APT attack detection method based on traceability graph behavior information

Abstract

The present invention belongs to the field of network attack detection, and specifically relates to an APT attack detection method based on behavioral information of a provenance graph. It is divided into four steps: Step 1, data preprocessing; Step 2, subgraph generation; Step 3, behavioral feature extraction; feature extraction is performed on each subgraph, including node feature extraction and edge feature extraction; Step 4, classification model design, training, and anomaly detection; training and testing the classification model, using the trained model to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing submodel, it is judged to be abnormal, and its behavioral structure graph is output. The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, which goes beyond the traditional focus on entity interaction relationships; by introducing pooling methods and graph representation learning, the expression ability of the model is improved, so that it can more effectively capture important information in the behavioral structure and continuously optimize on the basis of the initial structural information.

Description

Technical Field

[0001] The present invention belongs to the field of network attack detection, and in particular relates to an APT attack detection method based on traceability graph behavior information. Background Art

[0002] In today's digital age, the widespread use of the internet and technological advancements have brought unprecedented convenience to people. However, at the same time, the forms and scale of cyberattacks have continued to evolve, becoming a serious threat to individual, corporate, and even national security. Among them, APT (Advanced Persistent Threat) attacks have become one of the greatest threats to modern computing security. Their primary characteristics are their "low and slow" attack patterns and the frequent use of zero-day vulnerabilities.

[0003] APT attacks typically target critical national infrastructure and organizations, such as network infrastructure and large enterprises in energy, electricity, finance, and defense sectors, which are crucial to national livelihoods or core national interests. These attacks pose a direct threat to national security and economic interests. These attacks utilize advanced techniques, long-term infiltration, and covert operations to obtain critical information and maintain a persistent presence in target systems. Attackers typically infiltrate target systems through exploitation of zero-day vulnerabilities and social engineering, maintaining a persistent presence and stealing sensitive information undetected.

[0004] APT attack patterns are more secretive and targeted than traditional network attacks.

[0005] Traditional APT attack detection methods primarily rely on static feature matching, such as specific signatures, patterns, or rules. This approach struggles to cope with the high variability and unknowns of APT attacks, and the cost of maintaining and updating the feature library is high. Furthermore, traditional methods use audit logs as their data source. The basic unit of data is the log entries, which exist only in temporal order. This approach cannot directly and effectively represent the interactions between entities in the system and lacks structural information, making it ineffective for detecting APT attacks. As an intuitive and efficient form of information representation, provenance graphs offer powerful semantic expression and the ability to correlate attack histories, offering unique advantages in APT detection. Provenance graphs visualize the system execution process by representing the interactions between system entities, facilitating causal analysis during detection. Furthermore, provenance graphs preserve the entire system execution history, making them suitable for addressing the long-lasting nature of APT attacks.

[0006] APT attack detection methods based on traceability graphs can be further divided into anomaly-based, rule-based, and tag propagation-based methods.

[0007] Among them, the technical solution closest to the present invention is an anomaly-based detection method. This method first deploys appropriate monitoring tools, such as intrusion detection systems and traffic probes, to collect network traffic and behavior data. The collected data is then used to construct a provenance graph that represents the various nodes in the network and the interactions between them. Based on historical provenance graph data, a machine learning method is used to learn a normal network behavior model. Finally, this model is used to detect deviations in the real-time provenance graph data. If the deviation exceeds a certain threshold, it is determined to be a behavioral anomaly and may be an APT attack.

[0008] In summary, anomaly-based detection methods learn models of benign behavior and detect anomalies based on deviations from the model, and have the ability to adapt to new attack characteristics and variant behaviors of APT.

[0009] The shortcomings of the above-mentioned prior art are:

[0010] The main problem facing current technology is that APT attack detection methods based on provenance graphs primarily focus on the interactions between system entities, using them for causal reasoning. Specifically, interactions between entities in a provenance graph are simply represented as edges. For example, process A accessing file B is represented in the provenance graph as an edge from A to B. However, in this process, critical behavioral information, such as the time of occurrence and the specific method of execution, is ignored or discarded. This simplified representation results in a loss of behavioral information, reducing detection accuracy and increasing false positives.

[0011] Secondly, current technologies have a relatively coarse detection granularity, primarily performing detection at the graph level, or at most at the node level, resulting in a slow response. Specifically, detection output typically indicates which graph or node is potentially vulnerable to an APT attack. Considering that a graph may contain tens of thousands of nodes, and a single node may initiate tens of thousands of actions, this coarse detection granularity makes it difficult for security analysts to quickly and accurately pinpoint the specific steps of an attack, even if the detection result is correct. This results in a long time between attack detection and response.

