APT attack detection method and system based on multi-source knowledge fusion

Abstract

The present invention belongs to the field of network security and deep learning technology, and discloses an APT attack detection method and system based on multi-source knowledge fusion, including building a benign behavior knowledge base and a threat intelligence knowledge base, screening suspicious nodes and candidate paths in the origin graph according to the benign behavior knowledge base, obtaining clues for inputting a large language model according to the threat intelligence knowledge base, and forming abnormal clusters according to the output of the large language model, and taking the abnormal cluster with the highest average rare score to reconstruct the attack graph. The present invention effectively reduces false positives and false negatives, and significantly improves detection accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of network security and deep learning technology, and specifically relates to an APT (Advanced Persistent Threat) attack detection method and system based on multi-source knowledge fusion. Background Art

[0002] In today's complex network environment, advanced persistent threats are becoming increasingly severe and are gradually becoming the main security challenge facing enterprises. In order to effectively respond to this challenge, endpoint detection and response systems have begun to be widely used. However, there are a lot of false positives and missed negatives, which requires security analysts to spend manpower and time to conduct research and judgment, which may result in missing the best response events.

[0003] In order to solve this problem, the academic community began to explore intrusion detection systems based on kernel-level causal source graphs. During the research process, the characteristics of benign application behaviors were continuously summarized, and a knowledge base was built to assist attack detection. However, existing intrusion detection systems still face many challenges. On the one hand, rule-based detection systems are highly dependent on predefined rule bases to identify intrusion detection. Due to the limited nature of the rule base and the ever-changing means of network attacks, normal behaviors may be judged as attack behaviors, resulting in false positives. On the other hand, anomaly-based detection systems establish a model of normal behavior and regard behaviors that do not match the model as anomalies. However, it is difficult to distinguish true attack behaviors due to the incompleteness of the data set and the performance limitations of the model.

[0004] In addition, both rule-based and anomaly-based detection systems face the problem of knowledge islands. Simply relying on a single knowledge source for threat detection is often difficult to deal with unknown threats and complex attack methods. Therefore, how to effectively integrate multi-source knowledge and improve the accuracy and efficiency of threat detection has become a difficulty and hot spot in current research. Summary of the invention

[0005] The purpose of the present invention is to provide an APT attack detection method and system based on multi-source knowledge fusion, which can effectively reduce false positives and false negatives and significantly improve detection accuracy.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] In the first aspect, the present invention provides an APT attack detection method based on multi-source knowledge fusion, the APT attack detection method based on multi-source knowledge fusion comprising:

[0008] Collect benign log data, extract entities in the benign log data and event interaction information between entities, use the benign embedding model to embed entities to obtain benign vectors, and calculate the total frequency, total out-degree and total in-degree of each entity based on the event interaction information between entities, and save the benign vectors, total frequency, total out-degree and total in-degree to the benign behavior knowledge base;

[0009] Collect network threat intelligence and construct multiple attack scenario graphs. Take the longest path in each attack scenario graph as a sentence, and use the threat embedding model to embed the sentence to obtain the threat vector.

[0010] Obtain the log data to be detected and build a provenance graph;

[0011] Use the benign embedding model to embed the nodes in the origin graph to obtain the vector to be detected, calculate the similarity between the vector to be detected and the benign vector in the benign behavior knowledge base, and take the nodes with similarity lower than the threshold as suspicious nodes;

[0012] According to the total frequency, total out-degree and total in-degree of entities in the benign behavior knowledge base, the rare score of each path where each suspicious node is located is calculated, and the path with the highest rare score is selected. Paths are selected as candidate paths. Filtering threshold for the number of candidate paths;

[0013] The threat embedding model is used to generate a query vector for each candidate path of each suspicious node, and the top path with the greatest similarity to the query vector is selected. Threat vectors are formed into a clue by query vector and threat vector and input into the large language model. Filter thresholds for the number of threat vectors;

[0014] Suspicious nodes judged as abnormal by the large language model are taken as abnormal nodes, and all abnormal nodes are aggregated to obtain multiple abnormal clusters. The abnormal cluster with the highest average rare score is taken to reconstruct the attack graph.

