A method for detecting APT attacks based on feature-enhanced community detection

Abstract

The present invention belongs to the field of network security technology and discloses an APT attack discovery method based on feature-enhanced community detection, comprising: collecting log data and constructing an origin graph; dividing the origin graph into several subgraphs, generating a feature association vector set and a weight set for each subgraph, reconstructing a subgraph with feature association vectors and weights, each reconstructed subgraph containing multiple triples, and having feature association vectors and weights between the triples; performing feature-enhanced community detection on each reconstructed subgraph; performing rule matching on the communities in each reconstructed subgraph to obtain attack communities, and connecting the attack communities in each reconstructed subgraph according to the timestamp attributes of each reconstructed subgraph to complete APT attack discovery. The present invention uses the collected logs to construct an origin graph and accurately divides the attack communities by performing feature-enhanced community detection on the origin graph.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and particularly relates to a method for constructing a community detection algorithm based on feature enhancement and performing attack community discovery. Background Art

[0002] APT attacks (Advanced Persistent Threat) refer to persistent and effective attacks launched by certain organizations against specific targets. These attacks are highly covert and targeted, often leveraging various methods, including infected media, supply chains, and social engineering, to deliver advanced, persistent, and effective threats and attacks.

[0003] APT attacks are considered a highly dangerous network security threat due to their long latency, difficulty being detected by existing security defense systems, and even difficulty tracing their origins after an attack. APT attacks have become a major security threat facing all types of networks, leading to the emergence of a wide range of APT detection methods. A popular approach is to collect host logs and construct provenance graphs to reflect the interactions between entities in the system. These logs are constructed using <subject, operation, object> triples to construct provenance graphs. However, conventional graph data structures can only consider the behavior of nearby nodes and cannot account for the connections between distant nodes.

[0004] Community detection is also commonly used to aggregate and classify attack behaviors. It relies on the influence of nodes on their neighbors, forming communities through modularity optimization. However, this unsupervised approach can easily lead to the coupling of normal and offensive behaviors. The communities formed tend to aggregate a large number of benign behaviors, leading to dependency explosion, making the attack behaviors less obvious in the attack community and increasing false positives. Summary of the Invention

[0005] The purpose of the present invention is to provide an attack discovery method based on feature-enhanced community detection, which uses collected logs to construct an origin graph and accurately divides the attack community by performing feature-enhanced community detection on the origin graph.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A method for detecting APT attacks based on feature-enhanced community detection, comprising:

[0008] Step 1: Collect log data and build a provenance graph;

[0009] Step 2: Split the original graph into several subgraphs, generate a feature association vector set and a weight set for each subgraph, and reconstruct the subgraphs with feature association vectors and weights. Each reconstructed subgraph contains multiple triplets, and there are feature association vectors and weights between triplets.

[0010] Step 3: Perform feature-enhanced community detection on each reconstructed subgraph, including:

[0011] Step 3-1: Treat each triple in the subgraph as an independent community;

[0012] Step 3-2: For each triple, the triple is sequentially assigned to the community where its adjacent triples are located. The modularity change of the subgraph before and after the proposed assignment is calculated. If the modularity change is greater than zero, the non-overlapping part of the proposed triple is actually assigned to the community where the adjacent triple with the largest modularity change is located. Otherwise, the proposed triple is not actually assigned.

[0013] Step 3-3: Repeat step 3-2 until the communities to which all triples belong remain unchanged;

[0014] Step 3-4: Treat all triples belonging to the same community as a new triple, and update the feature association vectors and weights between the new triples;

[0015] Step 3-5: Repeat steps 3-1 to 3-4 until the modularity of the entire subgraph remains unchanged, completing the community division of the subgraph;

[0016] Step 4: Match the rules of the communities in each reconstructed subgraph to obtain the attack community. According to the timestamp attribute of each reconstructed subgraph, connect the attack communities in each reconstructed subgraph to complete the APT attack discovery.

[0017] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution. They are merely further supplements or optimizations. Under the premise that there are no technical or logical contradictions, each optional method can be combined separately for the above-mentioned overall solution, or multiple optional methods can be combined.

