A causal reasoning-based APT kill chain reconstruction and prediction method and system

Abstract

The present invention relates to the technical field of APT kill chain reconstruction and prediction methods, and provides an APT kill chain reconstruction and prediction method and system based on causal reasoning. The method aims to address the problems existing in existing APT detection and defense technologies, such as difficulty integrating multi-source heterogeneous data, insufficient spatiotemporal dynamic feature modeling, inaccurate kill chain reconstruction, limited predictive capabilities, poor interpretability, and difficulty balancing real-time and accuracy. The method comprises acquiring multi-source heterogeneous data, constructing a causal graph, performing multimodal feature extraction based on the causal graph to obtain initial node feature representations; inputting the initial node feature representations into a temporal causal graph convolutional learning algorithm to obtain optimized node representations; performing kill chain reconstruction based on the optimized node representations to obtain possible kill chain sequences; predicting future attack paths based on the possible kill chain sequences to obtain potential attack paths; and generating an interpretable analysis report based on the potential attack paths.

Description

Technical Field

[0001] The present invention relates to the technical field of APT kill chain reconstruction and prediction methods, and in particular to an APT kill chain reconstruction and prediction method and system based on causal reasoning. Background Art

[0002] Advanced Persistent Threats (APTs), complex, long-term, and highly targeted cyberattacks, have become one of the most severe challenges in the current cybersecurity field. With the rapid development of information technology and the deepening of digital transformation, the frequency and sophistication of APT attacks are increasing, especially against high-value targets such as finance, government, and critical infrastructure.

[0003] Existing APT detection and defense technologies can be mainly divided into the following categories:

[0004] 1. Rule-based detection systems: This is the most traditional approach, identifying potential threats through predefined rule sets. For example, open-source intrusion detection systems such as Snort and Suricata fall into this category. However, this approach faces serious limitations:

[0005] a) It is difficult to deal with unknown attack patterns;

[0006] b) The cost of rule maintenance is high and updates are not timely;

[0007] c) Easily circumvented by attackers;

[0008] d) The false positive rate is high, which places a huge burden on security analysts.

[0009] 2. Machine Learning-Based Anomaly Detection: In recent years, researchers have begun experimenting with using machine learning techniques to detect network anomalies. For example, clustering algorithms or anomaly detection algorithms such as Isolation Forest are used to identify abnormal traffic. While these methods offer some improvements over rule-based approaches, they still face the following challenges:

[0010] a) It is difficult to capture the temporal sequence and causal relationship of attacks;

[0011] b) Sensitive to changes in normal behavior and prone to false alarms;

[0012] c) Lack of understanding and ability to reconstruct the overall kill chain.

[0013] 3. Deep Learning Methods: With the development of deep learning technology, some studies have begun to apply convolutional neural networks (CNNs) and recurrent neural networks (RNNs) to APT detection. For example, some studies use LSTM networks to perform sequence analysis on network traffic. These methods have made breakthroughs in processing high-dimensional data and capturing long-term dependencies, but some key issues remain:

[0014] a) It is difficult to effectively integrate multi-source heterogeneous data;

[0015] b) Lack of consideration of network topology;

[0016] c) The model has poor interpretability and is difficult for security experts to trust and adopt;

[0017] d) The computational complexity is high and it is difficult to meet the needs of real-time detection.

[0018] 4. Graph Neural Network Methods: Graph Neural Networks (GNNs) have recently attracted attention due to their ability to naturally process network-structured data. Some studies have attempted to use graph convolutional networks (GCNs) to analyze cybersecurity incidents. However, these methods still have the following shortcomings:

[0019] a) It is difficult to effectively handle dynamically changing network structures;

[0020] b) Limited ability to model long-term kill chains;

[0021] c) The lack of explicit modeling of causal relationships hinders the understanding of attack intent;

[0022] d) It is difficult to accurately predict future attack paths.

[0023] In summary, existing technologies face the following major technical challenges when dealing with APT attacks:

[0024] 1. It is difficult to effectively integrate and utilize multi-source heterogeneous data;

[0025] 2. Lack of comprehensive modeling of the spatiotemporal dynamic evolution of attacks;

[0026] 3. Unable to accurately reconstruct the complete kill chain;

[0027] 4. Limited predictive capabilities, making it difficult to support active defense;

[0028] 5. Poor interpretability and difficulty in combining with human expert knowledge;

[0029] 6. It is difficult to achieve both real-time and accuracy, especially in large-scale network environments.

[0030] These problems severely restrict the effectiveness of existing APT defense systems, leaving many high-value targets facing significant security risks. Therefore, developing new APT detection and defense methods that can comprehensively address these issues has important theoretical significance and practical application value. Summary of the Invention

[0031] The causal reasoning-based APT kill chain reconstruction and prediction method proposed in this paper is designed to address these technical issues. This method combines the latest deep learning, graph learning, and causal reasoning techniques to propose an innovative quantum-inspired spatiotemporal causal attention graph convolutional network (QISCA-GCN) algorithm, enabling efficient detection, precise reconstruction, and accurate prediction of APT attacks.