[0015] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0016] Preferably, the calculating the total frequency, total out-degree and total in-degree of each entity according to the event interaction information between entities comprises:

[0017] ;

[0018] ;

[0019] ;

[0020] In the formula, represents the source node, represents the target node, Represents a type of event. From the source node To the target node Event Type The total frequency, express From the source node To the target node Event Type The frequency, Representation Node The total out-degree of the node As the source node, Represents a slave node To the target node Event Type The total frequency, Represents a slave node The sum of the total frequencies of all event types to all target nodes, Representation Node The total in-degree of the node As the target node, From the source node To Node Event Type The total frequency, Represents the number of nodes from all source nodes to node The sum of the total frequencies of all event types, Represents any of all event types.

[0021] Preferably, the calculating the similarity between the vector to be detected and the benign vector in the benign behavior knowledge base comprises:

[0022] ;

[0023] In the formula, represents the vector to be detected, represents the benign vector in the benign behavior knowledge base, represents the dot product of the vector to be detected and the benign vector, represents the magnitude of a vector, Represents the vector to be detected With benign vector The similarity.

[0024] Preferably, the calculating of the rare score of each path where each suspicious node is located comprises:

[0025] For a suspicious node, search forward and backward respectively. Jump neighbors to get one or more paths;

[0026] For suspicious nodes Every path , Indicates the first events, and calculate each of them The frequency scores are as follows:

[0027] ;

[0028] ;

[0029] ;

[0030] ;

[0031] Each event In triple form, , Indicates an event The source node, Indicates an event The target node, Indicates an event The event type, Indicates an event The frequency score of Indicates an event The out-degree ratio of Indicates an event The frequency ratio of Indicates an event The in-degree ratio of Represents a slave node To Node Event Type The total frequency, Represents a slave node To the target node Event Type The total frequency, Represents a slave node The sum of the total frequencies of all event types to all target nodes, Representation Node The total out-degree of Representation Node The total out-degree of is the origin graph nodes, Representation Node The total in-degree of Representation Node The total in-degree of

[0032] in, , and It is calculated based on the event interaction information in the provenance graph. , and Get from the good behavior knowledge base. If the acquisition fails, assign directly , is the default value;

[0033] ;

[0034] In the formula, Suspicious Node Each path A rare score.

[0035] Preferably, all abnormal nodes are aggregated to obtain multiple abnormal clusters, including:

[0036] Take the candidate paths of abnormal nodes to form a list of rare events;

[0037] The abnormal nodes that have intersections between the rare event list and the keyword list composed of sensitive files are divided into the same abnormal cluster, and the other nodes are used as nodes to be screened;

[0038] For the nodes to be screened, if a node appears in the rare event list of another node, the two nodes are divided into the same abnormal cluster.

[0039] Preferably, the average rare score of the abnormal cluster is calculated as follows:

[0040] The rare scores of the candidate paths corresponding to the abnormal nodes in the abnormal cluster are accumulated and divided by the number of abnormal nodes in the abnormal cluster to obtain the average rare score of the abnormal cluster.

[0041] Second aspect: The present invention provides an APT attack detection system based on multi-source knowledge fusion, comprising a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the APT attack detection method based on multi-source knowledge fusion.

[0042] The present invention provides an APT attack detection method and system based on multi-source knowledge fusion. Compared with the prior art, its significant advantages are mainly manifested in: 1. A comprehensive knowledge base including a benign behavior knowledge base and a threat intelligence knowledge base is constructed. By integrating multi-source knowledge, the limitation of a single knowledge source is broken. Provide comprehensive and accurate information for the Large Language Model (LLM), so that it can make more accurate judgments in anomaly detection, effectively reduce false positives and missed positives, and significantly improve detection accuracy. 2. Traceability analysis and attack graph reconstruction. When an anomaly is detected, the abnormal cluster can be quickly determined by analyzing the node association, the real attack node can be accurately screened out, and an attack graph that clearly shows the attack path can be reconstructed. Provide security analysts with clear attack paths and context information, which helps to quickly locate and respond to real attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The present invention is a flowchart of an APT attack detection method based on multi-source knowledge fusion. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0046] like Figure 1 As shown, this embodiment provides an APT attack detection method based on multi-source knowledge fusion, including the following steps:

[0047] (1) Constructing a knowledge base: Using Word2vec technology to process path information and record event interaction frequency, a benign behavior knowledge base was constructed based on this. Secondly, through natural language modeling and Doc2vec methods, threat intelligence was converted into digital vector form to construct a threat intelligence knowledge base.

