Ransomware attack path mining and depth identification method based on multivariate alarm log analysis

Abstract

The invention belongs to the field of industrial internet information security, and discloses a ransomware path mining and depth identification method based on multivariate alarm log analysis. Alarm data from various system sensors are collected, normalization processing is carried out on the alarm data in different formats, alarms which are normalized into uniform formats are mapped to an alarm graph, single-step attacks are found based on the principle of similarity, and a multi-dimensional analysis method is utilized to analyze the alarms in different formats. A comprehensive association degree score is calculated from four dimensions of IP address overlapping analysis, time approximation analysis, traffic feature analysis and user behavior anomaly analysis, whether single-step attacks are associated is judged, a ransomware attack scene graph is output, and a ransomware attack path is mined. The method is high in path recognition accuracy, potential threats can be found in time, the system safety is enhanced, and a new guarantee is provided for the safety of the industrial internet field.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet information security and discloses a method for mining and deeply identifying ransomware attack paths based on multivariate alarm log analysis. Background Art

[0002] Ransomware is a type of malware designed to extort users by encrypting their files or locking system functions. Its main purpose is to force victims to pay a ransom in exchange for access to data. In recent years, as cyber attacks have become more common and complex, the attack methods of ransomware have gradually evolved, not only limited to simple file encryption, but also including data leakage, identity theft, system paralysis and other forms, forming a more complex attack ecosystem. Currently, the impact of ransomware on individual users, enterprises and government agencies is particularly significant. For individuals, ransomware may cause the irrecoverable loss of important documents, photos and other private data, causing a huge impact on emotions and life. For enterprises, malware attacks not only cause direct economic losses, but also usually increase the burden on IT systems, cause operational interruptions, and even affect customer service and business continuity. In addition, if enterprises fail to properly handle data leaks, it may lead to a decline in customer trust and legal liability, and even affect the market competitiveness of enterprises.

[0003] Although there are many detection technologies for ransomware on the market, these methods still have many obvious shortcomings in practical applications. Signature-based detection methods detect by identifying the characteristic codes (i.e., signatures) of known malware, but this method cannot identify new and variant ransomware, which limits the detection capability and cannot be prevented in time; behavior monitoring is a method of identifying malicious activities by analyzing the behavioral characteristics of the program during operation. Although this method can detect unknown ransomware to a certain extent, it requires real-time detection of the system, which consumes a lot of system resources and causes system performance to decline, with a high false alarm rate. In addition, existing technologies are also limited in their ability to mine the attack path of ransomware. Most detection technologies focus on a single attack behavior (such as file encryption) and fail to fully understand and record the full picture of the attack. This includes every step of the attacker from initial intrusion to executing ransomware, such as how to obtain access rights, how to move laterally, and how to encrypt data. This lack of a comprehensive understanding of the attack path leads to the security team's failure to take effective measures in response and recovery, further increasing the possibility of losses.

[0004] Therefore, in view of the shortcomings of the prior art, the present invention provides a method for excavating and deeply identifying ransomware attack paths based on multi-source alarm log analysis. The method extracts the single-step attacks of the ransomware virus by comprehensively analyzing the multi-source alarm logs, and then analyzes the correlation between the single-step attacks. By mapping to the alarm graph, the attack path of the ransomware virus is fully depicted, and the whole process of virus invasion is deeply excavated. The system is invaded before the ransomware attack is formed, so as to respond early. Summary of the invention

[0005] In view of the problems of insufficient attack path mining and low response efficiency in existing detection methods, the purpose of the present invention is to provide a method for extortion attack path mining and deep identification based on multivariate alarm log analysis. By comprehensively analyzing alarm data from multiple sources, this method can comprehensively construct the entire process of the ransomware attack, mine the attack path, and deeply identify its behavioral characteristics. It has the following advantages: high path identification accuracy, capable of timely discovering potential threats; strong information integration capabilities, effectively reducing missed reports and false alarms; moderate complexity of the analysis process, easy to operate and maintain, thereby improving the overall security protection level and response efficiency.

[0006] The technical solution of the present invention is as follows:

[0007] A method for extortion attack path mining and deep identification based on multivariate alarm log analysis, the steps are as follows:

[0008] Step 1: Collection of multi-source data

[0009] Collects alert data from a variety of system sensors, including network-based intrusion detection systems (NIDS), host-based intrusion detection systems (HIDS), honeypot technology, and software fault reporting systems.

