Advanced persistent threat detection and response method based on improved self-supervised learning

Abstract

The invention discloses an advanced persistent threat detection and response method based on improved self-supervised learning. The method comprises the following steps: S1, acquiring an unlabeled data set in a network environment; s2, embedding a behavior path learning and prediction module in the self-supervised learning model; s3, forming a reference basis for an APT threat behavior path; s4, marking the nodes as potential threat nodes; s5, if potential threat nodes are detected, a behavior path learning and prediction module predicts potential threat nodes possibly occurring in the next attack stage according to the space-time relevance in the behavior path and the preliminary labeling information, and generates corresponding threat levels according to the features of the predicted nodes and the behavior path; and S6, triggering a response decision module according to the threat level, and triggering corresponding response measures by the response decision module according to the level of the threat node and the prediction path, including sending out an alarm, isolating a threat source, limiting access authority and recording an event log. According to the method, the detection efficiency and the response capability of the APT attack are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an advanced persistent threat detection and response method based on improved self-supervised learning. Background Art

[0002] With the rapid development of network technology and information security technology, network attack methods are becoming increasingly complex and covert. In particular, advanced persistent threat (APT) attacks have become a major challenge for financial institutions, enterprises and critical infrastructure. APT attacks are characterized by long-term latency, precise targeting and phased implementation. Traditional threat detection and response systems are difficult to respond to effectively. APT attacks can often lurk in the network for a long time and gradually penetrate into the target system, posing a serious threat to data and system security.

[0003] At present, existing threat detection systems mainly rely on detection methods based on rules and feature matching. For example, intrusion detection systems and firewalls usually implement alarms and protection by matching and detecting known threat features or attack patterns. However, APT attacks are usually divided into multiple stages, and attackers use different strategies and tools to infiltrate, expand, and steal data in each stage. Therefore, a single feature matching detection method cannot capture the full picture of the attack; secondly, APT attacks often use zero-day vulnerabilities and file anti-killing technology to bypass traditional detection systems based on known features.

[0004] In recent years, some security detection systems based on machine learning have begun to be applied to APT detection, but machine learning mainly relies on labeled data for model training. However, it is extremely difficult to obtain labeled data in APT attack scenarios, because APT attacks are often highly customized and hidden, and the number of security incident samples is limited, resulting in poor performance of detection models based on supervised learning in practical applications. In addition, traditional machine learning methods have deficiencies in dealing with the dynamics of attack paths and the complexity of attack behaviors, making it difficult to predict the attacker's next move, making existing machine learning systems more dependent on post-detection and unable to provide effective real-time response capabilities.

[0005] In summary, the existing technologies have the following deficiencies in the detection and response of APT attacks: 1) Reliance on rule matching results in the inability of the detection system to identify unknown threats and zero-day attacks; 2) Difficulty in handling the multi-stage and dynamic characteristics of APTs results in inaccurate identification of attack paths; 3) Strong dependence on labeled data cannot cope with the scarcity and high personalization of APT attack samples; 4) The response mechanism lags behind and lacks the ability to predict the attack path, making it difficult to effectively defend against the attack in the early stages. Therefore, a new method is urgently needed that can efficiently detect APT threats in an unlabeled data environment, and achieve accurate responses through behavioral path analysis and prediction mechanisms to overcome the limitations of existing technologies. Summary of the invention

[0006] One object of the present invention is to propose an advanced persistent threat detection and response method based on improved self-supervised learning, which significantly improves the detection efficiency and response capability of APT attacks.

[0007] According to an embodiment of the present invention, an advanced persistent threat detection and response method based on improved self-supervised learning includes the following steps:

[0008] S1. Obtain an unlabeled data set in a network environment, and input the unlabeled data set into a self-supervised learning model, wherein the self-supervised learning model generates a spatiotemporal threat feature representation set with spatiotemporal correlation through a multi-layer recursive feature aggregation module, an interactive pseudo-label generation mechanism module, and a multi-scale spatiotemporal feature extraction module;

[0009] S2. embedding a behavior path learning and prediction module in the self-supervised learning model, analyzing the spatiotemporal threat feature representation set, wherein the behavior path learning and prediction module generates positive and negative sample pairs using a contrastive learning mechanism, performs path learning analysis on the spatiotemporal threat feature representation set, and constructs behavior paths of multiple potential attack stages, wherein the behavior path is composed of multiple attack stage nodes, and each node includes one or more features in the threat feature representation set with preliminary annotations;

[0010] S3. In the behavior path learning and prediction module, the similarity of each attack stage node in the behavior path is measured based on the contrastive learning mechanism, normal network activities are distinguished from potential advanced persistent threat paths, and the threat path model that meets the APT characteristics is stored in the path model library to form a reference for the APT threat behavior path;

[0011] S4. Acquire the current network activity data in real time in the network environment, input the current network activity data into the self-supervised learning model, extract features from the current network activity data through the multi-scale spatiotemporal feature extraction module, generate a real-time threat feature representation set, match and analyze the real-time threat feature representation set with the APT threat path model in the path model library, and if a potential threat path node is matched, mark it as a potential threat node;

[0012] S5. If a potential threat node is detected, the behavior path learning and prediction module predicts the potential threat node in the next attack stage based on the spatiotemporal correlation and preliminary annotation information in the behavior path, and generates a corresponding threat level based on the characteristics of the predicted node and the behavior path;

[0013] S6. Trigger a response decision module according to the threat level. The response decision module triggers corresponding response measures according to the level of the threat node and the predicted path, including issuing an alarm, isolating the threat source, restricting access rights and recording event logs.