[0048] (1-1) Benign behavior knowledge base: Collect benign log data, extract entities in the benign log data and event interaction information between entities, use the benign embedding model to embed the entities to obtain benign vectors, and calculate the total frequency, total out-degree and total in-degree of each entity based on the event interaction information between entities, and save the benign vectors, total frequency, total out-degree and total in-degree to the benign behavior knowledge base.

[0049] Collect log data from various hosts within the enterprise, parse it, and extract the path names of entities and event interaction information between entities. Treat the path name as a text sequence, and treat each part of the path (such as folders and file names) as words. Use the Word2vec model to embed each part of the path, obtain the embedding vector of each node, and save the benign embedding model. For different events between entities, calculate their interaction frequency. For the total frequency of the node, calculate as follows:

[0050] ;

[0051] In the formula, represents the source node, represents the target node, Indicates a specific type of event. From the source node To the target node Event Type The total frequency, express From the source node To the target node Event Type frequency.

[0052] In addition, the total out-degree and total in-degree of each node are calculated as follows:

[0053] ;

[0054] ;

[0055] In the formula, Representation Node The total out-degree of the node As the source node, Represents a slave node To the target node Event Type The total frequency, Represents a slave node The sum of the total frequencies of all event types to all target nodes, Representation Node The total in-degree of the node As the target node, From the source node To Node Event Type The total frequency, Represents the number of nodes from all source nodes to node The sum of the total frequencies of all event types, Represents any event type among all event types, that is, refers to a class of event types.

[0056] The above data information is stored in a relational database and used as a benign behavior knowledge base for quick query in subsequent attack detection.

[0057] (1-2) Threat intelligence knowledge base: Collect network threat intelligence and construct multiple attack scenario graphs. The longest path in each attack scenario graph is used as a sentence, and the sentence is embedded using the threat embedding model to obtain a threat vector.

[0058] Collect Cyber ​​Threat Intelligence (CTI) reports from multiple threat intelligence sources. CTI reports should contain indicators of compromise (IOC) (such as IP addresses, domain names, malware signatures, etc.) and event interaction information between them. Perform natural language processing on the collected CTI reports, extract the attack entities and the relationships between them, and construct an attack scenario graph. Find the longest path consisting of nodes and edges in the attack scenario graph. , which is considered as a sentence, represents a node in the path, Indicates the edge in the path, subscript Used to represent the position in the path. Use the Doc2vec model to embed the longest path, obtain its digital vector representation, record it as a threat vector, and save the Doc2vec model as a threat embedding model. Store the embedded vector in the database so that it can be used as a threat intelligence knowledge base in subsequent attack detection.

[0059] (2) Obtain the log data to be tested and construct a provenance graph: Use system audit tools to capture logs, extract system entities and interaction events by parsing the logs, and use data compression technology to merge equivalent events to reduce redundancy and further construct a provenance graph.

[0060] (2-1) Provenance graph construction: Capture logs from system audit tools (such as Windows ETW (Event Tracing for Windows), Linux Audit, and CamFlow), and identify three types of entities and seven types of interactions between entities as shown in Table 1 based on the log content. Convert the identified events into edges with time and direction, and generate a provenance graph. .

[0061] Table 1 Definition of entities and interactions between entities

[0062]

[0063] (2-2) Data compression: In the provenance graph, if the same source node and target node generate events with the same semantics, they are called equivalent events. For equivalent events, only the first event that affects the target node is retained, and the frequency of the event is recorded. The compressed edge is defined as ,in Indicates the type of event. Indicates the timestamp of the first event. Indicates the frequency of this type of event within a period of time. Traverse the edges in the origin graph and use the above compression strategy to compress and record the frequency of the edges that meet the equivalent event conditions; the edges that do not meet the conditions remain unchanged. Finally, the compressed origin graph is generated , retaining key semantic information while also reducing redundancy.

[0064] (3) Anomaly detection and attack reconstruction based on LLM: The benign embedding model and rarity scoring algorithm are used to screen out suspicious nodes and candidate paths, and LLM and Retrieval Augmented Generation (RAG) technology are combined to determine suspicious nodes. Further, causal analysis is performed through attack representation knowledge to screen out the real attack nodes and reconstruct the complete attack graph.