[0032] The present invention provides an APT kill chain reconstruction and prediction method based on causal reasoning, comprising the following steps:

[0033] Acquire multi-source heterogeneous data, and perform data preprocessing and causal graph construction based on the multi-source heterogeneous data to obtain an initial causal graph;

[0034] Performing multimodal feature extraction based on the initial causal graph to obtain initial feature representation of nodes;

[0035] Inputting the initial feature representation of the node into a temporal causal graph convolutional learning algorithm to obtain an optimized node representation;

[0036] Performing kill chain reconstruction based on the optimized node representation to obtain a possible kill chain sequence;

[0037] Predicting future attack paths based on the possible kill chain sequence to obtain potential attack paths;

[0038] Generate an explainability analysis report based on the potential attack path; and perform model updating and optimization according to the explainability analysis report to optimize the initial causal graph, and return to perform data preprocessing and causal graph construction steps to form a closed-loop iteration.

[0039] Specifically, the temporal causal graph convolution learning algorithm is a quantum-inspired spatiotemporal causal attention graph convolutional network, which includes the following steps:

[0040] (a) Initialize the node quantum state vector |ψ i >

[0041] (b) Perform T iterations:

[0042] (b1) Based on the node quantum state vector |ψ i >Calculate quantum measurement and get node feature h i ; (b2) According to the node feature hi Update the edge weight w ij ;

[0043] (b3) Calculate the multi-scale attention a based on the edge weight w ij ; ij ;

[0044] (b4) Update the node representation h using the multi-scale attention a ij '; i ;

[0045] (b5) Update the quantum state |ψ based on the updated node representation h' i >; i >;

[0046] (c) Output the final node representation h i , where |ψ i > represents the quantum state of node v i , h i represents the feature representation of node v i , w ij represents the edge weight between node v i and v j , a ij represents the attention weight of node v i to v j , and T represents the number of iterations.

[0047] Specifically, the quantum measurement process in step (b1) is as follows:

[0048]

[0049] where M = ∑ k λ k |k><k| is the quantum measurement operator, λ k is a learnable parameter, p ij is the probability distribution of node v i in the j-th modality, <j|k> is the inner product, and is obtained as follows:

[0050] <j|k> = softmax(q T ·tanh(W·[x ij ||x ik + b))

[0051] where q, W, and b are learnable parameters. Specifically, W represents the weight matrix, b represents the bias term, x i j and x ik are the features of node v i in the j-th and k-th modalities respectively, and || represents the concatenation operation, which concatenates two feature vectors into a longer feature vector.

[0052] Specifically, the edge weight updating process in step (b2) is as follows:

[0053]

[0054] w ij =g ij w ij +(1-g ij )·F(w ij )

[0055] Among them, g ij is the update gate, σ is the sigmoid function, W g and b g is a learnable parameter, specifically W g represents the weight matrix, b g represents the bias term, Δt ij is the time interval, Δs ij is the spatial distance, D is the learnable fractal dimension, F(x) is the chaotic mapping function, defined as F(x) = rx(1-x), and r is a learnable parameter.

[0056] Specifically, the multi-scale attention calculation process in step (b3) is as follows:

[0057]

[0058] a ij =softmax(∑ l α l ·K l (i,j))

[0059] Among them, K l (i, j) is the multi-scale causal kernel, σ l is the kernel width of the lth scale, m ij is a mask based on causal structure, α l is the learnable scale weight.

[0060] Specifically, the node representation update process in step (b4) is as follows:

[0061]

[0062] Where W and b are learnable parameters, and R(x) is the residual function, defined as:

[0063] R(x)=W r x+b r , W r and b r are learnable parameters.

[0064] Specifically, the kill chain reconstruction step includes:

[0065] Using an improved Kahn algorithm to perform topological sorting on the optimized node representation to obtain a preliminary attack sequence;

[0066] Applying a beam search algorithm based on the preliminary attack sequence to obtain multiple candidate kill chains;

[0067] The multiple candidate kill chains are evaluated using a conditional random field model to obtain a final kill chain and its confidence level.

[0068] The Kahn algorithm implementation logic includes the following steps: First, during the initialization process, an empty queue Q is created to store nodes with in-degree 0, and an empty list L is created to store the final topological sorting result, and the initial in-degree and importance score I(v) of each node are calculated;

[0069] Calculate the priority P(v) of each node v using the formula:

[0070] P(v)=∑(w uv I(u))

[0071] Where u is all the incoming edge nodes of v, w_uv is the weight of the edge (u, v);

[0072] Then, add all nodes with in-degree 0 to the queue Q and sort them in descending order of P(v). In the main loop, when Q is not empty, take the node n with the highest priority from Q and add n to the result list L. For each node m adjacent to n, reduce m's in-degree and update its priority P(m). If m's in-degree becomes 0, add it to Q and keep Q sorted in descending order of P(v).

[0073] Finally, check whether there is a ring. If the number of nodes in L is less than the total number of nodes in the graph, report that there is a ring in the graph and return the topological sort result L.

[0074] Specifically, the future attack path prediction step includes:

[0075] Based on the possible kill chain sequence, an LSTM encoder with an attention mechanism is used to generate a state representation.

[0076] Based on the state representation, define the hierarchical softmax action space;

[0077] Based on the action space, a Monte Carlo tree search algorithm is applied to perform path prediction to obtain potential attack paths.

