APT network attack tracing method based on text learning

Abstract

The invention discloses an APT (Advanced Persistent Threat) attack tracing method based on text learning, which comprises the following steps: (1) collecting system kernel log data, and collecting threat intelligence; (2) data preprocessing: processing system kernel log data and a CTI report into an entity-to-entity text structure; (3) marking: segmenting the preprocessed data into small units by using a marker; (4) pre-training a model, taking the BERT as the pre-training model, and training the BERT by using the segmented data; (5) downstream task training: using a group of marked data to perform fine tuning on the model by using the LSTM model, so that the model can output all suspicious events; and (6) giving system log data for testing, finding attack events by using the model, connecting the attack events in series according to a causal relationship between the events, and constructing an attack link diagram. According to the method, the BERT model is adopted as a pre-training model, semantic and context information in the text data can be better captured, and a subsequent model can understand and represent the text data from a higher level.

Description

Technical Field

[0001] The present invention relates to the field of network security and deep learning technology, and in particular to an APT network attack tracing method based on text learning. Background Art

[0002] As cyberspace continues to develop, Advanced Persistent Threats (APTs) pose an increasingly serious threat to system security, which may lead to system intrusion, data leakage, and damage across various fields. When a security alert is triggered, the attack source should be traced quickly to determine the cause and scope of the attack, and appropriate measures should be taken in a timely manner to minimize the impact of the attack and prevent similar attacks in the future.

[0003] On the other hand, with the advent of the big data era, deep learning technology has shown great potential in the field of network security. By analyzing a large amount of network data and log information, deep learning can learn and identify potential attack behaviors from them, providing security teams with real-time threat detection and response capabilities. Deep learning models commonly used for network attack tracing include RNN (recurrent neural network), LSTM (long short-term memory network), CNN (convolutional neural network), BERT (Bidirectional Encoder Representation based on Transformer), etc. However, since system logs express the status of system operation and have complex causal relationships, general deep learning models may not be able to effectively extract and represent key features. If only log data is used, the less attack data contained may limit the model's comprehensive understanding of attack behavior and lead to misjudgment.

[0004] In response to the above problems, how to select reasonable data and models to achieve automatic tracing of APT network attacks is an issue that needs to be solved urgently. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an APT network attack tracing method based on text learning.

[0006] A method for tracing the source of APT network attacks based on text learning includes the following steps:

[0007] Step 1) Data collection: Collect system log data in text format and collect open source CTI reports.

[0008] Step 2) Data preprocessing: Extract the entities and actions involved in the threat behavior in the CTI report. The CTI report is unstructured text data, which contains a lot of descriptive language about the actual threat actions. The extracted data is of higher quality. Threat behavior refers to any action that may cause harm or interference to the system, network or data; this usually includes malicious behavior such as attack, intrusion or data theft.

[0009] Step 3) Tokenization: Use a tokenizer to split the preprocessed continuous text data into smaller units to provide the basic data structure for subsequent language analysis and modeling.

[0010] Step 4) Pre-trained model: Use BERT as a pre-trained model and train it using the segmented data.

[0011] Step 5) Downstream task training: Use a small set of labeled data to fine-tune the model using the LSTM model so that the model can output all suspicious events. Suspicious events usually refer to events that may indicate potential security threats or anomalies, and are used to describe objects that the model needs to identify and process.

[0012] Step 6) Attack tracing: Given the system log data used for testing, use the model to find the attack events, connect the attack events according to the causal relationship between the events, and build an attack chain diagram.

[0013] Furthermore, in step 1), system logs in text format are collected, where one log represents one system event, and are used as data for model training.

[0014] Further, the specific steps of step 2) are as follows:

[0015] (2-1) IOC entity extraction: Identify IOCs through an open source IOC parser and IOC entities through regular expressions;

[0016] (2-2) IOC relationship extraction: Build a keyword list. Each relational verb corresponds to two IOC entities. Match the IOC entities and verbs through the text order and subject-verb-object relationship to form an IOC entity-relation triple. Each triple is output as a line of text content, expressed as <subject, operation, object>.

