Self-adaptive traceability graph real-time attack detection method and system based on label and gradient back propagation

Abstract

The invention discloses a self-adaptive traceability graph real-time attack detection method and system based on labels and gradient back propagation, and belongs to the field of attack detection. According to the method, an anomaly detection mechanism is introduced, behavior tags are added to nodes, corresponding rules are set, abnormal conditions are additionally considered during detection, and detection event types and rules are expanded at the same time. According to the method, full benign data is adopted to train a detection module, a back propagation method and an Adam optimization algorithm are adopted to optimize and adjust a propagation rate, an abnormal threshold value, an alarm threshold value, a behavior label score and an entity label score according to a false alarm condition generated in a training process, and finally, the detection module after optimization training is used for detection. According to the method, the problem that the overall detection accuracy of the system cannot be comprehensively improved due to the fact that the optimization range is too limited to the nodes and edges corresponding to the alarm events in the prior art is solved, so that the false alarm rate is reduced, and the response capability of the system to complex attack scenes is remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of attack detection, and in particular relates to a real-time attack detection method and system based on an adaptive provenance graph with labels and gradient back propagation. Background Art

[0002] In recent years, as cyber attacks have become increasingly complex and covert, advanced persistent threats (APTs) have become a serious challenge faced by governments and industrial sectors, causing significant social impacts. Detecting intrusions in normal behavior has become increasingly important and challenging. [1] Source-based intrusion detection systems (PIDS) have received extensive attention in the academic community due to their causal analysis capabilities. [2] , to address the overhead issue, there is also a rule-based PIDS [3] , which has the advantage of being lightweight, greatly reduces storage requirements and allows for rapid response with minimal delay. However, in actual deployment, due to the high false alarm rate caused by the complexity and variability of the environment, the widespread problem of alarm fatigue has long plagued security personnel. Qi'anxin's statistics show that a digital enterprise with about 3,000 people generates an average of about 100,000 alarm messages per day, but a security expert with rich practical experience can only handle less than 500 alarms per day on average. For a 5-person security operations team, the upper limit of alarm handling is only 2,500 per day, which is far from the total number of 100,000 alarms. The contradiction between the massive amount of false alarm information and the limited number of analysis and processing personnel has greatly hindered the promotion of this technology.

[0003] In order to improve accuracy, in SOC, analysts must manually configure the model, which is a time-consuming process and requires extremely high professional skills. Therefore, there is an urgent need for an automated configuration method to improve the accuracy of rule-based PIDS.

[0004] Rule-based PIDS uses human-designed rules to map system entities and events to predefined semantic units (such as tags TTP, etc.) and propagate these units along the information flow to detect results. Due to its real-time processing capabilities and lightweight characteristics, it has become popular. Rule-based PIDS has solved the problem of large-scale burden of tracing analysis to a certain extent, but due to the complex environment, when threat reports are generated, they are accompanied by a large amount of false positive information, which brings a great burden to reviewers and causes widespread alarm fatigue, which has become the biggest hidden danger and loophole in security operations.

[0005] [1] A.Alshamrani, S.Myneni, A.Chowdhary, and D.Huang, "A survey on advanced persistent threats:Techniques, solutions, challenges, and research opportunities," IEEE Communications Surveys Tutorials, vol.21, no.2, 2019.

[0006] [2]M.Zipperle,et al.,"Provenance-based Intrusion Detection Systems:ASurvey".ACM Comput.Surv.2023.

[0007] [3]MNHossain, S.Sheikhi, and R.Sekar, "Combating dependence explosion in forensic analysis using alternative tag propagation semantics," in IEEESymposium on Security and Privacy(SP), 2020. Summary of the invention

[0008] In order to solve the problems in the prior art, the present invention proposes a real-time attack detection method and system based on adaptive provenance graph with labels and gradient back propagation.

