Tracing graph completion method and device based on graph completion

Abstract

The invention provides a traceability graph completion method and device based on graph completion, and the method comprises the steps: constructing a traceability graph which comprises an attack-related entity and an incidence relation thereof; based on the traceability graph, graph embedding learning is carried out, and nodes in the graph and the relation of the nodes are mapped into low-dimensional vectors; determining missing nodes and edges in the current traceability graph by using a graph completion algorithm; and updating the traceability graph processed by the graph completion algorithm. According to the method, missing paths and nodes in the APT attack traceability graph can be effectively complemented, the tracking and traceability capability on attack behaviors is improved, and the method is helpful for coping with complex and hidden APT attacks in the field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a traceability graph completion method based on graph completion. Background Art

[0002] Advanced persistent threats (APTs) are usually concealed, complex, and persistent. Attackers often use multiple paths and methods to conduct long-term infiltration. In order to identify the attacker's action trajectory and conduct effective defense, attack tracing is a key technology in network security. However, existing tracing technologies usually rely on the integrity of attack data. However, due to the attacker's hidden behavior and the limitations of data collection, the tracing graph is often incomplete. This incompleteness will lead to inaccurate analysis results and affect subsequent security decisions.

[0003] Traditional traceability graph construction methods are mainly based on known data and rules, but when dealing with complex APT attacks, it is often difficult to complete the missing parts of the attack path in a timely manner. Currently, there is a lack of effective automated methods to infer and complete unknown paths and nodes in the traceability graph, resulting in the traceability graph being unable to fully display the attacker's complete action path. Summary of the invention

[0004] The technical problem to be solved by the present invention is how to more comprehensively trace the attack behavior; in view of this, the present invention provides a traceability graph completion method and device based on graph completion.

[0005] The technical solution adopted by the present invention is a traceability graph completion method based on graph completion, comprising:

[0006] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0007] Step S2, performing graph embedding learning based on the traceability graph, mapping the nodes and their relationships in the graph into low-dimensional vectors;

[0008] Step S3, using a graph completion algorithm to determine the missing nodes and edges in the current traceability graph;

[0009] Step S4, updating the traceability graph after being processed by the graph completion algorithm.

[0010] In one embodiment, the graph embedding learning adopts Node2Vec, DeepWalk or GNN algorithm.

[0011] In one embodiment, the method of using a graph completion algorithm to determine missing nodes and edges in the current provenance graph includes:

[0012] Decomposing the adjacency matrix of the traceability graph to predict possible missing edges;

[0013] Edge prediction technology is used to predict the possibility of edges through graph neural networks to determine potential attack behaviors between nodes;

[0014] Node inference technology is used to infer possible missing attack nodes in the traceability graph through historical attack data and graph embedding features.

[0015] In one embodiment, updating the provenance graph after being processed by the graph completion algorithm includes: adding newly inferred nodes and edges to the preliminary provenance graph to form a more complete attack path.

[0016] In one embodiment, the method further includes: performing verification processing on the completed current traceability graph as a basis for iterating the graph completion algorithm.

[0017] Another aspect of the present invention further provides a source tracing graph completion device based on graph completion, comprising:

[0018] A construction unit configured to construct a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0019] A mapping unit, configured to perform graph embedding learning based on the traceability graph, and map the nodes and their relationships in the graph into low-dimensional vectors;

[0020] A completion unit, configured to determine missing nodes and edges in the current traceability graph using a graph completion algorithm;

[0021] An updating unit is configured to update the provenance graph after being processed by the graph completion algorithm.

[0022] In one embodiment, the completion unit is further configured to:

[0023] Decomposing the adjacency matrix of the traceability graph to predict possible missing edges;

[0024] Edge prediction technology is used to predict the possibility of edges through graph neural networks to determine potential attack behaviors between nodes;

[0025] Node inference technology is used to infer possible missing attack nodes in the traceability graph through historical attack data and graph embedding features.

[0026] In one embodiment, the updating unit is further configured to:

[0027] Add the newly inferred nodes and edges to the preliminary tracing graph to form a more complete attack path.