[0010] Step 2: Normalization of data

[0011] Normalize the collected alarm data in different formats: Structured alarms need to be converted by mapping different field names to a unified standard field set; unstructured alarms use natural language processing (NLP) technology, using regular expressions to extract key fields or applying text classification algorithms to identify alarm types.

[0012] Normalize the alarm data for missing fields: For alarms with missing non-key fields, set default values ​​to maintain the integrity of the data structure, record the missing information through marking, and complete the missing fields based on similarity inference or using machine learning models; alarms with missing key fields are discarded.

[0013] Step 3: Discovering Single-Step Attacks

[0014] The analysis method based on the similarity principle is used to study the relationship between alarms using a graph model. The normalized alarms are mapped to a weighted undirected alarm graph G_alert, where the nodes are alarms and the edge weights represent similarities. The relationship between alarms is determined to discover single-step attacks.

[0015] Step 4: Construct a multi-step ransomware attack scenario

[0016] After discovering the single-step attacks and representing them as an alarm set, we construct the attack scenario graph G_attack to determine whether there is a correlation between these single-step attacks. The attack scenario graph G_attack is an undirected weighted graph, and the nodes represent single-step attacks. If there is a correlation between the single-step attacks, they are connected by edges. If there is no correlation, the edges are not connected, thereby reconstructing the multi-step attack scenario of the ransomware. Then, a multi-dimensional analysis method is used to evaluate the connection between the single-step attacks. The multi-dimensional analysis method includes IP address overlap analysis, time proximity analysis, traffic feature analysis, and user behavior abnormality analysis; finally, the comprehensive correlation score is calculated and compared with the set threshold to determine the correlation between the single-step attacks and depict the multi-step attack scenario graph of the ransomware.

[0017] In step three, the progressive construction of attack scenarios is to gradually add newly generated alarms to the existing alarm set, thereby gradually building an alarm set representing a single-step attack; the scenario clustering is to cluster all alarms together without considering their generation time, thereby identifying possible attack patterns; the anomaly detection is to calculate the similarity between newly received alarms and known normal events, and determine whether a group of alarms is identified as an attack based on the degree of difference between them and normal events.

[0018] In step three, the method of discovering single-step attacks through the correlation of each alarm in the alarm graph is as follows: the alarm graph is a weighted undirected graph used to describe the alarms generated in the system and their similarity, where each node is an alarm, and the weight of the edge between alarms represents the similarity between the alarms. The larger the weight of the edge, the stronger the similarity.

[0019] First, we use scenario clustering to group the nodes in the alarm graph. Each cluster represents a group of alarms with similar characteristics. Each group of alarms belongs to the same attack. The similarity of each group of alarms is calculated as follows:

[0020] If both alarms are host alarms and they occur on the same host, the weight of the edge connecting these two alarms in the alarm graph is 1, otherwise there is no edge;

[0021] If one alarm is a host alarm and the other is a network alarm, the weight of the edge connecting the two alarms is 1 if the host that generates the host alarm is the attacker or victim of the network alarm, otherwise the edge is not connected;

[0022] If both alarms are network alarms, the correlation is calculated based on their IP addresses and ports: if the correlation exceeds the preset threshold, an edge is connected between the two alarms, and its weight is the calculated correlation; if the threshold is not reached, the edge is not connected.

[0023] For new alerts that are constantly generated, we use the method of progressively building attack scenarios to add them to existing clusters based on similar features, and then use the similarity calculation method to determine whether they are connected. For new alerts that are not captured by progressive construction, we use anomaly detection to determine whether they are attacks. If so, we add the alerts to existing clusters and then determine whether they are connected.

[0024] These similar alert nodes are represented as sets, each set is a single-step attack.

[0025] In step 4: a multi-dimensional analysis method is used to evaluate the connection between single-step attacks, and a comprehensive correlation score is calculated and compared with the set threshold to determine the connection between single-step attacks. The four dimensions and scores are as follows:

[0026] (1) IP address overlap analysis

[0027] Suppose the set of attacker IPs that attack A is A IP , the victim IP set is A victims , the IP set of attackers attacking B is B IP , the victim IP set is B victims , the intersection of attacker and victim IP:

[0028] I A =A IP ∩A Victims

[0029] I B =B IP ∩B Victims

[0030]

[0031] F IP Indicates the impact of IP address overlap.