[0009] The technical solution of the present invention is as follows:

[0010] The present invention first proposes a real-time attack detection method based on adaptive traceability graph of labels and gradient back propagation, which includes the following steps:

[0011] S1: Construct a traceability graph based on the input audit log training set; each node of the traceability graph has a behavior label and an entity label, and each edge of the traceability graph stores a source node ID, a destination node ID, an event type between two nodes, a propagation rate, an anomaly threshold, and an alarm threshold;

[0012] S2: Entity tags are transferred based on event type and propagation rate. The event type determines the transfer path, the destination node in the path stores the path information, and the source node stores the number of its corresponding destination nodes.

[0013] S3: For each edge, select the node to be detected for anomaly based on the event type stored on the edge, and perform anomaly detection on the behavior label score of the node based on the anomaly threshold; when an anomaly is detected, set an alarm weight to adjust the entity label score of the node during alarm detection;

[0014] S4: For each edge, select the node to be detected based on the event type, and perform alarm detection on the entity label score of the node according to the alarm threshold; and issue an alarm for the edge with abnormalities;

[0015] S5: Based on the gradient strategy, optimize the propagation rate of the edge that generates the alarm, the anomaly threshold, the alarm threshold, the behavior label score, and the entity label score;

[0016] S6: Perform back propagation optimization based on the path information stored in the node to optimize the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edges on the path;

[0017] S7: Repeat steps S1-S6 until the optimization is completed; after the optimization is completed, replace the audit log training set in step S1 with the audit log to be tested, and execute steps S1-S4 for testing.

[0018] The present invention also provides a real-time attack detection based on adaptive traceability graph of labels and gradient back propagation for implementing the method, which includes a detection module and a learning module;

[0019] The detection module is used to perform attack detection on the input audit log to be detected, which includes:

[0020] A traceability graph construction unit is used to construct a traceability graph according to the audit log; each node of the traceability graph has a behavior label and an entity label, and each edge of the traceability graph stores a source node ID, a destination node ID, an event type between two nodes, a propagation rate, an abnormal threshold, and an alarm threshold;

[0021] An entity label transmission unit is used to transmit the entity label according to the event type and the propagation rate; wherein the event type determines the transmission path, the destination node in the transmission path stores the path information, and the source node stores the number of its destination nodes;

[0022] The anomaly detection unit is used to select the node to be detected according to the event type stored on each edge, and perform anomaly detection on the behavior label score of the node according to the anomaly threshold; when an anomaly is detected, an alarm weight is set to adjust the entity label score of the node during alarm detection;

[0023] The alarm detection unit selects the node to be detected according to the event type for each edge, and performs alarm detection on the entity label score of the node according to the alarm threshold; and issues an alarm for the edge with abnormality;

[0024] The learning module is used to train and optimize the detection module; the learning module optimizes the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge that generates the alarm based on the gradient strategy; and further performs back propagation optimization based on the path information stored in the node to optimize the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge that generates the alarm.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] (1) The present invention adopts an incremental learning method. After the system is deployed and applied, the detection results are automatically divided into two categories: benign data and alarm data. By putting the benign data into the training mode, the system can re-learn the new data, and after the learning is completed, it automatically updates and replaces the original detection model. Therefore, the present invention effectively overcomes the problem of reduced detection accuracy caused by concept drift in the prior art, while reducing the complexity of long-term system maintenance and the need for manual intervention, thereby realizing the automatic update of detection parameters and ensuring that the system maintains efficient response capabilities in the face of ever-changing security threats.

[0027] (2) The present invention adopts a back propagation method, which is not limited to calculating the gradient back propagation optimization parameters based on the system generation results, and expands the scope of optimization. Back propagation is performed through the path stored in the node to optimize the parameters of the relevant nodes and edges. Therefore, the problem in the prior art that the optimization scope is too limited to the nodes and edges corresponding to the alarm event and the overall detection accuracy of the system cannot be fully improved is overcome, thereby reducing the false alarm rate, significantly improving the system's response capability to complex attack scenarios, and further improving the system efficiency.