[0012] Finally, current technologies offer poor interpretability of detection results. This is primarily due to the use of highly abstract features to represent entities or behaviors during the detection process. Detection results typically only indicate the presence or absence of an APT attack, making it difficult for security analysts to understand the underlying reasons for the decision.

[0013] Traditional APT attack detection methods often rely on static feature matching, which results in high maintenance and update costs for feature libraries and makes it difficult to detect unknown threats. Existing APT attack detection methods based on provenance graphs fail to leverage information about interactions between entities, resulting in poor detection accuracy, efficiency, and interpretability. Summary of the Invention

[0014] In order to solve the technical problems existing in the prior art, the present invention provides an APT attack detection method based on traceability graph behavior information.

[0015] Technical solution of the present invention:

[0016] A four-step APT attack detection method based on traceability graph behavior information is as follows:

[0017] Step 1: Data preprocessing

[0018] Step 1.1: Data cleaning

[0019] Identify entities and events in logs and record them using unified identifiers; standardize all information fields, such as timestamp format and IP address representation, to ensure comparability of all data.

[0020] Step 1.2: Generate a traceability diagram

[0021] By structuring the input data into a graph, the correlation of system behavior is presented.

[0022] Step 2: Subgraph generation

[0023] To keep space overhead manageable in practical applications, the original provenance graph is divided into several subgraphs of manageable size for subsequent steps. Each event in the complete provenance graph is retrieved sequentially in chronological order. If the subject and object of the retrieved event are not already in the cached graph in the system memory, they are added as new nodes to the cached graph, an edge is added between the new nodes, and the timestamps of the actions are assigned to these new nodes. If the subject and object of the retrieved event already exist in the cached graph, only their timestamps are updated to ensure that the timestamps are consistent with the latest action time.

[0024] Step 3: Behavioral feature extraction

[0025] After generating the subgraphs, feature extraction is performed on each subgraph, including node feature extraction and edge feature extraction.

[0026] Step 4: Classification model design, training, and anomaly detection

[0027] The subgraph with node and edge features output in step 3 is used for training and testing the classification model. In the anomaly detection stage, the trained model is used to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing sub-model, it is judged as an anomaly and its behavioral structure graph (BSG) is output.

[0028] Beneficial effects

[0029] The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, going beyond the traditional focus on entity interactions. In addition to capturing the basic interactive relationships between entities, the present invention also takes into account behavioral attributes, namely key features such as the time and manner in which the behavior occurs. Furthermore, the present invention takes the relationship between behavioral attributes into consideration and constructs behavioral structural information. By examining the associations between different behavioral attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects a more detailed contextual background into each behavioral entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0030] By introducing pooling methods and graph representation learning, the expressive power of the model is improved, enabling it to more effectively capture important information in the behavioral structure and continuously optimize based on the initial structural information.

[0031] This paper innovatively employs a randomized approach, specifically an ER random graph model, to initialize behavioral structure information. Ensuring that the initial behavioral structure graph (BSG) is a connected graph ensures that each behavioral attribute has a potential association path, avoiding premature exclusion of certain attribute associations from analysis at the initial stage.

[0032] This invention introduces more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-layered, multi-dimensional information structure within the model, enriching and diversifying the information hierarchy of the provenance graph. During the learning process, the model can more meticulously distinguish between normal behavior and APT attack behavior, improving overall judgment accuracy.

[0033] The present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack positioning shortens the time from detection to response, can locate the specific location and time when the attack behavior occurs, and improves the system's real-time perception of threats.

[0034] When the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationships between them. It then explains this key behavior information for determining the APT attack behavior, making the judgment criteria easier to understand. The APT attack behavior attributes and their relationships can also be displayed in graphical form, allowing security analysts to more intuitively understand abnormal behavior through visualization. By clearly presenting these key attributes, the system provides security analysts with a more detailed description of APT attack activities, making the results more interpretable. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1A schematic diagram of the steps of an edge-level APT detection method based on traceability graph behavior information is shown in the present invention;

[0036] Figure 2 A schematic diagram of the process of an edge-level APT detection method based on traceability graph behavior information of the present invention is shown;

[0037] Figure 3 Shown Figure 1 The middle line is a schematic diagram of the feature extraction process. DETAILED DESCRIPTION

[0038] The technical solution provided by this application will be further described below in conjunction with specific embodiments and accompanying drawings. The advantages and features of this application will become more apparent with reference to the following description.