[0078] Specifically, the model updating and optimization steps include:

[0079] Perform incremental learning based on the sliding window strategy to update model parameters;

[0080] Use the improved Peter-Clark algorithm to update the causal graph structure;

[0081] Apply Bayesian optimization algorithm for hyperparameter optimization;

[0082] Model compression is performed through knowledge distillation technology to obtain an optimized lightweight model.

[0083] APT kill chain reconstruction and prediction system based on causal reasoning, including:

[0084] Data preprocessing and causal graph construction module, used to obtain multi-source heterogeneous data and perform data preprocessing and causal graph construction;

[0085] A multimodal feature extraction module, configured to extract multimodal features based on the output of the data preprocessing and causal graph construction module;

[0086] A temporal causal graph convolution learning module, configured to apply a temporal causal graph convolution learning algorithm to the output of the multimodal feature extraction module;

[0087] a kill chain reconstruction module, configured to perform kill chain reconstruction based on the output of the temporal causal graph convolutional learning module;

[0088] a future attack path prediction module, configured to predict future attack paths based on the output of the kill chain reconstruction module;

[0089] an explainability analysis module for generating an explainability analysis based on the output of the future attack path prediction module; and

[0090] The model updating and optimization module is used to perform model updating and optimization according to the output of the explainability analysis module, and feed back the optimization results to the data preprocessing and causal graph construction module.

[0091] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0092] 1. Highly integrated multi-source heterogeneous data: Through multimodal feature extraction steps, it effectively integrates multiple data sources such as network logs, system events, and user behaviors, improving the ability to identify complex attack behaviors.

[0093] 2. Accurately modeling spatiotemporal dynamic features: The QISCA-GCN algorithm innovatively combines quantum computing ideas and graph neural networks, effectively capturing the spatiotemporal dynamic evolution of network attacks and significantly improving the ability to model long-term and complex APT attacks.

[0094] 3. Accurately reconstruct the kill chain: By combining causal reasoning and graph structure learning, the system can more comprehensively capture all stages of the attack and achieve high-precision reconstruction of the complete kill chain.

[0095] 4. Powerful predictive capabilities: Based on the reconstructed kill chain and learned attack patterns, the system can accurately predict possible future attack paths, providing strong support for proactive defense.

[0096] 5. High interpretability: Through local and global interpretability analysis, the system can provide security analysts with clear decision-making basis and promote human-machine collaboration.

[0097] 6. Superior real-time performance: Thanks to optimized algorithm design and high-performance hardware support, the system can achieve rapid response in large-scale network environments, with an average response time significantly better than existing methods.

[0098] 7. Low false alarm rate: The method of integrating causal reasoning and deep learning effectively reduces false alarms and improves the practicality and reliability of the system.

[0099] 8. Adaptive learning capability: Through continuous model updates and optimization, the system can continuously adapt to new attack patterns and changes in the network environment, maintaining long-term effectiveness.

[0100] 9. Support proactive defense: Predictive analysis capabilities provide security teams with the possibility of proactive defense, shifting from passive response to proactive prevention.

[0101] 10. Universal Applicability: Although the system excels in protecting high-value targets such as financial institutions, its design principles make it equally applicable to network environments of various sizes and types.

[0102] In summary, this invention provides a comprehensive, efficient, and explainable APT attack defense solution, significantly improving the detection, analysis, and prevention capabilities of complex network threats, and bringing revolutionary progress to the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0103] Figure 1 This is a flow chart of the APT kill chain reconstruction and prediction method based on causal reasoning of the present invention.

[0104] Figure 2 This is a flow chart of the temporal causal graph convolution learning steps of the present invention.

[0105] Figure 3 This is a schematic diagram of the APT kill chain reconstruction and prediction system framework based on causal reasoning of the present invention. DETAILED DESCRIPTION

[0106] To further illustrate the technical means and effects employed by the present invention to achieve its intended objectives, the following detailed description, along with the accompanying drawings and preferred embodiments, includes a detailed description of the specific implementations, structures, features, and effects thereof. In the following description, references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0107] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0108] The present invention provides a causal reasoning-based APT kill chain reconstruction and prediction method and system, which is particularly suitable for large-scale enterprise network security defense scenarios. In this scenario, enterprises face complex and changing network threats, especially advanced persistent threats (APTs). These APT attacks are usually long-lasting and highly concealed, posing a huge challenge to traditional security defense measures. The present invention aims to provide a method and system that can effectively reconstruct the kill chain and predict future attack paths through the combination of deep learning and causal reasoning.

[0109] The technical solution of the present invention is clearly and completely described below in conjunction with specific implementation methods.

[0110] Please refer to Figure 1 The APT kill chain reconstruction and prediction method based on causal reasoning includes the following steps:

[0111] 1. Data preprocessing and causal graph construction. In this step, the system first acquires heterogeneous data from multiple sources, including but not limited to network logs, system events, and user behavior data. For example, a large financial institution uses Zeek Network Security Monitor to collect communication data from all layers of the TCP / IP protocol stack, collects system-level events through Windows event logs and Linux syslog, and uses a custom user behavior monitoring agent to record employee keyboard input and mouse clicks.