[0017] Further, the specific steps of step 3) are as follows:

[0018] (3-1) Input formatting: First, the system log and pre-processed CTI text will be cleaned and processed, including removing extra spaces and special characters;

[0019] (3-2) Word segmentation: The input natural language text is divided into small processing units, i.e. tokens, according to the set rules. Each token represents a specific word or subword unit in the text. Based on the original tokenizer of the model, a corresponding tokenizer is added to perform targeted segmentation using predefined characters.

[0020] (3-3) Special tags: The BERT model inserts a [CLS] tag at the beginning of a given text and a [SEP] tag between two sentences to separate them.

[0021] Further, the specific steps of step 4) are as follows:

[0022] (4-1) Word embedding: Map each token after word segmentation to a vector representation of a fixed length;

[0023] (4-2) Paragraph embedding: Different paragraphs are distinguished and assigned different vector representations to them, so that the model can handle the causal relationship between log and CTI text content;

[0024] (4-3) Position embedding: Assign a vector representation to the position information of a word or character in the text, so that the model can perceive the relative position of the word in the sentence;

[0025] (4-4) Final input: After word embedding, paragraph embedding, and position embedding, each input token gets a complete embedding vector, which contains semantic information and contextual information about the token and can be passed to the next layer of the model for further processing;

[0026] (4-5) Masked Language Model (MLM): In the input sentence, randomly select some words and replace them with [MASK] tags, and predict the masked words based on the context;

[0027] (4-6) Next Sentence Prediction (NSP): For each pair of input sentences, in the preprocessing stage, there is a 50% probability of taking the second sentence as the next sentence, and a 50% probability of selecting a random sentence from the corpus as the next sentence; the task of the model is to predict whether the second sentence is the next sentence of the first sentence based on the relationship between the two sentences.

[0028] Further, the specific steps of step 5) are as follows:

[0029] (5-1) Data labeling: Obtain a small set of labeled data. Benign data only needs to collect normal activities of the system, and malicious data is manually labeled or obtained from CTI reports.

[0030] (5-2) Classification layer: The labeled text sequence is embedded in BERT and then input into the LSTM model. The output layer usually includes one or more hidden layers and an output layer with a Sigmoid activation function. The output layer maps the output of the LSTM to a binary probability distribution, where one class represents malicious events and the other class represents benign events.

[0031] (5-3) Model training: Select the cross entropy loss function to measure the gap between the predicted value and the true label; select the Adam optimizer to minimize the loss function and update the model parameters; traverse each sample in the training set and iteratively train the model until the model is stable.

[0032] Further, the specific steps of step 6) are as follows:

[0033] (6-1) Attack event detection: The purpose of the model is to trace the source of APT network attacks by learning text data, collect log data, mark log data and alarm events, and then use the pre-trained model and LSTM to discover all suspicious events;

[0034] (6-2) Attack graph generation: Generate an initial attack graph for each malicious log entry detected; for each individual graph, expand it by analyzing the original events in the log text to find nodes adjacent to other graphs; if two initial attack graphs share a common node, merge the two disconnected graph components by adding the node and the corresponding transformation; repeat this process until all non-intersecting graph components are connected, that is, a complete attack link graph is generated.

[0035] The beneficial effects of the present invention are as follows:

[0036] 1) System kernel logs provide system operation status and event logs, while CTI reports provide information about known attack activities. By combining these data sources, we can more comprehensively understand and analyze attack behaviors;

[0037] 2) Using the BERT model as a pre-training model can better capture the semantic and contextual information in text data, allowing subsequent models to understand and represent text data at a higher level;

[0038] 3) By establishing an attack tracing model, it is possible to trace and identify potential attack events based on the test data set, and connect attack events in series based on cause and effect to form an attack chain. This can not only help understand the attacker's behavior path and strategy, but also provide a comprehensive view of attack events, which is helpful for analyzing the entry point of the attack and the impact of the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1This is a flow chart of an APT network attack tracing method based on text learning;

[0040] Figure 2 Extract cases for CTI reporting attack incidents;

[0041] Figure 3 Schematic diagram of Masked Language Model and Next Sentence Prediction;

[0042] Figure 4 Figure 1 is a schematic diagram of the attack tracing module. DETAILED DESCRIPTION

[0043] The present invention will be further described below in conjunction with the accompanying drawings.

