APT attack detection method, system, storage medium and electronic device

Abstract

The present invention provides an APT attack detection method, system, storage medium, and electronic device. The method includes: collecting attack logs of multiple known attacks and constructing an attack subgraph based on the attack logs; performing feature enhancement on nodes in the attack subgraph based on an attention mechanism to obtain feature vectors corresponding to the nodes, and training an initial detection model based on the feature vectors to obtain a final detection model; obtaining host logs to be detected, and constructing a traceability graph based on the host logs to be detected, performing subgraph sampling on process nodes in the traceability graph to obtain at least one target subgraph; performing feature enhancement on at least one target subgraph to obtain enhanced target feature vectors, and sequentially inputting the target feature vectors into the final detection model to obtain detection results corresponding to each target subgraph. The present invention can improve the accuracy and flexibility of detection and reduce false positives or missed positives.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an APT attack detection method, system, storage medium and electronic device. Background Art

[0002] Attack detection, a key task in network security, aims to promptly identify and report malicious activity or security threats to computer systems, networks, or applications. Due to a spate of security incidents affecting large enterprise systems in recent years, these attacks have grown in scale and sophistication, causing significant losses to businesses. To better prevent and respond to these attacks, enterprises have begun widely deploying security information and event management tools, such as endpoint monitoring solutions, which continuously record system-level activity as audit logs. Analysis of these audit logs enables early detection of threats and, in the event of a security incident, allows for tracing the source and determining the scope of damage.

[0003] Traditional rule-based detection methods use predefined rule sets to match known attack patterns. Although intuitive and with a low false alarm rate, they are insufficient when dealing with APT attacks like the SolarWinds incident. Especially when attackers use customized tools or variants, it is difficult to update the rules in a timely manner. In addition, the cost of maintaining the rule base is high, and there is a risk of conflicts and false alarms. First, the hit of the rules depends on the quality of the rules written by security experts, and it is easy for attackers to bypass detection. If a new attack is not hit by the rules, no alarm will be generated. Secondly, because the rules need to be continuously updated and maintained, the maintenance cost is high, and there is a risk of rule conflicts and performance issues.

[0004] According to research, security researchers are actively exploring learning-based attack detection methods to address the limitations of rule-based detection. Machine learning and artificial intelligence technologies are used to analyze large amounts of data on the endpoint to automatically identify anomalous patterns and potential threats. This approach offers advantages such as high adaptability, automation, the ability to process large amounts of data, and the ability to detect complex attacks. However, learning-based methods also have drawbacks. First, learning-based detection methods rely on model training. Black-box training often results in attacks being identified but unable to be traced back to the source due to the lack of interpretability of learning-based methods. Second, in endpoint log detection, security personnel often rely on threat intelligence for detection. However, the quality of external threat intelligence varies significantly, significantly impacting the effectiveness of detection models. Furthermore, the attack behavior patterns derived from relational entity extraction from threat intelligence are coarse-grained and cannot be aligned with endpoint logs, often leading to missed or false positives. Summary of the Invention

[0005] The present invention aims to provide an APT attack detection method, system, storage medium and electronic device, aiming to solve the problems of missed reports and false reports existing in traditional technologies.

[0006] In a first aspect, the present invention provides an APT attack detection method, the method comprising:

[0007] Collect multiple attack logs of known attacks and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, ttp n represents the attack subgraph corresponding to the nth attack log;

[0008] Performing feature enhancement on nodes in the attack subgraph based on an attention mechanism to obtain feature vectors corresponding to the nodes, and training an initial detection model based on the feature vectors to obtain a final detection model;

[0009] Obtain the host log to be detected, and build a traceability graph based on the host log to be detected, perform subgraph sampling on the process nodes in the traceability graph, and obtain at least one target subgraph;

[0010] Feature enhancement is performed on the at least one target sub-graph to obtain enhanced target feature vectors, and the target feature vectors are sequentially input into the final detection model to obtain detection results corresponding to each target sub-graph.

[0011] Furthermore, the step of performing feature enhancement on the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and training the initial detection model according to the feature vectors to obtain the final detection model includes:

[0012] Feature vector enhancement is performed according to the following formula:

[0013]

[0014] Where h′ v is the vector representation after the attention mechanism update, σ is the activation function, represents the sum of all neighbors j of node v, α vj represents the attention coefficient between nodes v and j, W is the weight matrix, h j is the current representation of neighbor node j.

