Tracing graph cutting method and device based on graph cutting

Abstract

The invention provides a traceability graph cutting method and device based on graph cutting, and the method comprises the steps: constructing a traceability graph which comprises an attack-related entity and an incidence relation thereof; based on the traceability graph, importance measurement of nodes and edges is carried out; based on the importance of the nodes and the edges, cutting the nodes and the edges with low priorities, and reserving the nodes and the edges with high priorities for representing key attack paths; and optimizing the current traceability graph. According to the method, interference of irrelevant information in the analysis process is reduced through simplification processing of the traceability graph, and the accuracy and efficiency of traceability analysis are improved. The method can be flexibly applied in various complex network environments, and provides technical support for rapid detection and traceability of advanced persistent threat attacks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a traceability graph clipping method based on graph clipping. Background Art

[0002] With the continuous development of information technology, network attack methods are becoming increasingly complex. In particular, the defense and source tracing analysis of advanced persistent threat (APT) attacks have become an important research direction in the current network security field. APT attacks usually have the following characteristics: strong concealment, long attack cycle, clear goals and high customization. Attackers lurk in the network for a long time and gradually penetrate to circumvent traditional security protection measures, and finally invade and destroy the target system.

[0003] During the source tracing analysis of APT attacks, analysts usually construct an attack source tracing graph to show the attacker's behavior trajectory and its correlation in the network. The source tracing graph represents attack behaviors or events through nodes, and connects related attack activities through edges to show the integrity of the attack path. However, due to the complexity of APT attacks, the source tracing graph often leads to low analysis efficiency due to too many nodes and complicated paths, and even interferes with analysts' identification of key nodes. In this case, too many irrelevant nodes and noise information will obscure the true intention of the attack, which seriously affects the accuracy of the source tracing analysis.

[0004] Existing methods usually rely on graph completion technology to fill in missing attack paths, or manually simplify the traceability graph through static rules. However, these methods are powerless when dealing with dynamic and complex APT attack scenarios, and lack automated and intelligent graph cropping capabilities. Therefore, there is an urgent need for a technology that can automatically crop the traceability graph to improve the efficiency and effectiveness of APT attack traceability analysis. Summary of the invention

[0005] The technical problem to be solved by the present invention is how to improve the efficiency and accuracy of traceability analysis; in view of this, the present invention provides a traceability graph clipping method and device based on graph clipping.

[0006] The technical solution adopted by the present invention is a traceability graph clipping method based on graph clipping, comprising:

[0007] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0008] Step S2, measuring the importance of nodes and edges based on the traceability graph;

[0009] Step S3, based on the importance of the nodes and the edges, pruning low-priority nodes and edges, and retaining high-priority nodes and edges representing critical attack paths;

[0010] Step S4, optimizing the current traceability graph.

[0011] In one embodiment, the importance metrics of the nodes and edges include the following graph analysis algorithms: node degree, betweenness centrality and PageRank algorithm.

[0012] In one embodiment, pruning low priority nodes and edges includes:

[0013] Removing nodes and edges with low node degree, low betweenness centrality or low PageRank value to reduce redundant information in the traceability graph, wherein the node degree, the betweenness centrality and the PageRank value are all compared with corresponding thresholds;

[0014] According to the importance of the nodes in the traceability graph, low-priority nodes are gradually removed to ensure that the key attack path is not affected during the pruning process;

[0015] During the tracing process, the tracing graph is monitored and updated in real time. According to newly discovered attack behaviors or data changes, the current tracing graph structure is dynamically adjusted and re-cropped.

[0016] In one embodiment, the optimizing the current traceability graph includes optimizing the critical path identification in the pruned traceability graph by a dynamic programming algorithm or a greedy algorithm to retain important nodes and association relationships.

[0017] Another aspect of the present invention further provides a traceability graph clipping device based on graph clipping, comprising:

[0018] A construction unit configured to construct a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0019] A computing unit configured to measure the importance of nodes and edges based on the provenance graph;

[0020] A pruning unit configured to prune low-priority nodes and edges based on the importance of the nodes and the edges, and retain high-priority nodes and edges representing critical attack paths;

[0021] The optimization unit is configured to optimize the current traceability graph.