[0028] (3) The present invention adopts the Adam optimization algorithm, which is used to further optimize the calculated initial gradient, thereby overcoming the problem that the original Batch batch reduction is difficult to perfectly correspond to the number of events due to the fixed batch size. If the batch size is too small, it may be optimized before the detection is completed, resulting in the problem of inconsistent labels in a single traceability graph. At the same time, it can reach the optimal value faster and more accurately, rather than directly updating the parameters according to the gradient.

[0029] (4) The present invention introduces an anomaly detection mechanism, adds behavior tags, and sets corresponding rules for them, taking into account abnormal situations during detection. At the same time, it expands the types and rules of detection events. This overcomes the problem of the prior art that the false alarm rate increases due to the pursuit of reducing false alarms. This achieves a more reasonable detection result and a higher detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flow chart of the real-time attack detection method based on adaptive traceability graph of labels and gradient back propagation of the present invention;

[0031] Figure 2 It is a working schematic diagram of the detection module of the present invention;

[0032] Figure 3 It is a working schematic diagram of the learning module of the present invention;

[0033] Figure 4 It is a flowchart of the reverse propagation of the present invention;

[0034] Figure 5 A schematic diagram of the process of incremental learning after deploying the system of the present invention. DETAILED DESCRIPTION

[0035] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0036] like Figure 1 As shown, the present invention proposes a real-time attack detection method and system for adaptive traceability graph based on label and gradient back propagation. The system includes a detection module and a learning module; the detection module ( Figure 2 As shown) is used to perform attack detection on the input audit log to be detected: the learning module ( Figure 3 As shown) is used to train and optimize the detection module. In the training stage, the present invention uses completely benign audit logs as training samples. Therefore, if an alarm is generated during the training process, it means that a false alarm has occurred in the training process. Based on the false alarm situation, the learning module optimizes the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge that generates the alarm according to the gradient strategy; and further performs back propagation optimization based on the path information stored in the node to optimize the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge that generates the alarm. The detection module after the final training is completed can be deployed in the actual application scenario to perform attack detection on the audit log to be detected.

[0037] The detection module can be specifically divided into a traceability graph construction unit, an entity label transfer unit, an anomaly detection unit, and an alarm detection unit. The following is a detailed description of each module in conjunction with the specific detection method of the present invention. The adaptive traceability graph real-time attack detection method based on label and gradient back propagation of the present invention includes the following steps:

[0038] S1: Construct a traceability graph based on the input audit log training set; each node of the traceability graph has a behavior label and an entity label, and each edge of the traceability graph stores a source node ID, a destination node ID, an event type between two nodes, a propagation rate, an anomaly threshold, and an alarm threshold;

[0039] S2: Entity tags are transferred based on event type and propagation rate. The event type determines the transfer path, the destination node in the path stores the path information, and the source node stores the number of its corresponding destination nodes.

[0040] S3: For each edge, select the node to be detected for anomaly based on the event type stored on the edge, and perform anomaly detection on the behavior label score of the node based on the anomaly threshold; when an anomaly is detected, set an alarm weight to adjust the entity label score of the node during alarm detection;

[0041] S4: For each edge, select the node to be detected based on the event type, and perform alarm detection on the entity label score of the node according to the alarm threshold; and issue an alarm for the edge with abnormalities;

[0042] S5: Based on the gradient strategy, optimize the propagation rate of the edge that generates the alarm, the anomaly threshold, the alarm threshold, the behavior label score, and the entity label score;

[0043] S6: Perform back propagation optimization based on the path information stored in the node to optimize the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edges on the path;

[0044] S7: Repeat steps S1-S6 until the optimization is completed; after the optimization is completed, replace the audit log training set in step S1 with the audit log to be tested, and execute steps S1-S4 for testing.

[0045] like Figure 2 As shown, steps S1, S2, S3 and S4 in the method of the present invention are respectively executed by the traceability graph construction unit, the entity label transfer unit, the anomaly detection unit and the alarm detection unit of the detection module, as shown in FIG. Figure 3 As shown, S5 and S6 in the method of the present invention are performed by the learning module, and the actual detection work of S7 is performed by the trained detection module.