[0039] An APT attack detection method based on traceability graph behavior information is divided into four steps: data preprocessing step, subgraph generation step, behavior feature extraction step and classification model design, training and anomaly detection step.

[0040] Step 1: Data preprocessing

[0041] Step 1.1: Data cleaning

[0042] First, considering that raw system log data may come from multiple different data sources, the log formats of different systems may differ, resulting in heterogeneity. To facilitate subsequent analysis and processing, the present invention first identifies the entities and events in the logs and records them using unified identifiers. Second, all information fields are standardized, such as using a unified timestamp format and IP address representation, to ensure that all data is comparable.

[0043] Step 1.2: Generate a traceability diagram

[0044] By structuring the input data into a graph, the correlation of system behavior is presented. The details are as follows:

[0045] First, the cleaned data from step 1.1 is mapped into entities and events, with each entity considered a node in the graph and events as edges connecting the nodes. Then, after all entities are mapped to nodes, edges are added sequentially based on the causal relationships between events (for example, if entity A initiates an interaction with entity B, a directed edge from A to B is added). This constructs a traceability graph that reflects the interactions and evolutionary paths of each entity within the system.

[0046] Step 2: Subgraph generation

[0047] In practical applications, as the system runs, the size of the system log continues to increase, which also means that the corresponding traceability graph generated in step 1.2 will also become larger and larger. In order to control the space overhead during practical application, the present invention divides the original traceability graph into several subgraphs of controllable size for subsequent steps.

[0048] Specifically, the present invention stores the complete traceability graph generated in step 1.2 in the system disk, and maintains a cache graph in the system memory. The present invention retrieves each event of the complete traceability graph in chronological order. If the subject and object of the retrieved event have not been added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the new nodes, and the timestamps of the behavior are assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only their timestamps are updated to ensure that the timestamps are consistent with the latest behavior time.

[0049] Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, the cached graph at this time is saved as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the i-th cached graph reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S i Repeat until all the traceability graph data on disk is processed.

[0050] After the above processing for each traceability graph, we can get the subgraph set {S0, S1, ... S n During subsequent training, each subgraph is trained. In this way, during training, the present invention only needs to store a subgraph of a limited size in memory, thereby ensuring scalability.

[0051] Step 3: Behavioral feature extraction

[0052] After generating the subgraph, feature extraction is performed on each subgraph, which is divided into node feature extraction and edge feature extraction.

[0053] Step 3.1 Node feature extraction

[0054] For the characteristics of nodes in the subgraph, first count the number of node types and edge types in the graph as N n and N e . Set function X v and X e Map each node and edge to its type as follows. Σ V and Σ E Represents a collection of node types and edge types respectively.

[0055] X v :V→ΣV

[0056] X e :E→Σ E

[0057] Set the mapping function M v and M e Map node types and edge types to 0 to N respectively n -1 and 0~N e An integer between -1.

[0058] M v :Σ V →N

[0059] M e :Σ E →N

[0060] Nodes in the subgraph The eigenvectors of are set as:

[0061] [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a Ne*2-1 ]

[0062] where a i The calculation formula is as follows:

[0063]

[0064] To illustrate, a node's feature vector is divided equally into two parts: each dimension in the first half corresponds to the in-degree of a certain type of edge at the node, and each dimension in the second half corresponds to the out-degree of a certain type of edge at the node. It is believed that by using the node's degree distribution as a feature vector, we can statistically characterize the node's interactive behavior.

[0065] Step 3.2 Edge feature extraction

[0066] An edge in the subgraph represents an interaction between entities, also known as a behavior. Behaviors have four main attributes: the subject performing the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each of these main attributes can be further divided into more specific attributes, which together constitute the behavior attributes.

[0067] In previous APT attack detection work, behavioral attribute information is often ignored, or each behavioral attribute is analyzed independently. However, the present invention believes that there is an important correlation between behavioral attributes, and this correlation plays a key role in APT attack detection. For example, an abnormal process reads system files late at night. If only its runtime attributes (such as running late at night) or only its behavior type attributes (such as reading system files) are considered, important contextual information will be lost. Only by combining the time attributes with the behavior type attributes for comprehensive analysis can potential threat behaviors be accurately identified. This multi-dimensional correlation analysis helps to improve the accuracy and precision of detection, thereby more effectively responding to complex APT attacks.