[0065] (3-1) Select suspicious nodes: Use the benign embedding model to embed the nodes in the origin graph to obtain the vector to be detected, calculate the similarity between the vector to be detected and the benign vector in the benign behavior knowledge base, and take the nodes with similarity lower than the threshold as suspicious nodes.

[0066] Filter suspicious nodes in the origin graph, use the benign embedding model to embed the nodes in the origin graph, and obtain the vectors to be detected. Calculate the similarity between these vectors to be detected and the benign vectors of the nodes in the benign behavior knowledge base. Filter out nodes that are significantly different from the nodes in the benign behavior knowledge base as suspicious nodes. Specifically, this embodiment uses cosine similarity, which measures the similarity between two vectors by calculating the cosine value of the angle between them. The formula is as follows:

[0067] ;

[0068] In the formula, represents the vector to be detected, represents the benign vector in the benign behavior knowledge base, represents the dot product of the vector to be detected and the benign vector, represents the magnitude of a vector, Represents the vector to be detected With benign vector The closer the value is to 1, the more similar the two vectors are. When the cosine similarity value is lower than the threshold of 0.5, it is considered that the two vectors are very different, and the node is confirmed to be a suspicious node.

[0069] (3-2) Select candidate paths: According to the total frequency, total out-degree and total in-degree of entities in the benign behavior knowledge base, calculate the rare score of each path where each suspicious node is located, and select the candidate path with the highest rare score. Paths are selected as candidate paths. Filter threshold for the number of candidate paths.

[0070] Since directly extracting all paths of abnormal nodes from the traceability graph may lead to dependency explosion problems, this embodiment proposes a path selection algorithm based on rarity scoring. For each suspicious node, the frequency score of each event in all its paths is calculated, that is, the proportion of the path in all events on the subject.

[0071] For events The frequency score is calculated as follows:

[0072] ;

[0073] ;

[0074] ;

[0075] ;

[0076] Each event In triple form, , Indicates an event The source node, Indicates an event The target node, Indicates an event The event type, Indicates an event The frequency score of Indicates an event The out-degree ratio of Indicates an event The frequency ratio of events At the source node The percentage of all events Indicates an event The in-degree ratio of Represents a slave node To Node Event Type The total frequency, Represents a slave node To the target node Event Type The total frequency, Represents a slave node The sum of the total frequencies of all event types to all target nodes, Representation Node The total out-degree of Representation Node The total out-degree of is the origin graph nodes, Representation Node The total in-degree of Representation Node The total in-degree of .

[0077] in, , and It is calculated based on the event interaction information in the provenance graph. , and Obtain from the benign behavior knowledge base, compare the name of the entity and the name of the event type, take the total frequency / total in-out degree corresponding to the entity and event type with the same name for calculation, and establish a connection with the benign behavior knowledge base. If the acquisition fails, it means that the possibility of the event being benign is small, and then directly assign a value , is a preset value. In this embodiment, for the above formula, if the data of the corresponding node can be found in the database, these values ​​will be directly used for calculation. If no data of a certain node can be obtained from the benign behavior knowledge base, that is, the node has no record in the benign behavior knowledge base, its frequency score will be assigned a value of 0.5.

[0078] In order to reduce the complexity of path search and ensure the real-time detection, each abnormal node is searched forward and backward according to the time sequence. Hopping neighbors, calculate the rare score of each path. For any outlier node , whose path , the rare score is defined as follows:

[0079] ;

[0080] In the formula, Suspicious Node Each path The rare score of The rare paths are selected as candidate paths for further analysis.

[0081] (3-3) Use RAG to enhance LLM anomaly detection: Use the threat embedding model to generate a query vector for each candidate path of each suspicious node, and take the top path with the greatest similarity to the query vector. Threat vectors are formed into a clue by query vector and threat vector and input into the large language model. Filter thresholds for threat vector quantity.

[0082] The Doc2vec model is used to encode suspicious nodes and their candidate paths, and a query vector corresponding to each candidate path is generated. The query vector is similar to the threat vector block in the threat intelligence knowledge base, and the most similar predecessor to the query vector is retrieved. The threat vectors contain benign and malicious knowledge related to the query. All query vectors of suspicious nodes and the retrieved threat vectors are synthesized into a coherent clue, which is input into the LLM, and the context understanding ability of the LLM is used to determine whether the abnormal node has malicious behavior.