[0015] Furthermore, the steps of obtaining the log of the host to be detected, constructing a traceability graph based on the log of the host to be detected, and performing subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph include:

[0016] Taking each process node in the traceability graph as the center, subgraph sampling is performed within a neighborhood with a sampling radius of 5 hops.

[0017] Furthermore, the step of performing feature enhancement on the at least one target sub-graph to obtain an enhanced target feature vector, and sequentially inputting the target feature vector into the final detection model to obtain a detection result corresponding to each target sub-graph includes:

[0018] Obtain the similarity between the enhanced target feature vector and each final feature vector, and select the maximum similarity from all similarities;

[0019] Determining whether the maximum similarity is greater than or equal to a first preset similarity threshold;

[0020] If the maximum similarity is greater than or equal to a first preset similarity threshold, it is determined that an attack behavior exists in the target subgraph corresponding to the enhanced target feature vector;

[0021] If the maximum similarity is less than a first preset similarity threshold, it is determined that there is no attack behavior in the target subgraph corresponding to the enhanced target feature vector.

[0022] Furthermore, the step of obtaining the similarity between the enhanced target feature vector and each final feature vector, and selecting the maximum similarity from all similarities includes:

[0023] Filter out the maximum similarity according to the following formula:

[0024]

[0025] Among them, score(G) represents the enhanced target feature vector G and the i-th final feature vector ttp i The maximum similarity of similarity(·) represents the maximum similarity between the enhanced target feature vector G and the i-th final feature vector ttp i similarity.

[0026] In a second aspect, the present invention provides an APT attack detection system, the system comprising:

[0027] The attack subgraph embedding module is used to collect multiple attack logs of known attacks and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, ttp n represents the attack subgraph corresponding to the nth attack log;

[0028] A detection model construction module is used to enhance the features of the nodes in the attack subgraph based on the attention mechanism to obtain the feature vectors corresponding to the nodes, and train the initial detection model according to the feature vectors to obtain the final detection model;

[0029] A subgraph sampling module is used to obtain the logs of the host to be detected, build a traceability graph based on the logs of the host to be detected, and perform subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph;

[0030] The detection module is used to perform feature enhancement on the at least one target sub-image respectively to obtain an enhanced target feature vector, and input the target feature vector into the final detection model in sequence to obtain a detection result corresponding to each target sub-image.

[0031] In a third aspect, the present invention provides a storage medium storing one or more programs, which implement the above-mentioned APT attack detection method when executed by a processor.

[0032] In a fourth aspect, the present invention provides an electronic device, comprising a memory and a processor, wherein:

[0033] The memory is used to store computer programs;

[0034] When the processor is used to execute the computer program stored in the memory, the above-mentioned APT attack detection method is implemented.

[0035] Compared with the prior art, the present invention has the following advantages:

[0036] 1. By breaking down attacks into atomic-level attacks, this invention can more accurately capture attack features and improve detection accuracy and flexibility. By modeling the attack detection problem as an attack subgraph matching problem, the interpretability of the model is effectively enhanced, facilitating source tracing analysis by security personnel. The attention of the attack subgraph is enhanced through the IOC of threat intelligence to solve the serious problems of false positives and false negatives of the model.

[0037] 2. The present invention implements an enhancement mechanism by leveraging IOCs of threat intelligence during model training. When sampling and embedding the nodes and edges involved in the IOCs in subgraphs, the threat features are amplified through an attention enhancement mechanism to distinguish different attack subgraphs, effectively reducing the false positive and false negative rates of subgraph matching.

[0038] 3. This paper proposes an algorithm for attack subgraph matching detection by sampling embedding vectors for process-centric subgraphs and integrating an attention mechanism. This embedding approach effectively detects similar attack scenarios and identifies TTPs to restore attack sub-links. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of an APT attack detection method proposed in one embodiment of the present invention;

[0040] Figure 2 This is an overall framework diagram of the APT attack detection method proposed in one embodiment of the present invention;

[0041] Figure 3 This is a schematic diagram of the structure of an APT attack detection system proposed in one embodiment of the present invention.