[0112] Data preprocessing includes the following sub-steps:

[0113] a) Remove duplicate records: Use MD5 hash to generate a unique identifier for each record and remove duplicates.

[0114] b) Outlier handling: The IsolationForest algorithm is used to detect and mark outliers. The key parameters of this algorithm include the sample size (usually set to 256) and the contamination factor (usually set to 0.1).

[0115] c) Missing value filling: For time series data, use the forward filling method; for categorical data, use the mode filling method.

[0116] The process of constructing a causal diagram is as follows:

[0117] a) Node definition: Each event is a node, and its attributes include {event ID, timestamp, event type, source IP, destination IP, port, protocol}.

[0118] b) Edge definition: If two events meet one of the following conditions, a directed edge is added:

[0119] 1) They are adjacent in time (time interval is less than 5 minutes) and have the same IP address;

[0120] 2) Comply with predefined attack pattern rules (such as a port scan followed by a vulnerability exploit attempt);

[0121] c) Use the Peter-Clark algorithm (PC algorithm) to preliminarily estimate the causal structure. Key parameters of the PC algorithm include the significance level (usually set to 0.05) and the maximum condition set size (usually set to 3).

[0122] 2. Multimodal feature extraction step: Based on the initial causal graph, this step extracts features from different types of data:

[0123] a) Text Data Processing: We use the BERT-base-uncased model (768-dimensional output) to extract text features. For texts longer than 512 tokens, we use a segmentation and average pooling strategy.

[0124] b) Numerical Data Processing: Design a 5-layer stacked denoising autoencoder (SDAE) with the structure [input_dim, 256, 128, 64, 32]. Use mean squared error (MSE) as the reconstruction loss and the Adam optimizer for training. Set the learning rate to 0.001 and the batch size to 64.

[0125] c) Time series data processing: Design a bidirectional LSTM network with a hidden layer size of 128 and a 2-layer structure. Use the hidden state of the last time step as the feature representation.

[0126] d) Feature fusion: Map the features of each modality to the same dimension (256 dimensions) through a fully connected layer. Use the attention mechanism for weighted summation:

[0127] F=∑(α i FC i (fi i ))

[0128] where α i is the attention weight, FC i is the fully connected layer, and fi i are the features of each modality.

[0129] 3. Please refer to Figure 2 , the steps of temporal causal graph convolution learning. This step applies the quantum-inspired spatio-temporal causal attention graph convolution network (QISCA-GCN) algorithm, including the following sub-steps:

[0130] a) Initialize the node quantum state vector |ψ i >:

[0131]

[0132] where p ij is the probability distribution of node v i in the j-th modality, and |j> is the basis vector.

[0133] b) Perform T iterations (usually T is set to 10):

[0134] b1) Quantum measurement process:

[0135]

[0136] where M = Σ k λ k |k><k| is the quantum measurement operator, and λ k is the learnable parameter.

[0137] <j|k> = softmax(q T ·tanh(W·[x ij ||x ik +b))

[0138] q, W, b are learnable parameters, x i h and x ik are the features of the j-th and k-th modalities of node v i .

[0139] b2) Edge weight update:

[0140]

[0141] w ij = g ij ·w ij + (1 - g ij )·F(w ij )

[0142] where g ij is the update gate, σ is the sigmoid function, Wg and b g is a learnable parameter, Δt ij is the time interval, Δs ij is the spatial distance (e.g., the Hamming distance of IP addresses), D is the learnable fractal dimension (initial value is set to 1.5), F(x) is the logistic mapping function: F(x) = rx(1-x), and r is a learnable parameter (initial value is set to 3.8).

[0143] b3) Multi-scale attention calculation:

[0144]

[0145] a ij =softmax(∑ l α l ·K l (i,j))

[0146] Among them, K l (i,j) is the multi-scale causal kernel, σ l is the kernel width of the lth scale (usually using [0.1, 1, 10] three scales), m ij is a mask based on causal structure, α l is the learnable scale weight.

[0147] b4) Node representation update:

[0148] h′ i =∑ j a ij ·(W·h j +b)+R(h i )

[0149] Among them, W and b are learnable parameters, and R(x) is the residual function, defined as R(x) = W r x+b r , W r and b r are learnable parameters.

[0150] b5) Update the quantum state:

[0151] |ψ i >=N(h i i ), where N is the normalization function.

[0152] c) Output the final node representation h i .