[0046] To improve training efficiency, in a specific embodiment of the present invention, S1 of the present invention uses completely benign audit logs as training samples, and uses a learning module to adjust parameters in the detection module based on false alarms generated during the training process, and repeats the process until the training is completed.

[0047] In step S1, after the audit log is input, the object in the audit log is first identified. If a new entity is identified, it is added to the traceability graph as a new node. If it is an existing object (i.e., an existing node), the frequency score in the behavior label of the corresponding node will be reduced according to the frequency of the object's appearance.

[0048] Each node in the traceability graph has a behavior label and an entity label. The behavior label B of the node includes a frequency score b0 (a low frequency score represents an abnormal call frequency) and a time score b1 (a low time score represents an abnormal usage time). The score in the behavior label B is used for anomaly detection, and the alarm threshold of the alarm detection link is adjusted according to the detection results. The entity label A is related to the node type. For data type nodes, the entity label A includes a confidentiality score c (a low confidentiality score represents highly sensitive data) and an integrity score i (a low integrity score represents a high possibility of harm); for code type nodes, the entity label A only includes an integrity score i (a low integrity score represents a high possibility of harm). Entity label A is used for final alarm detection.

[0049] Each edge of the traceability graph stores the source node ID, the destination node ID, the event type between the two nodes, the propagation rate, the abnormal threshold and the alarm threshold. Among them, the event type is a well-known concept in the art, and the event type can be expanded as needed. In the embodiment of the present invention, the event types of interest mainly include creation, reading, loading, opening, writing, removing, renaming, executing, injecting, setting user identification, modifying permissions, creating a new process and binding. Among them, create(s,o) means that node s creates a node o, read(s,o) means that node s reads node o, load(s,o) means that node s loads node o, open(s,o) means that node s opens node o, write(s,o) means that node s writes node o, remove(s,o) means that node s removes node o, rename(s,o) means that node s renames node o, execve(s,o) means that node s executes node o, inject(s,o) means that node s injects node o, set user ID set_uid(s,o) means that node s sets the user ID of node o, modify permissions chmod(s,o) means that node s modifies the permissions of node o, create a new process fork(s,o) means that node s creates node o (new process), bind(s,o) means that node s binds to node o. In the symbols of each event type, s represents the source node and o represents the destination node. In the present invention, enent_type represents the event type, so an event can be recorded as (s, enent_type, o). If min(s.tag, o.tag) appears, the specific tag score is the minimum value of the two, and itag represents the integrity score.

[0050] In S2, the event type determines the transmission path, which represents the transmission direction of the data flow. During the transmission, the source node only transmits the entity label to the destination node. The destination node in the path stores the information of the transmission path, and the source node stores the number of its corresponding destination nodes. At the same time, the propagation rate is controlled by the parameter G. Specifically, for any edge e in the traceability graph, a g is stored. e , according to the rules corresponding to the event type, the entity tag tag of the target node to be updated is given dest and the entity tag of the source node rule During tag propagation, tags are updated as follows dest :

[0051] tag dest (new) = g e ×tag rule +(1–g e )×tag dest ;

[0052] The specific rules for entity tag transmission are as follows:

[0053] Table 1 Entity tag transfer rule design

[0054]

[0055]

[0056] The path is stored in the updated node, the source node regards it as a child node, and the number of child nodes is recorded.

[0057] The present invention selects detection nodes according to the event type stored on the edge, wherein the nodes selected for anomaly detection and alarm detection are the same. The specific rules for anomaly detection and alarm detection may need to be adjusted, and the present invention does not limit this, and the detection content corresponding to each event type is also well known. Taking the file creation event create(s,o) as an example, it means that the source node s creates a destination node o. The content of its alarm detection is: if the destination node is a file and the source node integrity score <threshold, it is deemed to be a malicious file creation, and the node to be detected for the create(s,o) event is the source node. In a specific embodiment of the present invention, the specific rules for alarm detection are shown in Table 2 below:

[0058] Table 2 Alarm detection rule design

[0059]

[0060]