[0042] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0044] The technical term "provenance graph" refers to a specialized directed graph structure used to describe and record the flow of data, behavioral interactions, and causal relationships within a system. It uses a combination of nodes and edges to represent the interaction history and dependencies between entities in the system. In this graph, nodes typically represent basic entities in the system (such as processes, files, and network connections), while edges represent various interactions between these entities (such as reads, writes, creations, and derivatives). The core characteristics of a provenance graph include its inherent temporality (accurately reflecting the chronological order of events), integrity (comprehensively capturing relevant system-level interactions), and immutability (ensuring the authenticity and reliability of the record). As a powerful data structure, provenance graphs have extensive applications in cybersecurity, playing a key role in intrusion detection, attack tracing, and threat analysis. They help security analysts trace attack chains, identify anomalous behavior patterns, and reconstruct attack scenarios, providing a reliable basis for incident response and forensic analysis. By recording and analyzing various behaviors and data flows within a system, provenance graphs make complex security incidents traceable, analyzable, and understandable, providing crucial technical support for modern cybersecurity protection systems.

[0045] The technical term "atomic attack subgraph" refers to an attack behavior decomposition and representation method based on the MITRE ATT&CK framework. It decomposes complex attack behavior sequences into the smallest granularity of tactics, techniques, and procedures (TTPs), representing and modeling them using a graph structure. This approach treats each attack step as an indivisible "atomic operation," each corresponding to a specific technique or sub-technique in the ATT&CK matrix. In the atomic attack subgraph, nodes represent specific attack techniques (such as initial access, privilege escalation, and lateral movement), while edges represent the sequence and dependencies between attack steps. Using subgraph sampling techniques, features of these atomic attack behaviors can be extracted from the complete attribution graph. This vectorized representation not only preserves the semantic information of the attack behavior but also facilitates subsequent tasks such as similarity measurement, pattern matching, and attack detection. This atomic attack subgraph representation method is of great significance in intrusion detection systems. It can effectively capture attacker behavior patterns, provide fine-grained attack feature representation, and support graph-based anomaly detection and attack identification.

[0046] like Figure 1 and Figure 2 An embodiment of the present invention provides an APT attack detection method, which includes steps S101 to S104, wherein:

[0047] Step S101: Collect multiple attack logs of known attacks and construct an attack subgraph based on the attack logs;

[0048] It should be pointed out that during the training phase, the attack logs collected are sample sizes. For example, for a single-step attack, a malicious file is run, and the system will recover the generated logs after the collection is completed. This means that one attack behavior corresponds to one log sample. During the actual training process, there will be hundreds or thousands of samples at this level, and each attack log will correspond to a TTP number, such as T1039.001 / T1039.002 / T1040.001.

[0049] In addition, in some embodiments, attacks are reproduced using ATT&CK-based automated attack tools such as Atomic Red Team and self-developed automated attack tools on a target range with locally deployed collection tools. Windows uses ETW (Event Tracing for Windows) to implement real-time collection of process, file, and registry activities, and Linux uses eBPF (Extended Berkeley Packet Filter) to achieve high-performance data filtering and log collection. The system design supports multi-threaded log collection and can achieve load balancing in a distributed environment.

[0050] Step S102: performing feature enhancement on the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and training the initial detection model based on the feature vectors to obtain the final detection model;

[0051] This step mainly involves constructing an attack subgraph for the atomic attack log. The target range host log in JSON format is parsed into a traceability graph through script parsing. The malicious process node is sampled using the follow-up walk algorithm for subgraph sampling, and then the graph is embedded using the GraphSAGE algorithm.

[0052] In addition, in order to distinguish similar behaviors with different purposes or entry points, they may exhibit different TTP behaviors, which can easily lead to false positives during detection. Therefore, during model training, the present invention introduces intelligence to enhance the attack subgraph features. Specifically, this embodiment extracts IOCs from threat intelligence text and then uses a graph attention network to integrate IOC information. For node v, feature vector enhancement is performed according to the following formula:

[0053]

[0054] Where h′ v is the vector representation after the attention mechanism is updated, that is, the feature vector, σ is the activation function, represents the sum of all neighbors j of node v, α vj represents the attention coefficient between nodes v and j, W is the weight matrix, h j is the current representation of neighbor node j.

