APT attack detection and tracing method based on log

Abstract

The invention discloses a log-based APT attack detection and tracing method, and belongs to the technical field of attack detection. In order to solve the problems of high efficiency, fine granularity and accuracy of APT attack detection, the method comprises the following steps: acquiring original system log data, and then preprocessing the original system log data to obtain a data set; and constructing a traceability graph based on the four operation types. The four operation types comprise file operation, process operation, authority operation and network operation; performing node anomaly detection by using a BERT model and a VAE model to obtain a threat node set; and based on the obtained threat node set and the traceability graph, obtaining an attack path comprising all threat nodes by using a Steiner tree algorithm. The method is suitable for learning under the condition that a large number of labeled samples and priori knowledge do not exist, the problem that a traditional algorithm cannot detect zero-day attacks can be solved, and a simple APT attack path traceability graph can be extracted from a large number of system logs.

Description

Technical Field

[0001] The present invention belongs to the technical field of attack detection, and in particular relates to a log-based APT attack detection and tracing method. Background Art

[0002] Advanced Persistent Threat (APT) is a highly targeted, well-organized, sophisticated, concealed and long-lasting cyber attack. Currently, APT attacks are gradually penetrating into important industries, the number of application vulnerabilities and high-risk zero-day vulnerabilities is increasing, and the exploitation of vulnerabilities is becoming increasingly active. At present, many companies are increasingly relying on active defense technologies, such as intrusion prevention systems (IPS), security information and event management (SIEM) tools, identity and access management tools, and web application firewalls (WAF). However, these methods are not very effective in detecting APT attacks, because APT attacks have three characteristics: 1. Advanced. The professional knowledge, methods and tools used by the attackers are all advanced. 2. Persistence. Usually an advanced persistent threat activity will last for a long time, from a few months to even years. 3. Concealment. Advanced persistent threats will use defense bypass technology to evade the defense deployment of the target system and gradually infiltrate through information collection, phishing and other methods.

[0003] Traditional APT attack detection has major flaws. It can only respond passively, and due to the lack of information about APT attack organizations, the defense effect is not good. Traditional APT attack detection mainly faces two types of challenges. One is that intrusion detection tools generate a large number of false alarms, resulting in a backlog of investigation tasks. At the same time, due to the large workload of confirming the authenticity of threat alarms, threat alarm fatigue occurs. In addition, the ratio of attack events to benign events in a large amount of data is extremely unbalanced. More than 99% of events are unrelated to attacks introduced by benign system activities. Using traditional APT attack detection tools will result in a high false positive rate and fail to detect imitation attacks. For example, attackers use PowerShell to run malicious scripts. However, system administrators can also use PowerShell to maintain the system. Traditional detection solutions (such as configuring blacklist rules) do not work because it is impossible to distinguish whether the attacker or the system administrator uses PowerShell. Another challenge is that it is difficult to process data with a long attack span, so it is impossible to identify malicious features and restore the attack chain. Traditional APT attack detection algorithms can only have limited or even no understanding of the contextual information of low-level anomalies. Because they are usually designed to detect a single attack or method, rather than multiple interconnected malicious threats. In attack tracing, contextual information is crucial. Based on this associated information, the complete chain of attack events can be displayed. Summary of the invention

[0004] The problem to be solved by the present invention is to achieve high efficiency, fine granularity and accuracy in APT attack detection, and propose a log-based APT attack detection and tracing method.

[0005] To achieve the above object, the present invention is implemented through the following technical solutions:

[0006] A log-based APT attack detection and tracing method includes the following steps:

[0007] S1. Collecting original system log data, and then preprocessing the original system log data to obtain a data set;

[0008] S2. For the data set obtained in step S1, a traceability graph is constructed based on four types of operations. The four types of operations include file operations, process operations, permission operations, and network operations;

[0009] S3. For the traceability graph obtained in step S2, use the BERT model and the VAE model to perform node anomaly detection and obtain a set of threat nodes;

[0010] S4. Based on the threat node set obtained in step S3 and the traceability graph obtained in step S2, the attack path including all threat nodes is obtained using the Steiner tree algorithm.

[0011] Furthermore, the preprocessing process of step S1 is to convert the original log records into log records in a standardized format.

[0012] Furthermore, the specific implementation method of step S2 includes the following steps:

[0013] S2.1. First, initialize and establish an empty traceability graph;

[0014] S2.2. From the logs in the data set obtained in step S2.1, determine the operation type, including file operation FILE_OP, process operation PROCESS_OP, permission operation PERM_OP, and network operation NET_OP;

[0015] S2.3. For each operation whose operation type is determined in step S2.2, create nodes and edges in the traceability graph, and add nodes to the traceability graph, where the types of the nodes include process, file, and network;

[0016] S2.4. Set the node attributes and node identifiers for the node created in step S2.3, and then add edges to the traceability graph. The edge attributes include the operation type and timestamp. The operation type is evt.type in the log.

[0017] S2.5. Check whether the traceability graph is a directed acyclic graph DAG. If so, remove the loop, then save the traceability graph in the format of Node-Link.json, and add the command line text in all node identifiers extracted from the log to the file command_line.json, and add the combination of file path, IP and port to the file object.json to obtain the traceability graph and node identifier set, where the node identifier set is the command line text or file path or IP address and port combination corresponding to the node.

[0018] Furthermore, the specific implementation method of step S3 includes the following steps:

[0019] S3.1. Use the WordPiece algorithm in the BERT word segmenter to perform word segmentation on the source graph and node identification set obtained in step S2 to obtain a word segmentation sequence;

[0020] S3.2. For the word segmentation sequence obtained in step S3.1, add a start tag [CLS] at the beginning of the word segmentation sequence and add an end tag [SEP] at the end of the sequence to obtain a marked word segmentation sequence;

[0021] S3.3.BERTTokenizer converts the tokenized word sequence into integer IDs, and converts the tokenized word sequence into token identifiers Token IDs; for two tokenized word sequences input at the same time, it generates segment identifiers Segment IDs to distinguish the two tokenized word sequences; then pads all tokenized word sequences to the specified input length, including truncating tokenized word sequences whose length is greater than the specified input length, and padding sentences of insufficient length with [PAD] tags to obtain Attention Masks;

[0022] S3.4. Input the Token IDs, Segment IDs, and Attention Masks obtained in step S3.3 into the BERT model, and perform preprocessing according to three pre-training tasks, including next sentence prediction NSP, masked language model MLM, and hypersphere volume minimization VHM, to obtain word vectors representing Token Embeddings, paragraph vectors representing Segment Embeddings, and position vectors representing Position Embeddings, and then add the elements together to obtain a merged sequence to obtain a merged sequence set as the input of the BERT Transformer layer;

[0023] S3.5. Based on the merged sequence set obtained in step S3.4, the BERT-base-cased model is used as the base model for training, and the trained model is obtained as a general language model for understanding log semantics and context;

[0024] S3.6. Input the last hidden state last_hidden_states of the general language model for understanding log semantics and context obtained in step S3.5 into the variational autoencoder VAE model for training, and obtain the trained variational autoencoder VAE model as a model for attack node detection;

[0025] S3.7. Based on the trained BERT model and VAE model, the traceability graph obtained in step S2 is tested to obtain a set of threat nodes.