[0018] Preferably, the step 2 comprises:

[0019] Step 2-1: Split the provenance graph based on the timestamp attributes of the edges in multiple triples. After the splitting is completed, multiple subgraphs are obtained, each subgraph contains multiple triples.

[0020] Step 2-2: For the segmented subgraph, extract the event features of each triple in the subgraph and compare them with the event features of other triples in the subgraph to obtain the feature association vector between the two triples, that is, obtain the feature association vector set of the subgraph;

[0021] Step 2-3: Use the logistic regression algorithm to optimize the weight of the feature association vector to obtain the weight set corresponding to the subgraph. Each element in the weight set is the weight between the corresponding two triples in the subgraph, and the initial self-loop weight of each triple is reset to 0.

[0022] Step 2-4: Use the weight set to weight the feature association vector set. Specifically, the weight is spliced ​​to the end of the corresponding feature association vector to complete the reconstruction of the subgraph.

[0023] Preferably, the attributes included in the feature association vector include: Subject type, Object type, Operator type, timestamp, S_pid, S_pname, S_domain, S_ip, S_socket, S_type, S_path, O_pid, O_pname, O_domain, O_ip, O_socket, O_type and O_path;

[0024] If the event features extracted from the two triples are recorded as event u and event v respectively, the specific meanings of the attributes contained in the feature association vector are as follows:

[0025] Subject type means: whether the initiator type of event u and event v is the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0026] Object type means: whether the operation object types of event u and event v are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0027] Operator type means: whether the operation behaviors of event u and event v are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0028] The meaning of timestamp is: whether the time between event u and event v is less than the time threshold. If so, the attribute value of the timestamp attribute between event u and event v is 1, otherwise the attribute value is 0;

[0029] S_pid means: if the initiator type of event u and event v are both processes, then whether the process id numbers are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0030] S_pname means: if the initiator type of event u and event v are both processes, whether the process names of the processes are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0031] S_domain means: if the initiator type of event u and event v are both sockets, whether the domains to which the sockets belong are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0032] S_ip means: if the initiator type of event u and event v are both sockets, whether the IP addresses of the sockets are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0033] S_socket means: if the initiator type of event u and event v are both sockets, whether the port numbers of their sockets are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0034] S_type means: if the initiator type of event u and event v are both sockets, whether the attachment types of their operations are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0035] S_path means: if the initiator type of event u and event v are both files, whether their file paths are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0036] O_pid means: if the operation object type of event u and event v are both processes, then whether the process id numbers are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0037] O_pname means: if the operation object type of event u and event v are both processes, whether the process names are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0038] O_domain means: if the operation object type of event u and event v are both sockets, whether the domains to which the sockets belong are the same; if they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0039] O_ip means: if the operation object type of event u and event v are both sockets, whether the IP addresses of the sockets are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0040] O_socket means: if the operation object type of event u and event v are both sockets, whether the port numbers of the sockets are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0041] O_type means: if the operation object type of event u and event v are both sockets, whether the attachment types of their operations are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0;

[0042] O_path means: if the operation object types of event u and event v are both files, whether their file paths are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0.

[0043] Preferably, in step 2-3, the feature association vector is weighted optimized by a logistic regression algorithm to obtain a weight set corresponding to the subgraph, including:

[0044] A weight vector is obtained through the logistic regression algorithm Using feature association vectors and weight vectors Perform dot multiplication as the weight between each two triplets. The weight calculation formula is as follows:

[0045]

[0046] Among them, ω is the weight, α i is the weight vector The value of the i-th position, e i is the value of the i-th bit of the feature association vector, and k is the total number of bits of the weight vector or feature association vector.