[0083] (3-4) Attack graph reconstruction: The suspicious nodes judged as abnormal by the large language model are taken as abnormal nodes, and all abnormal nodes are aggregated to obtain multiple abnormal clusters. The abnormal cluster with the highest average rarity score is taken to reconstruct the attack graph.

[0084] An anomaly cluster is a group of interrelated anomaly nodes that may together form part of an attack. The process of forming an anomaly cluster involves the following steps:

[0085] A. Take the candidate paths of abnormal nodes to form a list of rare events.

[0086] B. The abnormal nodes whose rare event lists intersect with the keyword list composed of sensitive files are divided into the same abnormal cluster, and the other nodes are used as nodes to be screened. This embodiment checks whether the relevant event list of each abnormal node intersects with the keyword list composed of sensitive files. If the relevant events of two nodes contain at least one keyword, they may belong to the same abnormal cluster.

[0087] C. For the nodes to be screened, if a node appears in the rare event list of another node, the two nodes are divided into the same anomaly cluster.

[0088] All nodes determined based on keyword and event correlation analysis are merged into related clusters. These clusters represent a group of interrelated abnormal nodes that may together constitute part of the attack. If there are still abnormal nodes that are not classified into any abnormal cluster after these two steps, it is considered that the possibility of these abnormal nodes being attack nodes is low and these nodes can be directly discarded.

[0089] Then, for each cluster, calculate its average rarity score: add up the rarity scores of the candidate paths corresponding to the abnormal nodes in the abnormal cluster, and divide the sum by the number of abnormal nodes in the abnormal cluster to get the average rarity score of the abnormal cluster.

[0090] Finally, we find the abnormal cluster with the largest average rare score as the real attack node that is finally screened out. The real attack nodes should be associated with key events to form a complete attack chain. We use the screened attack nodes and the interaction between them to reconstruct the attack graph. The attack graph shows how the attacker exploits the vulnerabilities in the system to attack, as well as the specific steps and paths of the attack. Based on the attack graph, we generate an attack story that describes the attacker's attack process, goals, means, etc. in detail, which helps analysts understand the complete attack scenario and formulate effective defense measures.

[0091] The method of the present invention realizes the multi-source knowledge fusion of attack representation knowledge, threat intelligence knowledge and benign behavior knowledge, and provides effective information and judgment basis for anomaly detection and attack graph reconstruction. It can also perform real-time intrusion detection, find the real attack node, and reconstruct the complete attack graph.

[0092] In another embodiment, the present invention also provides an APT attack detection system based on multi-source knowledge fusion, including a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the APT attack detection method based on multi-source knowledge fusion.

[0093] For the specific limitations of the APT attack detection system based on multi-source knowledge fusion, please refer to the limitations of the APT attack detection method based on multi-source knowledge fusion in the above text, which will not be repeated here.

[0094] The memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The memory stores a computer program that can be run on the processor, and the processor implements the method of the present invention by running the computer program stored in the memory.

[0095] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory is used to store a program, and the processor executes the program after receiving an execution instruction.

