Cross-host APT full-chain threat tracing method and device

Abstract

The invention relates to the technical field of network security, and discloses a cross-host APT full-chain threat tracing method and device, and the method comprises the steps: collecting an audit log from a single host, recognizing suspicious nodes in the audit log, and constructing a suspicious attack graph based on the suspicious nodes and corresponding events; performing edge compression on the suspicious attack graph, extracting a path, calculating the similarity between a parent event and a child event in the path, and calculating the influence degree of the child event on the parent event according to the similarity; calculating the path score of each path based on the influence degree between the events, and filtering the paths of which the path scores are lower than a threshold value from the compressed suspicious attack graph to obtain a main attack graph corresponding to the single host; acquiring security log information of a single host to obtain a cross-host causal relationship; and splicing the main attack graph of the single hosts and the single hosts with remote login behaviors based on a causal relationship to obtain an intra-domain complete cross-host attack graph. According to the method, the complete attack graph in the domain is effectively constructed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an advanced persistent threat detection and response method and device that combines single-host and multi-host analysis and uses remote login to perform attack reasoning and path restoration. Background Art

[0002] When facing APT (Advanced Persistent Threat) attacks, analysts lack effective automated analysis tools and cannot accurately predict the attacker's next move based on early behavioral information. Most of them can only rely on their own experience and knowledge to make judgments, which has great limitations in complex APT attack scenarios. At present, there is also a lack of effective artificial intelligence-assisted means to actively predict attack behaviors, and it is impossible to warn and reinforce the system in advance, resulting in a passive position in the attack and defense confrontation. Therefore, there is an urgent need for an innovative multi-stage comprehensive tracing method that integrates single-host and multi-host analysis to achieve effective detection, analysis and defense of APT attacks, thereby changing the current passive network security defense situation. Summary of the invention

[0003] The purpose of the present invention is to provide a cross-host APT full-chain threat tracing method and device to effectively build a complete attack graph within the domain.

[0004] To achieve the above object, the technical solution adopted by the present invention is:

[0005] A cross-host APT full-chain threat tracing method, the cross-host APT full-chain threat tracing method comprising:

[0006] Collect audit logs from a single host, identify suspicious nodes in the audit logs, and build a suspicious attack graph based on the suspicious nodes and corresponding events;

[0007] After edge compression of the suspicious attack graph, the path is extracted, the similarity between the parent event and the child event in the path is calculated, and the influence of the child event on the parent event is calculated based on the similarity;

[0008] The path score of each path is calculated based on the degree of influence between events, and the paths with path scores lower than the threshold are filtered out from the compressed suspicious attack graph to obtain the main attack graph corresponding to the single host;

[0009] Collect the security log information of a single host, obtain the remote login information between hosts based on the security log information, and determine the remote login source host and the controlled target host based on the remote login information to obtain the causal relationship between hosts;

[0010] Based on the causal relationship, the main attack graph of a single host and the single host with remote login behavior are spliced ​​together to obtain a complete cross-host attack graph in the domain.

[0011] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0012] Preferably, the identification rule of the suspicious node is as follows:

[0013] If the process receives data from the network, the process is marked as a suspicious node;

[0014] If a process marked as a suspicious node sends data to the network, the corresponding socket of the network can be marked as a suspicious node;

[0015] If a process reads a file marked as a suspicious node, the process is marked as a suspicious node;

[0016] If a process marked as a suspicious node writes a file, the file is marked as a suspicious node;

[0017] If a process marked as a suspicious node creates or clones a new process, the new process is marked as a suspicious node.

[0018] Preferably, the calculating the similarity between the parent event and the child event in the path includes:

[0019] Normalized data flow:

[0020] , (1);

[0021] Normalization occurs when:

[0022] , (2);

[0023] In the formula, and represents two events, and the event For events The parent event of and Represent events separately The data flow and occurrence time, and Represent events separately The data flow and occurrence time, Indicates an event Normalized data flow, Indicates an event Normalized data flow, Indicates an event The normalized occurrence time, Indicates an event The normalized occurrence time, Indicates the maximum data flow. Indicates the maximum occurrence time;

[0024] Calculation Events and events The similarity between:

[0025] (3);

[0026] In the formula, Indicates an event and events The similarity between .