[0032] (2) Time approximation analysis

[0033] Let the timestamp of attack A be T A , the timestamp of attack B is T B , the time interval is expressed as,

[0034] ΔT=|T A -T B |

[0035] Set the time threshold T thresh .

[0036] If ΔT≤T thresh

[0037] It is determined that attack A and attack B are close in time and may be related, so let F Time =1, otherwise 0, F Time = 1 is a binary indicator indicating the temporal proximity of the two attacks.

[0038] (3) Traffic characteristics analysis

[0039] The weighted sum method can be used to analyze the combination of traffic size and frequency. The comprehensive formula for traffic characteristics is:

[0040]

[0041] Where W size and W freq It is used to adjust the weight of traffic size and traffic frequency. A and Size B Respectively represent the size of flow A and flow B, Freq A and Freq B Represent the frequencies of flow A and flow B respectively.

[0042] (4) Analysis of abnormal user behavior

[0043] Refer to multiple behavioral characteristics, using H A and H B The user behavior feature set representing attack A and attack B uses a multi-dimensional similarity measurement. The multi-dimensional calculation formula is:

[0044]

[0045] Where n is the total number of behavioral features considered in attacks A and B; H Ai represents the i-th feature in the set of user behavior features representing attack A, H Bi represents the i-th feature in the set of user behavior features representing attack B.

[0046] User behavior similarity score:

[0047]

[0048] Where γ and δ are weight factors for adjusting similarity.

[0049] Total Score:

[0050] Taking the above four dimensions into consideration, we assign weights to them and the comprehensive relevance score (Total Score) is:

[0051] S Total =W(1)×F IP +W(2)F Time +W(3)F Traffic +W(4)×F user Set the threshold to β, when the correlation score S Total When it is greater than the threshold, it is considered that the single-step attacks are related and connected, with the weight being the correlation score; otherwise, no connection is made, thus completing the construction of the ransomware attack scenario graph.

[0052] Beneficial effects of the present invention: This method can comprehensively construct the entire process of ransomware attacks, mine attack paths, and deeply identify its behavioral characteristics by comprehensively analyzing alarm data from multiple sources. It has the following advantages: high path identification accuracy, which can timely discover potential threats; strong information integration capabilities, effectively reducing missed reports and false positives; moderate complexity of the analysis process, easy operation and maintenance, thereby improving the overall security protection level and response efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a structural diagram of a ransomware attack path mining and deep identification method based on multivariate alarm log analysis.

[0054] Figure 2 It is a flow chart of a ransomware attack path mining and deep identification method based on multivariate alarm log analysis. DETAILED DESCRIPTION

[0055] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

[0056] In a basic implementation of the present invention, there are four steps. The purpose of the invention is to analyze multi-source alarm logs, use the principle of similarity to discover single-step attacks, and then construct a scenario of multi-step attacks of ransomware, dig out the full path of ransomware entering the terminal system, and detect the system being invaded before the ransomware attack is formed, so as to respond early. The specific implementation steps are as follows:

[0057] Step 1: Collection of multi-source data

[0058] Collect alarm data from different system sensors, including network-based intrusion detection systems (NIDS), host-based intrusion detection systems (HIDS), honeypot technology, and software fault reporting systems. Network-based NIDS is mainly used to monitor network traffic and detect potential attack behaviors by analyzing transmitted data packets. The system generates structured alarms in the format of JSON or XML; host-based HIDS focuses on monitoring the security status of a single terminal or host. The alarms generated by the system usually exist in structured and unstructured forms; honeypot technology uses virtual environments to lure attackers to simulate vulnerable systems, services or network resources to induce attackers to make actual attempts. Most of the alarms generated are in plain text format; software fault reporting systems usually generate structured alarms by monitoring abnormal behavior of programs, but some fields are missing.

[0059] Step 2: Normalization of data

[0060] The collected alarm data in different formats are normalized. For structured alarms from different sources, they are converted into unified field definitions. For example, different NIDS generate alarms with different field names and structures. These fields are mapped to a standard field set for unification. For unstructured alarms, since they appear in plain text and do not have a fixed format, natural language processing (NLP) technology is used for normalization, such as using regular expressions to extract key fields, or using text classification algorithms to identify alarm types. For alarms with missing fields, if the missing fields are non-critical fields, reasonable default values ​​can be set first to maintain the integrity of the data structure, such as setting the severity level of the missing fields to "medium", and then marking the missing fields to record the missing information in the alarm, and completing the missing fields based on similarity inference or using machine learning models; if the missing fields are critical fields, they are discarded.