[0096] The processor may be an integrated circuit chip with data processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0097] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0098] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A method for detecting APT attacks based on multi-source knowledge fusion, characterized in that: The APT attack detection method based on multi-source knowledge fusion includes: Benign log data is collected, entities in the benign log data and event interaction information between entities are extracted, entities are embedded using a benign embedding model to obtain benign vectors, and the total frequency, total out-degree and total in-degree of each entity are calculated according to the event interaction information between entities, and the benign vectors, total frequency, total out-degree and total in-degree are saved in a benign behavior knowledge base; the benign embedding model is based on the extracted path names of the entities and the event interaction information between entities, the path names are regarded as text sequences, and each part of the path name is regarded as a word, and each part of the path name is embedded using a Word2vec model; Collect network threat intelligence and construct multiple attack scenario graphs. Take the longest path in each attack scenario graph as a sentence, and use the threat embedding model to embed the sentence to obtain a threat vector. Use the Doc2vec model to embed the longest path, and save the Doc2vec model as a threat embedding model. Obtain the log data to be detected and build a provenance graph; Use the benign embedding model to embed the nodes in the provenance graph to obtain the vector to be detected, calculate the similarity between the vector to be detected and the benign vector in the benign behavior knowledge base, and take the nodes with similarity lower than the threshold as suspicious nodes; According to the total frequency, total out-degree and total in-degree of entities in the benign behavior knowledge base, the rare score of each path where each suspicious node is located is calculated, and the path with the highest rare score is selected. Paths are selected as candidate paths. Filtering threshold for the number of candidate paths; The threat embedding model is used to generate a query vector for each candidate path of each suspicious node, and the top path with the greatest similarity to the query vector is selected. Threat vectors are formed into a clue by query vector and threat vector and input into the large language model. Filter thresholds for the number of threat vectors; Suspicious nodes that are judged as abnormal by the large language model are taken as abnormal nodes, and all abnormal nodes are aggregated to obtain multiple abnormal clusters. The abnormal cluster with the highest average rare score is taken to reconstruct the attack graph; The step of calculating the rare score of each path where each suspicious node is located includes: For a suspicious node, search forward and backward respectively. Jump neighbors to get one or more paths; For suspicious nodes Every path , Indicates the first events, and calculate each of them The frequency scores are as follows: ； ； ； ； Each event In triple form, , Indicates an event The source node, Indicates an event The target node, Indicates an event The event type, Indicates an event The frequency score of Indicates an event The out-degree ratio of Indicates an event The frequency ratio of Indicates an event The in-degree ratio of Represents a slave node To Node Event Type The total frequency, Represents a slave node To the target node Event Type The total frequency, Represents a slave node The sum of the total frequencies of all event types to all target nodes, Representation Node The total out-degree of Representation Node The total out-degree of is the origin graph nodes, Representation Node The total in-degree of Representation Node The total in-degree of in, , and It is calculated based on the event interaction information in the provenance graph. , and Get from the good behavior knowledge base. If the acquisition fails, assign directly , is the default value; ； In the formula, Suspicious Node Each path A rare score.

2. The APT attack detection method based on multi-source knowledge fusion according to claim 1 is characterized in that: The calculating of the total frequency, total out-degree and total in-degree of each entity according to the event interaction information between entities includes: ； ； ； In the formula, represents the source node, represents the target node, Represents a type of event. From the source node To the target node Event Type The total frequency, express From the source node To the target node Event Type The frequency, Representation Node The total out-degree of the node As the source node, Represents a slave node To the target node Event Type The total frequency, Represents a slave node The sum of the total frequencies of all event types to all target nodes, Representation Node The total in-degree of node As the target node, From the source node To Node Event Type The total frequency, Represents the number of nodes from all source nodes to node The sum of the total frequencies of all event types, Represents any of all event types.

3. The APT attack detection method based on multi-source knowledge fusion according to claim 1 is characterized in that: The calculating the similarity between the vector to be detected and the benign vector in the benign behavior knowledge base includes: ； In the formula, represents the vector to be detected, represents the benign vector in the benign behavior knowledge base, represents the dot product of the vector to be detected and the benign vector, represents the magnitude of a vector, Represents the vector to be detected With benign vector The similarity.

4. The APT attack detection method based on multi-source knowledge fusion according to claim 1 is characterized in that: The above-mentioned aggregating all abnormal nodes to obtain multiple abnormal clusters includes: Take the candidate paths of abnormal nodes to form a list of rare events; The abnormal nodes that have intersections between the rare event list and the keyword list composed of sensitive files are divided into the same abnormal cluster, and the other nodes are used as nodes to be screened; For the nodes to be screened, if a node appears in the rare event list of another node, the two nodes are divided into the same abnormal cluster.

5. The APT attack detection method based on multi-source knowledge fusion according to claim 1 is characterized in that: The average rarity score of the anomaly cluster is calculated as follows: The rare scores of the candidate paths corresponding to the abnormal nodes in the abnormal cluster are accumulated and divided by the number of abnormal nodes in the abnormal cluster to obtain the average rare score of the abnormal cluster.

6. An APT attack detection system based on multi-source knowledge fusion, comprising a processor and a memory storing a plurality of computer instructions, characterized in that: When the computer instructions are executed by the processor, the steps of the APT attack detection method based on multi-source knowledge fusion described in any one of claims 1 to 5 are implemented.

Images