[0047] Preferably, in step 3-2, the change in modularity of the subgraph before and after the proposed allocation is calculated as follows:

[0048]

[0049] Where Δ is the modularity change of the subgraph, m is the total number of feature association vectors in the subgraph, i,j∈[1,m], k i k represents the sum of the weights of all feature association vectors related to triple i and twice the self-loop weight of triple i. j A represents the sum of the weights of all feature association vectors related to triple j and twice the self-loop weight of triple j. ij Represents the weight corresponding to the feature association vector between triple i and triple j, a binary parameter c i represents the community to which triple i belongs, c j represents the community to which triple j belongs, c i = = c j It means that triple i and triple j belong to the same community.

[0050] Preferably, in step 3-4, updating the feature association vectors and weights between the new triplets includes:

[0051] Step 3-4-1: Perform bitwise AND operation on the feature association vectors of all triples in each community to form an enhanced self-loop feature association vector for each community.

[0052] Step 3-4-2: Eliminate all feature correlation vectors between different triples in the same community;

[0053] Step 3-4-3: For the feature correlation vectors between triples in different communities, if there are q feature correlation vectors between two communities A and B, calculate a feature correlation vector As the unique characteristic association vector between communities A and B, the calculation formula is: Among them, β i Represents the feature association vector The value of the i-th position, Δ i Represents the difference between the number of vectors with the value of 1 and 0 at the i-th position in the q feature association vectors;

[0054] Step 3-4-4: Take the weight vector obtained by the logistic regression algorithm in step 2-3 According to the feature association vector and weight vector The weight is calculated as the enhanced weight between communities A and B, according to the self-loop feature association vector and weight vector The calculated weight is used as the self-loop weight after community enhancement, and the unique feature association vector between communities A and B is The enhanced weights between communities A and B are used as the feature association vectors and weights between the new triples, and the self-loop feature association vectors of the communities are converted into The enhanced self-loop weight is used as the self-loop feature association vector and self-loop weight of the new triplet.

[0055] The present invention provides an attack detection method based on feature-enhanced community detection, which has the following advantages over existing technologies: 1. It improves the Louvain algorithm, which has excellent performance in processing large networks, by enhancing its features so that it can be applied to triples, detecting overlapping communities, optimizing detection results, and retaining its strong performance in processing large networks. 2. It provides a method for constructing feature association vectors and calculating weights between triples, fully exploring the semantic associations between events, and has strong scalability. 3. It uses community detection to divide attack communities, which can match multiple sensitive operations within a community, reducing matching difficulty and improving matching accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flow chart of an attack discovery method based on feature-enhanced community detection according to the present invention;

[0057] Figure 2 This is an example diagram of a triplet of the present invention;

[0058] Figure 3 An example diagram of the invention for dividing the origin graph into subgraphs;

[0059] Figure 4 An example diagram of community detection with feature enhancement performed by the present invention. DETAILED DESCRIPTION

[0060] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0062] like Figure 1 As shown, this embodiment provides an APT attack detection method based on feature-enhanced community detection, including the following steps:

[0063] Step 1. Collect log data and build a provenance graph: Use a published log collection tool (such as the log collection tool disclosed in Patent No. 2022110610516) to collect logs in the system, and build a provenance graph based on the collected log data. The nodes represent processes, files, or socket entities, and the edges represent the operational relationships between two nodes, such as read, write, download, send, etc. The timestamp is used as the attribute of the edge to indicate the time when the event occurred. The provenance graph is composed of multiple triples and stored. Figure 2 As shown in the figure, a triple (subject, operator, object) represents an event, where subject represents the main node that initiates the operation (initiator), object represents the object node that is operated (operation object), and operator represents the operation behavior, that is, the edge, subject and object may overlap.

[0064] Step 2: Divide the origin graph into subgraphs, generate a feature association vector set and a weight set for each subgraph, and reconstruct the subgraph with the feature association vector and weight. Each reconstructed subgraph contains multiple triplets, and there are feature association vectors and weights between the triplets.

[0065] Step 2-1: Split the provenance graph based on the timestamp attributes of the edges in multiple triples. If there are multiple triplets, and the time interval between their occurrence does not exceed 10ms, that is, Δtimestamp < 10ms, then these triplets will be divided into a subgraph. After the division is completed, multiple subgraphs are obtained. Each subgraph contains multiple triplets. Each subgraph is treated as a unit for subsequent operations. Figure 3 An example of segmenting the provenance graph based on timestamps.