[0044] like Figure 1 As shown, a method for tracing the source of APT network attacks based on text learning includes the following steps:

[0045] Step (1) Data collection: Collect system log data in text format and collect open source CTI reports.

[0046] In step (1), the detailed steps of data collection are as follows:

[0047] (1-1) System log collection: System logs describe the interactions between system entities in detail. System entities mainly involve files, processes, and network connections. The interactions between these entities are mapped into three major types of system events through system calls, including file access, process creation and destruction, and network access. System events are abstracted into the interaction relationship between subjects, operations, and objects. Collect system logs in text format. One log represents a system event, which is used as data for model training.

[0048] (1-2) CTI report collection: Open source cyber threat intelligence reveals a complete threat scenario. The descriptive relationship between threat indicators (IOCs) contains knowledge of threat behaviors at multiple stages. Collect enough CTI reports from open source websites. Since they are unstructured text data, they need to be processed before being used for model training.

[0049] Step (2) Data preprocessing: Extract the entities and actions involved in the threat behavior in the CTI report. The CTI report is unstructured text data and contains a lot of descriptive language about the actual threat actions. The extracted data is of higher quality, such as Figure 2 shown.

[0050] In step (2), the detailed steps of data preprocessing are as follows:

[0051] (2-1) IOC entity extraction: Identify IOCs (e.g., file name, file path, IP, etc.) through an open source IOC parser, mainly through regular expressions.

[0052] (2-2) IOC relationship extraction: The relationship between entities is usually expressed as some relational verbs (for example, read, write, download, open, etc.). Common operations are matched by building a keyword list. Each relational verb corresponds to two IOC entities. Through the text order and the correct subject-verb-object relationship, the IOC entities and verbs are matched to form an IOC entity-relation triple. Each triple is output as a line of text content, expressed as <subject, operation, object>.

[0053] Step (3) Tokenization: Use a tokenizer to split the preprocessed continuous text data into smaller units to provide a basic data structure for subsequent language analysis and modeling.

[0054] In step (3), the detailed steps of tokenization are as follows:

[0055] (3-1) Input formatting: First, the system log and pre-processed CTI text will be basically cleaned and processed, for example, removing extra spaces and special characters.

[0056] (3-2) Word segmentation: The input natural language text is divided into small processing units (tokens) according to certain rules. Each token represents a specific word or subword unit in the text. Log and CTI text data contain some text content in specific fields (for example, paths, URLs, IP addresses, and temporary file names). Based on the original tokenizer of the model, a tokenizer for specific fields is added to perform more targeted segmentation through predefined characters (such as ".", " / / ", and " / ").

[0057] (3-3) Special tags: The BERT model inserts a [CLS] tag at the beginning of a given text and a [SEP] tag between two sentences to separate them.

[0058] Step (4) Pre-training model: Use BERT as the pre-training model and train it using the segmented data, such as Figure 3 shown.

[0059] In step (4), the detailed steps of pre-training the model are as follows:

[0060] (4-1) Word embedding: Map each token after word segmentation to a vector representation of a fixed length.

[0061] (4-2) Paragraph embedding: Different paragraphs are distinguished and assigned different vector representations to them, so that the model can handle the causal relationship between log and CTI text content.

[0062] (4-3) Position embedding: Assign a vector representation to the position information of a word or character in the text, so that the model can perceive the relative position of the word in the sentence.