[0022] In one embodiment, the computing unit is further configured to: adopt the following graph analysis algorithms: node degree, betweenness centrality and PageRank algorithm.

[0023] In one embodiment, the cutting unit is further configured to:

[0024] Removing nodes and edges with low node degree, low betweenness centrality or low PageRank value to reduce redundant information in the traceability graph, wherein the node degree, the betweenness centrality and the PageRank value are all compared with corresponding thresholds;

[0025] According to the importance of the nodes in the traceability graph, low-priority nodes are gradually removed to ensure that the key attack path is not affected during the pruning process;

[0026] During the tracing process, the tracing graph is monitored and updated in real time. According to newly discovered attack behaviors or data changes, the current tracing graph structure is dynamically adjusted and re-cropped.

[0027] In one embodiment, the optimization unit is further configured to optimize the critical path identification in the pruned traceability graph through a dynamic programming algorithm or a greedy algorithm to retain important nodes and association relationships.

[0028] Another aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the graph clipping-based traceability graph clipping method as described in any one of the above items.

[0029] Another aspect of the present invention further provides a computer storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the provenance graph clipping method based on graph clipping as described in any one of the above items are implemented.

[0030] Compared with the prior art, the present invention has at least the following advantages:

[0031] The traceability graph clipping method based on graph clipping provided by the present invention reduces the interference of irrelevant information in the analysis process by streamlining the traceability graph, thereby improving the accuracy and efficiency of traceability analysis. This method can be flexibly applied in various complex network environments, providing technical support for the rapid detection and traceability of advanced persistent threat attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of a flow chart of a traceability graph clipping method based on graph clipping according to an embodiment of the present invention;

[0033] Figure 2 It is a schematic diagram of the composition of a traceability graph clipping device based on graph clipping according to an embodiment of the present invention;

[0034] Figure 3 The figure is a schematic diagram of the composition of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose, the present invention is described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0036] Unless otherwise defined, all terms (including technical terms and scientific terms) used in this article have the same meaning as commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that terms (such as terms defined in commonly used dictionaries) should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined in this article.

[0037] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0038] The first embodiment of the present invention is a traceability graph clipping method based on graph clipping, such as Figure 1 As shown, including:

[0039] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0040] Step S2, measuring the importance of nodes and edges based on the traceability graph;

[0041] Step S3, based on the importance of the nodes and the edges, pruning low-priority nodes and edges, and retaining high-priority nodes and edges representing critical attack paths;

[0042] Step S4, optimizing the current traceability graph.

[0043] refer to Figure 1 , the method provided in this embodiment will be described in detail step by step below.

[0044] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships.

[0045] In this embodiment, the preliminary construction of the traceability graph is specifically processed as follows: First, based on the output data of the existing security event log, threat intelligence report and attack detection system, an APT attack traceability graph is constructed. The nodes of the traceability graph represent attack-related entities (such as attacker IP, victim host, malware, attack tools, etc.), and the edges represent the associations between entities (such as attack behaviors, information transmission paths, network connections, etc.). Since the collected data is often incomplete or noisy, in this case, the preliminary constructed traceability graph may contain many incompletely connected sub-graph segments and isolated nodes. These fragmented information will be further processed in the subsequent graph cutting and optimization process to reveal potential attack paths and complete attack chains.

[0046] Step S2: measure the importance of nodes and edges based on the traceability graph.

[0047] Specifically, the importance of each node and edge is calculated through a variety of graph analysis algorithms, including but not limited to the following metrics:

[0048] Node degree: measures the number of other nodes to which a node is directly connected, and is used to determine the direct influence of the node in the graph.

[0049] Betweenness Centrality: Evaluates the bridge role of a node in information dissemination, that is, the number of shortest paths on which the node serves as an intermediate node.

[0050] PageRank algorithm: Use the random walk model to evaluate the importance of nodes, assign different weights according to the connection relationship of nodes, and thus identify potential key nodes.

[0051] Edge weight: Edges are weighted according to the frequency or association strength of the attack paths so that paths with high weights are retained preferentially during pruning.