[0026] Furthermore, the specific implementation method of step S3.5 includes the following steps:

[0027] S3.5.1. For the BERT-base-cased model, set the optimizer optimizer, set the learning rate learn_rate, and specify the training period epochs as 10;

[0028] S3.5.2. Determine the amount of data batch_size for each batch of processing, randomly shuffle the processed log set processed_logs data in each epoch, and use the data loader data_loader to load the data batch_data of each batch;

[0029] S3.5.3. In each training cycle, input each batch_data into the BERT-base-cased model, obtain the output BERT_outputs, calculate the MLM, NSP, and VHM losses from BERT_outputs, and backpropagate the total loss loss.backward();

[0030] S3.5.4. Execute the optimization step optimizer.step() to update the model parameters, use the learning rate scheduler scheduler.step() to update the learning rate scheduler, and then clear the gradient optimizer.zero_grad() to clear the gradient of the model parameters. After the training is completed, save the BERT model locally.

[0031] Furthermore, the specific implementation method of step S3.6 includes the following steps:

[0032] S3.6.1. Initialize a VAE model. In each epoch, obtain the input token IDinput_ids, token typetoken_type, attention maskattention_maskand labellabels encoded by the input segmenter of the BERT model, denoted as E i ;

[0033] S3.6.2. Obtain outputs through the BERT model, and extract the output corresponding to the CLS vector from the outputs as h CLS , and then train the VAE model;

[0034] S3.6.3. Use the VAE model to obtain the reconstructed vector, calculate the reconstruction loss and regularization loss, perform backpropagation update_model, and record the reconstruction error of each step in the loss list loss_list;

[0035] S3.6.4. After training, calculate the 90th percentile of the reconstruction error as the threshold and calculate the reconstruction error e for each vector. i >threshold, then mark this vector as an attack vector is_attack = True, otherwise it is a normal vector is_attack = False. Finally, use save(M VAE ), save the trained VAE model;

[0036] Furthermore, the specific implementation method of the Steiner tree algorithm in step S4 includes the following steps:

[0037] S4.1. Set the source graph G obtained in input S2 and the attack node set in the source graph G obtained in S2 to V t , the set of edges connecting the attacking nodes is S, and the selected edges will connect V t All the nodes in form a connected subgraph;

[0038] S4.2. Set a set V for storing processed attack nodes p and the set S of edges connecting the attacking nodes, both are empty sets at the beginning;

[0039] S4.3. For V t Each node t in i , set an empty path set path;

[0040] S4.4. First, perform V p If V p Not empty, for t i and set V p Each node t in j, in the computation graph G i to j Find the shortest path of findShortestPath(G,ti,tj) and add these paths to the set path;

[0041] Then select the minimum cost path and select a path S with the lowest cost from the set path i ,selectMinimumCostPath(path),S i Connect node t to the i and set V p Connect all the nodes in

[0042] Then S i Add to the edge set S;

[0043] If V p If it is empty, the node t will be attacked. i Add to Collection V p middle;

[0044] S4.5. Repeat the above process until V t All attack nodes in the set are processed, and each edge in the set S is undirected. Then the direction of each edge in S is retrieved and obtained from the traceability graph, and finally a directed edge set S is obtained, which is the path of the detected APT attack.

[0045] Furthermore, findShortestPath() in step S4.4 adopts a greedy strategy to find the shortest path between each pair of nodes.

[0046] Beneficial effects of the present invention:

[0047] The log-based APT attack detection and tracing method described in the present invention constructs the log information into a tracing graph for large-scale log information, then uses the BERT model and the VAE model to perform node anomaly detection, obtains a set of threat nodes related to the attack, and then uses the Steiner tree to obtain the path graph of the APT attack. This method has the characteristics of fast computing speed, low resource consumption, high detection accuracy, and fine granularity, and effectively solves the problems of excessive alarm volume and unutilized related information of system logs. The present invention can detect APT attacks with a long time span and can detect zero-day attacks. And subsequently, visual threat analysis is performed according to actual needs.

[0048] The log-based APT attack detection and tracing method described in the present invention is suitable for learning without a large number of labeled samples and prior knowledge. It can overcome the problem that traditional algorithms cannot detect zero-day attacks, and can extract concise APT attack path tracing diagrams from large quantities of system logs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flow chart of a log-based APT attack detection and tracing method according to the present invention;

[0050] Figure 2 Pseudo code for constructing a traceability graph;

[0051] Figure 3 This is an example diagram of the traceability diagram;

[0052] Figure 4 This is a schematic diagram of the overall structure of the BERT model;

[0053] Figure 5 Schematic diagram of the attention mechanism of the BERT model;

[0054] Figure 6 Diagram of converting text into Token IDs;

[0055] Figure 7 Replace the schematic diagram for MLM tasks;

[0056] Figure 8 It is the connection diagram of NSP task;

[0057] Fig. 9 This is a schematic diagram of the input of the BERT model;

[0058] Fig.10 Pseudocode for pre-training of the BERT model;

[0059] Fig.11 Schematic diagram of the VAE encoder structure;

[0060] Fig.12 Pseudo code for the training process of the VAE model;

[0061] Fig.13 This is a schematic diagram of the Steiner tree algorithm;

[0062] Fig.14 Pseudocode for the Steiner tree algorithm;

[0063] Fig.15 Generate a flowchart for APT attack paths. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the specific embodiments described are only part of the embodiments of the present invention, rather than all of the specific embodiments. The components of the specific embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0065] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected specific embodiments of the present invention. Based on the specific embodiments of the present invention, all other specific embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0066] In order to further understand the content, features and effects of the present invention, the following specific implementation methods are given as examples, and the attached Figure 1 -Attached Fig.15 The detailed instructions are as follows:

[0067] Embodiment 1:

[0068] A log-based APT attack detection and tracing method includes the following steps:

[0069] S1. Collecting original system log data, and then preprocessing the original system log data to obtain a data set;

[0070] Furthermore, the preprocessing process of step S1 is to convert the original log record into a log record in a standardized format, and combine the extracted fields into a standardized log record Fi, which is expressed as:

[0071] Fi={Timestamp:Li.MSec,Operation:Li.EventName,SourceIP:Li.saddr,DestIP:Li.daddr,Sourc

[0072] ePort:Li.sport,DestPort:Li.dport,ProcessID:Li.PID}

[0073] Where Li is the original log record, MSec is the timestamp, PID is the process ID, PName is the process name, TID is the thread ID, EventName is the event name, daddr is the destination IP address, saddr is the source IP address, dport is the destination port number, sport is the source port number, and size is the packet size;

[0074] S2. For the data set obtained in step S1, a traceability graph is constructed based on four types of operations. The four types of operations include file operations, process operations, permission operations, and network operations;

[0075] Furthermore, the specific implementation method of step S2 includes the following steps:

[0076] S2.1. First, initialize and establish an empty traceability graph;

[0077] S2.2. From the logs in the data set obtained in step S2.1, determine the operation type, including file operation FILE_OP, process operation PROCESS_OP, permission operation PERM_OP, and network operation NET_OP;

[0078] Table 1 Operation type table

[0079]

[0080]

[0081] Among them, file operations (FILE_OP) include operations directly related to the reading, writing and management of file data.

