A method for automatically generating advanced persistent threat samples at the traceability graph level

Abstract

The present invention belongs to the technical field of network security, and discloses a method for automatically generating advanced persistent threat samples at the traceability graph level, including generating an abstract attack graph structure using a flow-based graph generation model; determining the starting process node of each attack stage in the abstract attack graph structure; dividing the abstract attack graph structure into an initial intrusion subgraph, a privilege escalation subgraph, a sensitive behavior subgraph, and a target achievement subgraph based on each starting process node; identifying attack technologies in the initial intrusion subgraph, the privilege escalation subgraph, the sensitive behavior subgraph, and the target achievement subgraph, and obtaining entity names from an attack instantiation library based on the identified attack technologies; filling in corresponding entity names for entities having only entity types, and obtaining automatically generated advanced persistent threat samples at the traceability graph level. The present invention can quickly generate a large number of available advanced persistent threat samples.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for automatically generating advanced persistent threat samples at the source tracing graph level. Background Art

[0002] Advanced persistent threat attacks are advanced, covert and persistent cyber threat activities launched by experienced attackers against high-value targets. With the emergence of attack vectors, advanced persistent threat attacks are becoming more and more active around the world.

[0003] In order to detect advanced persistent threat attacks, the industry usually parses the entities and corresponding interaction events contained in the logs that record system activities into a traceability graph representing the system execution history and analyzes it. Traditional detection methods trigger alarms by propagating labels in the traceability graph through manually defined heuristic rules, but there is a defect that the rules cannot be spread everywhere. Nowadays, machine learning technology has performed well in security tasks that contain a large amount of training data, providing a new idea for advanced persistent threat attack detection. However, in advanced persistent threat attack detection, limited advanced persistent threat samples limit the efficient application of supervised machine learning algorithms.

[0004] In response to the above problems, how to quickly generate a large number of available advanced persistent threat samples and promote the application of supervised learning algorithms in advanced persistent threat attack detection is an urgent problem to be solved. Summary of the invention

[0005] The purpose of the present invention is to provide a method for automatically generating advanced persistent threat samples at the traceability graph level, which can quickly generate a large number of available advanced persistent threat samples.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A method for automatically generating advanced persistent threat samples at the traceability graph level, comprising:

[0008] Defining entity types and relationship types in advanced persistent threat samples at the tracing graph level, and using a flow-based graph generation model to generate an abstract attack graph structure, wherein nodes and edges in the abstract attack graph structure have the defined entity types and relationship types, respectively;

[0009] Using an attack phase division algorithm, determine the starting process node of each attack phase in the abstract attack graph structure, wherein the attack phase includes initial intrusion, privilege escalation, sensitive behavior, and goal achievement;

[0010] Based on each starting process node, the abstract attack graph structure is divided into the initial intrusion subgraph, the privilege escalation subgraph, the sensitive behavior subgraph, and the goal achievement subgraph;

[0011] Identify the attack techniques in the initial intrusion subgraph, the privilege escalation subgraph, the sensitive behavior subgraph, and the goal achievement subgraph according to the attack technique matching rules, and obtain entity names from an attack instantiation library based on the identified attack techniques, wherein the attack instantiation library stores entity names corresponding to all entity types related to each attack technique;

[0012] For the initial intrusion subgraph, privilege escalation subgraph, sensitive behavior subgraph, and goal achievement subgraph, only entities with entity types are filled with corresponding entity names to obtain the automatically generated advanced persistent threat samples at the traceability graph level.

[0013] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0014] Preferably, the entity types include malicious processes, benign processes, malicious files, system files, temporary files and sockets, and the relationship types include fork, delete, inject, read, write, change mode, execute, send and receive.

[0015] Preferably, the abstract attack graph structure is defined as ,in is the node matrix, is the edge matrix, is the maximum number of nodes in the abstract attack graph structure, is the number of entity types, is the number of relationship types, when Nodes and A node is indexed by a relationship type When the edges are connected, remember Otherwise, remember , , .