[0061] Step 3: Discovering Single-Step Attacks

[0062] Single-step attacks are discovered based on the principle of similarity. It is assumed that "single-step attacks will generate multiple similar alarms". Alarms are associated by evaluating the similarity between alarms. This method can discover single-step attacks through progressive construction of attack scenarios, scenario clustering, and anomaly detection. Progressive construction of attack scenarios gradually adds newly generated alarms to the existing alarm set, thereby gradually building an alarm set representing a single-step attack; scenario clustering clusters all alarms together regardless of their generation time to identify possible attack patterns; anomaly detection calculates the similarity between newly received alarms and known normal events. If a set of alarms differs significantly from normal events, it may be identified as an attack.

[0063] This step is based on the similarity principle and uses a graph model to study the relationship between alarms. Specifically, the alarms normalized into a unified format in step 2 are mapped to the alarm graph G_alert. The alarm graph is a weighted undirected graph used to describe the alarms generated in the system and their similarity. Each node is an alarm, and the edge weights between alarms describe the similarity between alarms. The larger the weight, the stronger the similarity.

[0064] First, the nodes in the alarm graph are grouped using scenario clustering. Each cluster represents a group of alarms with similar features. Each group of alarms belongs to the same attack. For the calculation of the similarity of each group of alarms, if both alarms are host alarms and they occur on the same host, the weight of the edge connecting the two alarms in the graph is 1, otherwise no edge is connected; if one alarm is a host alarm and the other is a network alarm, if the host that generates the host alarm is the attacker or victim of the network alarm, then an edge with a weight of 1 is connected, otherwise no edge is connected; if both alarms are network alarms, the correlation is calculated based on their IP addresses and ports. If the correlation exceeds the preset threshold, an edge is connected between the two alarms, and its weight is the calculated correlation; if the threshold is not reached, the edge is not connected. For new alarms that are constantly generated, the method of progressively building attack scenarios is used to add them to the existing clusters according to similar features, and then the similarity calculation method is used to determine whether to connect the edges. For new alarms that are not captured by the progressive construction, anomaly detection is used to determine whether they are attacks. If so, the alarm is added to the existing cluster and then it is determined whether there is an edge connection. These similar alarm points of the edge connection are represented as sets, and each set is a single-step attack.

[0065] Step 4: Construct a multi-step ransomware attack scenario

[0066] After extracting the single-step attacks from the alerts and expressing them as an alert set, in this step, we determine whether the single-step attacks are related and output them as an attack scenario graph G_attack, which is an undirected weighted graph. Each point in the graph represents a single-step attack. If there is a connection between the single-step attacks, they are connected, otherwise they are not connected. This is used to reconstruct the scenario graph of the ransomware multi-step attack. Using the multi-dimensional analysis method, we can determine whether the single-step attacks are related. The specific method is as follows:

[0067] (1) IP address overlap analysis

[0068] Suppose the attacker IP set of attacker A is A IP , the victim IP set is A victims , the IP set of attackers attacking B is B IP , the victim IP set is B victims , the intersection of attacker and victim IP:

[0069] I A =A IP ∩A Victims

[0070] I B =B IP ∩B Victims

[0071]

[0072] F IP Indicates the impact of IP address overlap.

[0073] (2) Time approximation analysis

[0074] Let the timestamp of attack A be T A , the timestamp of attack B is T B , the time interval is expressed as,

[0075] ΔT=|T A -T B |

[0076] Set the time threshold T thresh , which can be set to 5 minutes, and the threshold can be modified according to the situation.

[0077] If ΔT≤T thresh

[0078] It is determined that attack A and attack B are close in time and may be related, so let F Time =1, otherwise 0, F Time = 1 is a binary indicator indicating the temporal proximity of the two attacks.