[0055] Step S103: Obtain the host log to be detected, and construct a traceability graph based on the host log to be detected, perform subgraph sampling on the process nodes in the traceability graph, and obtain at least one target subgraph;

[0056] In the detection phase, we first construct a traceability graph using host logs, then use the graph sampling method of the previous attack subgraph to construct a graph representation vector for the incoming process node. Then, we use the subgraph matching algorithm to perform similarity matching on all attack subgraphs. If the similarity reaches the threshold, the corresponding TTP is output, an alarm is generated, and the attack scenario display is restored.

[0057] It should be noted that the host logs obtained during the detection phase are a summary of log data collected over a long period of time. During the subgraph sampling process, a subgraph within 5 hops around each process is embedded, and then compared with the samples in the training phase for similarity. When the similarity reaches the threshold, the TTP number is matched, such as T1039.001.

[0058] For example, process A in the provenance graph reads file B and then generates file C. In the form of a graph, for this huge provenance graph, each process-type node, such as A here, uses a subgraph sampling algorithm to sample the neighborhood within five hops, such as A->B->C->D->E. If the neighborhood exceeds five hops, it is considered too large to be conducive to training, so only the neighborhood within five hops is considered, thus completing subgraph sampling.

[0059] Step S104: performing feature enhancement on the at least one target sub-image to obtain enhanced target feature vectors, and inputting the target feature vectors into the final detection model in sequence to obtain detection results corresponding to each target sub-image.

[0060] It should be noted that the method of feature enhancement for the target subgraph is exactly the same as that for the attack subgraph. In addition, during the detection phase, the system first calculates the similarity of the two graph vectors based on cosine similarity, and selects the K most similar TTPs through the K nearest neighbor algorithm. Finally, it determines whether to trigger an alarm based on the threshold and displays the matching attack link. The threshold here is manually adjusted based on empirical data and statistical information. For the graph to be detected, G, and the TTP attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, calculate the maximum similarity score(G).

[0061] In some embodiments, the specific process of subgraph matching is as follows:

[0062] Obtain the similarity between the enhanced target feature vector and each final feature vector, and select the maximum similarity from all similarities;

[0063] Determining whether the maximum similarity is greater than or equal to a first preset similarity threshold;

[0064] If the maximum similarity is greater than or equal to a first preset similarity threshold, it is determined that an attack behavior exists in the target subgraph corresponding to the enhanced target feature vector;

[0065] If the maximum similarity is less than a first preset similarity threshold, it is determined that there is no attack behavior in the target subgraph corresponding to the enhanced target feature vector.

[0066] More specifically, the maximum similarity is selected according to the following formula:

[0067]

[0068] Among them, score(G) represents the enhanced target feature vector G and the i-th final feature vector ttp iThe maximum similarity of similarity(·) represents the maximum similarity between the enhanced target feature vector G and the i-th final feature vector ttp i similarity.

[0069] The test results are obtained according to the following formula:

[0070] Test results AS(G):

[0071]

[0072] Finally, the attack sub-link is restored and visualized based on the detected attack behavior.

[0073] In summary, the APT attack detection method described above breaks down attack logs into atomic, single-step attacks according to the ATT&CK framework and maps them to specific TTPs (Tactics, Techniques, and Procedures). This allows for the capture of attack signatures at the same granularity, improving detection accuracy and flexibility. Furthermore, leveraging threat intelligence-based IOCs, an enhancement mechanism is implemented to effectively reduce false positive detection rates. Finally, learning-based subgraph matching enables the effective discovery of unknown threats and the restoration of attack sub-links.

[0074] like Figure 3 As shown, an embodiment of the present invention further provides an APT attack detection system, the system comprising:

[0075] The attack subgraph embedding module 10 is used to collect multiple attack logs of known attacks and construct an attack subgraph {ttp1, ttp2, ttp3, ..., ttp n}, ttp n represents the attack subgraph corresponding to the nth attack log;

[0076] A detection model construction module 20 is configured to perform feature enhancement on nodes in the attack subgraph based on an attention mechanism to obtain feature vectors corresponding to the nodes, and to train an initial detection model based on the feature vectors to obtain a final detection model;

[0077] The subgraph sampling module 30 is used to obtain the log of the host to be detected, build a traceability graph based on the log of the host to be detected, and perform subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph;

[0078] The detection module 40 is configured to perform feature enhancement on the at least one target sub-image to obtain enhanced target feature vectors, and input the target feature vectors into the final detection model in sequence to obtain detection results corresponding to each target sub-image.