[0028] Another aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the graph completion-based source graph completion method as described in any one of the above items.

[0029] Another aspect of the present invention further provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the graph completion method based on graph completion as described in any one of the above items are implemented.

[0030] Compared with the prior art, the present invention has at least the following advantages:

[0031] The graph completion-based traceability graph completion method provided by the present invention can effectively complete the missing paths and nodes in the APT attack traceability graph, improve the tracking and tracing capabilities of attack behaviors, and help the network security field to deal with complex and hidden APT attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of a flow chart of a method for completing a source graph based on graph completion according to an embodiment of the present invention;

[0033] Figure 2 Schematic diagram of the composition of a source tracing graph completion device based on graph completion according to an embodiment of the present invention;

[0034] Figure 3 The figure is a schematic diagram of the composition of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose, the present invention is described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0036] Unless otherwise defined, all terms (including technical terms and scientific terms) used in this article have the same meaning as commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that terms (such as terms defined in commonly used dictionaries) should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined in this article.

[0037] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0038] The first embodiment of the present invention is a method for completing a source graph based on graph completion, such as Figure 1As shown, including:

[0039] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0040] Step S2, performing graph embedding learning based on the traceability graph, mapping the nodes and their relationships in the graph into low-dimensional vectors;

[0041] Step S3, using a graph completion algorithm to determine the missing nodes and edges in the current traceability graph;

[0042] Step S4, updating the traceability graph after being processed by the graph completion algorithm.

[0043] refer to Figure 1 , the method provided in this embodiment will be described in detail step by step below.

[0044] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships.

[0045] In the above-mentioned provenance graph completion method based on graph completion, the preliminary construction of the provenance graph includes:

[0046] Based on the existing attack logs, threat intelligence and security event data, a preliminary APT attack traceability diagram is constructed. The traceability diagram contains nodes such as attackers, victim systems, malware, attack tools, and the associations between nodes (such as network connections, file transfers, command execution, etc.).

[0047] Step S2: Based on the traceability graph, graph embedding learning is performed to map the nodes and their relationships in the graph into low-dimensional vectors.

[0048] In this embodiment, the graph embedding learning of the provenance graph includes:

[0049] Embed the provenance graph and map the nodes and their relationships in the provenance graph into a low-dimensional vector space. Graph embedding learning can be performed using techniques such as Node2Vec, DeepWalk, or Graph Neural Network (GNN) to capture local and global structural features in the graph.

[0050] Step S3, using a graph completion algorithm to determine the missing nodes and edges in the current traceability graph.

[0051] Specifically, the completion algorithm includes:

[0052] Based on the graph embedding results, use edge prediction algorithms or node inference algorithms to complete the missing edges and nodes in the traceability graph. Specific methods include:

[0053] Use matrix decomposition method to decompose the adjacency matrix and predict the possible missing connections;

[0054] Based on edge prediction of graph neural network, potential attack paths are inferred;

[0055] Combining historical attack data and statistical features, it is possible to infer attack nodes or behaviors that may exist but have not been observed.

[0056] Step S4, updating the traceability graph after being processed by the graph completion algorithm.

[0057] In this embodiment, the updating of the completed traceability graph includes:

[0058] According to the results of the completion algorithm, the predicted new nodes and edges are added to the original traceability graph to form a more complete attack path. The updated traceability graph can show the full picture of the APT attack more clearly.

[0059] In a possible implementation manner, the method provided in this embodiment may further include the following verification process:

[0060] Through existing attack cases and simulated attack data, the completed traceability graph is verified to evaluate its accuracy and coverage. At the same time, the model is iteratively optimized to improve the ability to predict potential attack paths in the future.

[0061] An application example of this embodiment will be provided below.

[0062] Step 101, preliminary construction of the traceability graph.

