Attack detection method based on behavior pattern

Abstract

The invention provides an attack detection method based on a behavior pattern, and belongs to the field of attack detection, and the method comprises the steps: S1, constructing a traceability graph through a system audit log, extracting a process event from the traceability graph, and creating the behavior pattern; s2, generating an embedded vector of the behavior pattern by using the embedded model, inputting the embedded vector into a semantic reconstruction module to learn internal characteristics of the behavior pattern, and outputting a reconstruction vector; s3, calculating the cosine similarity of the embedded vector and the reconstructed vector as the measure of a reconstruction error, and regarding the behavior pattern higher than a threshold as an abnormal behavior pattern; and constructing an attack sub-graph based on the abnormal behavior pattern to reconstruct an attack story. According to the method, the accuracy and interpretability of attack detection can be improved.

Description

Technical Field

[0001] The invention belongs to the field of host-based attack detection, and in particular relates to an attack detection method based on behavior patterns. Background Art

[0002] The ever-evolving battle between intrusion detection systems and attacks continues to evolve. Timely detection of abnormal events in computer systems is a key step in protecting computer systems from attacks. System logs contain detailed information about events generated by computer systems and play a key role in various contemporary anomaly detection techniques, including intrusion detection, digital forensics, and situational awareness. Therefore, log-based anomaly detection is an important method to ensure system reliability and service quality.

[0003] Traditional machine learning models are often used to identify intrusion events from logs. These methods extract valuable features from log messages and use machine learning algorithms to analyze log data. However, supervised learning methods face many difficulties in training binary classifiers to detect abnormal log sequences due to the well-known data imbalance problem. Therefore, many unsupervised learning models, such as principal component analysis (PCA) and single class, have been used for anomaly detection. Many machine learning-based methods require customized features. These methods may have difficulty accurately capturing abnormal patterns of discrete log messages, especially in scenarios involving nonlinear or complex data distributions. Deep learning (DL) has shown excellent capabilities in modeling complex relationships. Its results can match or even exceed the performance of human experts in certain fields. As a result, a large number of anomaly detection systems based on deep learning models have emerged. These systems use machine learning or deep learning techniques to detect and identify network attacks. By learning from large datasets containing network traffic or system logs, these systems can autonomously identify potential attack behaviors by discerning normal and malicious behavior patterns.

[0004] The existing technology mainly has the following shortcomings:

[0005] 1. Ignoring the interactive relationship between system entities. For example, DeepLog uses a long short-term memory (LSTM) network to convert system logs into natural language sequences. The network learns benign patterns and detects anomalies from system behavior. However, most of the attack traces left by attackers in the audit system are not simple time series, and the system contains a large number of benign activities while containing malicious activities. For example, when attackers use browser vulnerabilities to break into the system, users' activities of surfing the Internet through browsers will also leave a large number of logs in the audit system. If the audit logs are simply arranged in chronological order, a small amount of malicious activities will be mixed with a large number of benign activities. This detection system that only retains the temporal order relationship between log entries ignores the spatial interactive relationship between system entities, and the detection results are difficult to provide direct help in revealing the attack story.

[0006] 2. Over-reliance on expert knowledge. Rule-based methods (such as Sleuth and Holmes) require expert experience to set detection rules, which requires security analysts to have a deep understanding of attack behaviors. In addition, when applied in large-scale networks with unstable attack patterns, limited detection rules based on known attack knowledge are prone to more false negatives.

[0007] 3. Insufficient ability to support attack investigation. Some methods convert system logs into traceability graphs and detect whether there is attack activity in the entire traceability graph. However, even for traceability graphs that are determined to contain attacks, analysts still need to perform manual analysis to determine specific attack events and entities. On the other hand, some other methods mainly focus on detecting attack entities, but due to insufficient consideration of the attack context, the false alarm rate is high. Summary of the invention

[0008] To solve the above technical problems, the present invention provides an attack detection method based on behavior patterns, comprising the following steps:

[0009] Step S1: construct a traceability graph using the system audit log, extract process events from the traceability graph and create behavior patterns;

[0010] Step S2: using the embedding model to generate an embedding vector of the behavior pattern, then inputting it into a semantic reconstruction module to learn the intrinsic features of the behavior pattern, and outputting a reconstruction vector;

[0011] Step S3: Calculate the cosine similarity between the embedding vector and the reconstructed vector as a measure of the reconstruction error, and the behavior pattern above the threshold is regarded as an abnormal behavior pattern; construct an attack subgraph based on the abnormal behavior pattern to reconstruct the attack story.