[0027] Preferably, the calculating the influence of the child event on the parent event according to the similarity includes:

[0028] (4);

[0029] In the formula, Represents a sub-event Parent Events The degree of influence Represents a sub-event and parent event The similarity between As ,Will As Substituting into formula (3) we can get: Indicates the parent event The set of all sub-events of Represents a sub-event and parent event The similarity between As ,Will As Substitute it into formula (3) and calculate it.

[0030] Preferably, the calculating of the path score of each path based on the degree of influence between events comprises:

[0031] Calculating sub-events Event score:

[0032] (5);

[0033] In the formula, For sub-events The event score, is the adjustment factor, Represents a sub-event Parent Events the extent of the impact;

[0034] The path scores are as follows:

[0035] (6);

[0036] In the formula, represents the path score, Represents the set of all sub-events contained in the path. Indicates an event The weight factor of .

[0037] Preferably, the adjustment factor Determine as follows:

[0038] Get count value , Indicates the parent event The set of all sub-events of ;

[0039] like , then the adjustment factor ;like , then the adjustment factor .

[0040] Preferably, obtaining remote login information across hosts according to security log information, and determining a remote login source host and a controlled target host according to the remote login information, and obtaining a causal relationship across hosts, includes:

[0041] Obtaining remote login information across hosts based on security log information, and identifying the remote login type of the remote login session to which the remote login information belongs;

[0042] Correct the session ID of the remote login session corresponding to the preset remote login type and update the remote login information;

[0043] The remote login source host and the controlled target host are determined based on the remote login information, and the causal relationship between the hosts is obtained.

[0044] Preferably, the method of splicing the main attack graph of a single host and the single host with remote login behavior based on causality includes:

[0045] Summarize the main attack graphs of all single hosts as the preliminary intra-domain attack graph;

[0046] Single hosts that do not generate the main attack graph but have remote login behavior are added as nodes to the preliminary intra-domain attack graph;

[0047] Determine the connection relationship between the main attack graphs, between the single hosts as nodes, and between the main attack graph and the single host as a node in the preliminary intra-domain attack graph based on the causal relationship;

[0048] Add connection edges according to the connection relationship, and use the remote login type as the edge type to obtain the final intra-domain attack graph.

[0049] A cross-host APT full-chain threat tracing device comprises a processor and a memory storing a plurality of computer instructions. When the computer instructions are executed by the processor, the steps of a cross-host APT full-chain threat tracing method are implemented.

[0050] The present invention provides a cross-host APT full-chain threat tracing method and device, which integrates single-host and multi-host analysis, constructs a suspicious attack graph through a single-host audit log, and reasonably compresses the size of the graph, and then associates multi-host activities with remote login information to accurately locate cross-host attacks, providing a comprehensive perspective for APT defense. Constructing a complete attack graph within the domain helps to discover hosts that are potentially attacked by APT, thereby reducing losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The present invention is a flow chart of a cross-host APT full-chain threat tracing method. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0054] like Figure 1 As shown, this embodiment provides a cross-host APT full-chain threat tracing method, including the following steps:

[0055] (1) Suspicious node determination rules and construction of a single-host suspicious attack graph: The audit logs collected from the single-host system are preprocessed, and a method for determining suspicious nodes is defined. Then, a suspicious attack graph is constructed by combining nodes and events.

[0056] (1-1) Log collection and preprocessing: The system captures system-level data from audit data, which is collected by log infrastructure such as Windows ETW (Event Tracing for Windows) and Linux Audit. The collected logs are processed for nodes. , represented by a triple , is the node identifier, is the node type, Indicates the node status. When it is 0, it means the node is not suspicious. When it is 1, it means the node is suspicious; for events , using quintuple express, and are the unique identifiers of the event subject and object respectively. is the event type, is the time when the event occurred, For data traffic.

[0057] (1-2) Construct a set of predefined rules to process streaming logs and identify node status in real time, as shown in Table 1.

[0058] Table 1 Suspicious node determination rules

[0059] Event Type main body object describe take over Sockets process If the process receives data from the network, the process is marked as a suspicious node send process Sockets If a process marked as a suspicious node sends data to the network, the corresponding socket of the network can be marked as a suspicious node. read document process If a process reads a file marked as a suspicious node, the process is marked as a suspicious node. Write Process document If a process marked as a suspicious node writes a file, the file is marked as a suspicious node. Create / Clone process process If a process marked as a suspicious node creates or clones a new process, the new process is marked as a suspicious node.