[0063] In this embodiment, the initial construction of the traceability graph is specifically processed as follows: First, based on the existing security event logs, threat intelligence reports, and output data of the attack detection system, an APT attack traceability graph is constructed. The nodes of the traceability graph represent attack-related entities (such as attacker IP, victim host, malware, attack tools, etc.), and the edges represent the associations between entities (such as attack behaviors, information transmission paths, network connections, etc.). Since the attack path information is usually incomplete, some nodes or edges may be missing in the initial traceability graph.

[0064] Step 102: graph embedding learning of the provenance graph.

[0065] In this embodiment, the specific processing method of graph embedding learning of the provenance graph is as follows: graph embedding learning is performed on the constructed preliminary provenance graph through graph embedding technology. The specific steps are as follows:

[0066] 1. Use graph embedding technology (such as Node2Vec, DeepWalk) to embed the traceability graph and map the nodes and their associations in the graph into low-dimensional vectors. This vector representation retains the neighborhood structure information of the nodes and the relationship between the nodes.

[0067] 2. In more complex graph structures, graph neural networks (GNNs) can be used for embedding learning. GNNs can capture complex relational structures in graphs through multi-layer information transmission and aggregation mechanisms, and enhance the ability to infer potential attack paths.

[0068] Step 103, complete the traceability graph.

[0069] In this embodiment, the specific processing method of the source graph completion is as follows: after the graph embedding is completed, the graph completion algorithm is used to complete the source graph. The specific steps are as follows:

[0070] 1. Represent the adjacency matrix of the graph as a low-rank matrix and perform matrix decomposition. Through matrix reconstruction, possible missing edges are predicted. This method is particularly suitable for inferring the attacker's potential intermediate hosts or servers in multi-hop paths.

[0071] 2. Through the edge prediction algorithm, determine whether there are unobserved attack behaviors between nodes. For example, in the initial graph, there is no direct connection between attacker A and victim host B, but through edge prediction, it can be inferred that the attacker may use host C as a springboard for lateral movement.

[0072] 3. Based on the features of existing nodes and their embedded representations, infer the key nodes that may be missing in the traceability graph. For example, if a key node is missing in an attack chain, the algorithm can infer the location of this node and its connection relationship.

[0073] Step 104, complete the update of the traceability graph.

[0074] In this embodiment, the update of the complete traceability graph is specifically processed as follows: the output results of the graph completion algorithm (i.e., the newly inferred nodes and edges) are added to the preliminary traceability graph to form a more complete APT attack traceability graph. The updated traceability graph not only contains the original attack path, but also adds possible but unobserved attack behaviors or nodes to ensure a more comprehensive understanding of the full picture of the APT attack.

[0075] Step 105: Model verification and optimization.

[0076] In this embodiment, the specific processing method of model verification and optimization is as follows: through existing attack cases and attack simulation experiments, the completed traceability graph is verified. The specific steps are as follows:

[0077] 1. Accuracy verification: Check whether the completed graph contains real attack paths or nodes.

[0078] 2. Coverage evaluation: Evaluate whether the completed traceability graph contains all possible attack paths to ensure that no important attack behaviors are missed.

[0079] 3. Model optimization: Based on the verification results, iteratively adjust the parameters of the graph embedding model and completion algorithm to improve the completion effect.

[0080] Through the method of the present invention, the missing paths and nodes in the APT attack tracing graph can be effectively completed, the tracking and tracing capabilities of attack behaviors can be improved, and it is helpful for the network security field to deal with complex and hidden APT attacks.

[0081] The second embodiment of the present invention corresponds to the first embodiment, and can be referred to Figure 2 This embodiment introduces a traceability graph completion device based on graph completion, including the following components:

[0082] A construction unit configured to construct a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0083] A mapping unit, configured to perform graph embedding learning based on the traceability graph, and map the nodes and their relationships in the graph into low-dimensional vectors;

[0084] A completion unit, configured to determine missing nodes and edges in the current traceability graph using a graph completion algorithm;

[0085] An updating unit is configured to update the provenance graph after being processed by the graph completion algorithm.

[0086] In one embodiment, the completion unit is further configured to:

[0087] Decomposing the adjacency matrix of the traceability graph to predict possible missing edges;

[0088] Edge prediction technology is used to predict the possibility of edges through graph neural networks to determine potential attack behaviors between nodes;

[0089] Node inference technology is used to infer possible missing attack nodes in the traceability graph through historical attack data and graph embedding features.