[0061] The rules of anomaly detection are relatively simple, and the selection of nodes to be detected is the same as that of alarm detection. Anomaly detection is to detect the relationship between behavior labels and corresponding thresholds. For the edges of the traceability graph, set the anomaly detection threshold T b If the edge already has an anomaly detection threshold stored, it is directly read and used. Otherwise, the anomaly detection threshold T is initialized and set. b ={0.5,0.5,0.5,0.5}, T b The items in correspond to the source node frequency threshold, source node time threshold, destination node frequency threshold and destination node time threshold respectively; when S3 detects anomaly, according to the event type corresponding rule, the frequency score and time score of the corresponding node are selected to compare with the anomaly detection threshold respectively.

[0062] In a specific embodiment of the present invention, the behavior label score is obtained in the following manner: the frequency score b0 of the behavior label of the node that is first added to the traceability graph is assigned a value of 1. As the number of node appearances increases, the frequency score is gradually reduced according to a preset reduction rate. The specific reduction rate can be determined according to the actual situation. The time score depends on the user's setting of the normal usage time in a day (within 24 hours a day, the normal usage time range is set). Within the normal time range, the initial value is 1, otherwise, the time score is Among them, T0 represents the difference between the current usage time and the closest normal usage time, and T1 represents the abnormal usage time in a day.

[0063] When S3 detects anomalies, both the frequency score and the time score are compared with the anomaly threshold. As long as the frequency score is less than the corresponding threshold or the time score is less than the corresponding threshold, it is considered that the detection is abnormal. If there is no abnormality, set the alarm weight K = 1. If there is an abnormality, set the alarm weight Wherein, b is the sum of the frequency scores or time scores of the selected nodes that are less than the corresponding threshold, and t is the sum of the corresponding thresholds of the frequency scores or time scores of the selected nodes that are greater than the selected nodes.

[0064] In a specific embodiment of the present invention, the entity label score is obtained in the following manner: if the node already exists, the previous entity label score is directly inherited; if the node is added to the provenance graph for the first time, its entity label score is initialized. Specifically, for any node n∈N in the provenance graph, A stores its initial data label relative to its node characteristics. Node characteristics depend on the information granularity of the audit log, such as file path, process name, command line, IP address, port, etc. During training, initialization is performed with a conservative strategy. For example, we assign an initial integrity of 0 to all IP addresses so that we will not miss any attackers entering through network communications.

[0065] During S4 alarm detection, the entity label score of the detected node is multiplied by the alarm weight and then compared with the alarm threshold. The rules for alarm detection are shown in Table 2.

[0066] The present invention uses the above steps S1-S4 to perform attack detection. For the training process, the audit log training set is a fully benign audit log. An alarm is generated during the training process, indicating that a false alarm has occurred in the training process. After a false alarm is generated, optimization learning is started. Optimization learning specifically includes the gradient strategy optimization of step S5 and the back propagation optimization of S6. The present invention adopts the back propagation method, which is not limited to calculating the gradient back propagation optimization parameters according to the system generation results, and expands the scope of optimization. Back propagation is performed through the path stored in the node to optimize the parameters of the relevant nodes and edges. Therefore, the problem that the optimization scope in the prior art is too limited to the nodes and edges corresponding to the alarm event, and the overall detection accuracy of the system cannot be comprehensively improved, thereby reducing the false alarm rate, and significantly improving the system's responsiveness to complex attack scenarios, further improving the system efficiency. The present invention adopts the Adam optimization algorithm, and uses the algorithm to further optimize the calculated initial gradient, thereby overcoming the problem that the original Batch batch reduction is difficult to perfectly correspond to the number of events due to the fixed batch size. If the batch size is too small, it may be optimized before the detection is completed, resulting in the problem of inconsistent labels in a single traceability graph. At the same time, it can reach the optimal value faster and more accurately instead of updating the parameters directly according to the gradient.