[0066] Step 2-2: For the segmented subgraph, extract the event features of each triple in the subgraph and compare them with the event features of other triples in the subgraph to obtain the feature association vector between the two triplets, that is, obtain the feature association vector set of the subgraph.

[0067] This embodiment extracts event features from each triple and compares them with event features of other triples to form a feature association vector The values ​​of all attributes in this vector (eq) are 0 or 1, and the resulting feature association vector is as shown in Table 1 (including the continuation table):

[0068] Table 1. Attributes of feature association vectors

[0069] property Subject type Object type Operator type timestamp eq 0 or 1 0 or 1 0 or 1 0 or 1

[0070] Table 1 Feature association vector attributes

[0071] property S_pid S_pname S_domain S_ip S_socket S_type S_path eq 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1

[0072] Table 1 Feature association vector attributes

[0073] property O_pid O_pname O_domain O_ip O_socket O_type O_path eq 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1 0 or 1

[0074] If the event features extracted from the two triples are recorded as event u and event v respectively, the specific meanings of the attributes contained in the feature association vector are as follows:

[0075] Subject type means: whether the initiator type of event y and event v is the same, such as both are processes or both are network sockets. If they are the same, eq=1, otherwise eq=0;

[0076] Object type means: whether the operation object types of event u and event v are the same, such as both are processes or both are files. If they are the same, eq = 1, otherwise eq = 0;

[0077] Operator means: whether the operations performed by event u and event v are the same, such as both are read or both are write. If they are the same, eq = 1, otherwise eq = 0;

[0078] Timestamp means whether the time of occurrence of event u and event v is close. If u.timestamp - v.timestamp < 5ms, then the timestamp feature attribute between events u and v = 1, where 5ms is the time interval between events. This can be changed according to actual needs, but it must not exceed the time interval used to split the provenance graph in step 2-1.

[0079] S_pid (O_pid) means: if the initiator (operation object) type of event u and event v is both process, then whether the process id numbers are the same, if they are the same, eq = 1, otherwise eq = 0;

[0080] S_pname (O_pname) means: if the initiator (operation object) type of event u and event v are both processes, whether the process names of the processes are the same, if they are the same, eq=1, otherwise eq=0;

[0081] S_domain (O_domain) means: if the initiator (operation object) type of event u and event v is both socket, whether the domains to which the sockets belong are the same, if they are the same, eq = 1, otherwise eq = 0;

[0082] S_ip (O_ip) means: if the initiator (operation object) type of event u and event v is both socket, whether the IP addresses of the sockets are the same, if they are the same, eq = 1, otherwise eq = 0;

[0083] S_socket (O_socket) means: if the initiator (operation object) type of event u and event v are both sockets, whether the port numbers of their sockets are the same, if they are the same, eq = 1, otherwise eq = 0;

[0084] S_type (O_type) means: if the initiator (operation object) type of event u and event v are both sockets, whether the attachment types of their operations are the same, if they are the same, eq = 1, otherwise eq = 0;

[0085] S_path (O_path) means: if the initiator (operation object) type of event u and event v are both files, whether their file paths are the same, if they are the same, eq=1, otherwise eq=0;

[0086] like Figure 2 As shown in , there are two events in the provenance graph, namely event e1 and event e2. Assuming that the time interval between the two events is less than 10ms, there is a feature correlation vector between e1 and e2. The value of each item in the feature correlation vector represents the following meaning:

[0087] The initiator (Subject) type of event e1 and event e2 is the same, both are processes, and they are the same process (Subject type, S_pid, S_pname=1);

[0088] The operation (Operator) types of event e1 and event e2 are different. Event e1 is downloading, and event e2 is uploading (Operator type = 0).

