A ransomware attack path mining and deep identification method based on multivariate alarm log analysis

Abstract

The present invention belongs to the field of industrial Internet information security, and discloses a method for excavating and deeply identifying ransomware attack paths based on multivariate alarm log analysis. By collecting alarm data from multiple system sensors, normalizing the alarm data in different formats, and mapping the normalized alarms into a unified format onto an alarm graph, single-step attacks are discovered based on the principle of similarity. A multi-dimensional analysis method is used to calculate a comprehensive correlation score from four dimensions: IP address overlap analysis, time approximation analysis, traffic feature analysis, and user behavior anomaly analysis. It is determined whether single-step attacks are related, outputs a ransomware attack scenario graph, and excavates ransomware attack paths. This method has high path recognition accuracy, can promptly detect potential threats, enhance system security, and provide new guarantees for the security of the industrial Internet.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet information security and discloses a method for mining and deep identification of ransomware attack paths based on multi-element alarm log analysis. Background Art

[0002] Ransomware is a type of malware designed to extort users by encrypting their files or locking down system functions. Its primary purpose is to force victims to pay a ransom in exchange for access to their data. In recent years, with the increasing prevalence and sophistication of cyberattacks, ransomware attack methods have evolved beyond simple file encryption to include data exfiltration, identity theft, and system crashes, creating a more complex attack ecosystem. Currently, ransomware has a particularly significant impact on individual users, businesses, and government agencies. For individuals, ransomware can cause the irrecoverable loss of important documents, photos, and other private data, resulting in a significant emotional and personal impact. For businesses, malware attacks not only result in direct financial losses but also often overburden IT systems, causing operational disruptions and even impacting customer service and business continuity. Furthermore, if businesses fail to properly handle data breaches, they can lead to a loss of customer trust, legal liability, and even compromise their market competitiveness.

[0003] Although a variety of ransomware detection technologies are available on the market, these methods still have many significant shortcomings in practical application. Signature-based detection methods detect malware by identifying the characteristic codes (i.e., signatures) of known malware. However, this method cannot identify new and variant ransomware, limiting detection capabilities and preventing timely prevention. Behavior monitoring, a method that analyzes the behavioral characteristics of programs during operation to identify malicious activity, can detect unknown ransomware to a certain extent, but requires real-time system monitoring, which consumes a lot of system resources, can lead to reduced system performance, and has a high false positive rate. In addition, existing technologies are also limited in their ability to uncover ransomware attack paths. Most detection technologies focus on a single attack behavior (such as file encryption) and fail to fully understand and record the entire attack path. This includes every step the attacker takes from initial intrusion to ransomware execution, such as how to gain access, how to move laterally, and how to encrypt data. This lack of a comprehensive understanding of the attack path leads to security teams failing to take effective measures during response and recovery, further increasing the potential for losses.

[0004] Therefore, to address the shortcomings of existing technologies, the present invention provides a method for mining and deeply identifying ransomware attack paths based on multi-source alarm log analysis. This method comprehensively analyzes multi-source alarm logs to extract the single-step attacks of the ransomware virus, and then analyzes the correlation between each single-step attack. By mapping it onto an alarm graph, the method comprehensively depicts the ransomware virus attack path, deeply explores the entire process of virus invasion, and detects system intrusions before the ransomware attack takes shape, thereby enabling early response. Summary of the Invention

[0005] To address the issues of insufficient attack path mining and low response efficiency in existing detection methods, the present invention aims to provide a method for excavating and deeply identifying ransomware attack paths based on multi-source alarm log analysis. By comprehensively analyzing alarm data from multiple sources, this method can comprehensively construct the entire ransomware attack process, explore attack paths, and deeply identify their behavioral characteristics. This method offers the following advantages: high path identification accuracy, enabling timely detection of potential threats; strong information integration capabilities, effectively reducing missed alerts and false positives; and a moderately complex analysis process, making it easy to operate and maintain, thereby improving overall security protection and response efficiency.

[0006] The technical solutions of the present invention are as follows:

[0007] A ransomware attack path mining and deep identification method based on multi-element alarm log analysis, the steps are as follows:

[0008] Step 1: Collection of multi-source data

[0009] Collects alert data from various system sensors, including network-based intrusion detection systems (NIDS), host-based intrusion detection systems (HIDS), honeypot technology, and software fault reporting systems.