[0082] Process operations (PROCESS_OP) are concerned with process management and life cycle.

[0083] Network operations (NET_OP) involve network data transmission and connection management.

[0084] Permission operations (PERM_OP) involve user management and permission management.

[0085] The logical expression is:

[0086] SWITCH(operation)

[0087] CASE"read","write","rename","mmap":

[0088] Operation type = "FILE_OP"

[0089] BREAK

[0090] CASE"fork","vfork","pipe","kill":

[0091] Operation type = "PROCESS_OP"

[0092] BREAK

[0093] CASE"sendto","connect","bind":

[0094] Operation Type = "NET_OP"

[0095] BREAK

[0096] CASE"setuid","seteuid","setlogin","setgid":

[0097] Operation Type = "PERM_OP"

[0098] BREAK

[0099] END SWITCH

[0100] In this switch statement, the name of the log operation (ie, "operation") is used to determine the type of operation (FILE_OP, PROCESS_OP, NET_OP, or PERM_OP).

[0101] Other types of operations are not considered and their logs are deleted because they are less frequently used and their functional characteristics are different from regular file, process or network operations and are not related to APT attacks. For example, mprotect is mainly used to modify memory access permissions, which is closely related to memory management. This operation mainly involves security control and the memory protection mechanism of the operating system, but not directly related to file I / O, process life cycle or network communication.

[0102] After extracting the operation types, logs can be divided into three categories based on these operation types: process, file, and network. Nodes and edges are generated for the three types of logs respectively. The logic is as follows:

[0103] Determine the target node type based on the log operation type evt:

[0104] 1. The target node is a process (process operation process)

[0105] When the log represents the operation of one process (source node) on another process (target node). In this case, the command line of the parent process (source node) is used as the identifier of the parent node. The command line of the child process (target node) is used as the identifier of the child node. Add two nodes to the node set. And add the edges corresponding to the two nodes to the edge set. The type of the edge between the two process nodes is the operation type evt of the log, which describes the interaction between the processes, such as creation, pipeline, etc.

[0106] 2. The target node is a file (process operation file)

[0107] This situation is generally the interaction between processes and files, such as file reading, writing or execution. The source node is the process that performs the operation, and its command line description is used as the identifier of the parent node. The child node is the file being operated, which is identified by the file path or file descriptor. Add two nodes to the node set. And add the edges corresponding to the two nodes to the edge set. The type of the edge between the process node and the file node is the log operation type evt, which describes how the process interacts with the file and the nature of the operation (such as reading, writing or deleting).

[0108] 3. The target node is the network (process operation network)

[0109] This situation is generally a network activity performed by a process. The source node is the process that initiates the network operation, which is also identified by its command line. The target node represents the network connection target, which is identified as a combination of the target IP and port. Add two nodes to the node set. And add the edges corresponding to the two nodes to the edge set. The type of the edge between the process node and the network node is the log operation type evt, which describes the network connection or data transmission initiated by the process, initiating a connection, sending data, or receiving data.

[0110] S2.3. For each operation whose operation type is determined in step S2.2, create nodes and edges in the traceability graph, and add nodes to the traceability graph, where the types of the nodes include process, file, and network;

[0111] S2.4. Set the node attributes and node identifiers for the node created in step S2.3, and then add edges to the traceability graph. The edge attributes include the operation type and timestamp. The operation type is evt.type in the log.

[0112] S2.5. Check whether the traceability graph is a directed acyclic graph DAG. If so, remove the loop, then save the traceability graph in the format of Node-Link.json, and add the command line text in all node identifiers extracted from the log to the file command_line.json, and add the combination of file path, IP and port to the file object.json to obtain the traceability graph and node identifier set, where the node identifier set is the command line text or file path or IP address and port combination corresponding to the node.

[0113] S3. For the traceability graph obtained in step S2, use the BERT model and the VAE model to perform node anomaly detection and obtain a set of threat nodes;

[0114] The structure of BERT is as follows Figure 4 and Figure 5 As shown in the figure. The core of BERT is composed of multiple stacked Transformer encoder layers. Each encoder layer contains a self-attention mechanism and a feedforward neural network, allowing the model to capture complex dependencies in the input sequence. The advantage of the BERT model is that it can learn long-distance dependencies and can handle contextual relevance well, and has good generalization ability. The self-attention mechanism of the BERT model: allows the model to focus on tokens at different positions when processing sequences, and calculate the attention weights between tokens, thereby capturing the dependencies in the input sequence. The Attention mechanism mainly involves three concepts: Query, Key, and Value. In the application scenario of enhancing the semantic representation of words in the figure, the target word and its context words have their own original values. The Attention mechanism uses the target word as the Query and each word in its context as the Key, and uses the similarity between the Query and each Key as the weight, and integrates the Value of each word in the context into the original Value of the target word. The Attention mechanism takes the semantic vector representation of the target word and each word in the context as input. First, the Query vector representation of the target word, the Key vector representation of each word in the context, and the original Value representation of the target word and each word in the context are obtained through linear transformation. Then, the similarity between the Query vector and each Key vector is calculated as the weight (ultimately forming a weight relationship between each target word and the words in its context, and the sum of the weights is 1). The Value vector of the target word and the Value vector of each word in the context are weighted and fused as the output of Attention, that is, the enhanced semantic vector representation of the target word. Figure 5 As shown in the figure, the feedforward neural network of the BERT model captures the semantic and structural information of the input text by adopting a self-attention mechanism and position encoding.

[0115] Furthermore, the specific implementation method of step S3 includes the following steps:

[0116] S3.1. Use the WordPiece algorithm in the BERT word segmenter to perform word segmentation on the source graph and node identification set obtained in step S2 to obtain a word segmentation sequence;

[0117] Furthermore, Figure 6 For example, the text is converted into Token IDs and then the WordPiece tokenizer in BERT Tokenizer is used to split the sentence into Tokens. Figure 6 As shown in the figure, the sentence "a visually stunningrumination on love" is divided into ["a", "visually", "stunning", "rum", "##ination", "on", "love"]. The tokenizer is able to break down unknown or rare words into smaller, known sub-units, thereby improving the model's ability to handle unseen words.