[0014] Optionally, the multi-layer recursive feature aggregation module performs multiple rounds of recursive learning on the unlabeled data set, gradually aggregates potential threat features, and generates a preliminary threat feature representation containing multiple levels and fine-grainedness, specifically including:

[0015] Construct a multi-layer recursive neural network model, set the number of recursive layers to L, and the input unlabeled data set to be represented as a feature matrix Where N is the number of samples and D is the feature dimension;

[0016] At the lth layer, the feature representation H (l) Calculated by the following formula:

[0017] H (l) =f(W (l) H (l-1) +b (l) );

[0018] Among them, H (0) =X, is the weight matrix of the lth layer, responsible for learning the association between features, is the bias vector of the lth layer, which adjusts the output of the model, and f(·) is the nonlinear activation function;

[0019] After L layers of recursive iteration, the final preliminary threat feature representation H is obtained. (L) , contains multi-level and fine-grained feature information to capture the potential characteristics of advanced persistent threats.

[0020] Optionally, the interactive pseudo-label generation mechanism module generates pseudo-labels based on the preliminary threat feature representation and dynamically calibrates the pseudo-labels to obtain a set of threat feature representations with preliminary annotations, specifically including:

[0021] Take the preliminary threat feature representation as a sample and use the feature similarity metric to calculate the similarity matrix between samples Where S ij Represents the similarity between sample i and sample j:

[0022]

[0023] in is the i-th preliminary threat feature representation, ∥·∥ represents the norm of the vector;

[0024] Cluster the preliminary threat feature representations based on the similarity matrix S to generate an initial pseudo-label set where Y pseudo,i is the pseudo label of the i-th sample;

[0025] A dynamic calibration mechanism is used to iteratively update the pseudo labels, and the optimization objective function is:

[0026]

[0027] Among them, δ(Y pseudo,i ,Y pseudo,j ) is the indicator function, when Y pseudo,i =Y pseudo,j When , it takes 1, otherwise it takes 0, R(Y pseudo,i ) is a regularization term to prevent overfitting, and λ is a regularization parameter to balance the effects of similarity matching and regularization;

[0028] The dynamically calibrated pseudo-label set is obtained through iterative optimization With the preliminary threat characterization H (L) Combined to form a threat feature representation set with preliminary annotations:

[0029]

[0030] Optionally, the multi-scale spatiotemporal feature extraction module extracts dynamic patterns in the initially annotated threat feature representation set within a specific time window, and generates a spatiotemporal threat feature representation set with spatiotemporal correlation in combination with feature distributions of different nodes in the network environment, specifically including:

[0031] Define the time window T = {t-Δt,…,t,…,t+Δt}, where t is the current time point, Δt is the time scale range, and the network node set is N = {n1,n2,…,n M}, where M is the number of nodes, for each node n m and time point t k , extract the corresponding feature representation and pseudo labels

[0032] Computing spatiotemporal correlation feature representation

[0033]

[0034] Among them, α k,l is the time and space weight coefficient, reflecting the time offset k and node n l For node n m The effect at time t, d(n m ,n l ) is node n m and node n lThe network topological distance between them reflects the degree of association between nodes. σ is the distance attenuation coefficient, which controls the spatial influence range. It means that as the distance between nodes increases, the influence exponentially decreases;

[0035] Generated spatiotemporal threat signature representation set Integrate threat characteristics at different time points and nodes to capture the spatiotemporal propagation patterns of advanced persistent threats in the network.

[0036] Optionally, the S2 specifically includes:

[0037] S21. Representing the spatiotemporal threat feature set As input, we build a behavior path learning and prediction module, and let each stage node in the path be represented as Where i is the path node number, k is the attack stage, and the behavior path learning and prediction module constructs a behavior path set by learning the transfer rules between nodes. The node transfer probability is defined as follows:

[0038]

[0039] in, Indicates that in attack phase k, from node n m Transfer to node n l The probability of and is the spatiotemporal correlation feature representation of the corresponding nodes at time t and t+k, M is the total number of nodes in the network, and the transition probability is normalized by softmax to ensure that the sum of the probabilities is 1;

[0040] S22, according to the node transfer probability Generate positive and negative sample pairs for learning behavior paths, positive sample pairs Represents the continuous nodes that conform to the normal attack path, and the negative sample pair Represents the node combination that is inconsistent with the attack path, and uses the loss function of contrastive learning to optimize the sample pairs:

[0041]

[0042] in, is the set of positive sample pairs, is the set of negative sample pairs, Indicates feature nodes that do not conform to the behavior path learning and prediction module;

[0043] S23, the behavior path learning and prediction module performs path learning analysis based on the optimized positive and negative sample pairs, constructs behavior paths for multiple potential attack stages, and each behavior path It consists of nodes in different attack stages, where K is the total number of attack stages.