[0089] The operation objects (Object) of event e1 and event e2 are of the same type, both are sockets, and their domains, IP addresses, and port numbers are the same (Object type, O_domain, O_ip, O_socket=1);

[0090] The download type of event e1 (e.g., executable file) is different from the upload type of event e2 (e.g., PDF file) (O_type = 0);

[0091] The time between event e1 and event e2 is less than 10ms (timestamp=1); the feature association vector between event e1 and event e2 is 110111000000011100.

[0092] After generating the feature association vector between each triple, each subgraph will obtain a feature vector set, each element of which is the feature association vector between two triples in the subgraph.

[0093] Step 2-3: Use the logistic regression algorithm to optimize the weight of the feature association vector. Since there are complex relationships between events, and there are a large number of connections between attack events and benign events, there will be a dependency explosion problem between events. The logistic regression algorithm is used to find a weight vector Use the feature association vector and the vector to perform dot multiplication as the weight between each two triplets, and calculate the weight formula:

[0094]

[0095] Among them, α i is the weight vector The value of the i-th position, e i is the feature association vector The value of the i-th position, weight ω is the weight vector Associated with feature vector The dot product result of .

[0096] After weight optimization of the feature association vector, each subgraph will obtain a weight set, in which each element is the weight between two triples in the subgraph, and the initial self-loop weight of each triple is reset to 0.

[0097] Step 2-4: Use the weight set to weight the feature vector set, splice each calculated weight to the end of its corresponding feature association vector, and perform weighted reconstruction of the subgraph. Each triple in the reconstructed subgraph has a feature association vector and weight.

[0098] Step 3: Perform feature-enhanced community detection on each reconstructed subgraph. This method uses the Louvain algorithm, which can efficiently process large networks, for community detection and improves it so that features are enhanced in each iteration and it is suitable for triple partitioning. Specifically, this involves adapting the Louvain algorithm, originally designed for general graphs, to overlapping triplets, allowing the detected communities to have overlapping parts, and performing feature enhancement after each iteration to achieve a better partitioning. The specific steps are as follows:

[0099] Step 3-1: Treat each triple in the subgraph as an independent community.

[0100] Step 3-2: For each triple, assign the triple to the community where its adjacent triples are located in turn, and calculate the modularity change of the subgraph before and after the proposed assignment. If the modularity change is greater than zero, the non-overlapping part of the proposed triple is actually assigned to the community where the adjacent triple with the largest modularity change is located. Otherwise, the proposed triple is not actually assigned. The modularity change calculation formula is as follows:

[0101]

[0102] Where Δ is the modularity change of the subgraph, m is the total number of feature association vectors in the subgraph, i,j∈[1,m], k i k represents the sum of the weights of all feature association vectors related to triple i and twice the self-loop weight of triple i. j It represents the sum of the weights corresponding to all feature association vectors related to triple j and twice the self-loop weight of triple j. When the self-loop weight of the triple is 0, k i represents the sum of the weights corresponding to all feature association vectors related to triple i, k j A represents the sum of the weights corresponding to all feature association vectors related to triple j. ij Represents the weight corresponding to the feature association vector between triple i and triple j, a binary parameter c i represents the community to which triple i belongs, c j represents the community to which triple j belongs, c i = = c j It means that triple i and triple j belong to the same community.

[0103] Step 3-3: Repeat step 3-2 until the communities to which all triples belong remain unchanged.

[0104] Step 3-4: Treat all triples belonging to the same community as a new triple (i.e., compress all triples in the same community into a new "triplet"), and update the feature association vectors and weights between the new triples. The update method is as follows:

[0105] Step 3-4-1: Perform bitwise AND operation on the feature association vectors of all triples in each community to form an enhanced self-loop feature association vector for each community. Among them, the feature association vectors in all communities are used to enhance the features of the community self-loop edges through bitwise AND operations. If the values ​​of the same position of all feature association vectors in a community are 1, the attribute corresponding to the position is regarded as an important dependency attribute for dividing these triplets into the same community. Then, all feature association vectors in a community are bitwise ANDed to obtain a new feature association vector as the self-loop feature association vector of the community. This attribute is strengthened in the vector so that all important dependency attribute values ​​in the vector are 1, which further strengthens the characteristics of the community and can help obtain a better division.