[0016] Preferably, the generating an abstract attack graph structure by using a flow-based graph generation model comprises:

[0017] The abstract attack graph structure generation process is iterated from an empty abstract attack graph structure Start, in In the round iteration, according to the existing abstract attack graph structure Predict a new node, and then predict the edges between the new node and all existing nodes. Continue iterating until the newly predicted node has no relationship with any existing node, or the maximum number of nodes in the abstract attack graph structure has been reached. Then stop iterating and output the abstract attack graph structure. The prediction process of nodes and edges in one iteration is as follows:

[0018] For a given abstract attack graph structure , using dequantization techniques to add noise and abstract attack graph structures Represented as continuous data;

[0019] Learning embedding vectors for continuous data using relational graph convolutional networks , and perform sum-pooling operation on the embedded vector to obtain the entire abstract attack graph structure The embedding vector ;

[0020] Using two multi-layer perceptron models, for the embedding vector , respectively generate neural network parameters for predicting the mean of node distribution and neural network parameters for predicting the variance of node distribution, use the neural network that is respectively endowed with the neural network parameters for predicting the mean of node distribution and the neural network parameters for predicting the variance of node distribution, output the node distribution of this iteration for the node distribution obtained in the previous iteration, and select the entity type corresponding to the dimension with the highest median value of the node distribution as the node type of the newly predicted node in this iteration;

[0021] Using two multi-layer perceptron models, for the embedding vector , embedding vector The The embedding of nodes and the embedding vector The The embedding of nodes generates the neural network parameters for predicting the mean of the edge distribution and the neural network parameters for predicting the variance of the edge distribution, respectively. is the sequence number of the newly predicted node in this iteration, is the serial number of any existing node;

[0022] Using a neural network that is respectively endowed with neural network parameters for the predicted edge distribution mean and neural network parameters for the predicted edge distribution variance, the edge distribution of this iteration is output for the edge distribution obtained in the previous iteration, the newly predicted nodes in this iteration, and the edges predicted in this iteration. The relationship type corresponding to the dimension with the highest median value in the edge distribution is selected as the edge type of the newly predicted edge, and the edge type prediction is repeated until the prediction of the edge type between the newly predicted node in this iteration and any existing node is completed.

[0023] Preferably, the method of using an attack phase division algorithm to determine a starting process node of each attack phase in the abstract attack graph structure includes:

[0024] Obtain a starting node set and an ending node set of a function flow from an abstract attack graph structure, and obtain a function flow set corresponding to each process node in the abstract attack graph structure according to the starting node set and the ending node set;

[0025] Take the process nodes with non-0 out-degree in the abstract attack graph structure as candidate stage feature nodes, calculate the function flow similarity between any two candidate stage feature nodes, and delete the candidate stage feature nodes whose function flow similarity is greater than the similarity threshold and whose function flow set size is small;

[0026] The function flow number and total degree of the nodes are counted, and the candidate stage feature nodes remaining after deletion are sorted in ascending order according to the function flow number and total degree, respectively, to obtain a function flow number list and a total degree list, and the score of each candidate stage feature node is calculated according to its index in the function flow number list and the total degree list;

[0027] The first four candidate stage feature nodes with the highest scores are taken as the starting process nodes, and in the ascending chronological order of the starting process nodes, the four starting process nodes are respectively taken as the starting process nodes of initial intrusion, the starting process nodes of privilege escalation, the starting process nodes of sensitive behavior, and the starting process nodes of goal achievement.

[0028] Preferably, the entity types included in the starting node of the functional flow are malicious processes, benign processes and sockets, and the node degree feature of the starting node of the functional flow is 0 in-degree, or there is an out-degree edge whose timestamp is smaller than the timestamps of all in-degree edges;

[0029] The entity types contained in the termination node of the functional flow are malicious processes, benign processes, malicious files, system files, temporary files and sockets. The node degree feature of the functional flow is 0 out-degree, or there is an in-degree edge whose timestamp is greater than the timestamps of all out-degree edges.