[0044] Optionally, the S3 specifically includes:

[0045] S31. Using the contrastive learning mechanism in the behavior path learning and prediction module, the similarity of each attack stage node in the behavior path is measured. The node pair of the kth stage in the path is The goal of similarity measurement is to determine whether the nodes in two consecutive stages meet the characteristics of the APT threat path. Defined as:

[0046]

[0047] in, is the kth stage node and k+1 stage nodes The similarity of and is the node feature representation of two consecutive stages, ∥·∥ represents the norm of the vector, d(n i ,n j )) is node n i and n j The network topological distance between them, β is the weight parameter, which is used to balance the influence between node characteristics and network topology;

[0048] S32, based on node similarity The threshold τ is set as the basis for judgment to distinguish normal network activity paths from potential APT threat paths. When the following conditions are met, the node pair is marked as an APT threat path node:

[0049]

[0050] in, For the judgment result, when the similarity is greater than or equal to the threshold τ, it is determined to be an APT threat path node, otherwise it is a normal network activity path;

[0051] S33, for the path nodes that meet the APT characteristics Combine to generate a complete APT threat path model

[0052]

[0053] Among them, K is the total number of stages of APT attack, and the node pairs between each stage meet the characteristics of APT attack.

[0054] Optionally, the S4 specifically includes:

[0055] S41. Obtain current network activity data in real time in the network environment Where N t is the number of samples collected at the current moment, D t The characteristic dimension of the sample is used to input the current network activity data into the self-supervised learning model and analyze it through the multi-scale spatiotemporal feature extraction module in the self-supervised learning model;

[0056] S42, the multi-scale spatiotemporal feature extraction module extracts features from the current network activity data and generates a real-time threat feature representation set Generated real-time threat signature representation set Reflect potential threat patterns in current network activities;

[0057] S43. Use path similarity measurement to represent the real-time threat signature set APT threat path model in the path model library Perform matching analysis:

[0058]

[0059] Among them, MatchSim is the matching similarity, which is used to measure the similarity between the real-time features and the APT path model. is a real-time feature representation set, is an APT threat path model in the path model library, ∥·∥ is the norm of the vector;

[0060] S44, if the similarity is matched Exceeding the set threshold τ match , then the current network activity is judged to have potential threats, and the network node is marked as a potential threat node:

[0061]

[0062] in, To determine the result, when the matching similarity exceeds the threshold, it is marked as a potential threat node, otherwise it is a normal node.

[0063] Optionally, the S5 specifically includes:

[0064] S51: If a potential threat node is detected Behavior path learning and prediction module based on path model library The path structure and spatiotemporal correlation of nodes in the attack are analyzed to predict the possible nodes of the next attack stage and obtain the nodes of the current attack stage. With prediction node Relevance score

[0065]

[0066] S52. According to the node association score Set the threshold τ rel , if the following conditions are met, the prediction node Potential threat nodes for the next attack phase:

[0067]

[0068] in, To predict the result, when the correlation score is greater than or equal to the threshold, it is determined as a potential threat node in the next attack stage;

[0069] S53, behavior path learning and prediction module according to the prediction node The characteristics and behavior patterns in the path generate the corresponding threat level L threat :

[0070]

[0071] Among them, L threat is the predicted threat level, α1, β1, and η1 are weight parameters used to balance the influence of different factors. represents the risk factor of the prediction node, TimeDecay(t j -t i ) is the time decay function, which is used to measure the impact of the time interval between attack stages on the threat level.

[0072] The beneficial effects of the present invention are:

[0073] (1) The self-supervised learning model of the present invention adopts a multi-layer recursive feature aggregation module to recursively learn the unlabeled data set in the network, so that the self-supervised learning model can accumulate fine-grained features layer by layer, thereby extracting the complex features of potential threats. At the same time, the self-supervised learning model integrates an interactive pseudo-label generation mechanism, and generates high-quality pseudo-labels for unlabeled data through dynamic similarity matching and label calibration algorithms, which effectively solves the problem of insufficient labeled data in APT detection. Compared with traditional detection systems that rely on supervised learning, the method of the present invention can continuously optimize the threat feature representation in an unlabeled data environment, thereby improving the detection accuracy and adaptability of complex threats.

[0074] (2) The present invention embeds a behavior path learning and prediction module in the self-supervised learning model. Based on the results of multi-scale spatiotemporal feature extraction, a contrastive learning mechanism is used to construct an attack path model. The behavior path learning and prediction module predicts the potential next-stage nodes in the attack path through a spatiotemporal correlation scoring algorithm between nodes and dynamically generates a threat level based on the behavior pattern in the path model. Compared with the limitation of traditional systems that can only perform static detection, the method of the present invention can predict the next action of an attack before it is fully launched, providing early warning capabilities and targeted response strategies for security protection. The path prediction mechanism enhances the intelligence level of the detection system and shows higher robustness when dealing with new APT variant attacks.

[0075] (3) The multi-scale spatiotemporal feature extraction module designed in the present invention efficiently analyzes real-time network activity data to generate a real-time threat feature representation set, and dynamically matches it with the APT path model library. Through the path similarity matching algorithm, the system can quickly determine whether the current activity matches the APT attack path and mark potential threat nodes. Unlike traditional detection systems that can only respond laggingly based on historical data, the real-time detection mechanism of the present invention effectively shortens the time interval between threat detection and response, and realizes early identification and isolation of threats. Experimental results show that this method significantly improves the detection efficiency and response capability of APT attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0077] Figure 1 A flowchart of an advanced persistent threat detection and response method based on improved self-supervised learning proposed by the present invention;

[0078] Figure 2 This is a flow chart of a behavior path learning module in an advanced persistent threat detection and response method based on improved self-supervised learning proposed by the present invention, in which the behavior path learning module predicts potential threat nodes in the next attack stage and generates threat levels. DETAILED DESCRIPTION

[0079] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0080] refer to Figure 1-Figure 2 , an advanced persistent threat detection and response method based on improved self-supervised learning, comprising the following steps:

[0081] S1. Obtain an unlabeled dataset in a network environment and input the unlabeled dataset into a self-supervised learning model. The self-supervised learning model generates a spatiotemporal threat feature representation set with spatiotemporal correlation through a multi-layer recursive feature aggregation module, an interactive pseudo-label generation mechanism module, and a multi-scale spatiotemporal feature extraction module;

[0082] S2. Embed a behavior path learning and prediction module in the self-supervised learning model to analyze the spatiotemporal threat feature representation set. The behavior path learning and prediction module generates positive and negative sample pairs using a contrastive learning mechanism, performs path learning analysis on the spatiotemporal threat feature representation set, and constructs behavior paths of multiple potential attack stages. The behavior path consists of multiple attack stage nodes, and each node includes one or more features in the threat feature representation set with preliminary annotations.

[0083] S3. In the behavior path learning and prediction module, the similarity of each attack stage node in the behavior path is measured based on the contrastive learning mechanism, normal network activities are distinguished from potential advanced persistent threat paths, and the threat path model that meets the APT characteristics is stored in the path model library to form a reference for the APT threat behavior path;

[0084] S4. Acquire the current network activity data in real time in the network environment, input the current network activity data into the self-supervised learning model, extract features from the current network activity data through the multi-scale spatiotemporal feature extraction module, generate a real-time threat feature representation set, match and analyze the real-time threat feature representation set with the APT threat path model in the path model library, and if a potential threat path node is matched, mark it as a potential threat node;

[0085] S5. If a potential threat node is detected, the behavior path learning and prediction module predicts the potential threat node in the next attack stage based on the spatiotemporal correlation in the behavior path and the preliminary annotation information, and generates the corresponding threat level based on the characteristics of the predicted node and the behavior path;

[0086] S6. Trigger the response decision module according to the threat level. The response decision module triggers corresponding response measures according to the level of the threat node and the predicted path, including issuing an alarm, isolating the threat source, restricting access rights and recording event logs.

[0087] In this implementation, the multi-layer recursive feature aggregation module performs multiple rounds of recursive learning on the unlabeled data set, gradually aggregates potential threat features, and generates a preliminary threat feature representation containing multiple levels and fine-grainedness, specifically including:

[0088] Construct a multi-layer recursive neural network model, set the number of recursive layers to L, and the input unlabeled data set to be represented as a feature matrix Where N is the number of samples and D is the feature dimension;

[0089] At the lth layer, the feature representation H (l) Calculated by the following formula:

[0090] H (l) =f(W (l) H (l-1) +b (l) );

[0091] Among them, H (0) =X, is the weight matrix of the lth layer, responsible for learning the association between features, is the bias vector of the lth layer, which adjusts the output of the model, and f(·) is the nonlinear activation function;

[0092] After L layers of recursive iteration, the final preliminary threat feature representation H is obtained. (L) , contains multi-level and fine-grained feature information to capture the potential characteristics of advanced persistent threats.

[0093] In this implementation, the interactive pseudo-label generation mechanism module generates pseudo-labels based on the preliminary threat feature representation and dynamically calibrates the pseudo-labels to obtain a set of threat feature representations with preliminary annotations, specifically including:

[0094] Take the preliminary threat feature representation as a sample and use the feature similarity metric to calculate the similarity matrix between samples Where S ij Represents the similarity between sample i and sample j:

[0095]

[0096] in is the i-th preliminary threat feature representation, ∥·∥ represents the norm of the vector;

[0097] Cluster the preliminary threat feature representations based on the similarity matrix S to generate an initial pseudo-label set where Y pseudo,i is the pseudo label of the i-th sample;

[0098] A dynamic calibration mechanism is used to iteratively update the pseudo labels, and the optimization objective function is:

[0099]

[0100] Among them, δ(Y pseudo,i ,Y pseudo,j ) is the indicator function, when Y pseudo,i =Y pseudo,j When , it takes 1, otherwise it takes 0, R(Y pseudo,i) is a regularization term to prevent overfitting, and λ is a regularization parameter to balance the effects of similarity matching and regularization;

[0101] The dynamically calibrated pseudo-label set is obtained through iterative optimization With the preliminary threat characterization H (L) Combined to form a threat feature representation set with preliminary annotations:

[0102]

[0103] In this implementation, the multi-scale spatiotemporal feature extraction module extracts dynamic patterns in the initially annotated threat feature representation set within a specific time window, and combines the feature distribution of different nodes in the network environment to generate a spatiotemporal threat feature representation set with spatiotemporal correlation, specifically including:

[0104] Define the time window T = {t-Δt,…,t,…,t+Δt}, where t is the current time point, Δt is the time scale range, and the network node set is N = {n1,n2,…,n M}, where M is the number of nodes, for each node n m and time point t k , extract the corresponding feature representation and pseudo labels

[0105] Computing spatiotemporal correlation feature representation

[0106]

[0107] Among them, α k,l is the time and space weight coefficient, reflecting the time offset k and node n l For node n m The effect at time t, d(n m ,n l ) is node n m and node n l The network topological distance between them reflects the degree of association between nodes. σ is the distance attenuation coefficient, which controls the spatial influence range. It means that as the distance between nodes increases, the influence exponentially decreases;

[0108] Generated spatiotemporal threat signature representation set Integrate threat characteristics at different time points and nodes to capture the spatiotemporal propagation patterns of advanced persistent threats in the network.