[0063] (4-4) Final input: After word embedding, paragraph embedding, and position embedding, each input token gets a complete embedding vector. These vectors contain semantic and contextual information about the token and can be passed to the next layer of the model for further processing.

[0064] (4-5) Masked Language Model (MLM): In the input sentence, randomly select some words (15%), replace them with [MASK] tags, and predict these masked words based on the context. In this way, BERT can learn the context information of words in the sentence.

[0065] (4-6) Next Sentence Prediction (NSP): For each pair of input sentences, in the preprocessing stage, there is a 50% probability that the second sentence will be the next sentence, and there is a 50% probability that a random sentence will be selected from the corpus as the next sentence. The task of the model is to predict whether the second sentence is the next sentence of the first sentence based on the relationship between the pair of sentences. In this way, BERT can learn the logical relationship and contextual transition between sentences.

[0066] Step (5) Downstream task training: Use a small set of labeled data to fine-tune the LSTM model so that the model can output all suspicious events.

[0067] In step (5), the detailed steps of downstream task training are as follows:

[0068] (5-1) Data labeling: Obtain a small set of labeled data. Benign data only needs to collect normal activities of the system, while malicious data can be manually labeled or obtained from CTI reports.

[0069] (5-2) Classification layer: The labeled text sequence is embedded in BERT and then input into the LSTM model. The output layer usually includes one or more hidden layers and an output layer with a Sigmoid activation function. This output layer maps the output of the LSTM to a binary probability distribution, where one class represents malicious events and the other class represents benign events.

[0070] (5-3) Model training: Select the cross entropy loss function to measure the gap between the predicted value and the true label. Select the Adam optimizer to minimize the loss function and update the model parameters. Traverse each sample in the training set and iteratively train the model until the model is stable.

[0071] Step (6) Attack tracing: Given the system log data used for testing, use the model to find the attack events, connect the attack events according to the causal relationship between the events, and build an attack chain diagram.

[0072] In step (6), the detailed steps of attack tracing are as follows:

[0073] (6-1) Attack event detection: The purpose of the model is to trace the source of APT network attacks by learning text data, collecting log data, marking log data and alarm events, and then using pre-trained models and LSTM to detect all suspicious events.

[0074] (6-2) Attack graph generation: Generate an initial attack graph for each malicious log entry detected. Since the model reports a single event based on the log text, the initial attack graphs for each entry may be disjoint. For each separate graph, expand it by analyzing the original events in the log text to find nodes adjacent to other graphs. If two initial attack graphs share a common node, merge the two disconnected graph components by adding the node and the corresponding changes. Repeat this process until all disjoint graph components are connected, that is, a complete attack link graph is generated, such as Figure 4 shown.

[0075] The above embodiments are only preferred embodiments of the present invention and are not limitations of the technical solutions of the present invention. Any technical solution that can be implemented on the basis of the above embodiments without creative work should be deemed to fall within the scope of protection of the patent of the present invention.

Claims

1. A method for tracing the source of APT network attacks based on text learning, characterized in that: The steps include: Step 1) Data collection: Collect system log data in text format and collect open source CTI reports; Step 2) Data preprocessing: extracting entities and actions involved in threat behaviors in CTI reports; Step 3) Tokenization: Use a tokenizer to segment the preprocessed continuous text data to provide a basic data structure for subsequent language analysis and modeling; Step 4) Pre-training model: Use BERT as a pre-training model and train it using the segmented data; Step 5) Downstream task training: Use a set of labeled data to fine-tune the LSTM model so that the LSTM model can output all suspicious events; labeled data refers to a data set that has been manually labeled or pre-defined. Step 6) Attack tracing: Given the system log data used for testing, use the BERT model and LSTM model to find the attack events, connect the attack events according to the causal relationship between the events, and build an attack chain diagram.

2. According to claim 1, a method for tracing the source of APT network attacks based on text learning is characterized in that: In the step 1), system logs in text format are collected, where one log represents one system event, and are used as data for model training.

