors, but also enables the model to better understand the differences between normal behavior patterns and APT attack behavior patterns during training.

[0113] The richness of the structural information directly affects the accuracy of the determination.

[0114] By introducing more behavioral attributes and structural information, the model can more carefully distinguish the characteristics of normal behavior and APT attack behavior during the learning process. This detailed behavioral description enables the system to more accurately identify potential threats and APT attack behaviors, improving the overall judgment accuracy.

[0115] 5. Finer determination granularity

[0116] Traditional traceability graph detection methods perform APT attack detection at the graph level or node level. After detecting an APT attack, security analysts are still required to specifically locate the attack activity, which reduces processing efficiency. Edge-level judgment helps to quickly discover APT attack activities. That is, when an APT attack activity occurs, the present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack location shortens the time from detection to response, can locate the specific location and time of the attack behavior, and improves the system's real-time perception of threats.

[0117] 6. Explainability

[0118] When the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationship between them. For example, the output result shows that the interaction between a specific process and a file may be an APT attack, and then explains the key behavior information for determining the APT attack behavior, so that the determination criteria are easier to understand. The APT attack behavior attributes and the relationship between them can also be displayed in a graphical form, so that security analysts can more intuitively understand abnormal behavior in a visual way. By clearly presenting these key attributes, the system provides security analysts with a more detailed description of APT attack activities, making the results more explainable.

[0119] Explanation of terms in this article:

[0120] APT: Advanced Persistent Threat (APT) is a form of attack that uses advanced attack methods to carry out long-term persistent network attacks on specific targets. It contains three elements: advanced, long-term, and threatening.

[0121] Behavior: refers to the operations between entities in the system, which can be expressed as a four-tuple<subject,object,time,operation> Representation, that is, the subject of the behavior, the object of the behavior, the time of the behavior, and the content of the behavior. Behavior subject and behavior object: The behavior subject (subject) refers to the entity in the system that performs operations on another entity called the behavior object (object). The subject and the object are relative, and the subject of one behavior can be the object of another behavior. The subject can be a process, thread, etc.; the object can be a file, socket, etc. For different operating systems, the types of subject and object may be different.

[0122] Provenance Graph: A provenance graph is a collection of all subjects, objects, and behaviors, which can be represented by G=<S,O,E> In the provenance graph, S represents the set of subjects, O represents the set of objects, and E represents the set of behaviors. In the provenance graph, subjects and objects are represented as nodes, while behaviors are represented as edges. There may be multiple edges between two nodes, with different times or operations.

[0123] ER Random Graph: Erdos-Renyi Random Graph is named after two famous Hungarian mathematicians Paul The simplest and most commonly used method for generating random undirected graphs is named after A. Rényi and includes the following two closely related variants:

[0124] ●G np : An undirected graph with n nodes and edges (u,v) generated with independent and identically distributed probability p

[0125] ●G nm : An undirected graph with n nodes and m edges sampled from a uniform distribution.

[0126] GNN: Graph Neural Network (GNN) is a general term for algorithms that use neural networks to learn graph structured data, extract and discover features and patterns in graph structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0127] NLP: Natural Language Processing (NLP) is an important field in the fields of computer science and artificial intelligence. It studies various theories and methods that can enable effective communication between humans and computers using natural language. For example, FastText.

[0128] One-hot encoding: One-hot encoding, also known as one-bit effective encoding, uses an N-bit state register to encode N states. Each state has its own independent register bit, and at any time, only one of them is valid.

Claims

1. A method for detecting APT attacks based on traceability graph behavior information, characterized in that: It is divided into four steps, as follows: Step 1: Data preprocessing Step 1.1: Data cleaning Identify entities and events in the logs and record them with uniform identifiers; standardize all information fields to ensure that all data is comparable; Step 1.2: Generate a traceability graph By structuring the input data into a graph, the correlation of system behavior is presented; Step 2: Subgraph generation Divide the original traceability graph into several subgraphs of controllable size; retrieve each event of the complete traceability graph in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, add them as new nodes to the cache graph, add an edge between the new nodes, and assign the timestamp of the behavior to these new nodes; If the subject and object of the retrieved event already exist in the cache map, only the timestamp is updated; Step 3: Behavioral feature extraction After the subgraphs are generated, feature extraction is performed on each subgraph, including node feature extraction and edge feature extraction; Step 4: Classification model design, training, and anomaly detection The subgraph with node features and edge features output in step 3 is used for training and testing the classification model. In the anomaly detection stage, the trained model is used to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing sub-model, it is judged as an anomaly and its behavior structure diagram is output.

2. According to claim 1, the APT attack detection method based on traceability graph behavior information is characterized in that: In step 2, each event of the complete traceability graph is retrieved in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the new nodes. At the same time, the timestamps of the behaviors are assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache map, only the timestamp is updated to ensure that the timestamp is consistent with the latest behavior time; Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, save the cached graph at this time as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the cached graph for the i-th time reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S. i Repeat until the data of the traceability graph on the disk is processed; After the above processing for each traceability graph, we can get the subgraph set {S0, S1,…Sn}.