[0010] Step 2: Data normalization

[0011] Normalize the collected alarm data in different formats: Structured alarms need to be converted by mapping different field names to a unified standard field set; unstructured alarms use natural language processing (NLP) technology, using regular expressions to extract key fields or applying text classification algorithms to identify alarm types.

[0012] Normalize the alarm data for missing fields: For alarms with missing non-critical fields, set default values ​​to maintain the integrity of the data structure, record the missing information through marking, and complete the missing fields based on similarity inference or using machine learning models. Alarms with missing critical fields are discarded.

[0013] Step 3: Discovering Single-Step Attacks

[0014] Using the analysis method of similarity principle, a graphical model is adopted to study the relationship between alerts. The normalized alerts are mapped into a weighted undirected alert graph G_alert, where nodes are alerts and edge weights represent similarities. The relationship between alerts is judged to discover single-step attacks.

[0015] Step 4: Construct a multi-step ransomware attack scenario

[0016] After discovering single-step attacks and representing them as alert sets, we construct an attack scenario graph G_attack to determine whether there are any connections between these single-step attacks. This is an undirected, weighted graph, with nodes representing single-step attacks. If there are connections between the single-step attacks, they are connected by edges; if not, the edges are not connected, thus reconstructing the ransomware's multi-step attack scenario. We then use multi-dimensional analysis methods to assess the connections between the single-step attacks, including IP address overlap analysis, temporal proximity analysis, traffic characteristics analysis, and user behavior anomaly analysis. Finally, we calculate a comprehensive correlation score and compare it with a set threshold to determine the connections between the single-step attacks and create a multi-step ransomware attack scenario graph.

[0017] In step three, the progressive construction of attack scenarios is to gradually add newly generated alarms to the existing alarm set, thereby gradually building an alarm set representing a single-step attack; the scenario clustering is to cluster all alarms together, regardless of their generation time, to identify possible attack patterns; the anomaly detection is to calculate the similarity between newly received alarms and known normal events, and determine whether a group of alarms is identified as an attack based on the degree of difference between them and normal events.

[0018] In step three, the method for discovering single-step attacks through the correlation of each alarm in the alarm graph is as follows: the alarm graph is a weighted undirected graph used to describe the alarms generated in the system and their similarity. Each node is an alarm, and the weight of the edge between alarms represents the similarity between the alarms. The larger the edge weight, the stronger the similarity.

[0019] First, we use scenario clustering to group the nodes in the alarm graph. Each cluster represents a group of alarms with similar characteristics. Each group of alarms belongs to the same attack. The similarity of each group of alarms is calculated as follows:

[0020] If both alarms are host alarms and they occur on the same host, then the weight of the edge connecting these two alarms in the alarm graph is 1, otherwise there is no edge;

[0021] If one alarm is a host alarm and the other is a network alarm, then the weight of the edge connecting the two alarms is 1 if the host generating the host alarm is the attacker or victim of the network alarm, otherwise the edge is not connected;

[0022] If both alarms are network alarms, the correlation is calculated based on their IP addresses and ports. If the correlation exceeds the preset threshold, an edge is connected between the two alarms with a weight equal to the calculated correlation. If the threshold is not reached, no edge is connected.

[0023] For new alerts that are constantly generated, we use a progressive attack scenario construction method to add them to existing clusters based on similar features. We then use similarity calculation to determine whether they are connected. For new alerts that are not captured by the progressive construction method, we use anomaly detection to determine whether they are attacks. If so, we add the alert to the existing cluster and then determine whether they are connected.

[0024] These similar alert nodes are represented as sets, each set is a single-step attack.

[0025] In step 4, a multi-dimensional analysis method is used to evaluate the connection between single-step attacks. A comprehensive correlation score is calculated and compared with the set threshold to determine the correlation between single-step attacks. The four dimensions and scores are as follows:

[0026] (1) IP address overlap analysis

[0027] Suppose the IP set of attackers attacking A is A IP , the victim IP set is A victims , the IP set of attackers attacking B is B IP , the victim IP set is B victims , the intersection of attacker and victim IP:

[0028] I A =A IP ∩A Victims

[0029] I B =B IP ∩B Victims

[0030]

[0031] F IP Indicates the impact of IP address overlap.