[0060] (1-3) Suspicious attack graph construction: Create an abnormal node list, which stores all suspicious nodes, and initially default the socket to an abnormal node. Update the list based on the suspicious node judgment rules. Connect the suspicious nodes and events in the log to construct a suspicious attack graph.

[0061] It should be noted that Table 1 is a suspicious node determination rule provided in this embodiment. In other embodiments, existing suspicious node marking and transmission rules may also be used.

[0062] (2) Compression of suspicious attack graph and generation of main attack graph: The edges in the suspicious attack graph are compressed, and then the paths are screened and extracted to obtain a streamlined main attack graph.

[0063] (2-1) Edge compression: In the suspicious attack graph, if there is a suspicious node and its adjacent nodes that are the same, these identical nodes are merged. After merging, the events between the merged node and its adjacent nodes are retained, and only one identical event is retained, so as to achieve the purpose of simplifying the graph structure. For the judgment of identical nodes, the node identifier is mainly judged and node type Are they the same? If they are the same, it means the nodes are the same, otherwise the nodes are different. For the judgment of the same edge, the main judgment is the event subject identifier , event object identification and event type Are they the same? If all three are the same, it means the sides are the same, otherwise the sides are different.

[0064] (2-2) Suspicious path extraction: The compressed suspicious attack graph is converted into a multi-branch tree structure, and all paths from the root node to the leaf node are obtained by traversing the multi-branch tree structure.

[0065] (2-3) Calculate the degree of influence between events: Assume is the maximum value of data flow (obtained through statistical analysis of data flow of all events), It is the maximum value of the occurrence time (the longest time since the system started). Normalized data flow:

[0066] , (1);

[0067] Normalization occurs when:

[0068] , (2);

[0069] In the formula, and represents two events, and the event For events The parent event of and Represent events separately The data flow and occurrence time, and Represent events separately The data flow and occurrence time, Indicates an event Normalized data flow, Indicates an event Normalized data flow, Indicates an event The normalized occurrence time, Indicates an event Normalized occurrence time.

[0070] Calculation Events and events The similarity between:

[0071] (3);

[0072] In the formula, Indicates an event and events The similarity between .

[0073] (2-4) Calculate event scores: Score each event, and for sub-events , its score The calculation of takes into account the influence of the child event on the parent event and the situation of the sibling event. Represents a sub-event The parent event of Represents a sub-event The collection of all child events of the parent event. First, calculate the child events Parent Events Degree of impact:

[0074] (4);

[0075] In the formula, Represents a sub-event Parent Events The degree of influence Represents a sub-event and parent event The similarity between As ,Will As Substituting into formula (3) we can get: Indicates the parent event The set of all sub-events of Represents a sub-event and parent event The similarity between As ,Will As Substitute it into formula (3) and calculate it.

[0076] Then we introduce an adjustment factor Let's further consider the impact of the number of sibling events on the importance of events. (That is, the number of child events of the parent event). , It means that there is no competition among sibling events, and the importance of the event is not affected; at that time , It means that as the number of sibling events increases, the relative importance of the events gradually decreases, but the rate of decrease gradually slows down.

[0077] Last calculated sub-event Event score:

[0078] (5);

[0079] In the formula, For sub-events The event score.

[0080] (2-5) Calculate the path score: For each suspicious flow path , its path score The calculation is as follows:

[0081] (6);

[0082] In the formula Represents the set of all sub-events contained in the path. Indicates an event The weight factor can be pre-set according to the importance of the event type. Events related to key system resources (such as sensitive file access and key system process operations) are given higher weights, while events related to ordinary system operations are given lower weights. Finally, the path scores are normalized:

[0083] (7);

[0084] In the formula, Is the path The path score before normalization, Is the path The normalized path score, is the set of all paths extracted in step (2-2), Representing a collection Middle Path Through normalization, the path score can be mapped to interval, making it easier to compare the likelihood of different paths.

[0085] (2-6) Construction of the main attack graph: The above formula can be used to calculate the score of each path, set a score threshold, and regard the paths below the threshold as paths irrelevant to the attack events. Events in these paths are filtered out, and finally the main attack graph is generated.