[0109] In this implementation, S2 specifically includes:

[0110] S21. Representing the spatiotemporal threat feature set As input, we build a behavior path learning and prediction module, and let each stage node in the path be represented as Where i is the path node number, k is the attack stage, and the behavior path learning and prediction module constructs a behavior path set by learning the transfer rules between nodes. The node transfer probability is defined as follows:

[0111]

[0112] in, Indicates that in attack phase k, from node n m Transfer to node n l The probability of and is the spatiotemporal correlation feature representation of the corresponding nodes at time t and t+k, M is the total number of nodes in the network, and the transition probability is normalized by softmax to ensure that the sum of the probabilities is 1;

[0113] S22, according to the node transfer probability Generate positive and negative sample pairs for learning behavior paths, positive sample pairs Represents the continuous nodes that conform to the normal attack path, and the negative sample pair Represents the node combination that is inconsistent with the attack path, and uses the loss function of contrastive learning to optimize the sample pairs:

[0114]

[0115] in, is the set of positive sample pairs, is the set of negative sample pairs, Indicates feature nodes that do not conform to the behavior path learning and prediction module;

[0116] S23, the behavior path learning and prediction module performs path learning analysis based on the optimized positive and negative sample pairs, constructs behavior paths for multiple potential attack stages, and each behavior path It consists of nodes in different attack stages, where K is the total number of attack stages.

[0117] In this implementation, S3 specifically includes:

[0118] S31. Using the contrastive learning mechanism in the behavior path learning and prediction module, the similarity of each attack stage node in the behavior path is measured. The node pair of the kth stage in the path is The goal of similarity measurement is to determine whether the nodes in two consecutive stages meet the characteristics of the APT threat path. Defined as:

[0119]

[0120] in, is the kth stage node and k+1 stage nodes The similarity of and is the node feature representation of two consecutive stages, ∥·∥ represents the norm of the vector, d(n i ,n j )) is node n i and n j The network topological distance between them, β is the weight parameter, which is used to balance the influence between node characteristics and network topology;

[0121] S32, based on node similarity The threshold τ is set as the basis for judgment to distinguish normal network activity paths from potential APT threat paths. When the following conditions are met, the node pair is marked as an APT threat path node:

[0122]

[0123] in, For the judgment result, when the similarity is greater than or equal to the threshold τ, it is determined to be an APT threat path node, otherwise it is a normal network activity path;

[0124] S33, for the path nodes that meet the APT characteristics Combine to generate a complete APT threat path model

[0125]

[0126] Among them, K is the total number of stages of APT attack, and the node pairs between each stage meet the characteristics of APT attack.

[0127] In this implementation, S4 specifically includes:

[0128] S41. Obtain current network activity data in real time in the network environment Where N t is the number of samples collected at the current moment, D t The characteristic dimension of the sample is used to input the current network activity data into the self-supervised learning model and analyze it through the multi-scale spatiotemporal feature extraction module in the self-supervised learning model;

[0129] S42, the multi-scale spatiotemporal feature extraction module extracts features from the current network activity data and generates a real-time threat feature representation set Generated real-time threat signature representation set Reflect potential threat patterns in current network activities;

[0130] S43. Use path similarity measurement to represent the real-time threat signature set APT threat path model in the path model library Perform matching analysis:

[0131]

[0132] Among them, MatchSim is the matching similarity, which is used to measure the similarity between the real-time features and the APT path model. is a real-time feature representation set, is an APT threat path model in the path model library, ∥·∥ is the norm of the vector;

[0133] S44, if the similarity is matched Exceeding the set threshold τ match , then the current network activity is judged to have potential threats, and the network node is marked as a potential threat node:

[0134]

[0135] in, To determine the result, when the matching similarity exceeds the threshold, it is marked as a potential threat node, otherwise it is a normal node.

[0136] In this implementation, S5 specifically includes:

[0137] S51: If a potential threat node is detected Behavior path learning and prediction module based on path model library The path structure and spatiotemporal correlation of nodes in the attack are analyzed to predict the possible nodes of the next attack stage and obtain the nodes of the current attack stage. With prediction node Relevance score

[0138]

[0139] S52. According to the node association score Set the threshold τ rel , if the following conditions are met, the prediction node Potential threat nodes for the next attack phase:

[0140]

[0141] in, To predict the result, when the correlation score is greater than or equal to the threshold, it is determined as a potential threat node in the next attack stage;

[0142] S53, behavior path learning and prediction module according to the prediction node The characteristics and behavior patterns in the path generate the corresponding threat level L threat :

[0143]

[0144] Among them, L threat is the predicted threat level, α1, β1, and η1 are weight parameters used to balance the influence of different factors. represents the risk factor of the prediction node, TimeDecay(t j -t i ) is the time decay function, which is used to measure the impact of the time interval between attack stages on the threat level.

[0145] Embodiment 1:

[0146] In order to verify the feasibility and effectiveness of the present invention in APT attack detection and response, the experimenters used the NSL-KDD dataset and the CICIDS2017 dataset for experiments. The NSL-KDD dataset is a classic dataset in the field of network intrusion detection, which contains normal network traffic and various types of detection attacks and denial of service attacks. The CICIDS2017 dataset simulates a real enterprise network environment and covers a variety of advanced network attacks, including malware, spear phishing, and remote access Trojan complex attacks. The experimenters divided the two datasets into training sets and test sets in a ratio of 8:2 and simulated APT attack scenarios in a real network environment to verify the detection and response effects of the method of the present invention.