[0106] It should be noted that the self-loop feature association vector and self-loop weight refer to the feature association vector and weight of the community (or triple) itself, while those described only as feature association vector and weight refer to the feature association vector and weight between two communities (or between two triples).

[0107] Step 3-4-2: Eliminate all feature correlation vectors between different triples in the same community.

[0108] Step 3-4-3: For the feature correlation vectors between different communities, assuming that there are q feature correlation vectors between two communities A and B, calculate a feature correlation vector As the unique characteristic association vector between communities A and B, the calculation formula is: Among them, β i Represents the feature association vector The value of the i-th position, Δ i Indicates the difference between the number of vectors with the value of 1 and 0 at the i-th position in the q feature association vectors; according to the feature association vector The weight is calculated as the enhanced weight between communities A and B. The feature association vector between communities is used to enhance the features between communities through the above formula. If the number of vectors with a value of 0 and a value of 1 at the same position of all feature association vectors between two communities is significantly different (the difference is greater than half of the total number of vectors), the attribute corresponding to this position is regarded as an important dependent attribute of the triplets of the two communities not being classified into the same community. Then a new feature association vector is calculated according to the above formula. Strengthening this attribute in the vector so that all important dependent attribute values ​​in the vector are 1 further strengthens the characteristics between communities and can help obtain better divisions.

[0109] Step 3-4-4: Weight vector calculated based on step 2-3 The self-loop feature correlation vector calculated in steps 3-4-1 and 3-4-3 and feature association vector The weight calculation formula in steps 2-3 is used to calculate the community's enhanced self-loop weight and the enhanced weight between communities. The next iteration will directly use the enhanced weights of the community's self-loop and between communities for partitioning.

[0110] Step 3-5: Repeat steps 3-1 to 3-4 until the modularity of the entire subgraph no longer changes. At this point, events related to attack features have been divided into one community.

[0111] Figure 4 Schematic diagram of community detection enhancement features, where w in P4 is the feature association vector corresponding to w1, w2, w4, w5, w7, and w9 in P3, obtained by the calculation formula of the inter-community feature association vector. w1 in P4 is the feature association vector corresponding to w3, w6, and w8 in P3, and w2 is the feature association vector corresponding to w in P3. 10 The corresponding feature association vector is bitwise ANDed (i.e. w 10 itself).

[0112] Communities formed after community aggregation are divided according to the degree of attack characteristics exhibited by their operations. One community is for operations with very prominent attack characteristics, another community is for operations with a small number of attack characteristics (this part is usually a false positive), and another community is for operations with almost no attack characteristics. Each community may have overlapping parts, and the overlapping parts are generally some processes used in both benign and malicious operations, such as cmd and PowerShell.

[0113] Step 4: Perform rule matching on the communities in each segmented subgraph to find the attack community, and connect the attack communities in each subgraph according to the timestamp attribute of each subgraph.

[0114] Step 4-1: Match the rules of the community and specify the rules based on the characteristics of the attack behavior in the underlying logs, as shown in Table 2:

[0115] Table 2 Rules table

[0116]

[0117]

[0118] It should be noted that the technologies shown in the table are only part of them, and they can be added as needed during actual implementation.

[0119] Step 4-2: Rule matching: After the communities are divided, examine the subject and operator components in each community. The subjects of all triples in each community form a subject set, and the operators of all triples form an operator set. Each subject in the subject set is matched with the subject of the specific operation in Table 2. Each operator in the operator set is matched with the log representation in Table 2. A successful match identifies an attack triple. Communities with a greater number of attack triplets than the attack threshold are considered attack communities. For example, if the number of attack triplets in a community is greater than one-fifth of the total number of triplets in the community, the community is considered an attack community.

[0120] If a community has a triplet with the subject being a command-line process and the operator being netshadvfirewall set allprofiles state off, it indicates that a file operation was performed to disable the firewall, which is likely malicious. If this community then establishes a connection to download a file and executes it (subject being socket and operator being download), the more rules that match in the table, the more likely this community is an attacking community.