[0032] (2) Time approximation analysis

[0033] Let the timestamp of attack A be T A , the timestamp of attack B is T B , the time interval is expressed as,

[0034] ΔT=|T A -T B |

[0035] Set the time threshold T thresh .

[0036] If ΔT≤T thresh

[0037] It is determined that attack A and attack B are close in time and there may be a connection, so let F Time =1, otherwise 0, F Time = 1 is a binary indicator indicating the temporal proximity of the two attacks.

[0038] (3) Traffic characteristics analysis

[0039] To analyze the combination of traffic size and frequency, the weighted sum method can be used. The comprehensive formula for traffic characteristics is:

[0040]

[0041] Where W size and W freq It is used to adjust the weight of traffic size and traffic frequency. A and Size B Respectively represent the size of flow A and flow B, Freq A and Freq B Represent the frequencies of flow A and flow B respectively.

[0042] (4) Analysis of abnormal user behavior

[0043] Refer to multiple behavioral characteristics, use H A and H B The user behavior feature sets representing attack A and attack B are measured using multi-dimensional similarity. The multi-dimensional calculation formula is:

[0044]

[0045] Where n is the total number of behavioral features considered in attacks A and B; H Ai represents the i-th feature in the set of user behavior features representing attack A, H Bi Denotes the i-th feature in the set of user behavior features representing attack B.

[0046] User behavior similarity score:

[0047]

[0048] Where γ and δ are weight factors for adjusting similarity.

[0049] Total Score:

[0050] Taking the above four dimensions into consideration and assigning weights to them, the comprehensive relevance score (Total Score) is:

[0051] S Total =W(1)×F IP +W(2)F Time +W(3)F Traffic +W(4)×F user Set the threshold to β, when the correlation score S Total When it is greater than the threshold, it is considered that there is a correlation between the single-step attacks and the lines are connected, with the weight being the correlation score; otherwise, no lines are connected, thus completing the construction of the ransomware attack scenario graph.

[0052] The beneficial effects of this invention are as follows: By comprehensively analyzing alert data from multiple sources, this method can comprehensively construct the entire process of a ransomware attack, explore attack paths, and deeply identify its behavioral characteristics. This method has the following advantages: high path identification accuracy, enabling timely detection of potential threats; strong information integration capabilities, effectively reducing missed alerts and false positives; and a moderately complex analysis process, making it easy to operate and maintain, thereby improving overall security protection and response efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a structural diagram of a ransomware attack path mining and deep identification method based on multivariate alarm log analysis.

[0054] Figure 2 It is a flow chart of a ransomware attack path mining and deep identification method based on multivariate alarm log analysis. DETAILED DESCRIPTION

[0055] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

[0056] A basic implementation of this invention consists of four steps. The goal is to analyze multi-source alert logs, utilize similarity principles to discover single-step attacks, and then construct a multi-step ransomware attack scenario. This allows the full path of ransomware entering the terminal system to be discovered, allowing for early detection of system intrusions before a ransomware attack takes hold, enabling early response. The specific implementation steps are as follows:

[0057] Step 1: Collection of multi-source data

[0058] Collects alarm data from various system sensors, including network-based intrusion detection systems (NIDS), host-based intrusion detection systems (HIDS), honeypot technology, and software fault reporting systems. Network-based NIDS primarily monitors network traffic, detecting potential attacks by analyzing transmitted data packets. The system generates structured alerts in JSON or XML format. Host-based HIDS focuses on monitoring the security status of individual terminals or hosts. Alerts generated by the system are typically structured or unstructured. Honeypot technology uses virtual environments to lure attackers into conducting actual attempts by simulating vulnerable systems, services, or network resources. Most of the generated alerts are in plain text format. Software fault reporting systems typically generate structured alerts by monitoring abnormal program behavior, but some fields are missing.

[0059] Step 2: Data normalization

[0060] The collected alarm data in different formats are normalized. For structured alarms from different sources, they are converted into unified field definitions. For example, different NIDS generate alarms with different field names and structures. These fields are mapped to a standard field set for unification. For unstructured alarms, since they appear in plain text and do not have a fixed format, natural language processing (NLP) technology is used for normalization, such as using regular expressions to extract key fields or using text classification algorithms to identify alarm types. For alarms with missing fields, if the missing fields are non-critical fields, reasonable default values ​​can be set first to maintain the integrity of the data structure, such as setting the severity level of the missing fields to "medium". Then, by marking the missing fields, the missing information is recorded in the alarm, and the missing fields are completed based on similarity inference or using machine learning models. If the missing fields are critical fields, they are discarded.