[0147] The NSL-KDD dataset contains a total of 125,973 samples, of which normal traffic accounts for 80,932, and attack traffic includes detection, user-to-root directory access, and denial of service categories.

[0148] The CICIDS2017 dataset covers 5 days of network activity logs, with a total of 2.83 million data records, involving multiple protocols such as HTTP, HTTPS, FTP and SSH, and simulating the multi-stage behaviors of complex APT attacks.

[0149] In order to adapt to the self-supervised learning model of the present invention, the experimenters preprocessed the above data set. The experimenters used feature standardization to normalize the numerical features in the data and used PCA dimensionality reduction to compress the feature dimension from the original 41 dimensions to 25 dimensions to improve the training efficiency of the model.

[0150] During the training process, the experimenters performed multiple rounds of recursive feature aggregation and pseudo-label generation on the two datasets. On the NSL-KDD dataset, the experimenters set the number of recursive layers of the model to 5, the learning rate to 0.001, the mini-batch size to 128, and used the Adam optimizer for training. A total of 100 epochs were trained. On the CICIDS2017 dataset, considering the large amount of data, the experimenters adjusted the number of recursive layers to 7 and trained for 150 epochs.

[0151] During training, the experimenters generated a set of pseudo labels and calibrated the pseudo labels through a similarity matching algorithm. At the 50th epoch of the model, the accuracy of the pseudo labels reached 85% and stabilized at 92% after the 100th epoch.

[0152] In order to test the detection and response effect of the method of the present invention in a real environment, the experimenters simulated APT attacks in the experimental network environment within the enterprise. The experimental environment contains 50 server nodes, covering databases, file sharing, email systems and remote login systems. During the test, the experimenters simulated the following APT attack paths:

[0153] Initial access: The attackers obtained access to the employee's VPN account by tricking the employee into downloading a malicious attachment via a phishing email.

[0154] Privilege escalation: The attackers used a publicly available exploit (CVE-2021-3156) to escalate privileges on a database server.

[0155] Lateral movement: After successfully gaining access to the database server, the attacker logged into multiple file servers via SSH.

[0156] Data theft: Attackers stole customer data from a file server and uploaded it to an external server disguised as normal traffic.

[0157] Within 10 minutes after the APT attack began, the model captured abnormal behavior through the spatiotemporal feature extraction module and generated real-time threat feature representation. The feature similarity matching results showed that the attacker's login behavior in the initial access stage was 0.94 similar to the phishing attack path in the APT path model library (the threshold was set to 0.85). The system immediately marked the employee account as a potential threat node.

[0158] Subsequently, the behavioral path learning module predicted that the attacker might try to access the database system and blocked the relevant access rights in advance, avoiding the occurrence of privilege escalation. In the lateral movement phase, the model captured abnormal SSH login behavior between multiple servers, further triggered the isolation policy, and notified the network administrator for emergency response.

[0159] To verify the effectiveness of the present invention, the experimenters conducted comparative tests with the traditional intrusion detection system (IDS) and the rule-based firewall. The experimental results are shown in Table 1:

[0160]

[0161] It can be seen from the above experiments that the method of the present invention shows significant advantages in the detection and response of APT attacks. It successfully captures the initial behavior of the APT attack within 10 minutes, predicts the attacker's next move, and blocks access to the database server in advance. In contrast, traditional IDS systems and firewalls only issue alarms in the later stages of the attack, resulting in data leakage.

[0162] The method of the present invention has achieved excellent performance in many aspects:

[0163] The attack detection time was significantly shortened, and threat identification was completed at the early stage of the attack. The false alarm rate was reduced to 2.3%, which greatly reduced the workload of the security team. The threat prediction accuracy rate reached 94.7%, achieving accurate prediction of the attack path. The recovery time was shortened to 25 minutes, which significantly improved the system's emergency response capabilities.

[0164] Through the experimental data and real-scene simulation verification of Example 1, the method of the present invention performs far better than traditional systems in APT detection and response. The self-supervised learning model effectively solves the problem of insufficient unlabeled data, and realizes dynamic prediction and response to APT attack paths through the behavior path learning module. The experimental results show that the detection system of the present invention shows significant advantages in attack detection time, false alarm rate and response speed, providing a more intelligent and efficient solution for network security protection.

[0165] The self-supervised learning model of the present invention adopts a multi-layer recursive feature aggregation module to perform recursive learning on the unlabeled data set in the network, so that the self-supervised learning model can accumulate fine-grained features layer by layer, thereby extracting the complex features of potential threats. At the same time, the self-supervised learning model integrates an interactive pseudo-label generation mechanism, and generates high-quality pseudo-labels for unlabeled data through dynamic similarity matching and label calibration algorithms, which effectively solves the problem of insufficient labeled data in APT detection. Compared with traditional detection systems that rely on supervised learning, the method of the present invention can continuously optimize the threat feature representation in an unlabeled data environment, thereby improving the detection accuracy and adaptability of complex threats.

[0166] The present invention embeds a behavior path learning and prediction module in the self-supervised learning model, and constructs an attack path model based on the results of multi-scale spatiotemporal feature extraction using a contrastive learning mechanism. The behavior path learning and prediction module predicts potential next-stage nodes in the attack path through a spatiotemporal correlation scoring algorithm between nodes, and dynamically generates threat levels based on the behavior patterns in the path model. Compared with the limitation that traditional systems can only perform static detection, the method of the present invention can predict the next action of an attack before it is fully launched, providing early warning capabilities and targeted response strategies for security protection. The path prediction mechanism enhances the intelligence level of the detection system and exhibits higher robustness when responding to new APT variant attacks.