[0030] Preferably, the function flow similarity calculation process is as follows:

[0031] ;

[0032] In the formula, Represents the candidate stage feature node and candidate stage feature nodes The functional flow similarity between Represents the candidate stage feature node The corresponding function flow set, Represents the candidate stage feature node The corresponding function flow set, , They represent the serial numbers of the feature nodes in the candidate stage, Indicates the length of the collection. Indicates taking the maximum value.

[0033] Preferably, the score is calculated as follows:

[0034] ;

[0035] In the formula, Represents the candidate stage feature node The score, Represents the candidate stage feature node In the function flow number list The index in Indicates the function flow number list Length, Represents the candidate stage feature node In the total degree list The index in Represents a list of total degrees Length, is the weight constant.

[0036] Preferably, the attack technology matching rule includes:

[0037] In the initial intrusion attack phase, if the triples [socket, receive, benign process], [benign process, read, system file], and [benign process, send, socket] are satisfied in order, the identification attack technique is numbered T1590 or T1592;

[0038] In the initial intrusion attack phase, if the triples [socket, receive, benign process], [benign process, execute, malicious file], and [benign process, read, system file] are satisfied in order, the identification attack technique number is T1586;

[0039] In the initial intrusion attack phase, if the triples [malicious process, write, malicious file] and [malicious process, execute, malicious file] are satisfied in order, the identification attack technology is numbered as T1091;

[0040] In the initial intrusion attack phase, if the triples [malicious process, fork, benign process] and [benign process, execution, malicious file] are satisfied in order, the identification attack technology number is T1053;

[0041] In the initial intrusion attack phase, if the triples [malicious process, read, system file] and [malicious process, write, temporary file] are satisfied in order, the identification attack technology number is T1217;

[0042] In the privilege escalation attack phase, if the triples [malicious process, injection, benign process] and [benign process, execution, malicious file] are satisfied in order, the identification attack technique is numbered T1204;

[0043] In the privilege escalation attack phase, if the triples [malicious process, read, system file] and [malicious process, write, temporary file] are satisfied in order, the identification attack technique is numbered T1555 or T1539;

[0044] In the privilege escalation attack phase, if the triples [malicious process, read, system file] and [malicious process, write, system file] are satisfied in order, the identification attack technique is numbered T1078;

[0045] In the privilege escalation attack phase, if the triples [malicious process, fork, benign process] and [benign process, write, system file] are satisfied in order, the identification attack technique is numbered T1136;

[0046] In the privilege escalation attack phase, if the triples [malicious process, delete, system file] and [malicious process, write, system file] are satisfied in order, the identification attack technique is numbered T1036;

[0047] In the privilege escalation attack phase, if the triples [malicious process, fork, benign process] and [benign process, read, system file] are satisfied in order, the identification attack technique is numbered T1087;

[0048] In the privilege escalation attack phase, if the triple [malicious process, injection, benign process] is satisfied, the identification attack technique is numbered T1563;

[0049] In the sensitive behavior attack phase, if the triples [first malicious process, fork, benign process] and [benign process, fork, second malicious process] are satisfied in order, the identification attack technology is numbered T1569;

[0050] In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process] and [benign process, deletion, system file] are satisfied in order, the identification attack technology is numbered T1070;

[0051] In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process], [benign process, read, system file], and [benign process, write, temporary file] are satisfied in order, the identification attack technology is numbered as T1201, T1518, or T1614;

[0052] In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process] and [benign process, write, temporary file] are satisfied in order, the identification attack technology is numbered as T1056, T1074, or T1125;

[0053] In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process] and [benign process, send, socket] are satisfied in order, the identification attack technology is numbered T1568, T1571, or T1572;

[0054] In the target achievement attack phase, if the triples [first malicious process, fork, second malicious process] and [second malicious process, write, system file] are satisfied in order, the identification attack technique is numbered T1037 or T1525;

[0055] In the target achievement attack phase, if the triples [malicious process, fork, benign process] and [benign process, change mode, malicious file] are satisfied in order, the identification attack technology number is T1548;

[0056] In the target achievement attack phase, if the triples [malicious process, fork, benign process], [benign process, write, temporary file], and [benign process, send, socket] are satisfied in order, the identification attack technique is numbered T1567;

[0057] In the target achievement attack phase, if the triples [malicious process, fork, benign process] and [benign process, deletion, system file] are satisfied in order, the identification attack technique is numbered T1485, T1531, or T1561.