[0118] For the word "rumination", it is split into "rum" and "##ination" because the tokenizer usually uses the longest match strategy, that is, scanning from left to right, trying to find the longest substring that exists in the vocabulary. In this example, "us" may be a valid root in the vocabulary, and "##r" (the prefix ## indicates that it is the suffix part of a word) is used to represent the characters attached to the previous root. In this way, the tokenizer is able to retain some semantic information of the vocabulary even when faced with words outside the vocabulary. For example, although "rumination" is split, the form and meaning of the original word are retained to a certain extent through the combination of "rum" and "##ination". Such segmentation can help the model handle unencountered vocabulary, because many words can be synthesized through known subword units. This method is particularly effective when dealing with non-standard vocabulary, new vocabulary, or proper nouns, and can cover a wider range of vocabulary with a smaller vocabulary.

[0119] Furthermore, the process of the algorithm is as follows:

[0120]

[0121]

[0122] The meaning of each letter is as follows:

[0123] w: The complete word or sentence of the input, which represents the original text that needs to be segmented.

[0124] Vocab: Vocabulary, containing all word fragments known to the WordPiece tokenizer.

[0125] tokens: word segmentation list, used to store all word fragments after w is segmented.

[0126] subword: The longest word fragment found in the vocabulary that matches w.

[0127] ##: Prefix, indicating that the word fragment belongs to the subsequent part of the word (not the beginning of the word).

[0128] The specific process is explained as follows:

[0129] WHILE(w≠"")DO: Loop until w is completely divided.

[0130] IF (there exists subword∈Vocab and subword is a substring of w and the length of subword is the largest): Find the word fragment subword that has the longest match with w in the vocabulary Vocab.

[0131] IF subword is not at the beginning of the word THEN: If subword is not the beginning of w, add the "##" prefix.

[0132] tokens.append(subword): Add subword to the word list tokens.

[0133] w=w-subword: Update w to the remaining part and continue matching the next word fragment.

[0134] tokens.append("[UNK]"): If no match is found, add "[UNK]" to the token list to indicate that the word is an unknown word.

[0135] S3.2. For the word segmentation sequence obtained in step S3.1, add a start tag [CLS] at the beginning of the word segmentation sequence and add an end tag [SEP] at the end of the sequence to obtain a marked word segmentation sequence;

[0136] After the first step of word segmentation, the second step needs to add special tags to the sequence, adding a [CLS] tag at the beginning of the sequence and a [SEP] tag at the end of the sequence. If you are dealing with a two-sentence task (such as question answering or sentence relationship judgment), you also need to add a [SEP] tag between the two sentences. Figure 6As shown in , tokens are added before and after the single sentence: ["a","visually","stunning","rum","##ination","on","love"]: ["[CLS]","a","visually","stunning","rum,"##ination","on","love","[SEP]"].

[0137] Further, the logical expression of a single sentence:

[0138] tokens'=[CLS]+tokens+[SEP]

[0139] tokens': contains the list of tokens after the special token.

[0140] [CLS]: A special marker that indicates the beginning of a sequence.

[0141] tokens: the original word list, which contains the word fragments after the first step of word segmentation.

[0142] [SEP]: A special marker indicating the end of a sequence.

[0143] [CLS]+tokens+[SEP] in the expression means adding [CLS] before the tokens list and [SEP] at the end of the list to form a new word segmentation list tokens'.

[0144] In the case of two sentences, a [SEP] tag can be added between the two sentences to separate the sentences. The logical expression is as follows:

[0145] tokens'=[CLS]+tokens_A+[SEP]+tokens_B+[SEP]

[0146] tokens': contains a list of tokens after a special token, representing the complete input sequence.

[0147] [CLS]: Indicates the beginning of a sequence and serves as the start marker for the entire input.

[0148] tokens_A: The token list of the first sentence.

[0149] [SEP] (first): indicates the end of the first sentence and is used to separate sentence A and sentence B.

[0150] tokens_B: The token list of the second sentence.

[0151] [SEP] (second): indicates the end of the entire sequence.

[0152] This logical expression adds [CLS] before tokens_A as the start of the sequence, adds [SEP] between tokens_A and tokens_B as a sentence separator, and adds another [SEP] marker at the end of tokens_B to indicate the end of the sequence.

[0153] S3.3.BERTTokenizer converts the tokenized word sequence into integer IDs, and converts the tokenized word sequence into token identifiers Token IDs; for two tokenized word sequences input at the same time, it generates segment identifiers Segment IDs to distinguish the two tokenized word sequences; then pads all tokenized word sequences to the specified input length, including truncating tokenized word sequences whose length is greater than the specified input length, and padding sentences of insufficient length with [PAD] tags to obtain Attention Masks;

[0154] In the third step, the Tokenizer will convert each Token into a corresponding integer ID. These IDs are pre-defined in the vocabulary. Each Token has a unique corresponding ID. Figure 6 As shown in the example, ["[CLS]","a","visually","stunning","rum","##ination","on","love","[SEP]"] is converted to [101,1037,17453,14726,19379,12758,2006,2293,102].

[0155] Furthermore, the logical expression is: IDs = Vocab (tokens')

[0156] IDs: A list containing the integer IDs corresponding to each Token, representing the final numerical representation sequence.

[0157] Vocab: Vocabulary, which contains the mapping between each token and its corresponding unique integer ID. The vocabulary that comes with the BERT model. When using a pre-trained BERT model, the model contains a built-in vocabulary, which is built by BERT during pre-training and released with the model.

[0158] tokens': contains special tags [CLS], [SEP] and the word list of all word fragments (i.e. the word sequence after the first and second steps).

[0159] The expression IDs=Vocab(tokens') means mapping each Token in tokens' to a unique integer ID in the vocabulary Vocab to generate an integer ID list IDs.

[0160] After completing the above three steps, the sentences are converted into Token IDs.

[0161] The fourth step is to generate Segment IDs. For double-sentence input, Segment IDs are used to distinguish the two sentences. The tokens of the first sentence are all marked as 0, and the tokens of the second sentence are marked as 1. For single-sentence input, Segment IDs are all marked as 0. Finally, all sentences need to be padded to the specified input length. For those sentences whose length is greater than the specified input length, they are truncated, and for those sentences of insufficient length, special [PAD] tags are used to fill them, because the neural network requires a fixed-size input. And get the attention mask (Attention Masks), that is, create a mask to indicate which tokens are real data and which are filled data. For non-filled tokens, the mask value is 1; for filled tokens, the mask value is 0. For example, if ["[CLS]","a","visually","stunning","rum","##ination","on","love","[SEP]"] is padded to a length of 10, it becomes ["[CLS]","a","visually","stunning","rum","##ination","on","love","[SEP]","[PAD]"], and the corresponding Segment IDs are [1,1,1,1,1,1,1,1,1,0], that is, the last bit is padded with the [PAD] marker and the mask of this bit is set to 0. In this way, the Attention Masks are obtained.

[0162] Furthermore, for double sentence input:

[0163] Segment_IDs=[0]*len(tokens_A)+[1]*len(tokens_B)+[0]*padding_length

[0164] For single sentence input:

[0165] Segment_IDs=[0]*(len(tokens)+padding_length)

[0166] Segment_IDs: The generated Segment IDs list.