[0079] (3) Traffic characteristics analysis

[0080] The weighted sum method can be used to analyze the combination of traffic size and frequency. The comprehensive formula for traffic characteristics is:

[0081]

[0082] Where W size and W freq It is used to adjust the weight of the flow size and flow frequency. The balance weight can be set to 0.5 and 0.5, the bias flow size can be set to 0.6 and 0.4, and the bias flow frequency can be set to 0.4 and 0.6. A and Size B Respectively represent the size of flow A and flow B (usually in MB or bytes), Freq A and Freq B Respectively represent the frequency of flow A and flow B (usually in times / minute).

[0083] (4) Analysis of abnormal user behavior

[0084] Refer to multiple behavioral characteristics, using H A and H B The user behavior feature set representing attack A and attack B uses a multi-dimensional similarity measurement. The multi-dimensional calculation formula is:

[0085]

[0086] Where n is the total number of behavioral features considered in attacks A and B; H Ai represents the i-th feature in the set of user behavior features representing attack A, H Bi represents the i-th feature in the set of user behavior features representing attack B.

[0087] User behavior similarity score:

[0088]

[0089] Among them, γ and δ are weight factors for adjusting similarity. If the user features of the two attack types are equally important, they can be set to 1 and 1; if they are biased towards A, they can be set to 1.5 and 1; if they are biased towards B, they can be set to 1 and 1.5.

[0090] Total Score:

[0091] Taking the above four dimensions into consideration, we assign weights to them. According to prior knowledge, we assign weights to them as W(1)=0.2, W(2)=0.25, W(3)=0.3, and W(4)=0.25. The total score is:

[0092] S Total =W(1)×F IP +W(2)F Time +W(3)F Traffic +W(4)×F user

[0093] Set the threshold to β, when the correlation score S Total When it is greater than the threshold, it is considered that there is a correlation between the single-step attacks and the lines are connected, with the weight being the correlation score. Otherwise, the lines are not connected, thereby completing the construction of the ransomware attack scenario graph, deeply analyzing the attacker's attack chain, exploring the attacker's intentions, and summarizing the situation of asset penetration in the system.

[0094] In view of the above description, the embodiments provided by the present invention are only exemplary, and the realization of certain features and advantages does not constitute a limitation. For those skilled in the art, various modifications and changes can be made to the present invention without departing from the technical concept of the present invention. Therefore, the protection scope of the present invention should be determined according to the contents described in the claims, rather than being limited to the specific embodiments in the specification. Any reasonable changes and substitutions to the present invention should be deemed to fall within the protection scope of the present invention.

Claims

1. A method for extortion attack path mining and deep identification based on multivariate alarm log analysis, characterized in that: Here are the steps: Step 1: Collection of multi-source data Collects alarm data from a variety of system sensors, including network-based intrusion detection systems, host-based intrusion detection systems, honeypot technology, and software fault reporting systems; Step 2: Normalization of data Normalize the collected alarm data in different formats: structured alarms need to be converted by mapping different field names to a unified standard field set; unstructured alarms use natural language processing technology, regular expressions to extract key fields or apply text classification algorithms to identify alarm types; Normalize the alarm data for missing fields: For alarms with missing non-key fields, set default values ​​to maintain the integrity of the data structure, record the missing information through marking, and complete the missing fields based on similarity inference or using machine learning models. For alarms with missing key fields, discard them. Step 3: Discovering Single-Step Attacks Using the analysis method of similarity principle, a graph model is used to study the relationship between alarms. The normalized alarms are mapped to a weighted undirected alarm graph G_alert, where the nodes are alarms and the edge weights represent similarities. The relationship between alarms is determined to discover single-step attacks. Step 4: Construct a multi-step ransomware attack scenario After discovering the single-step attack and representing it as an alarm set, we construct an attack scenario graph G_attack to determine whether there is a correlation between these single-step attacks. The attack scenario graph G_attack is an undirected weighted graph, and the nodes represent single-step attacks. If there is a correlation between the single-step attacks, they are connected by edges. If there is no correlation, the edges are not connected, thereby reconstructing the multi-step attack scenario of the ransomware. Then, a multi-dimensional analysis method is used to evaluate the connection between the single-step attacks. The multi-dimensional analysis method includes IP address overlap analysis, time proximity analysis, traffic feature analysis, and user behavior abnormality analysis. Finally, the comprehensive correlation score is calculated and compared with the set threshold to determine the correlation between the single-step attacks and depict the multi-step attack scenario graph of the ransomware.