[0068] Therefore, the present invention proposes a new concept of Behavior Structure Graph (BSG) for the first time. A Behavior Structure Graph (BSG) is composed of various behavioral attributes of a single behavior and the connections between them, where each behavioral attribute is mapped to a node in the Behavior Structure Graph (BSG), and the connections between behavioral attributes are mapped to edges between corresponding nodes in the Behavior Structure Graph (BSG). By constructing a Behavior Structure Graph (BSG), the present invention can map the relationship between behavioral attributes into the graph structure information of the Behavior Structure Graph (BSG), and more effectively capture the hidden threat patterns and correlations in the behavior. By analyzing the Behavior Structure Graph (BSG) of each edge in the subgraph, the present invention constructs its corresponding feature vector. The process is as follows: Figure 3 shown.

[0069] Step 3.2.1 Initialize Behavior Structure Graph (BSG)

[0070] For each edge in the subgraph, or in other words, each behavior, its behavior attribute information is identified and recorded. The behavior structure graph (BSG) is initially a zero-node zero-graph. Whenever a behavior attribute is identified, a new node corresponding to this behavior attribute is added to the behavior structure graph (BSG). Assuming a behavior has x behavior attributes, the corresponding behavior structure graph (BSG) is constructed as an undirected graph with x nodes and 0 edges.

[0071] Step 3.2.2 Construct semantic and structural information of behavior structure graph (BSG)

[0072] Step 3.2.2.1 Constructing semantic information

[0073] Traverse each node in the behavior structure graph (BSG) in turn, and convert the behavior attribute corresponding to the node into a sentence in a unified format. Specifically, the embodiment converts non-alphanumeric symbols of the behavior attribute text into spaces, for example: converting the file path " / etc / tmp / log.txt" into the sentence "etc tmp log txt". For each such sentence, use FastText to embed it into a numerical vector. Specifically, FastText is a word vector and text classification tool open sourced by Facebook, which can convert words into numerical vectors, that is, extract semantic information from the text. The present invention uses FastText to convert each word in the sentence into a numerical vector, and then adds and averages the numerical vectors of all words to obtain the feature vector of the sentence. The feature vector of this sentence is used as the feature vector of the corresponding node in the behavior structure graph (BSG).

[0074] Step 3.2.2.2 Build structural information

[0075] Considering the various uncertainties inherent in behavioral attributes, and inspired by the practice of rGINs (graph isomorphism networks with random features) that enhance the expressive power of GNNs by adding random features to each node, this paper employs the ER random graph model to randomly initialize the structural information of the behavior structure graph (BSG). Specifically, by traversing each node pair in the BSG and generating edges with a random probability p, the structural information of the behavior structure graph (BSG) is ultimately obtained.

[0076] It is worth noting that here, p is set to a constant value greater than log(x) / x, which theoretically ensures that the behavior structure graph (BSG) is a connected graph. The connectivity between any two nodes in the connected graph ensures that the potential relationship between any two behavior attributes is not ignored during initialization.

[0077] Step 3.2.3 Extract the final edge feature vector from the behavior structure graph (BSG)

[0078] In order to integrate the semantic information and structural information in the behavior structure graph (BSG) into the final edge feature vector, the present invention applies a pooling method based on multiple node discarding to the behavior structure graph (BSG). The pooling method is divided into multiple pooling steps. By gradually discarding non-important nodes and aggregating the information of the remaining important nodes based on the graph structure, the feature vector of the entire behavior structure graph (BSG) is obtained.

[0079] Specifically, the importance of the nodes is first evaluated in each pooling step, and the weight value of each node is calculated based on the node's position in the entire graph structure, the connection relationship, and the node's attribute characteristics. Through this evaluation mechanism, unimportant nodes will be gradually discarded. These nodes usually play a secondary role in the graph and have little impact on the global characteristics of the graph. After discarding unimportant nodes, information is aggregated between the remaining nodes, so that the remaining graph can simplify the computational complexity while maintaining key structure and information. The pooling process is progressive. As the steps proceed, the number of nodes in the graph gradually decreases, and finally a feature vector for the entire graph is obtained. This feature vector is then used as the edge feature vector of its corresponding edge, thereby more comprehensively reflecting the semantic and structural information in the behavior structure graph (BSG).

[0080] Step 4: Classification model design, training, and anomaly detection

[0081] The subgraph with node features and edge features output in step 3 is used for training and testing of the classification model.

[0082] Step 4.1 Model design

[0083] The model design of this invention is based on GraphSAGE (existing technology) and incorporates Residual Gated Graph ConvNets (existing technology) to better address the challenges of APT attack detection. Specifically, by combining the efficiency of GraphSAGE with the deep modeling capabilities of Residual Gated Graph ConvNets, the model designed by this invention can not only efficiently process large-scale provenance graphs, but also more comprehensively capture the complex dependencies in the graph, improving the overall representation capabilities and providing stronger support for APT attack detection.