3. According to the text learning-based APT network attack tracing method of claim 1, it is characterized in that: The specific steps of step 2) are as follows: (2-1) IOC entity extraction: Identify IOCs through an open source IOC parser and IOC entities through regular expressions; (2-2) IOC relationship extraction: Build a keyword list. Each relational verb corresponds to two IOC entities. Match the IOC entities and verbs through the text order and subject-verb-object relationship to form an IOC entity-relation triple. Each triple is output as a line of text content, expressed as <subject, operation, object>.

4. According to claim 1, a method for tracing the source of APT network attacks based on text learning is characterized in that: The specific steps of step 3) are as follows: (3-1) Input formatting: First, the system log and pre-processed CTI text will be cleaned and processed, including removing extra spaces and special characters; (3-2) Word segmentation: The input natural language text is segmented into multiple processing units, namely tokens, according to the set rules. Each token represents a specific word or subword unit in the text. On the basis of the original tokenizer, a corresponding tokenizer is added to perform targeted segmentation using predefined characters. (3-3) Special tags: The BERT model inserts a [CLS] tag at the beginning of a given text and a [SEP] tag between two sentences to separate them.

5. According to the text learning-based APT network attack tracing method of claim 1, it is characterized in that: The specific steps of step 4) are as follows: (4-1) Word embedding: Map each token after word segmentation to a vector representation of a fixed length; (4-2) Paragraph embedding: Different paragraphs are distinguished and assigned different vector representations to them, so that the model can handle the causal relationship between log and CTI text content; (4-3) Position embedding: Assign a vector representation to the position information of a word or character in the text, so that the model can perceive the relative position of the word in the sentence; (4-4) Final input: After word embedding, paragraph embedding, and position embedding, each input token gets a complete embedding vector, which contains semantic information and contextual information about the token and can be passed to the next layer of the model for further processing; (4-5) Masked Language Model MLM: In the input sentence, randomly select some words and replace them with [MASK] tags, and predict the masked words based on the context; (4-6) Next Sentence Prediction (NSP): For each pair of input sentences, in the preprocessing stage, there is a 50% probability of taking the second sentence as the next sentence, and a 50% probability of selecting a random sentence from the corpus as the next sentence; the task of the model is to predict whether the second sentence is the next sentence of the first sentence based on the relationship between the two sentences.

6. The APT network attack tracing method based on text learning according to claim 1 is characterized in that: The specific steps of step 5) are as follows: (5-1) Data labeling: Obtain a set of labeled data. For benign data, only the normal activities of the system need to be collected. For malicious data, it is necessary to manually label it or obtain it from CTI reports. Malicious data refers to data containing malicious behavior, benign data refers to data without malicious behavior, and normal activities refer to operations and events during the normal operation of the system. (5-2) Classification layer: The labeled text sequence is embedded in BERT and then input into the LSTM model. The output layer usually includes one or more hidden layers and an output layer with a Sigmoid activation function. The output layer maps the output of the LSTM to a binary probability distribution, where one class represents malicious events and the other class represents benign events. (5-3) Model training: Select the cross entropy loss function to measure the gap between the predicted value and the true label; select the Adam optimizer to minimize the loss function and update the model parameters; traverse each sample in the training set and iteratively train the model until the model is stable, that is, the loss function converges.

7. The APT network attack tracing method based on text learning according to claim 1 is characterized in that: The specific steps of step 6) are as follows: (6-1) Attack event detection: Collect log data of the end system that needs to be detected, collect log data through pre-trained models, and discover all suspicious events through pre-trained BERT models and LSTM models; (6-2) Attack graph generation: Generate an initial attack graph for each malicious log entry detected; for each individual graph, expand it by analyzing the original events in the log text to find nodes adjacent to other graphs; if two initial attack graphs share a common node, merge the two disconnected graph components by adding the node and the corresponding transformation; This process is repeated until all disjoint graph components are connected, thus generating a complete attack link graph.

Images