2. The method for extortion attack path mining and deep identification based on multi-alarm log analysis according to claim 1 is characterized in that: In step three, the progressive construction of attack scenarios is to gradually add newly generated alarms to the existing alarm set, thereby gradually building an alarm set representing a single-step attack; the scenario clustering is to cluster all alarms together without considering their generation time, thereby identifying possible attack patterns; the anomaly detection is to calculate the similarity between newly received alarms and known normal events, and determine whether a group of alarms is identified as an attack based on the degree of difference between them and normal events.

3. The method for extortion attack path mining and deep identification based on multi-alarm log analysis according to claim 1 is characterized in that: In step 3, the method of discovering single-step attacks through the correlation of each alarm in the alarm graph is as follows: the alarm graph is a weighted undirected graph used to describe the alarms generated in the system and their similarity, where each node is an alarm, and the weight of the edge between alarms represents the similarity between the alarms. The larger the weight of the edge, the stronger the similarity. First, we use scenario clustering to group the nodes in the alarm graph. Each cluster represents a group of alarms with similar characteristics. Each group of alarms belongs to the same attack. The similarity of each group of alarms is calculated as follows: If both alarms are host alarms and they occur on the same host, the weight of the edge connecting these two alarms in the alarm graph is 1, otherwise there is no edge; If one alarm is a host alarm and the other is a network alarm, the weight of the edge connecting the two alarms is 1 if the host that generates the host alarm is the attacker or victim of the network alarm, otherwise the edge is not connected; If both alarms are network alarms, the correlation is calculated based on their IP addresses and ports: if the correlation exceeds the preset threshold, an edge is connected between the two alarms, and its weight is the calculated correlation; If the threshold is not reached, the edge is not connected; For new alarms that are constantly generated, we use the method of progressively building attack scenarios to add them to existing clusters based on similar features, and then use the similarity calculation method to determine whether they are connected. For new alarms that are not captured by progressive construction, we use anomaly detection to determine whether they are attacks. If so, we add the alarms to existing clusters and then determine whether they are connected. These similar alert nodes are represented as sets, each set is a single-step attack.

4. The method for extortion attack path mining and deep identification based on multi-alarm log analysis according to claim 1 is characterized in that: In step 4: a multi-dimensional analysis method is used to evaluate the connection between single-step attacks, and a comprehensive correlation score is calculated and compared with the set threshold to determine the connection between single-step attacks. The four dimensions and scores are as follows: (1) IP address overlap analysis Suppose the set of attacker IPs that attack A is A IP , the victim IP set is A victims , the IP set of attackers attacking B is B IP , the victim IP set is B victims , the intersection of attacker and victim IP: I A =A IP ∩A Victims I B =B IP ∩B Victims F IP Indicates the impact of IP address overlap; (2) Time approximation analysis Let the timestamp of attack A be T A , the timestamp of attack B is T B , the time interval is expressed as, ΔT=|T A -T B | Set the time threshold T thresh ; If ΔT≤T thresh It is determined that attack A and attack B are close in time and may be related, so let F Time =1, otherwise 0, F Time =1 is a binary indicator, indicating the temporal proximity of the two attacks; (3) Traffic characteristics analysis The combination of traffic size and frequency can be analyzed using the weighted sum method. The comprehensive formula for traffic characteristics is: Where W size and W freq It is used to adjust the weight of traffic size and traffic frequency. A and Size B Respectively represent the size of flow A and flow B, Freq A and Freq B Represent the frequencies of flow A and flow B respectively; (4) Analysis of abnormal user behavior Refer to multiple behavioral characteristics, using H A and H B The user behavior feature set representing attack A and attack B uses a multi-dimensional similarity measurement. The multi-dimensional calculation formula is: Where n is the total number of behavioral features considered in attacks A and B; H Ai represents the i-th feature in the user behavior feature set representing attack A, H Bi represents the i-th feature in the set of user behavior features representing attack B; User behavior similarity score: Among them, γ and δ are weight factors for adjusting similarity; Overall relevance score: Taking the above four dimensions into consideration, their weights are assigned and the comprehensive correlation score is: S Total =W(1)×F IP +W(2)F Time +W(3)F Traffic +W(4)×F user Set the threshold to β, when the correlation score S Total When it is greater than the threshold, it is considered that the single-step attacks are related and connected, and the weight is the correlation score, otherwise no connection is made, thereby completing the construction of the ransomware attack scenario graph.

Images