[0052] Step S3, based on the importance of the nodes and the edges, prune the low-priority nodes and edges, and retain the high-priority nodes and edges that represent the key attack path.

[0053] In this embodiment, the node and edge clipping thresholds can be set according to the actual application scenario and traceability requirements. The threshold setting can be based on empirical rules or a dynamic adjustment model to adapt to traceability graphs of different scales and complexities.

[0054] The higher the threshold, the fewer nodes and edges are retained during the pruning process; conversely, when the threshold is lower, more nodes and edges are retained, thereby increasing the complexity of the traceability graph.

[0055] In this embodiment, the intelligent cutting process can be specifically divided into three steps:

[0056] 1. Preliminary pruning: Based on the importance analysis of the graph, first remove nodes and edges with low node degree, small betweenness centrality or low PageRank value to reduce redundant information in the graph.

[0057] 2. Multi-level pruning: Perform pruning in different levels, gradually removing low-priority nodes according to the importance of the nodes in the traceability graph, ensuring that the key attack paths are retained and not affected during the pruning process.

[0058] 3. Dynamic cropping and updating: During the tracing process, the traceability graph is monitored and updated in real time. According to newly discovered attack behaviors or data changes, the graph structure is dynamically adjusted and re-cropped to maintain the optimal state of the traceability graph.

[0059] Step S4, optimizing the current traceability graph.

[0060] By analyzing the weight distribution of all nodes and edges in the graph, we ensure that the key nodes and high-priority edges in the attack path are always retained in the graph structure. This process uses a greedy algorithm or a dynamic programming algorithm to optimize the pruned graph so that the overall structure of the traceability graph is concise and can fully reflect the attacker's action trajectory.

[0061] Compared with the prior art, the advantages of this embodiment include at least:

[0062] 1) Automated data preprocessing and graph construction: Construct a traceability graph through data cleaning and feature extraction, so that the traceability graph can accurately reflect the events and correlations during the APT attack process.

[0063] 2) Graph pruning strategy design: A pruning algorithm based on importance measurement is used to automatically evaluate the nodes and edges in the graph, determine their importance in the attack path, and perform intelligent pruning based on the threshold.

[0064] 3) Dynamically adjust the cropping strategy: According to the new information generated during the traceability analysis process, the cropping strategy is dynamically adjusted to adapt to changes in different attack stages and improve the flexibility and accuracy of the traceability graph.

[0065] 4) Critical path identification and source tracing analysis: In the trimmed graph structure, focus on identifying key nodes and key events in the attack path to provide analysts with accurate attack source tracing guidance.

[0066] In summary, through the above technical solutions, the present invention can effectively reduce the noise information in the traceability graph while ensuring the integrity of the attack path, making the traceability analysis more efficient and accurate.

[0067] The second embodiment of the present invention corresponds to the first embodiment, and can be referred to Figure 2This embodiment introduces a traceability graph clipping device based on graph clipping, including the following components:

[0068] A construction unit configured to construct a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0069] A computing unit configured to measure the importance of nodes and edges based on the provenance graph;

[0070] A pruning unit configured to prune low-priority nodes and edges based on the importance of the nodes and the edges, and retain high-priority nodes and edges representing critical attack paths;

[0071] The optimization unit is configured to optimize the current traceability graph.

[0072] In one embodiment, the computing unit is further configured to: adopt the following graph analysis algorithms: node degree, betweenness centrality and PageRank algorithm.

[0073] In one embodiment, the cutting unit is further configured to:

[0074] Removing nodes and edges with low node degree, low betweenness centrality or low PageRank value to reduce redundant information in the traceability graph;

[0075] According to the importance of the nodes in the traceability graph, low-priority nodes are gradually removed to ensure that the key attack path is not affected during the pruning process;

[0076] During the tracing process, the tracing graph is monitored and updated in real time. According to newly discovered attack behaviors or data changes, the current tracing graph structure is dynamically adjusted and re-cropped.

[0077] In one embodiment, the optimization unit is further configured to optimize the critical path identification in the pruned traceability graph through a dynamic programming algorithm or a greedy algorithm to retain important nodes and association relationships.