[0058] Compared with the prior art, the method for automatically generating advanced persistent threat samples at the traceability graph level provided by the present invention has the following beneficial effects: 1. A new practical solution is proposed for automatically generating advanced persistent threat samples at the traceability graph level using existing attack knowledge in network threat intelligence reports, providing a reliable data base for related fields. 2. By adopting a flow-based graph generation model, a large number of attack graph structures with traceability graph structural characteristics and representing a certain type of attack behavior can be automatically generated by learning the distribution of existing attack samples, thereby promoting sample generation diversity. 3. Based on the observation of the traceability graph structure, an attack phase subgraph partitioning algorithm based on functional flow search is proposed to help identify the various attack phases in the attack graph structure and quickly locate the stage targets corresponding to each behavior in the graph. 4. With reference to the existing attack knowledge sources, credible attack technology matching rules and instantiation libraries are designed to improve the interpretability of behaviors in the attack graph, and ultimately obtain logically reasonable and semantically rich instantiation attack samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1This is a flow chart of a method for automatically generating advanced persistent threat samples at the traceability graph level of the present invention. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0062] like Figure 1 As shown, this embodiment provides a method for automatically generating advanced persistent threat samples at the traceability graph level, including the following steps:

[0063] (1) Construction of an abstract attack graph structure based on a flow-based graph generation model: Define the entity types and relationship types that are often involved in advanced persistent threat samples. On this basis, train a flow-based graph generation model based on some pre-constructed samples, and use the flow-based graph generation model to generate an abstract attack graph structure. Finally, an abstract attack graph structure that can represent an attack behavior pattern is generated. The nodes and edges in the abstract attack graph structure have the defined entity types and relationship types, respectively.

[0064] (1-1) Definition of entity types and relationship types: By investigating the underlying behavior of the system, the six most common types of entities and nine types of relationships in the traceability diagram are summarized. The entity types, relationship types and descriptions involved are shown in Tables 1 and 2.

[0065] Table 1 Definition of entity types in advanced persistent threat samples

[0066]

[0067] Table 2 Definition of relationship types in advanced persistent threat samples

[0068]

[0069] (1-2) Definition of abstract attack graph structure: Based on the defined entity types and relationship types, the entities and relationships in the existing network threat intelligence reports were manually annotated, and available samples of advanced persistent threats at the traceability graph level (attack graph structures with entity names) were obtained as training data for the flow-based graph generation model. The flow-based graph generation model learns from the existing attack graph structures in the training data to construct an abstract attack graph structure (AAG) that can represent different attack activity behaviors. The abstract attack graph structure only has node types and edge types, and no node names. The abstract attack graph structure is defined as ,in is the node matrix, is an edge matrix, where nodes represent entities and edges represent relationships. , , is the maximum number of nodes in the abstract attack graph structure, is the number of entity types, is the number of relationship types, when Nodes and A node is indexed by a relationship type When the edges are connected, remember Otherwise, remember , , .

[0070] (1-3) Construction of flow-based graph generation model: Using the trained flow-based graph generation model, the iteration of the abstract attack graph structure generation process starts from an empty graph Start, in In the round iteration, according to the existing abstract attack graph structure It predicts the new node distribution, and then predicts the edge distribution between the new node and all existing nodes. This iterative process continues until the newly predicted node has no relationship with any of the previous existing nodes (the relationship type includes the type of no relationship), or the maximum number of nodes in the abstract attack graph structure has been reached. The prediction process of nodes and edges in round iteration is as follows:

[0071] ①For a given abstract attack graph structure , using dequantization techniques to add noise and abstract attack graph structures Represented as continuous data ,in It is a distribution representation of continuous nodes and edges.

[0072] ②Use relational graph convolutional network (Relational-GCN) to learn the embedding vector of continuous data , as shown in formula (1), where The dimension of the embedding vector for each node, and the embedding vector Perform sum-pooling operation to obtain the entire abstract attack graph structure The embedding vector , as shown in formula (2).