[0061] Step 3: Discovering Single-Step Attacks

[0062] This method detects single-step attacks based on the principle of similarity. Assuming that a single-step attack will generate multiple similar alerts, the alerts are correlated by assessing their similarity. This method detects single-step attacks through progressive attack scenario construction, scenario clustering, and anomaly detection. Progressive attack scenario construction gradually adds newly generated alerts to the existing set of alerts, gradually building a set of alerts representing a single-step attack. Scenario clustering analyzes all alerts together, regardless of their generation time, to identify possible attack patterns. Anomaly detection calculates the similarity between newly received alerts and known normal events. If a set of alerts differs significantly from normal events, it may be considered an attack.

[0063] This step, based on the principle of similarity, uses a graphical model to study the connections between alerts. Specifically, the alerts normalized into a unified format in Step 2 are mapped onto the alert graph G_alert. The alert graph is a weighted undirected graph that describes the alerts generated in the system and their similarity. Each node represents an alert, and the edge weights between alerts describe their similarity. The larger the weight, the stronger the similarity.

[0064] First, we use scenario clustering to group the nodes in the alarm graph. Each cluster represents a group of alarms with similar characteristics, and each group of alarms belongs to the same attack. To calculate the similarity of each group of alarms, if both alarms are host alarms and they occur on the same host, the edge connecting the two alarms in the graph has a weight of 1; otherwise, the edge is not connected. If one alarm is a host alarm and the other is a network alarm, an edge with a weight of 1 is connected if the host generating the host alarm is the attacker or victim of the network alarm; otherwise, the edge is not connected. If both alarms are network alarms, the correlation between them is calculated based on their IP addresses and ports. If the correlation exceeds a preset threshold, an edge is connected between the two alarms with a weight equal to the calculated correlation; if it does not reach the threshold, the edge is not connected. For newly generated alarms, we use a progressive attack scenario construction method to add them to existing clusters based on similar characteristics. We then use similarity calculation to determine whether to connect the edges. For new alerts not captured by the progressive build, anomaly detection is used to determine whether they represent an attack. If so, the alert is added to an existing cluster and then checked for edges. These edges of similar alert points are represented as clusters, each representing a single-step attack.

[0065] Step 4: Construct a multi-step ransomware attack scenario

[0066] After extracting single-step attacks from the alerts and representing them as an alert set, this step determines whether there is a connection between the single-step attacks. This is output as the attack scenario graph G_attack, an undirected weighted graph where each point represents a single-step attack. If there is a connection between the single-step attacks, a line is connected; otherwise, no line is connected. This allows us to reconstruct the scenario graph of the ransomware's multi-step attack. Using multi-dimensional analysis, we determine whether the single-step attacks are connected. The specific method is as follows:

[0067] (1) IP address overlap analysis

[0068] Let attacker A’s attacker IP set be A IP , the victim IP set is A victims , the IP set of attackers attacking B is B IP , the victim IP set is B victims , the intersection of attacker and victim IP:

[0069] I A =A IP ∩A Victims

[0070] I B =B IP ∩B Victims

[0071]

[0072] F IP Indicates the impact of IP address overlap.

[0073] (2) Time approximation analysis

[0074] Let the timestamp of attack A be T A , the timestamp of attack B is T B , the time interval is expressed as,

[0075] ΔT=|T A -T B |

[0076] Set the time threshold T thresh , can be set to 5 minutes, and the threshold can be modified according to the situation.

[0077] If ΔT≤T thresh

[0078] It is determined that attack A and attack B are close in time and there may be a connection, so let F Time =1, otherwise 0, F Time = 1 is a binary indicator indicating the temporal proximity of the two attacks.

[0079] (3) Traffic characteristics analysis

[0080] To analyze the combination of traffic size and frequency, the weighted sum method can be used. The comprehensive formula for traffic characteristics is:

[0081]

[0082] Where W size and W freq It is used to adjust the weight of the flow size and flow frequency. The balance weight can be set to 0.5 and 0.5, the bias flow size can be set to 0.6 and 0.4, and the bias flow frequency can be set to 0.4 and 0.6. A and Size B Respectively represent the size of flow A and flow B (usually in MB or bytes), Freq A and Freq B Respectively represent the frequency of flow A and flow B (usually in times / minute).