[0084] GraphSAGE is a well-known and simple graph neural network that aggregates and updates the representation of a target node by sampling features from neighboring nodes. Its local aggregation strategy enables GraphSAGE to effectively capture neighbor information and extract local structural features of nodes. It also reduces computational complexity through sampling, ensuring efficient performance when processing large-scale provenance graphs. However, in the provenance graph scenario of this problem, GraphSAGE itself has limitations in handling edge features and long-range dependencies.

[0085] To address this issue, this paper introduces Residual Gated Graph ConvNets. Through its gating mechanism, it effectively captures long-range dependencies in the provenance graph and accurately depicts the complex interactions between nodes. This is highly consistent with the long latency and complex attack methods of APT attacks. Furthermore, Residual Gated Graph ConvNets can process and integrate edge features, allowing the model to not only focus on node features during graph representation learning but also leverage edge information, further improving the accuracy and reliability of APT detection.

[0086] Step 4.2 Model training

[0087] The model of the present invention is trained using the subgraph with node features and edge features outputted in step 3.

[0088] Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels.

[0089] One training will generate vector representations of all nodes and edges. The vector representations of node v and edge e are Z v and Z e . Where Z v is an N v dimensional vector, Z e is an N e dimensional vector.

[0090] Combine the vector representations of all edges in the subgraph after one round of training to obtain a matrix Z. Assuming that there are N edges in the subgraph, the dimension of the matrix Z is N×N e Similarly, the one-hot encoding vector L of all edge labels in the subgraph can be e Put them together to get the matrix L.

[0091] The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows:

[0092]

[0093] Among them L ic represents the element in the i-th row and c-th column of the matrix L, Z ic Represents the element in the i-th row and c-th column of the matrix Z.

[0094] Then, the weight matrix and pooling parameters are adjusted using the loss value through the back-propagation algorithm.

[0095] For each round of training, the edge of the classification subgraph is used. Specifically, when the vector Z e With vector L eWhen the distance ds is lower than the threshold d, the classification is considered correct. ds takes the L2 distance, and the calculation formula is as follows:

[0096] ds=||Z e -L e ||2

[0097] Correctly classified edges are removed from the detection edge set, and the corresponding edges in the subgraph are also removed. The resulting model is saved. A new model is trained again using the remaining data in the subgraph, and this process is repeated until the training subgraph is empty. In this way, the present invention can generate multiple models.

[0098] Note that at the beginning of subsequent subgraph training, the present invention first verifies the subgraph in the existing model and removes correctly classified edges from it.

[0099] This strategy is based on the assumption that the previous model has already learned the representations of the deleted edges, eliminating the need to retrain them. By applying this pre-filtering strategy, the present invention reduces the number of initial edges in the subgraph, further reducing the number of models. More broadly, the present invention only uses a subgraph for training when there are edges in the subgraph that none of the current models can correctly classify. This is an incremental process that prevents the generation of "redundant" models.

[0100] Step 4.3 Anomaly Detection

[0101] In the anomaly detection phase, the present invention uses the model trained in step 4.2 to classify the type of each edge in turn. When an edge cannot be correctly classified by any of the existing sub-models, it is determined to be an anomaly and its behavior structure graph (BSG) is output.

[0102] The key points, innovations and advantages of the above technical solutions are:

[0103] 1. Utilization of Behavioral Attributes and Their Structural Information

[0104] The present invention introduces behavioral attributes and their structural information in the modeling of the provenance graph, going beyond the traditional focus on entity interactions. In addition to capturing the basic interactive relationships between entities, the present invention also takes into account behavioral attributes, namely key features such as the time and manner in which the behavior occurs. Furthermore, the present invention takes the relationship between behavioral attributes into consideration and constructs behavioral structural information. By examining the associations between different behavioral attributes, the present invention increases the understanding of the internal structure of the behavior and improves the density of information. The introduction of this information increases the level of the provenance graph and injects a more detailed contextual background into each behavioral entity. This rich and structured information hierarchy provides a more rigorous and detailed foundation for subsequent APT attack detection and analysis.

[0105] 2. Optimized Behavior Structure of Pooling and Graph Representation Learning

[0106] By introducing pooling methods and graph representation learning, this paper optimizes behavioral structure information. The pooling method repeatedly discards nodes to obtain the feature vector of the entire behavioral structure graph (BSG), retaining the attributes and relationships that contribute most to the discrimination of normal and abnormal behavior. This step improves the model's expressiveness, enabling it to more effectively capture important information in the behavioral structure and continuously optimize based on the initial structural information.