[0167] The multi-scale spatiotemporal feature extraction module designed in the present invention efficiently analyzes real-time network activity data to generate a real-time threat feature representation set, and dynamically matches it with the APT path model library. Through the path similarity matching algorithm, the system can quickly determine whether the current activity matches the APT attack path and mark potential threat nodes. Unlike traditional detection systems that can only respond laggingly based on historical data, the real-time detection mechanism of the present invention effectively shortens the time interval between threat detection and response and realizes early identification and isolation of threats. Experimental results show that this method significantly improves the detection efficiency and response capability of APT attacks.

[0168] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An advanced persistent threat detection and response method based on improved self-supervised learning, characterized in that: The steps include: S1. Obtain an unlabeled data set in a network environment, and input the unlabeled data set into a self-supervised learning model, wherein the self-supervised learning model generates a spatiotemporal threat feature representation set with spatiotemporal correlation through a multi-layer recursive feature aggregation module, an interactive pseudo-label generation mechanism module, and a multi-scale spatiotemporal feature extraction module; S2. embedding a behavior path learning and prediction module in the self-supervised learning model, analyzing the spatiotemporal threat feature representation set, wherein the behavior path learning and prediction module generates positive and negative sample pairs using a contrastive learning mechanism, performs path learning analysis on the spatiotemporal threat feature representation set, and constructs behavior paths of multiple potential attack stages, wherein the behavior path is composed of multiple attack stage nodes, and each node includes one or more features in the threat feature representation set with preliminary annotations; S3. In the behavior path learning and prediction module, the similarity of each attack stage node in the behavior path is measured based on the contrastive learning mechanism, normal network activities are distinguished from potential advanced persistent threat paths, and the threat path model that meets the APT characteristics is stored in the path model library to form a reference for the APT threat behavior path; S4. Acquire the current network activity data in real time in the network environment, input the current network activity data into the self-supervised learning model, extract features from the current network activity data through the multi-scale spatiotemporal feature extraction module, generate a real-time threat feature representation set, match and analyze the real-time threat feature representation set with the APT threat path model in the path model library, and if a potential threat path node is matched, mark it as a potential threat node; S5. If a potential threat node is detected, the behavior path learning and prediction module predicts the potential threat node in the next attack stage based on the spatiotemporal correlation and preliminary annotation information in the behavior path, and generates a corresponding threat level based on the characteristics of the predicted node and the behavior path; S6. Trigger a response decision module according to the threat level. The response decision module triggers corresponding response measures according to the level of the threat node and the predicted path, including issuing an alarm, isolating the threat source, restricting access rights and recording event logs.

2. The advanced persistent threat detection and response method based on improved self-supervised learning according to claim 1, characterized in that: The multi-layer recursive feature aggregation module performs multiple rounds of recursive learning on the unlabeled data set, gradually aggregates potential threat features, and generates a preliminary threat feature representation containing multiple levels and fine granularity, specifically including: Construct a multi-layer recursive neural network model, set the number of recursive layers to L, and the input unlabeled data set to be represented as a feature matrix Where N is the number of samples and D is the feature dimension; At the lth layer, the feature representation H (l) Calculated by the following formula: Among them, H (0) =X, is the weight matrix of the lth layer, responsible for learning the association between features, is the bias vector of the lth layer, which adjusts the output of the model, and f(·) is the nonlinear activation function; After L layers of recursive iteration, the final preliminary threat feature representation H is obtained. (L) , contains multi-level and fine-grained feature information to capture the potential characteristics of advanced persistent threats.

3. The advanced persistent threat detection and response method based on improved self-supervised learning according to claim 2, characterized in that: The interactive pseudo-label generation mechanism module generates pseudo-labels based on the preliminary threat feature representation and dynamically calibrates the pseudo-labels to obtain a set of threat feature representations with preliminary annotations, specifically including: Take the preliminary threat feature representation as a sample and use the feature similarity metric to calculate the similarity matrix between samples Where S ij Represents the similarity between sample i and sample j: in is the i-th preliminary threat feature representation, ∥·∥ represents the norm of the vector; Cluster the preliminary threat feature representations based on the similarity matrix S to generate an initial pseudo-label set where Y pseudo,i is the pseudo label of the i-th sample; A dynamic calibration mechanism is used to iteratively update the pseudo labels, and the optimization objective function is: Among them, δ(Y pseudo,i ,Y pseudo,j ) is the indicator function, when Y pseudo,i =Y pseudo,j When , it takes 1, otherwise it takes 0, R(Y pseudo,i ) is a regularization term to prevent overfitting, and λ is a regularization parameter to balance the effects of similarity matching and regularization; The dynamically calibrated pseudo-label set is obtained through iterative optimization With the preliminary threat characterization H (L) Combined to form a threat feature representation set with preliminary annotations:

4. The advanced persistent threat detection and response method based on improved self-supervised learning according to claim 3 is characterized in that: The multi-scale spatiotemporal feature extraction module extracts dynamic patterns in the initially annotated threat feature representation set within a specific time window, and generates a spatiotemporal threat feature representation set with spatiotemporal correlation in combination with the feature distribution of different nodes in the network environment, specifically including: Define the time window T = {t-Δt,…,t,…,t+Δt}, where t is the current time point, Δt is the time scale range, and the network node set is N = {n1,n2,…,n M }, where M is the number of nodes, for each node n m and time point t k , extract the corresponding feature representation and pseudo labels Computing spatiotemporal correlation feature representation Among them, α k,l is the time and space weight coefficient, reflecting the time offset k and node n l For node n m The effect at time t, d(n m ,n l ) is node n m and node n l The network topological distance between them reflects the degree of association between nodes. σ is the distance attenuation coefficient, which controls the spatial influence range. It means that as the distance between nodes increases, the influence exponentially decreases; Generated spatiotemporal threat signature representation set Integrate threat characteristics at different time points and nodes to capture the spatiotemporal propagation patterns of advanced persistent threats in the network.