[0079] Another aspect of the present invention further provides a storage medium storing one or more programs, which implement the above-mentioned APT attack detection method when executed by a processor.

[0080] On the other hand, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the above-mentioned APT attack detection method.

[0081] Those skilled in the art will appreciate that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device.

[0082] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0083] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement the hardware: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0084] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A method for detecting APT attacks, characterized in that: The method comprises: Collect multiple attack logs of known attacks and construct an attack subgraph based on the attack logs , represents the attack subgraph corresponding to the nth attack log; Performing feature enhancement on nodes in the attack subgraph based on an attention mechanism to obtain feature vectors corresponding to the nodes, and training an initial detection model based on the feature vectors to obtain a final detection model; Obtain the host log to be detected, and build a traceability graph based on the host log to be detected, perform subgraph sampling on the process nodes in the traceability graph, and obtain at least one target subgraph; Feature enhancement is performed on the at least one target sub-graph to obtain enhanced target feature vectors, and the target feature vectors are sequentially input into the final detection model to obtain detection results corresponding to each target sub-graph.

2. The APT attack detection method according to claim 1, characterized in that: The steps of performing feature enhancement on the nodes in the attack subgraph based on the attention mechanism to obtain feature vectors corresponding to the nodes, and training the initial detection model according to the feature vectors to obtain the final detection model include: Feature vector enhancement is performed according to the following formula: ， in, is the vector representation after the attention mechanism update, σ is the activation function, represents the sum of all neighbors j of node v, represents the attention coefficient between nodes v and j, W is the weight matrix, is the current representation of neighbor node j.

3. The APT attack detection method according to claim 1, characterized in that: The steps of obtaining the log of the host to be detected, constructing a traceability graph based on the log of the host to be detected, and performing subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph include: Taking each process node in the traceability graph as the center, subgraph sampling is performed within a neighborhood with a sampling radius of 5 hops.

4. The APT attack detection method according to claim 1, characterized in that: The step of performing feature enhancement on the at least one target sub-graph to obtain enhanced target feature vectors, and sequentially inputting the target feature vectors into the final detection model to obtain a detection result corresponding to each target sub-graph comprises: Obtain the similarity between the enhanced target feature vector and each final feature vector, and select the maximum similarity from all similarities; Determining whether the maximum similarity is greater than or equal to a first preset similarity threshold; If the maximum similarity is greater than or equal to a first preset similarity threshold, it is determined that an attack behavior exists in the target subgraph corresponding to the enhanced target feature vector; If the maximum similarity is less than a first preset similarity threshold, it is determined that there is no attack behavior in the target subgraph corresponding to the enhanced target feature vector.

5. An APT attack detection system, characterized in that: The system comprises: Attack subgraph embedding module, used to collect multiple attack logs of known attacks and construct attack subgraphs based on the attack logs , represents the attack subgraph corresponding to the nth attack log; A detection model construction module is used to enhance the features of the nodes in the attack subgraph based on the attention mechanism to obtain the feature vectors corresponding to the nodes, and train the initial detection model according to the feature vectors to obtain the final detection model; A subgraph sampling module is used to obtain the logs of the host to be detected, build a traceability graph based on the logs of the host to be detected, and perform subgraph sampling on the process nodes in the traceability graph to obtain at least one target subgraph; The detection module is used to perform feature enhancement on the at least one target sub-image respectively to obtain an enhanced target feature vector, and input the target feature vector into the final detection model in sequence to obtain a detection result corresponding to each target sub-image.

6. A storage medium, characterized in that The storage medium stores one or more programs, which, when executed by a processor, implement the APT attack detection method according to any one of claims 1 to 4.

7. An electronic device comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the APT attack detection method according to any one of claims 1 to 4.

Images