[0107] 3. Random method to initialize behavior structure information

[0108] This invention innovatively adopts a randomized approach, specifically the ER random graph model, to initialize behavioral structure information. This design takes into account the various uncertain associations between behavioral attributes in reality, introduces a certain probability into the relationship between each pair of behavioral attributes, and from the perspective of information theory, helps to cover a wider range of information space in the initial stage. Ensuring that the initial behavioral structure graph (BSG) is a connected graph ensures that each behavioral attribute has a potential association path, avoiding the premature exclusion of certain attribute associations from the analysis in the initial stage.

[0109] 4. Improved judgment accuracy

[0110] Traditional provenance graph modeling methods focus primarily on the basic interactions between entities, while this invention introduces more detailed and comprehensive behavioral attributes and their structural information. These behavioral attributes form a multi-level, multi-dimensional information structure in the model, making the provenance graph's information level richer and more diverse.

[0111] Behavioral attributes include key characteristics such as the time and manner in which the behavior occurred, information often overlooked in traditional methods. By describing each behavioral attribute in detail, the system can more comprehensively understand the behavior between entities during the modeling and training phases. For example, it can not only determine that process A accessed file B, but also understand when and how this operation occurred, providing more detailed context.

[0112] The relationships between behavioral attributes form behavioral structural information. By considering the interrelationships between behavioral attributes, the model can capture more complex and in-depth behavioral patterns. This structural information not only provides insights into potential connections between behaviors but also enables the model to better understand the differences between normal and APT attack patterns during training.

[0113] The richness of the structural information directly affects the accuracy of the judgment.

[0114] By incorporating more behavioral attributes and structural information, the model can more precisely distinguish between normal behavior and APT attack behavior during learning. This detailed behavioral description enables the system to more accurately identify potential threats and APT attacks, improving overall judgment accuracy.

[0115] 5. Finer judgment granularity

[0116] Traditional traceability graph detection methods perform APT attack detection at the graph or node level. After detecting an APT attack, security analysts are still required to specifically locate the attack activity, which reduces processing efficiency. Edge-level determination, on the other hand, helps quickly discover APT attack activities. That is, when an APT attack activity occurs, the present invention does not need to traverse the entire graph, but can quickly locate the specific edge where the APT attack behavior is located. This precise attack location shortens the time from detection to response, can locate the specific location and time of the attack behavior, and improves the system's real-time perception of threats.

[0117] 6. Explainability

[0118] When the present invention detects an APT attack, it not only outputs the result of detecting the APT attack behavior, but also outputs the key attributes related to the APT attack and the relationships between them. For example, the output result shows that the interaction between a specific process and a file may be an APT attack, and then explains the key behavior information for determining such an APT attack behavior, making the judgment criteria easier to understand. The APT attack behavior attributes and the relationships between them can also be displayed in graphical form, allowing security analysts to understand abnormal behavior more intuitively through visualization. By clearly presenting these key attributes, the system provides security analysts with a more detailed description of APT attack activities, making the results more explainable.

[0119] Explanation of terms in the text:

[0120] APT: Advanced Persistent Threat (APT) is a form of attack that uses advanced attack methods to carry out long-term persistent network attacks on specific targets. It contains three elements: advanced, long-term, and threatening.

[0121] Behavior: refers to the operations between entities in the system, which can be expressed as a quad<subject,object,time,operation> Representation, namely, the subject, object, time, and content of the action. Subject and object: A subject is an entity in the system that performs an action on another entity, called an object. Subject and object are relative; the subject of one action can be the object of another. A subject can be a process, thread, or other object; an object can be a file, socket, or other object. The types of subject and object may vary depending on the operating system.

[0122] Provenance Graph: A provenance graph is a collection of all subjects, objects, and behaviors, which can be represented by G=<S,O,E> In the provenance graph, S represents the set of subjects, O represents the set of objects, and E represents the set of actions. In the provenance graph, subjects and objects are represented as nodes, while actions are represented as edges. Multiple edges may exist between two nodes, with different times or operations.

[0123] ER random graph: Erdos-Renyi random graph is named after two famous Hungarian mathematicians Paul The simplest and most commonly used method for generating random undirected graphs is named after A. Rényi, and includes the following two closely related variants:

[0124] ●G np : An undirected graph with n nodes and edges (u,v) generated with independent and identically distributed probability p

[0125] ●G nm : An undirected graph with n nodes and m edges sampled from a uniform distribution.