[0167] [0]: Indicates the Segment ID of the first sentence and the padding part.

[0168] [1]: Indicates the Segment ID of the second sentence (used when inputting two sentences).

[0169] tokens_A: The token list of the first sentence.

[0170] tokens_B: The token list of the second sentence.

[0171] tokens: a list of tokens for a single sentence (used when the input is a single sentence).

[0172] padding_length: padding length. To ensure uniform length of input, if the combined sentence is less than the specified length, the Segment ID is padded.

[0173] illustrate:

[0174] For two-sentence input:

[0175] [0]*len(tokens_A) generates the '0' token for the first sentence.

[0176] [1]*len(tokens_B) generates the '1' token for the second sentence.

[0177] [0]*padding_length generates '0' marks for the padding part to ensure the input length is consistent.

[0178] + is used for list concatenation to generate a complete Segment_IDs list.

[0179] Single sentence input:

[0180] [0]*(len(tokens)+padding_length) generates 0 tokens for the entire sentence, because a single sentence does not need to distinguish different sentences.

[0181] The padding part is also marked with 0 to ensure that the length of the input Segment_IDs is consistent with the specified length.

[0182] These three types of input are required inputs based on the design of the BERT model. Token IDs provide a direct mapping from vocabulary to tokens and are the basis for obtaining token embeddings. Segment IDs are very useful when processing inputs of multiple sentences, allowing the model to distinguish tokens from different sentences and are the basis for obtaining segment embeddings. AttentionMasks ensure that the model does not take into account irrelevant and padded tokens when performing self-attention calculations, thereby maintaining the accuracy and efficiency of the output.

[0183] Subsequently, the next step of preprocessing will be carried out according to the three pre-training tasks.

[0184] S3.4. Input the Token IDs, Segment IDs, and Attention Masks obtained in step S3.3 into the BERT model, and perform preprocessing according to three pre-training tasks, including next sentence prediction NSP, masked language model MLM, and hypersphere volume minimization VHM, to obtain word vector representation Token Embeddings, paragraph vector representation Segment Embeddings, and position embedding representation Position Embeddings, and then add the elements to obtain a merged sequence to obtain a merged sequence set as the input of the BERT Transformer layer;

[0185] Next Sentence Prediction (NSP), Masked Language Model (MLM) and Volume of Hypersphere Minimization (VHM) tasks.

[0186] For the Masked Language Model (MLM) task, some input tokens of the input sequence are randomly masked. The ratio is 15%. For example, if the length of the token sequence is 7, then 7*15%≈1 token will be replaced. The replacement rule is as follows Figure 780% of the time: replace the word with a special [MASK] token, e.g., [[CLS],a,visually,stunning,rum,##ination,on,love,[SEP]] → [[CLS],a,visually,stunning,rum,[MASK],on,love,[SEP]], 10% of the time: replace the word with a random word, e.g., [[CLS],a,visually,stunning,rum,##ination,on,love,[SEP]] → [[CLS],a,visually,stunning,rum,apple,on ,love,[SEP]], in the remaining 10% of the time: keep the word unchanged, for example, [[CLS],a,visually,stunning,rum,##ination,on,love,[SEP]]→[[CLS],a,visually,stunning,rum,##ination,on,love,[SEP]]. The purpose of this is to bias the representation towards the actual observed words. In this way, the Transformer encoder does not know which word to predict in the end, let alone which word in the input sentence pair is randomly replaced by other words, so it must retain the contextual expression distribution information of each word and make full use of the contextual information. In addition, because the random replacement only occurs in 1.5% of all tokens (i.e. 10% of 15%), this does not harm the language understanding ability of the model.

[0187] For the next sentence prediction (NSP) task, two sentences A and B are taken from the node identifier, and A and B are concatenated. In 50% of the samples, A and B are in a contextual relationship and their label is "IsNext". In 50% of the samples, B is a sentence randomly extracted from the corpus and its label is "NotNext". Figure 8 shown.

[0188] 1.Next Sentence Prediction (NSP),For the NSP task, it can be expressed as the way of selecting Sentence_B, that is, the probability that sentence B is the next sentence of sentence A is 50%, and the probability of random selection is 50%.

[0189] P(Sentence_B|Sentence_A)=0.5if Sentence_B is the next sentence of Sentence_A

[0190] P(Sentence_B|Sentence_A)=0.5ifSentence_B is a random sentence

[0191] The meaning of each part:

[0192] P(Sentence_B|Sentence_A): The probability of choosing Sentence_B given Sentence_A.

[0193] Sentence_A: The first sentence.

[0194] Sentence_B: The second sentence, used to predict whether it is the next sentence of Sentence_A.

[0195] 0.5: indicates equal probability of the next sentence or a random sentence.

[0196] Explanation: This logical expression means that in the NSP task, for each input sentence pair, there is a 50% probability of selecting the actual next sentence as Sentence_B, and another 50% probability of selecting a random sentence as Sentence_B, so that the model learns the coherence between sentences.

[0197] 2. Masked Language Model (MLM) expression:

[0198] P(MLM)=0.15

[0199] P([MASK]|Token)=0.8

[0200] P(Random Token|Token)=0.1

[0201] P(Original Token|Token)=0.1

[0202] The meaning of each part:

[0203] P(MLM): The total probability of each token being covered.

[0204] P([MASK]|Token): The probability of replacing the original Token with the [MASK] tag.

[0205] P(Random Token|Token): The probability of replacing the original Token with a random Token.

[0206] P(Original Token|Token): The probability of keeping the original Token unchanged.

[0207] 0.15: means 15% of the tokens will be randomly masked.

[0208] 0.8, 0.1, 0.1: represents the probability distribution of different replacement strategies after masking.

[0209] Explanation: MLM means that when the model is training, 15% of the tokens are randomly masked. Among these 15% of the masked tokens, 80% are replaced with [MASK], 10% are replaced with random tokens, and the remaining 10% remain unchanged.

[0210] 3.Volume of Hypersphere Minimization(VHM)

[0211] Center vector calculation: Calculate the center vector c of the normal log sequence:

[0212] c=(1 / N)*Σe_j

[0213] Among them, c represents the center vector of the normal log sequence; N is the total number of normal log sequences; e_j is the embedding vector of the jth log sequence; Σ represents the sum of all normal log sequences.

[0214] Volume minimization objective function: Minimize the sum of the squares of the Euclidean distances between the embedding vectors and the center vector c of all normal log sequences to minimize the volume of the hypersphere:

[0215] VHM_Loss=Σ||e_j-c||^2

[0216] Among them, VHM_Loss represents the loss of the VHM task, which is used to measure the distribution compactness of the log sequence; ||e_j-c||^2 represents the square of the Euclidean distance from the embedding vector e_j of the jth log sequence to the center vector c;

[0217] By minimizing VHM_Loss, the model is able to cluster normal log sequences near the center in the embedding space, thereby achieving significant distinction between attack sequences and normal sequences.