[0067] In a specific embodiment of the present invention, the step S5 optimizes the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge generating the alarm based on the gradient strategy, and specifically includes the following steps:

[0068] 1) The audit log training set is a completely benign audit log. If an alarm is generated during the training process, it means that a false alarm has occurred during the training process;

[0069] At this time, let f(e) = tag rule -thr i Represents the entity tag score Tag selected by the event detection rule of edge e rule The alarm detection threshold thr stored by the edge i The difference,

[0070] Let L(e) = max(0,(1-f(e)) 2 -1), if L(e) is not 0, it means that the edge generates a false positive;

[0071] 2) Calculate the loss function:

[0072] Loss=∑ e∈E L(e)+α||A-A0||2+μ||B-B0||2+γ||G-G0||2+τ||T b -T b0 ||2+r||T-T0||2

[0073] Among them, α, μ, γ, τ, r are regularization coefficients, E represents the set of edges, A parameter represents the label entity score, B parameter represents the behavior label behavior score, G parameter represents the label propagation rate, T b represents the abnormal behavior detection threshold, T represents the alarm detection threshold, A0, B0, G0, T b0 , T0 represents the initial default value;

[0074] 3) For the parameters θ∈{A, B, G, T b , T}, the gradient is calculated as follows,

[0075] Where f represents f(e), a represents a specific parameter in θ, and a0 represents the initial default value of parameter a.

[0076] 4) Adam gradient optimization, the gradient of parameter θ

[0077] First moment:

[0078] Second moment:

[0079]

[0080] The parameter θ is finally modified:

[0081]

[0082] Among them, t represents the number of times, β1 and β2 are hyperparameters, represents the correction value, η represents the learning rate, and ε is a small value added to prevent division by zero. In a specific embodiment of the present invention, β1 = 0.9, β2 = 0.999, and ε takes a value of 10 -8 .

[0083] like Figure 4 As shown, in a specific embodiment of the present invention, the S6 performs reverse propagation optimization based on the path information stored in the node, optimizes the propagation rate, abnormal threshold, alarm threshold and entity label score on the path, and specifically includes the following steps:

[0084] 1) When an edge generates an alarm and completes gradient optimization, the path information is stored in the nodes connected by the edge, and the path information is propagated backwards;

[0085] 2) For the parameters θ involved in the path, according to the final gradient when the alarm edge is optimized Attenuation is performed according to the path, and each additional propagation is performed to optimize the gradient attenuation Gradient

[0086] 3) For a node with multiple sub-paths, the propagated gradient is additionally attenuated according to the number of sub-nodes n of the node Gradient

[0087] 4) Update parameters η represents the learning rate.

[0088] The detection module and the learning module repeat steps S1-S6 to continuously optimize and learn until the entire training optimization process is completed; after the optimization is completed, the obtained detection module can perform the detection task. The detection module is deployed in the actual detection scenario, and the audit log training set in step S1 is replaced by the audit log to be detected. The detection module can then execute steps S1-S4 for detection. Furthermore, if Figure 5 As shown, after the system is deployed and applied, the present invention can automatically divide the detection results into two categories: benign data and alarm data. Subsequently, by putting the benign data into the training mode, the system can re-learn the new data, and after the learning is completed, automatically update and replace the original detection module. Therefore, the present invention can effectively overcome the problem of decreased detection accuracy caused by concept drift in the prior art, while reducing the complexity of long-term system maintenance and the need for manual intervention, thereby realizing the automatic update of detection parameters and ensuring that the system maintains efficient response capabilities in the face of ever-changing security threats.

[0089] In summary, the present invention introduces an anomaly detection mechanism, adds behavior tags, and sets corresponding rules for them, taking into account abnormal situations during detection, and at the same time, expanding the types and rules of detection events. This overcomes the problem of the prior art that the false alarm rate increases due to the pursuit of reducing false alarms. This achieves a more reasonable detection result and a higher detection accuracy.