[0012] Beneficial effects:

[0013] 1. This invention proposes a new method for dividing process behavior patterns. This method not only considers the behavioral characteristics of each process, but also considers the relationship between processes. By integrating behavioral and structural information, this method enhances the ability to fully understand the operating status of the system.

[0014] 2. The present invention summarizes and generalizes the behavior of system processes in a benign environment, providing rich materials for learning embedded models. Based on the simplest behavioral pattern division between processes, behavioral patterns are extracted, so that the attack story can be directly reconstructed by associating behavioral patterns during the investigation phase.

[0015] 3. The present invention uses the pre-trained DistilBERT as the initial model and further trains it using contrastive learning. Due to the pre-training on a large-scale corpus, the DistilBERT model has a strong semantic embedding capability. The contrastive learning design based on dropout makes the semantic vector highly discriminable and can capture the different meanings of various behavior patterns. The present invention compares the similarities between various behavior patterns and optimizes the feature extraction process through the rich feature representation learned by the pre-trained model in a large corpus. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flow chart of an attack detection method based on a behavior pattern of the present invention;

[0017] Figure 2 Schematic diagram of the network structure of the embedded model;

[0018] Figure 3 The embedding vector generation process for behavioral patterns based on contrastive learning;

[0019] Figure 4 This is a schematic diagram of the network structure of the semantic reconstruction module;

[0020] Figure 5 Reconstruct a schematic diagram for the attack graph. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0022] Embodiment 1

[0023] like Figure 1 As shown, an attack detection method based on behavior pattern provided by an embodiment of the present invention includes the following steps:

[0024] Step S1: Use the system audit log to build a traceability graph, extract process events from the traceability graph and create behavior patterns;

[0025] Step S2: Use the embedding model to generate an embedding vector of the behavior pattern, then input it into the semantic reconstruction module to learn the intrinsic features of the behavior pattern and output the reconstruction vector;

[0026] Step S3: Calculate the cosine similarity between the embedded vector and the reconstructed vector as a measure of the reconstruction error. Behavior patterns above the threshold are considered abnormal behavior patterns. Construct an attack subgraph based on the abnormal behavior pattern to reconstruct the attack story.

[0027] In one embodiment, the above step S1: constructing a traceability graph using the system audit log, extracting process events from the traceability graph and creating a behavior pattern, specifically includes:

[0028] Step S11: construct a traceability graph using the system audit log, wherein the nodes of the traceability graph represent system entities, including processes, files or sockets; the edges of the traceability graph represent system call events;

[0029] In the embodiment of the present invention, the system entity that actively initiates the operation is called the subject, and the system entity that is operated is called the object. Table 1 illustrates the event types between the subject and the object, as well as the entity attributes.

[0030] Table 1 System entities, event types and entity attributes

[0031]

[0032] Step S12: extract all events related to each process and its parent process from the traceability graph, and regard the processing sequence of events of the parent and child processes as a behavior pattern, specifically including:

[0033] The present invention extracts all events related to each process and its parent process from the traceability graph and regards them as a basic behavior unit. For each event within the behavior unit, the entity path associated with the event is abstracted into a standard form. For the file entity, the specific file path is abstracted into the folder path to which the file belongs. For example, " / lib / x86 64-linux-gnu / libtdb.so.1" and " / lib / x86 64-linux-gnu / libc.so.6" are both converted to " / lib / x8664-linuxgnu", while " / usr / share / dpkg / cputable" and " / usr / share / dpkg / tupletable" are converted to " / usr / share / dpkg". For network sockets, specific IP addresses are abstracted into their respective subnets. Regarding event types, the event types outlined in Table 1 are used. Then, the events within each behavior unit are organized in chronological order to capture their temporal relationships. When there are repeated events within the same process, only the earliest event is retained. Finally, the processing sequence of events of a set of parent and child processes is considered as a behavioral pattern.