[0218] S3.5. Based on the merged sequence set obtained in step S3.4, the BERT-base-cased model is used as the base model for training, and the trained model is obtained as a general language model for understanding log semantics and context;

[0219] Furthermore, the specific implementation method of step S3.5 includes the following steps:

[0220] S3.5.1. For the BERT-base-cased model, set the optimizer optimizer, set the learning rate learn_rate, and specify the training period epochs as 10;

[0221] Furthermore, assuming that the downloaded BERT basic model is denoted as M Bert , set the optimizer O and learning rate learn_rate, set the optimizer parameter to θ, set the number of training cycles to epochs, and the data batch size to batch_size;

[0222] S3.5.2. Determine the amount of data batch_size for each batch, randomly shuffle the preprocessed log processed_logs data in each epoch, and use the data loader data_loader to load the data batch_data of each batch;

[0223] Furthermore, in each training cycle epoch, the training set D is randomly shuffled and the data batch_data is loaded, and the expression is obtained:

[0224] D epoch = shuffle(D)

[0225] batch_data epoch =data_loader(D epoch ,batch_data)

[0226] Among them, D epoch For each cycle, the shuffled data set is used, and data_loader is used to load the data;

[0227] S3.5.3. In each training cycle, input each batch_data into the BERT-base-cased model, obtain the output BERT_outputs, calculate the MLM, NSP, and VHM losses from BERT_outputs, and backpropagate the total loss loss.backward();

[0228] In each batch of data batch_data epoch In the data batch_data epoch Input to model M Bert In the calculation, the BERT model output BERT_outputs is expressed as:

[0229] BERT_outputs = M Bert (batch_data epoch )

[0230] Calculate MLM loss L MLM 、NSP loss L NSP 、VHM loss L VHM , the total loss L total Defined as:

[0231] L total =L MLM +L NSP +L VHM ;

[0232] Then use the total loss L total Back propagation of the gradient of the model parameter θ is expressed as:

[0233]

[0234] Among them, θ is the model parameter;

[0235] S3.5.4. Execute the optimization step optimizer.step() to update the model parameters, use the learning rate scheduler to update the scheduler.step() to update the learning rate scheduler, and then the optimizer clears the gradient optimizer.zero_grad() to clear the gradient of the model parameters. After the training is completed, save the BERT model locally.

[0236] S3.6. Input the last hidden state last_hidden_states of the general language model for understanding log semantics and context obtained in step S3.5 into the variational autoencoder VAE model for training, and obtain the trained variational autoencoder VAE model as a model for attack node detection;

[0237] Furthermore, the specific implementation method of step S3.6 includes the following steps:

[0238] S3.6.1. Initialize a VAE model. In each epoch, obtain the input token IDinput_ids, token typetoken_type, attention maskattention_maskand labellabels encoded by the input segmenter of the BERT model, denoted as E i ;

[0239] For each training cycle t, the dataset N of normal log node identifiers is encoded as the input of the BERT model, and the sequence E of the i-th node in the dataset encoded by the tokenizer is obtained. i :

[0240] E i =tokenizer(N i );

[0241] S3.6.2. Obtain outputs through the BERT model, and extract the output corresponding to the CLS vector from the outputs as h CLS , and then train the VAE model M VAE ;

[0242] Furthermore, for each data sample x i Input into the BERT model to get the output h of the CLS vector CLS , the expression is:

[0243] h CLS =M BERT (x i ) CLS ;

[0244] S3.6.3. Use the VAE model to obtain the reconstructed vector, calculate the reconstruction loss and regularization loss, perform backpropagation update_model, and record the reconstruction error of each step in the loss list loss_list;

[0245] The CLS vector h CLS Passed as input to the VAE model, the reconstructed vector h' is obtained CLS :

[0246] h' CLS =M VAE (h CLS )

[0247] Then calculate the reconstruction loss L recon and the regularization loss L reg , where the reconstruction loss is h CLS With h' CLS The error:

[0248] L recon =||h CLS -h' CLS || 2

[0249] The regularization loss is calculated based on the latent distribution parameters μ and σ of the VAE model:

[0250] L reg =D KL (q(z∣x)||p(z))

[0251] The total loss Ltotal is:

[0252] Ltotal=L recon +λL reg

[0253] Where λ is the regularization weight coefficient;

[0254] Back-propagate the total loss Ltotal to update the VAE model parameters and record the reconstruction error L at each time recon To the error list loss_list:

[0255] loss_list.append(L recon );

[0256] S3.6.4. After training, calculate the 90th percentile of the reconstruction error as the threshold and calculate the reconstruction error e for each vector. i >threshold, then mark this vector as an attack vector is_attack = True, otherwise it is a normal vector is_attack = False. Finally, use save(M VAE ), save the trained VAE model;

[0257] threshold=percentile(loss_list,90)

[0258] Determine each reconstruction error e i Is it greater than the threshold? If e i >threshold, the vector is marked as an attack vector is_attack = True, otherwise it is a normal vector is_attack = False, the expression is:

[0259]

[0260] S3.7. Based on the trained BERT model and VAE model, the traceability graph obtained in step S2 is tested to obtain a set of threat nodes.

[0261] Through the above steps, we obtain Token IDs, Segment IDs, and Attention Masks and input them into the BERT model. The BERT model maps each Token to a high-dimensional vector space, forming three vectors: TokenEmbeddings, Segment Embeddings, and Position Embeddings. The input becomes the representation of the addition of the three embeddings. These vectors capture the semantic information of the Token and are the basis for the model to understand the text.

[0262] Token Embeddings converts a single word (Tokens) into a fixed-size vector representation. These Embeddings come from the vocabulary of the Tokenizer, and each word corresponds to a point in a high-dimensional space. In BERT, Token Embeddings is mainly used to capture the semantic information of the vocabulary, and the size is (batch_size,n,768), where n is the length of the input sequence.

[0263] Segment Embeddings are used to distinguish different sentences in a sentence pair, such as distinguishing the two sentence pairs A and B in the NSP task just now. This is a simple vector that adds the same vector to all tokens in each sentence so that the BERT model can distinguish tokens from different sentences. The size is (batch_size,n,768).

[0264] Position Embeddings provides the position information of each token in the sentence. Since BERT uses the Transformer architecture, and the Transformer does not have a natural order perception ability, it cannot naturally process the order of input data like a recurrent neural network, so Position Embeddings is needed to add this sequence information, and the size is (batch_size,n,768).

[0265] After this step of pre-training is completed, a general language model that can understand the semantics and context of logs can be obtained. This model has been pre-trained on a large number of normal log texts, and has learned how to fill in mask words based on context (MLM task) and how to determine whether two sentences are continuous (NSP task) and can more effectively distinguish between normal and attack logs (VHM task). These capabilities make BERT very suitable for use as the basis for log attack node detection. In the next step, the model can be trained for downstream tasks.