[0126] GNN: Graph Neural Network (GNN) refers to a general term for algorithms that use neural networks to learn graph-structured data, extract and discover features and patterns in graph-structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0127] NLP: Natural Language Processing (NLP) is a key area of ​​research in computer science and artificial intelligence. It studies theories and methods that enable effective communication between humans and computers using natural language. For example, FastText is an example.

[0128] One-hot encoding: One-hot encoding, also known as one-bit effective encoding, uses an N-bit state register to encode N states. Each state has its own independent register bit, and at any time, only one of them is valid.

Claims

1. A method for detecting APT attacks based on traceability graph behavior information, characterized in that: It is divided into four steps, as follows: Step 1: Data preprocessing Step 1.1: Data cleaning Identify entities and events in the logs and record them using unified identifiers; standardize all information fields to ensure that all data is comparable; Step 1.2: Generate a traceability diagram By structuring the input data into a graph, the correlation of system behavior is presented; Step 2: Subgraph generation The original provenance graph is divided into several subgraphs of controllable size. Each event in the complete provenance graph is retrieved in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the new nodes. At the same time, the timestamp of the behavior is assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only the timestamp is updated; Step 3: Behavioral feature extraction After generating the subgraph, feature extraction is performed on each subgraph, including node feature extraction and edge feature extraction; Step 4: Classification model design, training, and anomaly detection The subgraph with node features and edge features output in step 3 is used for training and testing the classification model. In the anomaly detection stage, the trained model is used to classify the type of each edge in turn. When an edge cannot be correctly classified by any existing sub-model, it is judged as an anomaly and its behavior structure diagram is output.

2. The APT attack detection method based on traceability graph behavior information according to claim 1 is characterized in that: In step 2, each event in the complete traceability graph is retrieved in chronological order. If the subject and object of the retrieved event are not added to the cache graph in the system memory, they are added as new nodes to the cache graph, and an edge is added between the new nodes. At the same time, the timestamp of the behavior is assigned to these new nodes. If the subject and object of the retrieved event already exist in the cache graph, only the timestamp is updated to ensure that the timestamp is consistent with the latest behavior time; Set the node threshold to n and the forgetting rate to fr. When the number of nodes in the cached graph reaches the preset threshold n, save the cached graph at this time as the first subgraph S0. As new nodes are continuously added to the disk, whenever the number of nodes in the i-th cached graph reaches n×(1+fr), the n×fr nodes with the oldest timestamps are discarded, and the remaining n nodes and the edges between them are saved to the new subgraph S. i Repeat until all traceability graph data on disk is processed; After the above processing for each traceability graph, we can obtain the subgraph set {S0, S1,…Sn}.

3. The APT attack detection method based on traceability graph behavior information according to claim 1 is characterized in that: Step 3 includes the following steps: Step 3.1 Node feature extraction For the characteristics of nodes in the subgraph, first count the number of node types and edge types in the graph as N n and N e ; Set function X v and X e As follows, each node and edge is mapped to its type, Σ V and Σ E Represents a collection of node types and edge types respectively: X v :V→Σ V X e :E→Σ E Set the mapping function M v and M e Map node types and edge types to 0 to N respectively n -1 and 0~N e Integer between -1; M v :S V →N M e :S E →N Nodes in the subgraph The eigenvectors of are set as: [a0,a1,…,a Ne-1 ,a Ne ,a Ne+1 ,…,a Ne*2-1 ] where a i The calculation formula is as follows: The node's feature vector is evenly divided into two parts, each dimension of the first half corresponds to the in-degree of a certain type of edge on the node, and each dimension of the second half corresponds to the out-degree of a certain type of edge on the node. By using the node's degree distribution as the feature vector, the interaction behavior characteristics of the node are statistically represented. Step 3.2 Edge feature extraction An edge in the subgraph represents an interaction event between entities, also known as a behavior. A behavior has four main attributes: the subject performing the behavior, the object of the behavior, the time when the behavior occurs, and the specific content of the behavior. Each of these main attributes is further divided into more specific attributes, which together constitute the behavior attributes. Map the relationships between behavior attributes into the graph structure information of the behavior structure graph to capture the threat patterns and correlations hidden in the behavior; and construct the corresponding feature vector by analyzing the behavior structure graph of each edge in the subgraph. The behavior structure graph is composed of various behavior attributes of a single behavior and the connections between them, wherein each behavior attribute is mapped to a node in the behavior structure graph, and the connections between behavior attributes are mapped to edges between corresponding nodes in the behavior structure graph.