5. The method for advanced persistent threat detection and response based on improved self-supervised learning according to claim 1, characterized in that: The S2 specifically includes: S21. Representing the spatiotemporal threat feature set As input, we build a behavior path learning and prediction module, and let each stage node in the path be represented as Where i is the path node number, k is the attack stage, and the behavior path learning and prediction module constructs a behavior path set by learning the transfer rules between nodes. The node transfer probability is defined as follows: in, Indicates that in attack phase k, from node n m Transfer to node n l The probability of and is the spatiotemporal correlation feature representation of the corresponding nodes at time t and t+k, M is the total number of nodes in the network, and the transition probability is normalized by softmax to ensure that the sum of the probabilities is 1; S22, according to the node transfer probability Generate positive and negative sample pairs for learning behavior paths, positive sample pairs Represents the continuous nodes that conform to the normal attack path, and the negative sample pair Represents the node combination that is inconsistent with the attack path, and uses the loss function of contrastive learning to optimize the sample pairs: in, is the set of positive sample pairs, is the set of negative sample pairs, Indicates feature nodes that do not conform to the behavior path learning and prediction module; S23, the behavior path learning and prediction module performs path learning analysis based on the optimized positive and negative sample pairs, constructs behavior paths for multiple potential attack stages, and each behavior path It consists of nodes in different attack stages, where K is the total number of attack stages.

6. The advanced persistent threat detection and response method based on improved self-supervised learning according to claim 1, characterized in that: The S3 specifically includes: S31. Using the contrastive learning mechanism in the behavior path learning and prediction module, the similarity of each attack stage node in the behavior path is measured. The node pair of the kth stage in the path is The goal of similarity measurement is to determine whether the nodes in two consecutive stages meet the characteristics of the APT threat path. Defined as: in, is the kth stage node and k+1 stage nodes The similarity of and is the node feature representation of two consecutive stages, ∥·∥ represents the norm of the vector, d(n i ,n j )) is node n i and n j The network topological distance between them, β is the weight parameter, which is used to balance the influence between node characteristics and network topology; S32, based on node similarity The threshold τ is set as the basis for judgment to distinguish normal network activity paths from potential APT threat paths. When the following conditions are met, the node pair is marked as an APT threat path node: in, For the judgment result, when the similarity is greater than or equal to the threshold τ, it is determined to be an APT threat path node, otherwise it is a normal network activity path; S33, for the path nodes that meet the APT characteristics Combine to generate a complete APT threat path model Among them, K is the total number of stages of APT attack, and the node pairs between each stage meet the characteristics of APT attack.

7. The method for advanced persistent threat detection and response based on improved self-supervised learning according to claim 1, characterized in that: The S4 specifically includes: S41. Obtain current network activity data in real time in the network environment Where N t is the number of samples collected at the current moment, D t The characteristic dimension of the sample is used to input the current network activity data into the self-supervised learning model and analyze it through the multi-scale spatiotemporal feature extraction module in the self-supervised learning model; S42, the multi-scale spatiotemporal feature extraction module extracts features from the current network activity data and generates a real-time threat feature representation set Generated real-time threat signature representation set Reflect potential threat patterns in current network activities; S43. Use path similarity measurement to represent the real-time threat signature set APT threat path model in the path model library Perform matching analysis: Among them, MatchSim is the matching similarity, which is used to measure the similarity between the real-time features and the APT path model. is a real-time feature representation set, is an APT threat path model in the path model library, ∥·∥ is the norm of the vector; S44, if the similarity is matched Exceeding the set threshold τ match , then the current network activity is judged to have potential threats, and the network node is marked as a potential threat node: in, To determine the result, when the matching similarity exceeds the threshold, it is marked as a potential threat node, otherwise it is a normal node.

8. The method for advanced persistent threat detection and response based on improved self-supervised learning according to claim 1, characterized in that: The S5 specifically includes: S51: If a potential threat node is detected Behavior path learning and prediction module based on path model library The path structure and spatiotemporal correlation of nodes in the attack are analyzed to predict the possible nodes of the next attack stage and obtain the nodes of the current attack stage. With prediction node Relevance score S52. According to the node association score Set the threshold τ rel , if the following conditions are met, the prediction node Potential threat nodes for the next attack phase: in, To predict the result, when the correlation score is greater than or equal to the threshold, it is determined as a potential threat node in the next attack stage; S53, behavior path learning and prediction module according to the prediction node The characteristics and behavior patterns in the path generate the corresponding threat level L threat : Among them, L threat is the predicted threat level, α1, β1, and η1 are weight parameters used to balance the influence of different factors. represents the risk factor of the prediction node, TimeDecay(t j -t i ) is the time decay function, which is used to measure the impact of the time interval between attack stages on the threat level.

Images