[0266] After pre-training BERT using MLM, NSP, and VHM tasks, what needs to be done is the downstream task, which means performing specific attack node extraction tasks based on the pre-trained model of BERT.

[0267] The basis of this step is the pre-trained BERT model in (1). The data used is the node identification set of normal logs after pre-processing and traceability graph generation.

[0268] In this step, the node identification set is input into the BERT model, and then the last hidden state of BERT (last_hidden_states) is taken as input into the variational autoencoder (VAE) model for training. During this training process, VAE will try to learn the representation of normal log data and identify potential attack nodes by comparing the reconstruction error. Training the VAE model on normal log data can learn the ability to reconstruct the input log. After the training is completed, VAE can compare the reconstruction error of the new input data. If the error exceeds the predetermined threshold, it is considered that the input data represents an attack node.

[0269] Hidden_states is a deep semantic expression of the input log. The commonly used is last_hidden_state(torch.FloatTensor ofshape(batch_size,sequence_length,hidden_size)), which is the hidden state sequence output by the last layer of the model. It contains the hidden state of each token, which usually has 768 dimensions. To extract the information of the entire sentence, the hidden state of [CLS]Token is usually used, because under the structure of the BERT model, the hidden state of [CLS]Token contains the aggregated information of the entire sentence, as shown in the table, which is a 768-dimensional vector.

[0270] Table 2 Example of BERT input to [CLS]Token output

[0271]

[0272]

[0273] In downstream tasks, the variational autoencoder (VAE) model is used. The VAE model is very effective in attack node detection because it can help identify data points that are significantly different from the normal data distribution. In addition, the VAE model only needs to be trained using normal data and can generalize to unseen data samples and adapt to new and unknown attack patterns.

[0274] like Fig.11 As shown in the figure, the architecture of VAE mainly consists of two parts: encoder and decoder. The encoder compresses the input data into latent variables, and the decoder decodes the latent variables into output data. The input of the encoder is the original data, and the output is the mean and variance of the latent variables. During the training process, the encoder learns how to extract latent features from the original data through a neural network. The input of the decoder is the latent variables, and the output is the reconstructed data. During the training process, the decoder learns how to decode the latent features into an approximate representation of the original data through a neural network.

[0275] In general, this step is to connect the output of BERT to the encoder part of VAE for the numerical vector obtained by the BERT model. The encoder will map these representations to the latent space, so as to use the VAE model for attack node detection. The process is as follows: For a node a, the numerical vector X obtained by inputting it into the BERT model a , input it into the VAE model for reconstruction, and obtain the numerical vector X' a , then X' a , and X a Compare, if X' a , and X a If the difference is large, then the input node a is the attack node, and the node is marked as the attack node. a ≈X a , then it means that the node is a normal node and has nothing to do with the attack process.

[0276] After this step, a VAE model for attack node detection is obtained. Combined with the BERT model, it can detect whether each node in the traceability graph generated in Section 2 is an attack node. The purpose of extracting attack nodes is to focus on key nodes related to APT attacks, which can more efficiently identify and understand the key paths and attack methods of APT attacks. Reduce the need to process and analyze irrelevant data and focus on information directly related to security threats, thereby optimizing the use of computing and storage resources. In addition, because the VAE algorithm is an unsupervised learning method, it can learn complex patterns of normal behavior from system logs and evaluate whether newly observed data points are attack data based on these learned patterns. It does not rely on labels, so it can effectively reveal attack behaviors that are significantly different from known normal behaviors, including unknown zero-day attacks.

[0277] S4. Based on the threat node set obtained in step S3 and the traceability graph obtained in step S2, the attack path including all threat nodes is obtained using the Steiner tree algorithm.

[0278] Furthermore, the specific implementation method of the Steiner tree algorithm in step S4 includes the following steps:

[0279] S4.1. Set the source graph G obtained in the input step S2 and the attack node set in the source graph G obtained in step S2 to V t , the set of edges connecting the attacking nodes is S, and the selected edges will connect V t All the nodes in form a connected subgraph;

[0280] S4.2. Set a set V for storing processed attack nodes p and the set S of edges connecting the attacking nodes, both are empty sets at the beginning;

[0281] S4.3. For V t Each node t in i , set an empty path set path;

[0282] S4.4. First, V p If V p Not empty, for t i and set V p Each node t in j , in the computation graph G i to j The shortest path findShortestPath(G,ti,tj) is found, and these paths are added to the set path. The expression is:

[0283]

[0284] Then select the minimum cost path and select a path S with the lowest cost from the set path i ,selectMinimumCostPath(path),S i Connect node t to the i and set V p Connect all nodes in S i Add to the edge set S;

[0285] From the set of all paths {path ti ∣ti∈V t \V p} selects a path pmin with minimum cost that connects the node to all nodes in the set with the least number of edges:

[0286]

[0287] Change this path Add the edges in to the set S:

[0288]

[0289] If V p If it is empty, the node t will be attacked. i Add to Collection V p Update the processed node set and add all attack nodes in the path pmin to the processed node set V p middle:

[0290]

[0291] Further, the findShortestPath() in step S4.4 adopts a greedy strategy to find the shortest path between each pair of nodes;

[0292] S4.5. Repeat the above process until all the attack nodes in V t are processed, so that each edge in the set S is undirected. Then, retrieve and obtain the direction of each edge in S from the traceability graph, and finally obtain a set S of directed edges, which is the path of the detected APT attack.

[0293] Further, the Steiner tree algorithm is a classic problem in graph theory. Similar to the minimum spanning tree, it is a kind of shortest network. That is, given a weighted graph with n points and m edges, k points are selected as key nodes (k < n), and a subgraph with the minimum weight is found. This subgraph connects these k key nodes and allows additional points to be added outside the given key points. The minimum spanning tree is a special case of the minimum Steiner tree. The minimum spanning tree seeks the shortest network in the given set of key points and edges to connect all points. While the Steiner tree allows additional points to be added outside the given key points to minimize the cost of the generated shortest network. This is a known NP-hard problem. Specifically, as Fig.13 shown, if the key points are {1, 2, 3, 4}, it can be found that the minimum sum of edge weights when directly connecting these four key points is 12, which is obviously not optimal. If the Steiner tree algorithm is used to solve, considering adding node 5, then the minimum sum of edge weights will be 9, obtaining a better answer. The node set in the Steiner tree is {1, 2, 3, 4, 5}, and the edge set is {(1, 4), (1, 5), (2, 5), (3, 5)}. The total weight of the Steiner tree is 9.

[0294] Further, this strategy selects the path with the lowest cost of connecting two nodes each time to gradually construct the attack network. Although this strategy may not necessarily guarantee finding the global optimal solution, in most cases, an effective approximate solution can be obtained. In addition, to reduce the total weight of the Steiner tree, the final output set S may include some non-attack nodes. Although these nodes do not belong to the set of attack nodes identified in step three, they play a key role in connecting each attack node to form a low-cost network. This way of including non-attack nodes makes the constructed path an approximate representation of the attack path.