[0078] A third embodiment of the present invention is an electronic device, such as Figure 3 As shown, it can be understood as a physical device, including a processor and a memory storing instructions executable by the processor. When the instructions are executed by the processor, the following operations are performed:

[0079] Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships;

[0080] Step S2, measuring the importance of nodes and edges based on the traceability graph;

[0081] Step S3, based on the importance of the nodes and the edges, pruning low-priority nodes and edges, and retaining high-priority nodes and edges representing critical attack paths;

[0082] Step S4, optimizing the current traceability graph.

[0083] The fourth embodiment of the present invention, the process of the traceability graph clipping method based on graph clipping of this embodiment is the same as the first, second or third embodiment, the difference is that, in engineering implementation, this embodiment can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the method of the present invention can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), including a number of instructions for a device to execute the method described in the embodiment of the present invention.

[0084] Through the description of the specific implementation methods, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the predetermined purpose should be obtained. However, the accompanying drawings are only for reference and illustration purposes and are not intended to limit the present invention.

Claims

1. A provenance graph clipping method based on graph clipping, characterized in that: include: Step S1, constructing a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships; Step S2, measuring the importance of nodes and edges based on the traceability graph; Step S3, based on the importance of the nodes and the edges, pruning low-priority nodes and edges, and retaining high-priority nodes and edges representing critical attack paths; Step S4, optimizing the current traceability graph.

2. The traceability graph clipping method based on graph clipping according to claim 1, characterized in that: The importance metrics of the nodes and edges adopt the following graph analysis algorithms: node degree, betweenness centrality and PageRank algorithm.

3. The traceability graph clipping method based on graph clipping according to claim 1, characterized in that: The pruning of low priority nodes and edges includes: Removing nodes and edges with low node degree, low betweenness centrality or low PageRank value to reduce redundant information in the traceability graph, wherein the node degree, the betweenness centrality and the PageRank value are all compared with corresponding thresholds; According to the importance of the nodes in the traceability graph, low-priority nodes are gradually removed to ensure that the key attack path is not affected during the pruning process; During the tracing process, the tracing graph is monitored and updated in real time. According to newly discovered attack behaviors or data changes, the current tracing graph structure is dynamically adjusted and re-cropped.

4. The traceability graph clipping method based on graph clipping according to claim 1, characterized in that: The optimizing of the current traceability graph includes optimizing the key path identification in the pruned traceability graph through a dynamic programming algorithm or a greedy algorithm to retain important nodes and association relationships.

5. A traceability graph cutting device based on graph cutting, characterized in that: include: A construction unit configured to construct a traceability graph, wherein the traceability graph includes attack-related entities and their association relationships; A computing unit configured to measure the importance of nodes and edges based on the provenance graph; A pruning unit configured to prune low-priority nodes and edges based on the importance of the nodes and the edges, and retain high-priority nodes and edges representing critical attack paths; The optimization unit is configured to optimize the current traceability graph.

6. The device for tracing graph cutting based on graph cutting according to claim 1, characterized in that: The computing unit is further configured to: adopt the following graph analysis algorithms: node degree, betweenness centrality and PageRank algorithm.

7. The device for tracing graph cutting based on graph cutting according to claim 1, characterized in that: The cutting unit is further configured as follows: Removing nodes and edges with low node degree, low betweenness centrality or low PageRank value to reduce redundant information in the traceability graph, wherein the node degree, the betweenness centrality and the PageRank value are all compared with corresponding thresholds; According to the importance of the nodes in the traceability graph, low-priority nodes are gradually removed to ensure that the key attack path is not affected during the pruning process; During the tracing process, the tracing graph is monitored and updated in real time. According to newly discovered attack behaviors or data changes, the current tracing graph structure is dynamically adjusted and re-cropped.

8. The device for tracing graph cutting based on graph cutting according to claim 1, characterized in that: The optimization unit is further configured to optimize the critical path identification in the pruned traceability graph through a dynamic programming algorithm or a greedy algorithm to retain important nodes and association relationships.

9. An electronic device, characterized in that: The electronic device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the traceability graph clipping method based on graph clipping as claimed in any one of claims 1 to 4.

10. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the provenance graph clipping method based on graph clipping as claimed in any one of claims 1 to 4.

Images