[0090] The above-mentioned embodiments only express several implementation methods of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A real-time attack detection method based on adaptive traceability graphs and gradient back propagation, characterized in that: The steps include: S1: Construct a traceability graph based on the input audit log training set; each node of the traceability graph has a behavior label and an entity label, and each edge of the traceability graph stores a source node ID, a destination node ID, an event type between two nodes, a propagation rate, an anomaly threshold, and an alarm threshold; S2: Entity tags are transferred based on event type and propagation rate. The event type determines the transfer path, the destination node in the path stores the path information, and the source node stores the number of its corresponding destination nodes. S3: For each edge, select the node to be detected for anomaly based on the event type stored on the edge, and perform anomaly detection on the behavior label score of the node based on the anomaly threshold; when an anomaly is detected, set an alarm weight to adjust the entity label score of the node during alarm detection; S4: For each edge, select the node to be detected based on the event type, and perform alarm detection on the entity label score of the node according to the alarm threshold; and issue an alarm for the edge with abnormalities; S5: Based on the gradient strategy, optimize the propagation rate of the edge that generates the alarm, the anomaly threshold, the alarm threshold, the behavior label score, and the entity label score; S6: Perform back propagation optimization based on the path information stored in the node to optimize the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edges on the path; S7: Repeat steps S1-S6 until the optimization is completed; after the optimization is completed, replace the audit log training set in step S1 with the audit log to be tested, and execute steps S1-S4 for testing.

2. The attack detection method according to claim 1, characterized in that: The audit log training set described in S1 is a completely benign audit log.

3. The attack detection method according to claim 1, characterized in that: In S1, the objects in the audit log are first identified, and if a new entity is identified, it is added to the provenance graph as a new node; The behavior label B of the node includes the frequency score b0 and the time score b1; for the data type node, the entity label A includes the confidentiality score c and the integrity score i; for the code type node, the entity label A only includes the integrity score i.

4. The attack detection method according to claim 1, characterized in that: The event type determines the transmission path, which represents the transmission direction of the data flow. During the transmission, the source node only transmits the entity label to the destination node, and at the same time, the propagation rate is controlled by the parameter G. Specifically, for any edge e in the traceability graph, a g is stored. e , according to the rules corresponding to the event type, the entity tag tag of the target node to be updated is given dest and the entity tag of the source node rule During tag propagation, tags are updated as follows dest : tag dest (new)=g e ×tag rule +(1–g e )×tag dest ; The path is stored in the updated node, the source node regards it as a child node, and the number of child nodes is recorded.

5. The attack detection method according to claim 3, characterized in that: The behavior label score is obtained in the following way: the frequency score b0 of the behavior label of the node added to the traceability graph for the first time is assigned to 1. As the number of node appearances increases, the frequency score is gradually reduced according to the preset reduction rate; the time score depends on the user's setting of the normal usage time of the day. Within the normal time range, the initial value is 1, otherwise, the time score is Among them, T0 represents the difference between the current usage time and the closest normal usage time, and T1 represents the abnormal usage time in a day; During S3 anomaly detection, both the frequency score and the time score are compared with the anomaly threshold. As long as the frequency score is less than the corresponding threshold or the time score is less than the corresponding threshold, the detection is considered to be abnormal.

6. The attack detection method according to claim 5, characterized in that: The alarm weight is set in the following way: First, for the edge of the traceability graph, set the anomaly detection threshold T b If the edge already has an anomaly detection threshold stored, it is directly read and used; otherwise, the anomaly detection threshold T is initialized and set b ={0.5,0.5,0.5,0.5}, T b The items in correspond to the source node frequency threshold, the source node time threshold, the destination node frequency threshold and the destination node time threshold respectively; When S3 detects anomalies, according to the event type corresponding rules, the frequency score and time score of the corresponding node are selected and compared with the anomaly detection threshold. If there is no anomaly, the alarm weight K=1 is set; if there is an anomaly, the alarm weight is set. Wherein, b is the sum of the frequency scores or time scores of the selected nodes that are less than the corresponding threshold, and t is the sum of the corresponding thresholds of the frequency scores or time scores of the selected nodes that are greater than the selected nodes.