[0086] (3) Remote login session identification technology: predefine a series of remote login rules and patterns, identify the remote login type from the obtained security log information (i.e., authentication and login log information), and correct remote login sessions that may have recorded errors.

[0087] Technical principle: When a user logs in from one machine to another, the login session on the second machine is actually triggered by a login session on the first machine. By establishing this cross-machine causal relationship, scattered system activities can be connected in series and their propagation paths between different machines can be traced. Only focusing on system activities related to the login session, irrelevant information can be effectively filtered out to avoid the problem of traceability dependency explosion caused by complex intra-machine behavior chains. This method realizes efficient cross-machine traceability, can clearly reveal the causal relationship between activities between systems, and improve the efficiency of attack behavior analysis.

[0088] (3-1) Log collection and processing: Collecting security log information from Windows and Linux systems is an important basis for remote login tracing and security analysis. The Windows system's security event log and firewall log record remote login events in detail, including successful login (event ID 4624), privilege use (event ID 4672), and matching of related network connections and firewall rules. The Linux system records login attempt information through auth.log or / var / log / secure, and the auditd system audit log tracks key security events. Combining these logs, you can gain in-depth insights into login behavior details, such as user identity, source IP address, login time, access target, etc., and obtain remote login information.

[0089] (3-2) Remote login type identification: Define a series of predefined rules and patterns to identify remote login methods. For example, if when a login event occurs, it is detected that the system has started a process related to RDP (such as mstsc.exe), and there is a specific network connection pointing to port 3389 (RDP default port) of the target host, accompanied by a system call sequence related to the establishment of the RDP connection, the system will identify the remote login type of this remote login session as RDP. For other common remote login types, Table 2 describes the feature rules for matching judgment.

[0090] Table 2 Common remote login type feature rules

[0091] Remote access type Feature rules Remote Desktop Protocol RDP Process: mstsc.exe Network connection: Destination port is 3389 System call: GDI32.dll or USER32.dll Log: Event ID 4624 and 4778 Secure Shell Protocol SSH Process: ssh.exe Network connection: Target port 22 Log: Linux log / var / log / auth.log or / var / log / secure PowerShell-Remoting Process: powershell.exe Network connection: Destination port is 5985 or 5986 Log: Event ID 4103 Windows Management Instrumentation (WMI) Process: wmiprvse.exe Network connection: Destination port is 135 Log: Event ID 4624 and 7045 Remote Procedure Call (RPC) Process: rpcss.exe Network connection: Destination port is 135 or 445 System call: RPCRT4.dll Log: Event ID 5712 Remote command line tool PsExec Process: PSEXESVC.exe Network connection: Destination port is 445 Log: Event ID 7045 and 4624 Network Share SMB Network connection: Target port is 445 File access: Shared path\ <host>\share log: Event ID 5140 < / host> Internal Web Server Requests Network connection: Target port is 80 or 443 Log: Web server access log Virtual Network Computing (VNC) Process: vncviewer.exe Network connection: The default port is 5900 Log: Specific VNC client log Network Protocol Telnet Process: telnet.exe Network connection: The default port is 23 Log: Related connection and authentication records File Transfer Protocol FTP Process: ftp.exe Network connection: The default port is 21 Log: Authentication and file transfer records Cross-platform remote control software TeamViewer Process: TeamViewer.exe Network connection: Communication through TeamViewer server Log: TeamViewer proprietary log Remote control software AnyDesk Process: AnyDesk.exe Network connection: Communication through AnyDesk server Log: AnyDesk proprietary log File synchronization and transfer tool Rsync Process: rsync Network connection: The default port is 873 Log: File synchronization record SMB Redirection Network connection: Target port is 445 Operation: File share redirection or mapping Log: SMB related event log

[0092] (3-3) Remote login session correction: This is carried out for remote access types (such as RDP, PowerShell-Remoting, and internal Web server requests) that cause system activities to be recorded in the wrong session. Based on the actual login and operation process, the login session ID is reallocated to ensure the accuracy of session tracking. For RDP access, the login information is determined by analyzing the system security log, paying attention to the interaction between the mstsc.exe process and related processes, and the correct session ID is determined in combination with the fast user switching mechanism related events. Then, the relevant session records in the system are updated to associate the activities under the wrong session with the new session ID; for PowerShell-Remoting access, first check the startup parameters of the powershell.exe or pwsh.exe process and subsequent related processes, analyze the remote command execution related operations to determine the correct session ID, determine the session start and end time to determine the accuracy of the record, and finally update the PowerShell operation log record and reallocate the wrong associated activities to the correct session; for internal Web server requests, the access log needs to be analyzed to identify suspicious requests, combined with user identity and permission checks, request relevance is analyzed, and the session context is determined based on business logic. Finally, the Web server session management record is modified to accurately associate the request with the correct session ID.