[0073] (1)

[0074] (2)

[0075] ③ As shown in formula (3), construct It predicts node distribution based on subgraph information, specifically using two multi-layer perceptron (MLP) models and , for the embedding vector , respectively generate the neural network parameters for predicting the node distribution mean and the neural network parameters for predicting node distribution variance As shown in formula (4), random sampling from the standard Gaussian distribution gives the random variable , using a neural network with neural network parameters that are assigned with the mean of the predicted node distribution and the variance of the predicted node distribution and , for the node distribution obtained in the previous iteration , output the node distribution of this round of iteration , and select the node distribution The entity type corresponding to the dimension with the highest median value is used as the node type of the newly predicted node in this iteration.

[0076] : , (3)

[0077] (4)

[0078] ④ As shown in formula (5), construct It predicts edge distribution based on subgraph and node information, specifically using two multi-layer perceptron models and , for the embedding vector , embedding vector The The embedding of nodes and the embedding vector The The embedding of nodes , respectively generate the neural network parameters for the mean of the predicted edge distribution and the neural network parameters for the predicted side distribution variance ,in is the sequence number of the newly predicted node in this iteration, is the serial number of any existing node. As shown in formula (6), the random variable is then randomly sampled from the standard Gaussian distribution , using a neural network with neural network parameters assigned to the mean of the predicted edge distribution and the neural network parameters assigned to the variance of the predicted edge distribution and , for the edge distribution obtained in the previous iteration , the newly predicted nodes in this iteration And the edges predicted in this iteration , output the edge distribution of this iteration , and select the relationship type corresponding to the dimension with the highest median value in the edge distribution as the edge type of the newly predicted edge, and repeat the prediction of the edge type until the prediction of the edge type between the newly predicted node and any existing node in this iteration is completed, where For this round of predictions Nodes With The edge between the nodes is the predicted Nodes and front The edges between nodes, For is a neural network with parameters, Predict the mean through two layers of MLP, Predict the variance through a linear transformation.

[0079] : , (5)

[0080] (6)

[0081] In the first round of iteration, the first node is obtained. At this time, there is no existing node, so there is no need to predict the edge. In the second round of iteration, the second node is obtained, and the edge between the second node and the first node is predicted to obtain the first edge. In the third round of iteration, the third node is obtained, and the edges between the third node and the first node and the second node are predicted to obtain the second edge. And so on.

[0082] like Figure 1As shown in , the abstract attack graph structure automatically generated by the flow-based graph generation model includes nodes MP generated in the first iteration, nodes TF and edges RD generated in the second iteration, nodes (not shown in the figure) and edges (not shown in the figure) generated in the third iteration, nodes TP and edges FR generated in the fourth iteration, nodes SF and edges EX generated in the fifth iteration, nodes (not shown in the figure) and edges (not shown in the figure) generated in the sixth iteration, nodes (not shown in the figure) and edges (not shown in the figure) generated in the seventh iteration, nodes TP and edges FR generated in the eighth iteration, nodes SF and edges EX generated in the ninth iteration, nodes (not shown in the figure) and edges (not shown in the figure) generated in the tenth iteration, nodes (not shown in the figure) and edges (not shown in the figure) generated in the eleventh iteration, nodes TP and edges FR generated in the twelfth iteration, and nodes SF and edges EX generated in the thirteenth iteration. It is easy to understand that the number of iterations is not limited to the number shown in the figure, and the nodes and edges not shown in the figure have been predicted and are only omitted in the figure.

[0083] (2) Attack stage subgraph division based on function flow search: Using the attack stage division algorithm, considering the function flow similarity between processes, the starting process node of each attack stage in the abstract attack graph structure is determined. The attack stage includes initial intrusion, privilege escalation, sensitive behavior and goal achievement. Based on each starting process node, the abstract attack graph structure is divided into initial intrusion subgraph, privilege escalation subgraph, sensitive behavior subgraph and goal achievement subgraph.