[0083] (4) Analysis of abnormal user behavior

[0084] Refer to multiple behavioral characteristics, use H A and H B The user behavior feature sets representing attack A and attack B are measured using multi-dimensional similarity. The multi-dimensional calculation formula is:

[0085]

[0086] Where n is the total number of behavioral features considered in attacks A and B; H Ai represents the i-th feature in the set of user behavior features representing attack A, H Bi Denotes the i-th feature in the set of user behavior features representing attack B.

[0087] User behavior similarity score:

[0088]

[0089] Among them, γ and δ are weight factors for adjusting similarity. If the user features of the two attack types are equally important, they can be set to 1 and 1. If they are biased towards A, they can be set to 1.5 and 1. If they are biased towards B, they can be set to 1 and 1.5.

[0090] Total Score:

[0091] Taking the above four dimensions into consideration, we assign weights to them. According to prior knowledge, we assign weights to W(1) = 0.2, W(2) = 0.25, W(3) = 0.3, and W(4) = 0.25. The total score is:

[0092] S Total =W(1)×F IP +W(2)F Time +W(3)F Traffic +W(4)×F user

[0093] Set the threshold to β, when the correlation score S Total When the value is greater than the threshold, the single-step attacks are considered to be related and connected, with the weight being the correlation score. Otherwise, no connection is made. This completes the construction of the ransomware attack scenario graph, deeply analyzes the attacker's attack chain, explores the attacker's intentions, and summarizes the situation of asset penetration in the system.

[0094] In view of the above description, the embodiments provided by the present invention are merely exemplary, and the realization of certain features and advantages does not constitute a limitation. For those skilled in the art, various modifications and variations can be made to the present invention without departing from the technical concept of the present invention. Therefore, the scope of protection of the present invention should be determined based on the contents described in the claims, rather than being limited to the specific embodiments in the specification. Any reasonable changes and substitutions to the present invention should be deemed to fall within the scope of protection of the present invention.

Claims

1. A ransomware attack path mining and deep identification method based on multivariate alarm log analysis, characterized in that: Here are the steps: Step 1: Collection of multi-source data Collects alert data from various system sensors, including network-based intrusion detection systems, host-based intrusion detection systems, honeypot technology, and software fault reporting systems; Step 2: Data normalization Normalize the collected alert data in different formats: Structured alerts are converted by mapping different field names to a unified standard field set. Unstructured alerts are processed using natural language processing techniques, such as regular expressions to extract key fields or text classification algorithms to identify alert types. Normalize alert data with missing fields: For alerts with missing non-critical fields, set default values ​​to maintain data structure integrity. Missing fields are recorded by marking, and missing fields are completed based on similarity inference or using machine learning models. Alerts with missing critical fields are discarded. Step 3: Discovering Single-Step Attacks Using the similarity principle analysis method, a graphical model is used to study the relationship between alerts. The normalized alerts are mapped into a weighted undirected alert graph G_alert, where nodes represent alerts and edge weights represent similarities. The relationship between alerts is determined to detect single-step attacks. Step 4: Construct a multi-step ransomware attack scenario After discovering single-step attacks and representing them as an alarm set, we construct an attack scenario graph G_attack to determine whether there is a correlation between these single-step attacks. The attack scenario graph G_attack is an undirected weighted graph, and the nodes represent single-step attacks. If there is a correlation between the single-step attacks, they are connected by edges. If there is no correlation, the edges are not connected, thereby reconstructing the multi-step attack scenario of the ransomware. Then, a multi-dimensional analysis method is used to evaluate the connection between the single-step attacks. The multi-dimensional analysis method includes IP address overlap analysis, time proximity analysis, traffic feature analysis, and user behavior anomaly analysis. Finally, the comprehensive correlation score is calculated and compared with the set threshold to determine the correlation between the single-step attacks and depict the multi-step attack scenario graph of the ransomware.