[0034] In one embodiment, the above step S2: using the embedding model to generate an embedding vector of the behavior pattern, then inputting the embedding vector into the semantic reconstruction module to learn the intrinsic features of the behavior pattern, and outputting the reconstruction vector, specifically includes:

[0035] Step S21: Build an embedding model based on the DistilBERT model , including: an embedding layer, 6 Transformer layers and a fully connected layer including Dropout; among them, the Dropout operation is added to the fully connected layer. Behavior pattern set composed of , and the behavior patterns Input Transformer layer twice, with different dropout operations and Associated, we get the embedding vectors of the two behavior patterns: and ;in, and constitutes a positive instance pair, and Compared to other embeddings from the same batch with different behavioral patterns Constitute a negative instance pair;

[0036] The embodiment of the present invention uses the open source pre-trained model DistilBERT as the initial model to build the embedding model, and further trains it using contrastive learning. DistilBERT uses the BERT model as its teacher model and is pre-trained by self-supervised learning on the corpus. Therefore, DistilBERT does not rely on any form of manual annotation or text tagging. A key challenge in contrastive learning is how to construct positive instance pairs. Due to the discrete nature of natural language data, it is difficult to obtain the same text by applying random transformations (such as flipping, twisting, and rotating) as in the field of image processing. and . Considering the alignment and uniformity of contrastive learning, the present invention uses an independently sampled dropout mask to generate positive examples. Dropout is a regularization technique that aims to prevent overfitting. During training, Dropout randomly selects a portion of neurons (the output of the fully connected layer) according to probability and sets their output to 0. This process occurs randomly in each training batch, so that the model cannot rely too much on certain features. In the training process of the embedding model of the present invention, the dropout operation is added to the fully connected layer, and the probability of dropout is 0.1. Figure 2 As shown in Figure 1, it is a schematic diagram of the network structure of the embedded model.

[0037] Construct the training loss function for the embedding model:

[0038] (1)

[0039] in, Indicates the batch size, ,in Represents the embedding model; is a hyperparameter, sim( ) represents the cosine similarity function;

[0040] By adopting contrastive learning, the goal of embedding model training is to minimize the distance between two embeddings of the same behavior pattern, while maximizing the distance between these embeddings and other embeddings of different behavior patterns that serve as counterexamples. Figure 3 The embedding vector generation process of behavioral patterns based on contrastive learning is demonstrated.

[0041] Step S22: Use the autoencoder to construct a semantic reconstruction module, using a multi-layer perceptron as the encoder and decoder; embedding vector Input semantic reconstruction module for semantic reconstruction and output reconstruction vector ;

[0042] The loss function of the semantic reconstruction module is constructed using mean square error:

[0043] (2)

[0044] in, For each behavior mode The embedding vector of for The reconstruction vector of .

[0045] The present invention uses an autoencoder to construct a semantic reconstruction module to semantically reconstruct the embedding vector of the behavior pattern. The autoencoder uses a multi-layer perceptron as the encoder and decoder components. Figure 4 As shown in the figure, the input of the autoencoder is the embedding vector of the behavior pattern. Multilayer perceptron (MLP) is used as the main building block of the encoder, and each layer consists of multiple neurons connected by nonlinear activation functions. This design helps to deeply explore the deep semantic relationships in the input data. The decoder is also implemented based on multilayer perceptron, but contrary to the encoding process, its goal is to restore the form as close to the original input as possible. The error threshold between the encoded input and the output of the decoder is used as the decision boundary.