[0093] (4) Remote login session tracing and domain attack graph construction: Based on the associated remote login information and intrusion detection results within a single host, the hosts attacked by APT are connected together to obtain a complete attack graph within the domain.

[0094] (4-1) Tracing the source of remote login sessions: Using the user's remote login information and the remote login session to which it belongs, the process creation chain is traced back to the root process, so as to fully understand the source of the session and its operation context. When a user logs in to the system remotely, the system generates a specific login session (such as the System Logon Session of Windows (a login session initiated by the system account) or the user session of Linux). Taking PowerShell-Remoting as an example, when a user executes a command on a remote host, the command is executed by the wsmprovhost.exe process on the target host, which is usually derived from svchost.exe and can be further traced back to the System Logon Session. In the tracing process, it is necessary to combine event logs, system call tracking, and network connection information to locate the user's login source and behavior path, and associate the remote login session with its specific remote login type through predefined rules (Table 2), and correct the specific remote login session according to the remote login type. Then, the source host of the remote login is connected to the controlled target host according to the remote login session to obtain the causal relationship between the hosts, thus completing the tracing work between the two hosts.

[0095] (4-2) Construction of intra-domain attack graph: The causal relationship constructed based on remote login information is used as a bridge and link to organically connect the main attack graphs of each single host. The main attack graphs obtained by a single host describe in detail the malicious process activities, abnormal file operations, and permission change attack behaviors that occur within the host, as well as their logical sequence and association. First, the main attack graphs of all single hosts are summarized as the preliminary intra-domain attack graph.

[0096] For a single host in the domain that has not been detected to have an APT attack but has remote login behavior, the single host is added as a node to the domain attack graph based on the remote login information of the single host, indicating that the host has the potential for APT attacks. By continuously connecting and summarizing the main attack graphs of each single host, taking the remote login type as the event type, establishing the connection relationship between the main attack graphs, between the single hosts as nodes, and between the main attack graph and the single host as a node, a comprehensive domain attack graph is finally formed, which clearly presents the attacker's action trajectory in the entire domain, the attack path, and the mutual influence and coordination relationship between each host. After an abnormal attack is detected in a single host, other hosts with potential APT attacks can be found through remote login session tracing, which can reduce the property losses caused by the attack.

[0097] In the attack source tracing, steps (1) and (2) are executed in a single host, and steps (3) and (4) are coordinated and executed by an integrated host to obtain the main attack graphs generated in each single host, and obtain the security log information of each single host to trace the cross-host attack in the domain and generate the attack graph in the domain.

[0098] In another embodiment, the present invention also provides a cross-host APT full-chain threat tracing device, including a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the cross-host APT full-chain threat tracing method.

[0099] For the specific limitations of the cross-host APT full-chain threat tracing device, please refer to the limitations of the cross-host APT full-chain threat tracing method above, which will not be repeated here.

[0100] The memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The memory stores a computer program that can be run on the processor, and the processor implements the method of the present invention by running the computer program stored in the memory.

[0101] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory is used to store a program, and the processor executes the program after receiving an execution instruction.

[0102] The processor may be an integrated circuit chip with data processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0103] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0104] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A cross-host APT full-chain threat tracing method, characterized in that: The cross-host APT full-chain threat tracing method includes: Collect audit logs from a single host, identify suspicious nodes in the audit logs, and build a suspicious attack graph based on the suspicious nodes and corresponding events; After edge compression of the suspicious attack graph, the path is extracted, the similarity between the parent event and the child event in the path is calculated, and the influence of the child event on the parent event is calculated based on the similarity; The path score of each path is calculated based on the degree of influence between events, and the paths with path scores lower than the threshold are filtered out from the compressed suspicious attack graph to obtain the main attack graph corresponding to the single host; Collect the security log information of a single host, obtain the remote login information between hosts based on the security log information, and determine the remote login source host and the controlled target host based on the remote login information to obtain the causal relationship between hosts; Based on the causal relationship, the main attack graph of a single host and the single host with remote login behavior are spliced ​​together to obtain a complete cross-host attack graph in the domain.