[0153] The quantum-inspired spatiotemporal causal attention graph convolutional network (QISCA-GCN) is the core innovation of this invention and solves multiple technical problems. First, in terms of multi-source heterogeneous data integration, QISCA-GCN uses quantum state representation |ψ i >Fusing multimodal information, using quantum measurement process h i =<ψ i |M|ψ i > Achieve unified representation of heterogeneous data, thereby significantly improving the ability to identify complex attack behaviors and reducing the complexity of data preprocessing. Secondly, in terms of spatiotemporal dynamic feature modeling, by introducing the edge weight update mechanism g ij and multi-scale causal kernel K l (i,j), combined with the time interval Δt ij and spatial distance Δs ij , accurately modeling the spatiotemporal dynamic characteristics of APT attacks, and improving the detection capabilities of long-term and complex attacks. In addition, through the multi-scale attention mechanism ij =softmax(∑α l ·K l (i, j)), QISCA-GCN effectively captures long-range dependencies, significantly improving the ability to understand and reconstruct complex attack chains spanning long periods of time. Its quantum measurement process and attention mechanism enhance the visualization and explanation of model decisions, improving credibility. At the same time, the quantum-inspired algorithm design provides the possibility of parallel computing, and the iterative update mechanism improves computational efficiency, making it suitable for large-scale network environments. Dynamic edge weight update w ij =g ij w ij +(1-g ij )·F(w ij ) enhances the model's adaptability to changes in the network environment and improves its long-term effectiveness. The QISCA-GCN algorithm effectively addresses several key technical challenges in APT attack detection by innovatively combining quantum computing, graph neural networks, and causal reasoning. This not only improves detection accuracy and comprehensiveness, but also enhances the model's interpretability and adaptability. This provides a new paradigm for APT attack defense and has the potential to significantly enhance the overall level of network security protection.

[0154] 4. Kill chain reconstruction step. Based on the optimized node representation, this step performs kill chain reconstruction:

[0155] a) Use the improved Kahn algorithm for topological sorting: Define node priority: P(v i )=Σ j w ij ·I(v j )where I(v j ) is the node vj The importance score of a page is calculated using the PageRank algorithm.

[0156] The improved Kahn algorithm is designed to take into account edge weights and node importance to better meet the needs of APT attack chain reconstruction. Its implementation logic includes the following steps: First, during the initialization process, an empty queue Q is created to store nodes with an in-degree of 0, and an empty list L is created to store the final topological sorting results. The initial in-degree and importance score I(v) of each node are calculated (such as using the PageRank algorithm). Next, the priority P(v) of each node v is calculated using the formula:

[0157] P(v)=∑(w uv I(u))

[0158] Where u represents all the incoming nodes of v, and w_uv is the weight of the edge (u, v). Then, all nodes with an in-degree of 0 are added to the queue Q and sorted in descending order by P(v). In the main loop, when Q is not empty, the node n with the highest priority is taken from Q and added to the result list L. For each node m adjacent to n, the in-degree of m is reduced and its priority P(m) is updated. If the in-degree of m becomes 0, it is added to Q and Q is kept sorted in descending order by P(v). Finally, check whether there is a loop. If the number of nodes in L is less than the total number of nodes in the graph, report that there is a loop in the graph. Return the topological sorting result L. By considering node importance and edge weights, this improved Kahn algorithm can better reflect the actual order and importance of APT attacks and improve the accuracy of attack chain reconstruction.

[0159] b) Apply the beam search algorithm to generate kill chains: use a search width k = 5 and a maximum depth of 20. At each step, retain the k partial sequences with the highest scores.

[0160] c) Calculate the kill chain confidence using the Conditional Random Field (CRF) model: For a kill chain C = {v1, v2, ..., v n},, define confidence: Conf(C) = Π i P(v i |v1,…,v i-1 ) uses the forward-backward algorithm to calculate the conditional probability.

[0161] 5. Future attack path prediction step: Based on the reconstructed kill chain sequence, this step predicts the future attack path:

[0162] a) Using the LSTM encoder with attention mechanism to generate state representation: s t =LSTM att (E)

[0163] Where E={e1,e2,…,et} is the observed event sequence.

[0164] b) Define the action space of hierarchical softmax:

[0165] P(a t )=P(type t )·P(target t |type t )

[0166] Where type t For attack type, target t As the target of attack.

[0167] c) Apply Monte Carlo Tree Search (MCTS) algorithm for path prediction:

[0168] Use the UCT (UpperConfidenceBoundforTrees) algorithm for node selection:

[0169]

[0170] where Q(s,a) is the state-action value function, N(s) is the number of visits to state s, N(s,a) is the number of visits to a state-action pair, and c is the exploration constant (usually set to ).

[0171] Each simulation is performed for 1000 iterations, and the child node with the most visits is selected as the prediction result.

[0172] 6. Explainability analysis step: Based on the predicted attack path, this step generates an explainability analysis report:

[0173] a) Local interpretability: SHAP (SHapley Additive exPlanations) values are used to calculate feature importance. For each prediction decision, the top 5 most important features and their contribution values are generated.

[0174] b) Global Interpretability: We construct a decision tree to approximate the behavior of the QISCA-GCN model using the CART algorithm with a maximum depth of 5 and a minimum number of leaf node samples of 10.

[0175] c) Visualization: Use the force-directed graph algorithm to display the causal graph structure, with edge thickness representing weight. Use a heat map to display the distribution of attention weights.

[0176] 7. Model update and optimization step. According to the interpretability analysis report, this step performs model update and optimization:

[0177] a) Incremental learning: We use a sliding window strategy, retaining the most recent 30 days of data at a time. We update the model every 24 hours, using the Adam optimizer with a learning rate of 0.001.

[0178] b) Causal structure update: Re-evaluate the causal graph structure weekly, using the improved PC algorithm. Introduce the L1 regularization term to encourage sparse structure: L = L original +λ·||W||1, where λ is the regularization coefficient, usually set to 0.01.