7. The attack detection method according to claim 3, characterized in that: The entity label score is obtained in the following way: if the node already exists, the previous entity label score is directly inherited; if the node is added to the traceability graph for the first time, its entity label score is initialized; During S4 alarm detection, the entity label score of the detected node is multiplied by the alarm weight and then compared with the alarm threshold.

8. The attack detection method according to claim 1, characterized in that: The gradient strategy is used to optimize the propagation rate of the edge generating the alarm, the anomaly threshold, the alarm threshold, the behavior label score, and the entity label score, and specifically includes the following steps: 1) The audit log training set is a completely benign audit log. If an alarm is generated during the training process, it means that a false alarm has occurred during the training process; At this time, let f(e) = tag rule -thr i Represents the entity tag score Tag selected by the event detection rule of edge e rule The alarm detection threshold thr stored by the edge i The difference, Let L(e) = max(0,(1-f(e)) 2 -1), if L(e) is not 0, it means that the edge generates a false positive; 2) Calculate the loss function: Loss=∑ e∈E L(e)+α||A-A0||2+μ||B-B0||2+γ||G-G0||2+τ||T b -T b0 ||2+r||T-T0||2 Among them, α, μ, γ, τ, r are regularization coefficients, E represents the set of edges, A parameter represents the label entity score, B parameter represents the behavior label behavior score, G parameter represents the label propagation rate, T b represents the abnormal behavior detection threshold, T represents the alarm detection threshold, A0, B0, G0, T b0 , T0 represents the initial default value; 3) For the parameters θ∈{A, B, G, T b , T}, the gradient is calculated as follows, Where f represents f(e), a represents a specific parameter in θ, and a0 represents the initial default value of parameter a. 4) Adam gradient optimization, the gradient of parameter θ Recorded as First moment: Second order moment: The parameter θ is finally modified: Among them, t represents the number of times, β1 and β2 are hyperparameters, represents the correction value, η represents the learning rate, and ε is the value added to prevent division by zero.

9. The attack detection method according to claim 8, characterized in that: The reverse propagation optimization is performed based on the path information stored in the node to optimize the propagation rate, abnormal threshold, alarm threshold and entity label score on the path, which specifically includes the following steps: 1) When an edge generates an alarm and completes gradient optimization, the path information is stored in the nodes connected by the edge, and the path information is propagated backwards; 2) For the parameters θ involved in the path, according to the final gradient when the alarm edge is optimized Attenuation is performed according to the path, and each additional propagation is performed to optimize the gradient attenuation Gradient 3) For a node with multiple sub-paths, the propagated gradient is additionally attenuated according to the number of sub-nodes n of the node Gradient 4) Update parameters η represents the learning rate.

10. A method for implementing the method of claim 1 based on label and gradient back propagation adaptive provenance graph real-time attack detection, characterized in that: Includes detection module and learning module; The detection module is used to perform attack detection on the input audit log to be detected, which includes: A traceability graph construction unit is used to construct a traceability graph according to the audit log; each node of the traceability graph has a behavior label and an entity label, and each edge of the traceability graph stores a source node ID, a destination node ID, an event type between two nodes, a propagation rate, an abnormal threshold, and an alarm threshold; An entity label transmission unit is used to transmit the entity label according to the event type and the propagation rate; wherein the event type determines the transmission path, the destination node in the transmission path stores the path information, and the source node stores the number of its destination nodes; The anomaly detection unit is used to select the node to be detected according to the event type stored on each edge, and perform anomaly detection on the behavior label score of the node according to the anomaly threshold; when an anomaly is detected, an alarm weight is set to adjust the entity label score of the node during alarm detection; The alarm detection unit selects the node to be detected according to the event type for each edge, and performs alarm detection on the entity label score of the node according to the alarm threshold; and issues an alarm for the edge with abnormality; The learning module is used to train and optimize the detection module; the learning module optimizes the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge that generates the alarm based on the gradient strategy; and further performs back propagation optimization based on the path information stored in the node to optimize the propagation rate, anomaly threshold, alarm threshold, behavior label score, and entity label score of the edge that generates the alarm.

Images