2. The ransomware attack path mining and deep identification method based on multi-level alarm log analysis according to claim 1 is characterized in that: In step 3, the method for discovering single-step attacks by analyzing the correlation between each alarm in the alarm graph is as follows: the alarm graph is a weighted undirected graph used to describe the alarms generated in the system and their similarity. Each node is an alarm, and the weight of the edge between alarms represents the similarity between the alarms. The larger the edge weight, the stronger the similarity. First, we use scenario clustering to group the nodes in the alarm graph. Each cluster represents a group of alarms with similar characteristics. Each group of alarms belongs to the same attack. The similarity of each group of alarms is calculated as follows: If both alarms are host alarms and they occur on the same host, then the weight of the edge connecting these two alarms in the alarm graph is 1, otherwise there is no edge; If one alarm is a host alarm and the other is a network alarm, then the weight of the edge connecting the two alarms is 1 if the host generating the host alarm is the attacker or victim of the network alarm, otherwise the edge is not connected; If both alerts are network alerts, a correlation is calculated based on their IP addresses and ports. If the correlation exceeds a preset threshold, an edge is connected between the two alerts with a weight equal to the calculated correlation. If the threshold is not reached, the edge is not connected; For new alerts that are constantly generated, we use a method of progressively building attack scenarios to add them to existing clusters based on similar features. We then use similarity calculations to determine whether they are connected. For new alerts that are not captured by the progressive build, we use anomaly detection to determine whether they are attacks. If so, we add the alert to the existing cluster and then determine whether to connect to it. These similar alert nodes are represented as sets, each set is a single-step attack.

3. The method for excavating and deeply identifying ransomware attack paths based on multi-level alarm log analysis according to claim 2 is characterized in that: In step 3, the progressive construction of attack scenarios is to gradually add newly generated alarms to the existing alarm set, thereby gradually constructing an alarm set representing a single-step attack; The scenario clustering is to cluster all alarms together for analysis, regardless of their generation time, to identify possible attack patterns. The anomaly detection is to calculate the similarity between newly received alarms and known normal events, and determine whether a group of alarms is identified as an attack based on the degree of difference between them and normal events.

4. The method for excavating and deeply identifying ransomware attack paths based on multi-level alarm log analysis according to claim 1, characterized in that: In step 4, a multi-dimensional analysis method is used to evaluate the connection between single-step attacks. A comprehensive correlation score is calculated and compared with the set threshold to determine the correlation between single-step attacks. The four dimensions and scores are as follows: (1) IP address overlap analysis Suppose the attacker IP set of attack A is A ΙΡ , the victim IP set is A victims , the IP set of attackers attacking B is B ΙΡ , the victim IP set is B victims , the intersection of attacker and victim IP: I A =A IP ∩A Victims I B =B IP ∩B Victims F ΙΡ Indicates the impact of IP address overlap; (2) Time approximation analysis Let the timestamp of attack A be T A , the timestamp of attack B is T B , the time interval is expressed as, △T=|T A -T B | Set the time threshold T thresh ; If △T≤T thresh It is determined that attack A and attack B are close in time and there may be a connection, so let F Time =1, otherwise 0, F Time =1 is a binary indicator indicating the temporal proximity of the two attacks; (3) Traffic characteristics analysis To analyze the combination of traffic size and frequency, the weighted sum method can be used. The comprehensive formula for traffic characteristics is: Where W size and W freq It is used to adjust the weight of traffic size and traffic frequency. A and Size B Respectively represent the size of flow A and flow B, Freq A and Freq B Represent the frequencies of flow A and flow B respectively; (4) Analysis of abnormal user behavior Refer to multiple behavioral characteristics, use H A and H B The user behavior feature sets representing attack A and attack B are measured using multi-dimensional similarity. The multi-dimensional calculation formula is: Where n is the total number of behavioral features considered in attacks A and B; H Ai represents the i-th feature in the user behavior feature set of attack A, H Bi Represents the i-th feature in the set of user behavior features of attack B; User behavior similarity score: Where γ and δ are weight factors for adjusting similarity; Comprehensive relevance score: Taking the above four dimensions into consideration, we assign weights to them and the comprehensive correlation score is: S Total =W(1)×F IP +W(2)F Time +W(3)F Traffic +W(4)×F user Set the threshold to β, when the correlation score S Total When it is greater than the threshold, it is considered that there is a correlation between the single-step attacks and the lines are connected, with the weight being the correlation score; otherwise, no lines are connected, thus completing the construction of the ransomware attack scenario graph.

Images