[0179] c) Hyperparameter Optimization: We use a Bayesian optimization algorithm to automatically adjust hyperparameters. The optimization objective is to maximize the weighted sum of the F1 score and minimize the false alarm rate. We use a Gaussian process as the surrogate model and the expected improvement (EI) as the acquisition function.

[0180] d) Model Compression: Using knowledge distillation, we transfer knowledge from the large model (teacher model) to the small model (student model). The teacher model is a full QISCA-GCN, and the student model is a lightweight GCN. The distillation temperature is typically set between 2 and 4.

[0181] Through the above steps, the method of the present invention can effectively reconstruct the APT kill chain and accurately predict possible future attack paths. For example, in actual application at a financial institution, this method successfully detected and prevented a highly complex APT attack involving multiple stages, including initial intrusion, lateral movement, and data theft. The system not only accurately reconstructed the kill chain but also predicted the attacker's likely next move, enabling the security team to take proactive defensive measures.

[0182] Please refer to Figure 3 ,The APT kill chain reconstruction and prediction system of the ,present invention consists of seven core modules, which are tightly ,integrated at the software level and supported by high-performance ,hardware.

[0183] The data preprocessing and causal graph construction module 1 uses Apache Spark for distributed data processing and the Neo4j graph database to store the causal graph; it utilizes the multi-core parallel processing capabilities of the Intel Xeon CPU; and is used to perform multimodal feature extraction based on the output of the data preprocessing and causal graph construction module;

[0184] The multimodal feature extraction module 2 uses the PyTorch framework to implement the BERT, SDAE and LSTM models; the NVIDIA A100 GPU is used to accelerate deep learning model training and inference; and is used to perform multimodal feature extraction based on the output of the data preprocessing and causal graph construction modules.

[0185] The temporal causal graph convolution learning module 3 uses a custom PyTorch geometry library to implement the QISCA-GCN algorithm. It mainly relies on the GPU for large-scale matrix operations to apply the temporal causal graph convolution learning algorithm to the output of the multimodal feature extraction module.

[0186] Kill chain reconstruction module 4 uses the NetworkX library to implement graph algorithms and scikit-learn to implement the CRF model. It primarily relies on the CPU for graph traversal and probability calculations, and is used to perform kill chain reconstruction based on the output of the temporal causal graph convolutional learning module.

[0187] The future attack path prediction module 5 uses TensorFlow to implement the LSTM encoder and a custom Python library to implement the MCTS algorithm. The GPU is used for LSTM calculations and the CPU is used for MCTS search. It is used to predict future attack paths based on the output of the kill chain reconstruction module.

[0188] The interpretability analysis module 6 uses the SHAP library to calculate feature importance and the Graphviz library for visualization. It mainly relies on the CPU for analysis and rendering, and is used to generate interpretability analysis based on the output of the future attack path prediction module.

[0189] The model update and optimization module 7 uses the Ray library for distributed hyperparameter optimization and PyTorch for knowledge distillation. Distributed computing fully utilizes multi-core CPU and multi-GPU resources to perform model updates and optimization based on the output of the interpretability analysis module and feed the optimization results back to the data preprocessing and causal graph construction module.

[0190] The system workflow is as follows:

[0191] 1. Data is input into the system through a high-speed network interface and stored in a distributed file system after preprocessing.

[0192] 2. Feature extraction and graph learning processes are executed in parallel on a GPU cluster.

[0193] 3. Kill chain reconstruction and path prediction are performed in a CPU-GPU hybrid environment.

[0194] 4. The analysis results are transmitted to the display terminal of the security operation center via a high-bandwidth network.

[0195] 5. The model update process continues in the background, utilizing idle computing resources.

[0196] In order to verify the superiority of the present invention, we conducted a series of comparative experiments. The following is a detailed comparison of Example 1 of the present invention and three comparative examples:

[0197] Example 1: Complete implementation of the present invention

[0198] Comparative Example 1: Traditional rule-based APT detection system

[0199] Comparative Example 2: APT Detection System Using Ordinary GCN

[0200] Comparative Example 3: APT Detection System Using LSTM

[0201] Test environment: A real network environment of a large financial institution, consisting of 10,000 nodes, with an observation period of 3 months.

[0202] Test indicators:

[0203] 1. Attack Detection Accuracy (ACC): Number of correctly identified attack events / total number of events

[0204] 2. Kill Chain Reconstruction Completeness (CR): Number of correctly reconstructed attack steps / Total number of actual attack steps

[0205] 3. Future Attack Prediction Accuracy (PAC): Number of correctly predicted future attack steps / Total number of predicted steps

[0206] 4. Average Response Time (ART): The average time (in minutes) from the start of an attack to the system sending an alert

[0207] 5. False Positive Rate (FPR): Number of false positive attack events / total number of alarm events

[0208] Detection method:

[0209] ACC and FPR: Attack incidents reported through the manual review system

[0210] CR: Comparison with the kill chain manually analyzed by security experts

[0211] PAC: Record system predictions and verify them during a subsequent observation period

[0212] ART: Record timestamps in system logs

[0213] The test results are shown in the following table:

[0214] index Example 1 Comparative Example 1 Comparative Example 2 Comparative Example 3 ACC 95.8％ 78.3％ 86.5％ 84.2％ CR 92.7％ 61.4％ 79.1％ 73.6％ PAC 88.5％ not applicable 72.3％ 76.8％ ART 12.3 47.6 25.8 31.2 FPR 3.2％ 15.7％ 8.9％ 10.3％

[0215] As can be seen from the test results in the table, Example 1 demonstrates the significant advantages of the present invention:

[0216] 1. The attack detection accuracy (95.8%) is much higher than other methods, thanks to the QISCA-GCN algorithm's effective integration of multimodal data and full utilization of spatiotemporal features.