3. According to claim 1, the APT attack detection method based on traceability graph behavior information is characterized in that: Step 3 includes the following steps: Step 3.1 Node feature extraction For the characteristics of nodes in the subgraph, first count the number of node types and edge types in the graph as N n and N e ; Set function X v and X e As follows, each node and edge is mapped to its type, Σ V and Σ E Represents a collection of node types and edge types: X v :V→Σ V X e :E→Σ E Set the mapping function M v and M e Map node types and edge types to 0 to N respectively n -1 and 0~N e Integer between -1; M v :S V →N M e :S E →N Nodes in a subgraph The eigenvector of is set to: [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a Ne*2-1 ] where a i The calculation formula is as follows: The feature vector of a node is evenly divided into two parts, each dimension of the first half corresponds to the in-degree of a certain type of edge on the node, and each dimension of the second half corresponds to the out-degree of a certain type of edge on the node. By using the degree distribution of the node as the feature vector, the interactive behavior characteristics of the node are statistically represented. Step 3.2 Edge feature extraction An edge in the subgraph represents an interaction event between entities, that is, a behavior. A behavior includes four main attributes: the subject that performs the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each of the main attributes is further divided into more specific attributes, which constitute the behavior attributes. Map the relationship between behavior attributes into the graph structure information of the behavior structure graph to capture the threat patterns and correlations hidden in the behavior; construct the corresponding feature vector by analyzing the behavior structure graph of each edge in the subgraph; The behavior structure graph is composed of various behavior attributes of a single behavior and the connections between them, wherein each behavior attribute is mapped to a node in the behavior structure graph, and the connections between the behavior attributes are mapped to edges between corresponding nodes in the behavior structure graph.

4. According to claim 3, the APT attack detection method based on traceability graph behavior information is characterized in that: Step 3.2 includes the following steps: Step 3.2.1 Initialize the behavior structure diagram For each edge in the subgraph, that is, each behavior, its behavior attribute information is identified and recorded; the behavior structure graph is initially a zero graph with 0 nodes. Whenever a behavior attribute of the behavior is identified, a new node is added to the behavior structure graph, and the node corresponds to this behavior attribute; assuming that a behavior has x behavior attributes, the corresponding behavior structure graph is constructed as an undirected graph with x nodes and 0 edges; Step 3.2.2 Construct semantic information and structural information of the behavior structure diagram Step 3.2.2.1 Build semantic information Traverse each node in the behavior structure diagram in turn, convert the behavior attributes corresponding to the node into sentences in a unified format, and then use natural language processing technology to extract its semantic information; Step 3.2.2.2 Build structure information The ER random graph model is used to randomly initialize the structural information of the behavior structure graph. Specifically, by traversing each node pair in the behavior structure graph and generating edges with a random probability p, the structural information of the behavior structure graph is finally obtained. Step 3.2.3 Extract the final edge feature vector from the behavior structure graph A pooling method based on multiple node discarding is used for the behavior structure graph. The pooling method is divided into multiple pooling steps. By gradually discarding non-important nodes and aggregating the information of remaining important nodes based on the graph structure, the feature vector of the entire behavior structure graph is obtained.

5. According to claim 1, the APT attack detection method based on traceability graph behavior information is characterized in that: Step 4 includes the following steps: Step 4.1 Model design Based on GraphSAGE, it also introduces Residual Gated Graph ConvNets. By adopting a local aggregation strategy, GraphSAGE can capture neighbor information and extract local structural features of nodes. At the same time, it reduces the computational complexity through sampling to achieve high performance when processing large-scale traceability graphs. The Residual Gated Graph ConvNetss is introduced. Through its gating mechanism, it captures the long-range dependencies in the traceability graph and describes the complex interactions between nodes, which is consistent with APT attacks. By processing and integrating edge features through Residual Gated Graph ConvNets, the model takes into account both node features and edge information in the graph representation learning process, thereby improving the accuracy and reliability of APT detection. Step 4.2 Model training Use the subgraph with node features and edge features output from step 3 for training; Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels; One training will generate vector representations of all nodes and edges; the vector representations of node v and edge e are Z v and Z e ; where Z v is an N v dimensional vector, Z e is an N e dimensional vector; Combine the vector representations of all edges in the subgraph after a round of training to get a matrix Z; assuming there are N edges in the subgraph, the dimension of the matrix Z is N×N e ; One-hot encoding vector L of all edge labels in the subgraph e Put them together to get the matrix L; The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows: Where L ic represents the element in the i-th row and c-th column of the matrix L, Z ic represents the element in the i-th row and c-th column of the matrix Z; Then, through the back-propagation algorithm, the loss value is used to adjust the weight matrix and pooling parameters; For each round of training, the edge of the classification subgraph is used; specifically, when the vector Z e With vector L e When the distance ds is lower than the threshold d, the classification is considered correct; ds takes the L2 distance, and the calculation formula is as follows: ds=||Z e -L e ||2 Remove the correctly classified edges from the detection edge set, and simultaneously eliminate the corresponding edges in the subgraph; save the model at this time; use the remaining data in the subgraph to train a new model again, and repeat this process until the training subgraph is empty, and obtain multiple models; At the beginning of subsequent subgraph training, the subgraph is first verified in the existing model and the correctly classified edges are removed from it; by applying this pre-filtering strategy, the number of initial edges in the subgraph is reduced, thereby further reducing the number of models; Step 4.3 Anomaly Detection Use the model trained in step 4.2 to classify the type of each edge in turn; when an edge cannot be correctly classified by any existing sub-model, it is judged as an abnormality and its behavior structure diagram is output.

6. According to claim 4, the APT attack detection method based on traceability graph behavior information is characterized in that: The step 3.2.3 extracts the final edge feature vector from the behavior structure graph, specifically: First, the importance of the node is evaluated in each pooling step. The weight of each node is calculated based on the node's position in the entire graph structure, the connection relationship, and the node's attribute characteristics. Unimportant nodes will be gradually discarded. After discarding non-important nodes, information is aggregated between the remaining nodes so that the remaining graph maintains key structures and information; The pooling process is progressive, and the feature vector of the entire graph is obtained; The feature vector is then used as the edge feature vector of its corresponding edge, reflecting the semantic and structural information in the behavior structure graph.

Images