Claims

1. A log-based APT attack detection and tracing method, characterized in that: The steps include: S1. Collecting original system log data, and then preprocessing the original system log data to obtain a data set; S2. For the data set obtained in step S1, a traceability graph is constructed based on four types of operations. The four types of operations include file operations, process operations, permission operations, and network operations; S3. For the traceability graph obtained in step S2, use the BERT model and the VAE model to perform node anomaly detection and obtain a set of threat nodes; S4. Based on the threat node set obtained in step S3 and the traceability graph in step S2, the Steiner tree algorithm is used to obtain the attack path including all threat nodes.

2. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 1, characterized in that: The preprocessing process of step S1 is to convert the original log records into log records in a standardized format.

3. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 2, characterized in that: The specific implementation method of step S2 includes the following steps: S2.

1. First, initialize and establish an empty traceability graph; S2.

2. From the logs in the data set obtained in step S2.1, determine the operation type, including file operation FILE_OP, process operation PROCESS_OP, permission operation PERM_OP, and network operation NET_OP; S2.

3. For each operation whose operation type is determined in step S2.2, create nodes and edges in the traceability graph, and add nodes to the traceability graph, where the types of the nodes include process, file, and network; S2.

4. Set the node attributes and node identifiers for the node created in step S2.3, and then add edges to the traceability graph. The edge attributes include the operation type and timestamp. The operation type is evt.type in the log. S2.

5. Check whether the traceability graph is a directed acyclic graph DAG. If there is a cycle, remove the cycle. Then save the traceability graph in the format of Node-Link.json, and add the command line text in all node identifiers extracted from the log to the file command_line.json, and add the combination of file path, IP and port to the file object.json to obtain the traceability graph and node identifier set, which is the command line text or file path or IP address and port combination corresponding to the node.

4. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 3, characterized in that: The specific implementation method of step S3 includes the following steps: S3.

1. Use the WordPiece algorithm in the BERT word segmenter to perform word segmentation on the source graph and node identification set obtained in step S2 to obtain a word segmentation sequence; S3.

2. For the word segmentation sequence obtained in step S3.1, add a start tag [CLS] at the beginning of the word segmentation sequence and add an end tag [SEP] at the end of the sequence to obtain a marked word segmentation sequence; S3.3.BERTTokenizer converts the tokenized word sequence into integer IDs and tokenized word sequence into token identifiers Token IDs; for two tokenized word sequences input at the same time, it generates segment identifiers SegmentIDs to distinguish the two tokenized word sequences; Then all the marked word segmentation sequences are padded to the specified input length, including truncating the marked word segmentation sequences whose length is greater than the specified input length, and using the [PAD] tag to fill the sentences of insufficient length to obtain the attention masks; S3.

4. Input the Token IDs, Segment IDs, and Attention Masks obtained in step S3.3 into the BERT model, and perform preprocessing according to three pre-training tasks, including next sentence prediction NSP, masked language model MLM, and hypersphere volume minimization VHM, to obtain word vectors representing Token Embeddings, paragraph vectors representing Segment Embeddings, and position vectors representing Position Embeddings, and then add the elements together to obtain a merged sequence to obtain a merged sequence set as the input of the BERT Transformer layer; S3.

5. Based on the merged sequence set obtained in step S3.4, the BERT-base-cased model is used as the base model for training, and the trained model is obtained as a general language model for understanding log semantics and context; S3.

6. Input the last hidden state last_hidden_states of the general language model for understanding log semantics and context obtained in step S3.5 into the variational autoencoder VAE model for training, and obtain the trained variational autoencoder VAE model as a model for attack node detection; S3.

7. Based on the trained BERT model and VAE model, the traceability graph obtained in step S2 is tested to obtain a set of threat nodes.

5. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 4, characterized in that: The specific implementation method of step S3.5 includes the following steps: S3.5.

1. For the BERT-base-cased model, set the optimizer optimizer, set the learning rate learn_rate, and specify the training period epochs as 10; S3.5.

2. Determine the amount of data batch_size for each batch of processing, randomly shuffle the processed log set processed_logs data in each epoch, and use the data loader data_loader to load the data batch_data of each batch; S3.5.

3. In each training cycle, input each batch_data into the BERT-base-cased model, obtain the output BERT_outputs, calculate the MLM, NSP, and VHM losses from BERT_outputs, and backpropagate the total loss loss.backward(); S3.5.

4. Execute the optimization step optimizer.step() to update the model parameters, use the learning rate scheduler scheduler.step() to update the learning rate scheduler, and then clear the gradient optimizer.zero_grad() to clear the gradient of the model parameters. After the training is completed, save the BERT model locally.

6. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 5, characterized in that: The specific implementation method of step S3.6 includes the following steps: S3.6.

1. Initialize a VAE model. In each epoch, get the input token IDinput_dis, token type token_type, attention mask attention_mask and label labels encoded by the input segmenter of the BERT model, denoted as E i ; S3.6.

2. Obtain outputs through the BERT model, and extract the output corresponding to the CLS vector from the outputs as h CLS , and then train the VAE model M VAE ; S3.6.

3. Use the VAE model to obtain the reconstructed vector, calculate the reconstruction loss and regularization loss, perform backpropagation update_model, and record the reconstruction error of each step in the loss list loss_list; S3.6.

4. After training, calculate the 90th percentile of the reconstruction error as the threshold and calculate the reconstruction error e for each vector. i >threshold, then mark this vector as an attack vector is_attack = True, otherwise it is a normal vector is_attack = False. Finally, use save(M VAE ) to save the trained VAE model.

7. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 6, characterized in that: The specific implementation method of the Steiner tree algorithm in step S4 includes the following steps: S4.

1. Set the source graph G obtained in the input step S2 and the attack node set in the source graph G obtained in step S2 to V t , the set of edges connecting the attacking nodes is S, and the selected edges will connect V t All the nodes in form a connected subgraph; S4.

2. Set a set V for storing processed attack nodes p and the set S of edges connecting the attacking nodes, both are empty sets at the beginning; S4.

3. For V t Each node t in i , set an empty path set path; S4.

4. First, perform V p If V p Not empty, for t i and set V p Each node t in j , in the computation graph G i to j Find the shortest path of findShortestPath(G,ti,tj) and add these paths to the set path; Then select the minimum cost path and select a path S with the lowest cost from the set path i ,selectMinimumCostPath(path),S i Connect node t to the i and set V p Connect all the nodes in Then S i Add to the edge set S; If V p If it is empty, the node t will be attacked. i Add to Collection V p middle; S4.

5. Repeat the above process until V t All attack nodes in the set are processed, and each edge in the set S is undirected. Then the direction of each edge in S is retrieved and obtained from the traceability graph, and finally a directed edge set S is obtained, which is the path of the detected APT attack.

8. A method for detecting out-of-distribution network traffic data based on calculating likelihood ratio according to claim 7, characterized in that: The findShortestPath() in step S4.4 uses a greedy strategy to find the shortest path between each pair of nodes.

Images