2. The cross-host APT full-chain threat tracing method according to claim 1 is characterized in that: The identification rules of the suspicious nodes are as follows: If the process receives data from the network, the process is marked as a suspicious node; If a process marked as a suspicious node sends data to the network, the corresponding socket of the network can be marked as a suspicious node; If a process reads a file marked as a suspicious node, the process is marked as a suspicious node; If a process marked as a suspicious node writes a file, the file is marked as a suspicious node; If a process marked as a suspicious node creates or clones a new process, the new process is marked as a suspicious node.

3. The cross-host APT full-chain threat tracing method according to claim 1 is characterized in that: The similarity between the parent event and the child event in the calculation path includes: Normalized data flow: ， （1）； Normalization occurs when: ， （2）； In the formula, and represents two events, and the events For events The parent event of and Respectively represent events The data flow and occurrence time, and Respectively represent events The data flow and occurrence time, Indicates an event Normalized data flow, Indicates an event Normalized data flow, Indicates an event The normalized occurrence time, Indicates an event The normalized occurrence time, Indicates the maximum data flow. Indicates the maximum occurrence time; Calculation Events and events The similarity between: （3）； In the formula, Indicates an event and events The similarity between .

4. The cross-host APT full-chain threat tracing method according to claim 3 is characterized in that: The calculation of the influence of the child event on the parent event according to the similarity includes: （4）； In the formula, Represents a sub-event Parent Events The degree of influence, Represents a sub-event and parent event The similarity between As ,Will As Substituting into formula (3) we can get: Indicates the parent event The set of all sub-events of Represents a sub-event and parent event The similarity between As ,Will As Substitute it into formula (3) and calculate it.

5. The cross-host APT full-chain threat tracing method according to claim 1 is characterized in that: The step of calculating the path score of each path based on the degree of influence between events includes: Calculating sub-events Event score: （5）； In the formula, For sub-events The event score, is the adjustment factor, Represents a sub-event Parent Events the extent of the impact; The path scores are as follows: （6）； In the formula, represents the path score, Represents the set of all sub-events contained in the path. Indicates an event The weight factor of .

6. The cross-host APT full-chain threat tracing method according to claim 5 is characterized in that: The adjustment factor Determine as follows: Get count value , Indicates the parent event The set of all sub-events of ; like , then the adjustment factor ;like , then the adjustment factor .

7. The cross-host APT full-chain threat tracing method according to claim 1 is characterized in that: The method of obtaining remote login information between hosts according to the security log information, and determining the source host of the remote login and the controlled target host according to the remote login information, and obtaining the causal relationship between hosts, includes: Obtaining remote login information across hosts based on security log information, and identifying the remote login type of the remote login session to which the remote login information belongs; Correct the session ID of the remote login session corresponding to the preset remote login type and update the remote login information; The remote login source host and the controlled target host are determined based on the remote login information, and the causal relationship between the hosts is obtained.

8. The cross-host APT full-chain threat tracing method according to claim 1 is characterized in that: The main attack graph of a single host and a single host with remote login behavior are spliced ​​based on causal relationship, including: Summarize the main attack graphs of all single hosts as the preliminary intra-domain attack graph; Single hosts that do not generate the main attack graph but have remote login behavior are added as nodes to the preliminary intra-domain attack graph; Determine the connection relationship between the main attack graphs, between the single hosts as nodes, and between the main attack graph and the single host as a node in the preliminary intra-domain attack graph based on the causal relationship; Add connection edges according to the connection relationship, and use the remote login type as the edge type to obtain the final intra-domain attack graph.

9. A cross-host APT full-chain threat tracing device, comprising a processor and a memory storing a plurality of computer instructions, characterized in that: When the computer instructions are executed by the processor, the steps of the cross-host APT full-chain threat tracing method described in any one of claims 1 to 8 are implemented.

Images