[0217] 2. The high score of kill chain reconstruction completeness (92.7%) shows that the present invention is able to capture all stages of the attack more comprehensively, thanks to the combination of causal reasoning and graph structure learning.

[0218] 3. The accuracy of future attack prediction (88.5%) shows the powerful ability of this system in predictive defense, which is not available in traditional methods.

[0219] 4. The average response time (12.3 minutes) is significantly ahead of other methods, reflecting the real-time advantage of this system, which is crucial for preventing APT attacks in a timely manner.

[0220] 5. The low false positive rate (3.2%) shows that the system can effectively distinguish between normal activities and malicious behaviors, reducing the workload of the security team.

[0221] The above test results are analyzed as follows:

[0222] 1. Compared to Comparative Example 1 (traditional rule-based system), the present invention significantly improves all metrics, particularly kill chain reconstruction and response time. This demonstrates the significant advantages of machine learning-based approaches in handling complex and dynamic APT attacks.

[0223] 2. Compared with Comparative Example 2 (the conventional GCN system), the present invention has an improvement of about 10% in accuracy and completeness. This demonstrates the superiority of the QISCA-GCN algorithm in processing time series data and capturing long-term dependencies.

[0224] 3. Comparative Example 3 (LSTM system) performs well in terms of prediction accuracy, but is significantly inferior to the present invention in terms of kill chain reconstruction. This demonstrates that pure sequence models have difficulty capturing the complex spatial relationships in cyberattacks.

[0225] 4. The significant reduction in false alarm rate achieved by the present invention (reduced by more than 50% compared to other methods) shows that the integration of causal reasoning and deep learning can effectively reduce false alarms and improve the practicality of the system.

[0226] These test results fully demonstrate the comprehensive advantages of this invention in APT attack detection, reconstruction, and prediction. The system demonstrates exceptional performance, particularly when handling complex, long-term kill chains. Its low false alarm rate and rapid response time make it ideal for deployment in large-scale, high-value network environments. The addition of future attack prediction capabilities further strengthens active defense strategies. These advantages, derived from the invention's unique QISCA-GCN algorithm, multimodal data fusion method, and application of causal reasoning, represent revolutionary advancements in the field of APT defense.

[0227] Through the above detailed description, the method and system of the present invention have demonstrated significant innovation and practical value in the field of APT attack detection and prevention, and provide a powerful tool for enterprise-level network security defense.

[0228] It should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A causal reasoning-based APT kill chain reconstruction and prediction method, characterized by: The following steps are involved: Acquire multi-source heterogeneous data, and perform data preprocessing and causal graph construction based on the multi-source heterogeneous data to obtain an initial causal graph; Performing multimodal feature extraction based on the initial causal graph to obtain initial feature representation of nodes; Inputting the initial feature representation of the node into a temporal causal graph convolutional learning algorithm to obtain an optimized node representation; Performing kill chain reconstruction based on the optimized node representation to obtain a possible kill chain sequence; Predicting future attack paths based on the possible kill chain sequence to obtain potential attack paths; generating an explainability analysis report based on the potential attack paths; And perform model update and optimization according to the interpretability analysis report to optimize the initial causal graph, and return to perform data preprocessing and causal graph construction steps to form a closed-loop iteration; the temporal causal graph convolution learning algorithm is a quantum-inspired spatiotemporal causal attention graph convolutional network, which includes the following steps: (a) Initialize the node quantum state vector |ψ i > (b) Perform T iterations: (b1) Based on the node quantum state vector |ψ i >Calculate quantum measurement and get node feature h i ; (b2) According to the node feature h i Update edge weight w ij ; (b3) Based on the edge weight w ij Compute multi-scale attention ij ; (b4) Using the multi-scale attention ij Update node representation h′ i ; (b5) Based on the updated node representation h′ i Update quantum state |ψ i > (c) Output the final node representation h i ; Among them, |ψ i > represents node v i The quantum state of h i Represents node v i The feature representation of w ij Represents node v i and v j The edge weight between ij Represents node v i v j The attention weight is , and T represents the number of iterations.

2. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The quantum measurement process in step (b1) is as follows: where ψ i represents the quantum state vector of node v i , p ik represents the probability distribution of node v i in the k-th mode, M = ∑ k λ k |k><k| is the quantum measurement operator, λ k is a learnable parameter, p ij is the probability distribution of node v i in the j-th mode, <j|k> is the inner product, and is obtained as follows: <j|k>=softmax(q T ·tanh(W·[x ij ||x ik ]+b)) Where W represents the weight matrix, q T represents a vector, where q is a set of learnable parameters, b represents the bias term, and x ij and x ik Node v i The features of the j-th and k-th modes, tanh(*) is the hyperbolic tangent function, which is used for nonlinear transformation, and || represents the concatenation operation, which concatenates two feature vectors into a longer feature vector.

3. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The edge weight updating process in step (b2) is as follows: w ij =g ij ·w ij +(1-g ij )·F(w ij ) Among them, g ij is the update gate, σ is the sigmoid function, W g represents the weight matrix, b g represents the bias term, Δt ij is the time interval, Δs ij is the spatial distance, D is the learnable fractal dimension, F(x) is the chaotic mapping function, defined as F(x) = rx(1-x), r is the learnable parameter, Represents node v i and node v j The D-dimensional fractal dimension of the time interval between them, || represents the splicing operation.

4. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The multi-scale attention calculation process in step (b3) is as follows: a ij =softmax(∑ l a l ·K l (i,j)) Among them, K l (i,j) is the multi-scale causal kernel, σ l is the kernel width of the lth scale, m ij is a mask based on causal structure, α l is the learnable scale weight, h i Represents node v i The feature representation, h j Represents node v j The feature representation of ||*|| 2 Represents the Euclidean norm of a vector.

5. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The node representation update process in step (b4) is as follows: Among them, W represents the weight matrix, b represents the bias term, a ij Represents node v i For node v j The attention weight, R(x) is the residual function, defined as: R(x)=W r ·x+b r W r represents the weight matrix, b r represents the bias term.

6. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The kill chain reconstruction steps include: Using an improved Kahn algorithm to perform topological sorting on the optimized node representation to obtain a preliminary attack sequence; Applying a beam search algorithm based on the preliminary attack sequence to obtain multiple candidate kill chains; Evaluating the multiple candidate kill chains using a conditional random field model to obtain a final kill chain and its confidence level; The Kahn algorithm implementation logic includes the following steps: First, during the initialization process, an empty queue Q is created to store nodes with in-degree 0, and an empty list L is created to store the final topological sorting result, and the initial in-degree and importance score I(v) of each node are calculated; Calculate the priority P(v) of each node v using the formula: P(v)=∑(w uv ·I(u)) Where u is all the incoming edge nodes of v, w_uv is the weight of the edge (u, v); Then, add all nodes with in-degree 0 to the queue Q and sort them in descending order of P(v). In the main loop, when Q is not empty, take the node n with the highest priority from Q and add n to the result list L. For each node m adjacent to n, reduce m's in-degree and update its priority P(m). If m's in-degree becomes 0, add it to Q and keep Q sorted in descending order of P(v). Finally, check whether there is a ring. If the number of nodes in L is less than the total number of nodes in the graph, report that there is a ring in the graph and return the topological sort result L.

7. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The future attack path prediction step includes: Based on the possible kill chain sequence, an LSTM encoder with an attention mechanism is used to generate a state representation. Based on the state representation, define the hierarchical softmax action space; Based on the action space, a Monte Carlo tree search algorithm is applied to perform path prediction to obtain potential attack paths.

8. The APT kill chain reconstruction and prediction method based on causal reasoning according to claim 1 is characterized in that: The model updating and optimization steps include: Perform incremental learning based on the sliding window strategy to update model parameters; Use the improved Peter-Clark algorithm to update the causal graph structure; Apply Bayesian optimization algorithm for hyperparameter optimization; Model compression is performed through knowledge distillation technology to obtain an optimized lightweight model.

9. An APT kill chain reconstruction and prediction system based on causal reasoning, characterized by: include: Data preprocessing and causal graph construction module, used to obtain multi-source heterogeneous data and perform data preprocessing and causal graph construction; A multimodal feature extraction module, configured to extract multimodal features based on the output of the data preprocessing and causal graph construction module; A temporal causal graph convolution learning module, configured to apply a temporal causal graph convolution learning algorithm to the output of the multimodal feature extraction module; a kill chain reconstruction module, configured to perform kill chain reconstruction based on the output of the temporal causal graph convolutional learning module; a future attack path prediction module, configured to predict future attack paths based on the output of the kill chain reconstruction module; an explainability analysis module, configured to generate an explainability analysis based on the output of the future attack path prediction module; as well as A model updating and optimization module, configured to perform model updating and optimization based on the output of the interpretability analysis module, and feed back the optimization results to the data preprocessing and causal graph construction module; The temporal causal graph convolution learning algorithm is a quantum-inspired spatiotemporal causal attention graph convolutional network, which includes the following steps: (a) Initialize the node quantum state vector |ψ i > (b) Perform T iterations: (b1) Based on the node quantum state vector |ψ i >Calculate quantum measurement and get node feature h i ; (b2) According to the node feature h i Update edge weight w ij ; (b3) Based on the edge weight w ij Compute multi-scale attention ij ; (b4) Using the multi-scale attention ij Update node representation h′ i ; (b5) Based on the updated node representation h′ i Update quantum state |ψ i > (c) Output the final node representation h i ; Among them, |ψ i > represents node v i The quantum state of h i Represents node v i The feature representation of w ij Represents node v i and v j The edge weight between ij Represents node v i v j The attention weight is , and T represents the number of iterations.

Images