[0090] In one embodiment, the updating unit is further configured to:

[0091] Add the newly inferred nodes and edges to the preliminary tracing graph to form a more complete attack path.

[0092] A third embodiment of the present invention is an electronic device, such as Figure 3 As shown, it can be understood as a physical device, including a processor and a memory storing instructions executable by the processor. When the instructions are executed by the processor, the following operations are performed:

[0093] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0094] Step S2, performing graph embedding learning based on the traceability graph, mapping the nodes and their relationships in the graph into low-dimensional vectors;

[0095] Step S3, using a graph completion algorithm to determine the missing nodes and edges in the current traceability graph;

[0096] Step S4, updating the traceability graph after being processed by the graph completion algorithm.

[0097] The fourth embodiment of the present invention, the process of the traceability graph completion method based on graph completion in this embodiment is the same as that of the first, second or third embodiment, the difference is that, in engineering implementation, this embodiment can be implemented by means of software plus a necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the method of the present invention can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), including a number of instructions for a device to execute the method described in the embodiment of the present invention.

[0098] Through the description of the specific implementation methods, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the predetermined purpose should be obtained. However, the accompanying drawings are only for reference and illustration purposes and are not intended to limit the present invention.

Claims

1. A traceability graph completion method based on graph completion, characterized in that: include: Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships; Step S2, performing graph embedding learning based on the traceability graph, mapping the nodes and their relationships in the graph into low-dimensional vectors; Step S3, using a graph completion algorithm to determine the missing nodes and edges in the current traceability graph; Step S4, updating the traceability graph after being processed by the graph completion algorithm.

2. The method for tracing back graph completion based on graph completion according to claim 1, characterized in that: The graph embedding learning adopts Node2Vec, DeepWalk or GNN algorithm.

3. The method for tracing back graph completion based on graph completion according to claim 1, characterized in that: The method of using a graph completion algorithm to determine missing nodes and edges in the current traceability graph includes: Decomposing the adjacency matrix of the traceability graph to predict possible missing edges; Edge prediction technology is used to predict the possibility of edges through graph neural networks to determine potential attack behaviors between nodes; Node inference technology is used to infer possible missing attack nodes in the traceability graph through historical attack data and graph embedding features.

4. The method for tracing back graph completion based on graph completion according to claim 3, characterized in that: The updating of the traceability graph after the graph completion algorithm is processed includes: adding newly inferred nodes and edges to the preliminary traceability graph to form a more complete attack path.

5. The method for tracing back graph completion based on graph completion according to claim 1, characterized in that: The method further includes: verifying the completed current traceability graph as a basis for iterating the graph completion algorithm.

6. A traceability graph completion device based on graph completion, characterized in that: include: A construction unit configured to construct a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships; A mapping unit, configured to perform graph embedding learning based on the traceability graph, and map the nodes and their relationships in the graph into low-dimensional vectors; A completion unit, configured to determine missing nodes and edges in the current traceability graph using a graph completion algorithm; An updating unit is configured to update the provenance graph after being processed by the graph completion algorithm.

7. The device for tracing back graph completion based on graph completion according to claim 6, characterized in that: The completion unit is further configured as follows: Decomposing the adjacency matrix of the traceability graph to predict possible missing edges; Edge prediction technology is used to predict the possibility of edges through graph neural networks to determine potential attack behaviors between nodes; Node inference technology is used to infer possible missing attack nodes in the traceability graph through historical attack data and graph embedding features.

8. The device for tracing back graph completion based on graph completion according to claim 6, characterized in that: The updating unit is further configured as follows: Add the newly inferred nodes and edges to the preliminary tracing graph to form a more complete attack path.

9. An electronic device, characterized in that: The electronic device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the graph completion method based on graph completion as claimed in any one of claims 1 to 5.

10. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method for tracing graph completion based on graph completion as claimed in any one of claims 1 to 5.

Images