[0046] In one embodiment, the above step S3: calculates the cosine similarity between the embedded vector and the reconstructed vector as a measure of the reconstruction error, and the behavior pattern above the threshold is regarded as an abnormal behavior pattern; and constructs an attack subgraph based on the abnormal behavior pattern to reconstruct the attack story.

[0047] The detection mechanism of the present invention is based on the model being fully trained on normal behavior patterns. Therefore, if the behavior pattern being tested is benign, a lower reconstruction error should be generated in the semantic reconstruction module. The present invention uses the cosine similarity between the input and output vectors as a measure of the reconstruction error. The larger the reconstruction error, the higher the abnormality of the behavior pattern.

[0048] During the testing phase, similar to the training phase, the present invention first semantically vectorizes the behavior pattern to obtain an embedding vector, and then performs semantic reconstruction. The degree of abnormality of a given behavior pattern is quantified by the reconstruction error. Behavior patterns whose abnormality exceeds a predefined threshold are considered abnormal patterns and require further investigation.

[0049] The goal of the investigation is to reconstruct the attack story based on the behavioral patterns between processes. Correlations are made between disconnected behavioral pattern graphs to obtain a comprehensive attack picture.

[0050] like Figure 5 As shown, for each behavior pattern diagram (such as Figure 5 -A), by searching for other nodes adjacent to the entities in the behavior pattern on the traceability graph ( Figure 5 -B) to expand it. If two components share a common node ( Figure 5 -B), will merge disconnected graph components by merging shared nodes and their corresponding edges (e.g. Figure 5 -C). This iterative process continues until all disjoint graph components are connected to each other.

Claims

1. A behavior pattern-based attack detection method, characterized in that: include: Step S1: construct a traceability graph using the system audit log, extract process events from the traceability graph and create behavior patterns; Step S2: using the embedding model to generate an embedding vector of the behavior pattern, then inputting it into a semantic reconstruction module to learn the intrinsic features of the behavior pattern, and outputting a reconstruction vector; Step S3: Calculate the cosine similarity between the embedded vector and the reconstructed vector as a measure of reconstruction error, and a behavior pattern above a threshold is regarded as an abnormal behavior pattern; An attack subgraph is constructed based on the abnormal behavior pattern to reconstruct the attack story.

2. The behavior pattern-based attack detection method according to claim 1, characterized in that: The step S1: constructing a traceability graph using the system audit log, extracting process events from the traceability graph and creating behavior patterns, specifically includes: Step S11: construct a traceability graph using the system audit log, wherein the nodes of the traceability graph represent system entities, including processes, files or sockets; and the edges of the traceability graph represent system call events; Step S12: extract all events related to each process and its parent process from the traceability graph, and regard the processing sequence of events of the parent and child processes as a behavior pattern.

3. The behavior pattern-based attack detection method according to claim 2, characterized in that: The step S2: using the embedding model to generate the embedding vector of the behavior pattern, then inputting it into the semantic reconstruction module to learn the intrinsic features of the behavior pattern, and outputting the reconstruction vector, specifically includes: Step S21: Build an embedding model based on the DistilBERT model , including: an embedding layer, 6 Transformer layers and a fully connected layer including Dropout; among them, the Dropout operation is added to the fully connected layer. Behavior pattern set composed of , and the behavior patterns Input Transformer layer twice, with different dropout operations and Associated, we get the embedding vectors of the two behavior patterns: and ;in, and constitutes a positive instance pair, and Compared to other embeddings from the same batch with different behavioral patterns Constitute a negative instance pair; Construct the training loss function for the embedding model: （1） in, Indicates the batch size, ,in Represents the embedding model; is a hyperparameter, sim( ) represents the cosine similarity function; Step S22: Use the autoencoder to construct a semantic reconstruction module, using a multi-layer perceptron as the encoder and decoder; embedding vector Input the semantic reconstruction module to perform semantic reconstruction and output the reconstruction vector ; The loss function of the semantic reconstruction module is constructed using mean square error: （2） in, For each behavior mode The embedding vector of for The reconstruction vector of .

Images