4. The APT attack detection method based on traceability graph behavior information according to claim 3 is characterized in that: Step 3.2 includes the following steps: Step 3.2.1 Initialize the behavior structure diagram For each edge in the subgraph, that is, each behavior, its behavior attribute information is identified and recorded; the behavior structure graph is initially a zero-node zero-graph. Whenever a behavior attribute of the behavior is identified, a new node is added to the behavior structure graph, and the node corresponds to this behavior attribute. Assuming that a behavior has x behavior attributes, the corresponding behavior structure graph is constructed as an undirected graph with x nodes and 0 edges; Step 3.2.2 Construct semantic and structural information of the behavior structure diagram Step 3.2.2.1 Constructing semantic information Traverse each node in the behavior structure diagram in turn, convert the behavior attributes corresponding to the node into sentences in a unified format, and then use natural language processing technology to extract its semantic information; Step 3.2.2.2 Build structural information The ER random graph model is used to randomly initialize the structural information of the behavior structure graph. Specifically, by traversing each node pair in the behavior structure graph and generating edges with a random probability p, the structural information of the behavior structure graph is finally obtained. Step 3.2.3 Extract the final edge feature vector from the behavior structure graph A pooling method based on multiple node discarding is used for the behavior structure graph. This pooling method is divided into multiple pooling steps. By gradually discarding non-important nodes and aggregating the information of the remaining important nodes based on the graph structure, the feature vector of the entire behavior structure graph is obtained.

5. The APT attack detection method based on traceability graph behavior information according to claim 1 is characterized in that: Step 4 includes the following steps: Step 4.1 Model design Based on GraphSAGE, it also introduces Residual Gated Graph ConvNets. By adopting a local aggregation strategy, GraphSAGE can capture neighbor information and extract local structural features of nodes. At the same time, it reduces computational complexity through sampling to achieve high performance when processing large-scale provenance graphs. The introduction of Residual Gated Graph ConvNets uses a gating mechanism to capture long-range dependencies in the traceability graph and characterize the complex interactions between nodes, which is consistent with APT attacks. By processing and integrating edge features through Residual Gated Graph ConvNets, the model considers both node features and edge information during graph representation learning, thereby improving the accuracy and reliability of APT detection. Step 4.2 Model training Use the subgraph with node features and edge features output in step 3 for training; Calculate the one-hot encoding vectors of nodes and edges in the subgraph respectively and use them as their respective labels; One training will generate vector representations of all nodes and edges; the vector representations of node v and edge e are Z v and Z e ; where Z v is an N v dimensional vector, Z e is an N e dimensional vector; Combine the vector representations of all edges in the subgraph after one round of training to obtain a matrix Z; assuming there are N edges in the subgraph, the dimension of the matrix Z is N×N e ; One-hot encoding vector L of all edge labels in the subgraph e Collect them together to get the matrix L; The loss function Loss is obtained by calculating the cross entropy loss function of the matrix Z and the matrix L, as follows: Among them L ic represents the element in the i-th row and c-th column of the matrix L, Z ic Represents the element in the i-th row and c-th column of the matrix Z; Then, through the back-propagation algorithm, the loss value is used to adjust the weight matrix and pooling parameters; For each round of training, the edge of the classification subgraph is used; specifically, when the vector Z e With vector L e When the distance ds is lower than the threshold d, the classification is considered correct; ds takes the L2 distance, and the calculation formula is as follows: ds=||Z e -L e ||2 Remove the correctly classified edges from the detection edge set, and simultaneously eliminate the corresponding edges in the subgraph; save the current model; use the remaining data in the subgraph to train a new model again, and repeat this process until the training subgraph is empty, thus obtaining multiple models; At the beginning of subsequent subgraph training, the subgraph is first verified in the existing model and the correctly classified edges are removed from it; by applying this pre-filtering strategy, the number of initial edges in the subgraph is reduced, thereby further reducing the number of models; Step 4.3 Anomaly Detection Use the model trained in step 4.2 to classify the type of each edge in turn; when an edge cannot be correctly classified by any existing sub-model, it is judged as an anomaly and its behavior structure diagram is output.

6. The APT attack detection method based on traceability graph behavior information according to claim 4 is characterized in that: The step 3.2.3 extracts the final edge feature vector from the behavior structure graph, specifically: First, the importance of the nodes is evaluated in each pooling step. The weight of each node is calculated based on its position in the entire graph structure, its connection relationship, and its attribute characteristics. Unimportant nodes are gradually discarded. After discarding non-important nodes, information is aggregated between the remaining nodes so that the remaining graph maintains key structures and information; The pooling process is progressive, and the feature vector of the entire graph is obtained; The feature vector is then used as the edge feature vector of its corresponding edge, reflecting the semantic and structural information in the behavior structure graph.

Images