[0121] This has several advantages over using the origin graph directly. The first is that most of the logs are benign, with only a few malicious ones. Figure 1Matching one by one is inefficient. However, after detection, the area is directly divided into communities. Rule matching is not random, but rather scoped (i.e., operations within the same community). This avoids needle-in-a-haystack matching and provides targeted matching. Secondly, communities with very prominent attack signatures are very easy to match. Therefore, once a community is found to have a large number of operations matched, other communities in the subgraph are no longer matched, thus reducing the number of matching operations.

[0122] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make numerous modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for detecting APT attacks based on feature-enhanced community detection, characterized in that: The APT attack detection method based on feature-enhanced community detection includes: Step 1: Collect log data and build a provenance graph; Step 2: Split the original graph into several subgraphs, generate a feature association vector set and a weight set for each subgraph, and reconstruct the subgraphs with feature association vectors and weights. Each reconstructed subgraph contains multiple triplets, and there are feature association vectors and weights between triplets. Step 3: Perform feature-enhanced community detection on each reconstructed subgraph, including: Step 3-1: Treat each triple in the subgraph as an independent community; Step 3-2: For each triple, the triple is sequentially assigned to the community where its adjacent triples are located. The modularity change of the subgraph before and after the proposed assignment is calculated. If the modularity change is greater than zero, the non-overlapping part of the proposed triple is actually assigned to the community where the adjacent triple with the largest modularity change is located. Otherwise, the proposed triple is not actually assigned. Step 3-3: Repeat step 3-2 until the communities to which all triples belong remain unchanged; Step 3-4: Treat all triples belonging to the same community as a new triple, and update the feature association vectors and weights between the new triples; Step 3-5: Repeat steps 3-1 to 3-4 until the modularity of the entire subgraph remains unchanged, completing the community division of the subgraph; Step 4: Match the rules of the communities in each reconstructed subgraph to obtain the attack community. According to the timestamp attribute of each reconstructed subgraph, connect the attack communities in each reconstructed subgraph to complete the APT attack discovery.

2. The APT attack detection method based on feature-enhanced community detection according to claim 1 is characterized in that: The step 2 includes: Step 2-1: Split the provenance graph based on the timestamp attributes of the edges in multiple triples. After the splitting is completed, multiple subgraphs are obtained, each subgraph contains multiple triples. Step 2-2: For the segmented subgraph, extract the event features of each triple in the subgraph and compare them with the event features of other triples in the subgraph to obtain the feature association vector between the two triples, that is, obtain the feature association vector set of the subgraph; Step 2-3: Use the logistic regression algorithm to optimize the weight of the feature association vector to obtain the weight set corresponding to the subgraph. Each element in the weight set is the weight between the corresponding two triples in the subgraph, and the initial self-loop weight of each triple is reset to 0. Step 2-4: Use the weight set to weight the feature association vector set. Specifically, the weight is spliced ​​to the end of the corresponding feature association vector to complete the reconstruction of the subgraph.

3. The APT attack detection method based on feature-enhanced community detection according to claim 2 is characterized in that: The attributes included in the feature association vector are: Subject type, Object type, Operator type, timestamp, S_pid, S_pname, S_domain, S_ip, S_socket, S_type, S_path, O_pid, O_pname, O_domain, O_ip, O_socket, O_type and O_path; If the event features extracted from the two triples are recorded as event u and event v respectively, the specific meanings of the attributes contained in the feature association vector are as follows: Subject type means: whether the initiator type of event u and event v is the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; Object type means: whether the operation object types of event u and event v are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; Operator type means: whether the operation behaviors of event u and event v are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; The meaning of timestamp is: whether the time between event u and event v is less than the time threshold. If so, the attribute value of the timestamp attribute between event u and event v is 1, otherwise the attribute value is 0; S_pid means: if the initiator type of event u and event v are both processes, then whether the process id numbers are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0; S_pname means: if the initiator type of event u and event v are both processes, whether the process names of the processes are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; S_domain means: if the initiator type of event u and event v are both sockets, whether the domains to which the sockets belong are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0; S_ip means: if the initiator type of event u and event v are both sockets, whether the IP addresses of the sockets are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; S_socket means: if the initiator type of event u and event v are both sockets, whether the port numbers of their sockets are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; S_type means: if the initiator type of event u and event v are both sockets, whether the attachment types of their operations are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; S_path means: if the initiator type of event u and event v are both files, whether their file paths are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; O_pid means: if the operation object type of event u and event v are both processes, then whether the process id numbers are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0; O_pname means: if the operation object type of event u and event v are both processes, whether the process names are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; O_domain means: if the operation object type of event u and event v are both sockets, whether the domains to which the sockets belong are the same; if they are the same, the attribute value is 1, otherwise the attribute value is 0; O_ip means: if the operation object type of event u and event v are both sockets, whether the IP addresses of the sockets are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; O_socket means: if the operation object type of event u and event v are both sockets, whether the port numbers of the sockets are the same, if they are the same, the attribute value is 1, otherwise the attribute value is 0; O_type means: if the operation object type of event u and event v are both sockets, whether the attachment types of their operations are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0; O_path means: if the operation object types of event u and event v are both files, whether their file paths are the same. If they are the same, the attribute value is 1, otherwise the attribute value is 0.

4. The APT attack detection method based on feature-enhanced community detection according to claim 2 is characterized in that: In step 2-3, the feature association vector is weighted optimized using a logistic regression algorithm to obtain a weight set corresponding to the subgraph, including: A weight vector is obtained through the logistic regression algorithm Using feature association vectors and weight vectors Perform dot multiplication as the weight between each two triplets. The weight calculation formula is as follows: Among them, ω is the weight, α i is the weight vector The value of the i-th position, e i is the value of the i-th bit of the feature association vector, and k is the total number of bits of the weight vector or feature association vector.

5. The APT attack detection method based on feature-enhanced community detection according to claim 2 is characterized in that: In step 3-2, the change in the modularity of the subgraph before and after the proposed allocation is calculated as follows: Where Δ is the modularity change of the subgraph, m is the total number of feature association vectors in the subgraph, i,j∈[1,m], k i k represents the sum of the weights of all feature association vectors related to triple i and twice the self-loop weight of triple i. j A represents the sum of the weights of all feature association vectors related to triple j and twice the self-loop weight of triple j. ij Represents the weight corresponding to the feature association vector between triple i and triple j, a binary parameter c i represents the community to which triple i belongs, c j represents the community to which triple j belongs, c i = = c j It means that triple i and triple j belong to the same community.

6. The APT attack detection method based on feature-enhanced community detection according to claim 2 is characterized in that: In step 3-4, updating the feature association vectors and weights between the new triplets includes: Step 3-4-1: Perform bitwise AND operation on the feature association vectors of all triples in each community to form an enhanced self-loop feature association vector for each community. Step 3-4-2: Eliminate all feature correlation vectors between different triples in the same community; Step 3-4-3: For the feature correlation vectors between triples in different communities, if there are q feature correlation vectors between two communities A and B, calculate a feature correlation vector As the unique characteristic association vector between communities A and B, the calculation formula is: Among them, β i Represents the feature association vector The value of the i-th position, Δ i Represents the difference between the number of vectors with the value of 1 and 0 at the i-th position in the q feature association vectors; Step 3-4-4: Take the weight vector obtained by the logistic regression algorithm in step 2-3 According to the feature association vector and weight vector The weight is calculated as the enhanced weight between communities A and B, according to the self-loop feature association vector and weight vector The calculated weight is used as the self-loop weight after community enhancement, and the unique feature association vector between communities A and B is The enhanced weights between communities A and B are used as the feature association vectors and weights between the new triples, and the self-loop feature association vectors of the communities are converted into The enhanced self-loop weight is used as the self-loop feature association vector and self-loop weight of the new triplet.

Images