[0084] (2-1) Functional flow definition: A functional flow represents an attack behavior chain consisting of many single edges, representing a series of behaviors performed by an attacker to achieve a specific purpose. The characteristics of the starting node and the ending node of the functional flow are shown in Table 3.

[0085] Table 3 Definition of the start and end nodes of the functional flow

[0086]

[0087] (2-2) Attack stage division algorithm: This embodiment designs the following 4-step attack stage division algorithm, the purpose of which is to find the starting process nodes (i.e., stage characteristic nodes SCN) of the four major attack stages: initial intrusion, privilege escalation, sensitive behavior, and target achievement, and divide the stage subgraph based on these four SCNs. The specific steps are as follows:

[0088] ① Functional flow calculation: First, obtain the starting node set and the ending node set of the functional flow from an AAG, and check whether there is a time-increasing connection path (functional flow) between any pair of nodes in the two sets. If there is such a functional flow, ,and Not a function flow collection Any subflow of an existing functional flow in the function flow (that is, the access path represented by the functional flow is not a subpath of the access path represented by other functional flows) is added to the functional flow set. . And for each process node in AAG , maintain a corresponding set of function flows To record the functional flow information it passes through (that is, there is an edge in the functional flow with as the starting point or end point).

[0089] ② Remove high flow similarity nodes: All nodes with out-degree not equal to 0 are active process nodes. In this embodiment, active process nodes are regarded as candidate stage feature nodes. , join the candidate stage feature node set For any two candidate stage feature nodes and , defining its functional flow similarity As shown in formula (7), the similarity of the functional flows between two process nodes is described by calculating the overlap degree of two functional flow sets. Represents the candidate stage feature node The corresponding function flow set, Represents the candidate stage feature node The corresponding function flow set, , They represent the serial numbers of the feature nodes in the candidate stage, Indicates the length of the collection. Indicates taking the maximum value. If the threshold is exceeded, the feature node set in the candidate stage is Delete and The candidate stage feature nodes that have passed through fewer functional flows.

[0090] (7)

[0091] ③ Scoring: For each candidate stage feature node , consider the two indicators of function flow number and total degree (i.e. the sum of in-degree and out-degree), and arrange the candidate stage feature nodes in ascending order to obtain the function flow number list and the total degree list , and finally according to the index of each candidate stage feature node in the two queues and , define its score , as shown in formula (8), describes the weighted average ranking of each node in the two queues, where is the weight constant, Indicates the function flow number list Length, Represents a list of total degrees Length:

[0092] (8)

[0093] ④ Attack phase subgraph generation: For each AAG, select the score The top four candidate stage feature nodes are used as the SCN representing the start of each attack stage, and in the ascending order of the timing of the start process nodes, the four start process nodes are used as the start process node of the initial intrusion, the start process node of the privilege escalation, the start process node of the sensitive behavior, and the start process node of the goal achievement. Then, based on the SCN, the abstract attack graph structure is divided into four attack stage subgraphs: the initial intrusion subgraph (attack stage 1 subgraph), the privilege escalation subgraph (attack stage 2 subgraph), the sensitive behavior subgraph (attack stage 3 subgraph), and the goal achievement subgraph (attack stage 4 subgraph). Specifically, for all other nodes except the SCN, they are assigned to the attack stage subgraph to which the SCN with the closest generation timing (i.e., node sequence number) belongs; for each edge, it is then assigned to the attack stage subgraph where its starting point is located.

[0094] (3) Generation of instantiated attack samples based on behavior matching: Referring to the description in the ATT&CK model, attack technology matching rules are designed to match the stage subgraph, and reasonable entity names are selected from the pre-built instantiation library based on the matching results to fill in the abstract attack graph structure and obtain usable samples.

[0095] (3-1) Design of attack technique matching rules: Based on the four attack stages corresponding to the attack stage subgraph, with reference to the attack technique details defined in the ATT&CK model, and according to the entity types and relationship types in the advanced persistent threat samples at the provenance graph level defined in this embodiment, corresponding attack technique matching rules are designed for each attack stage, as shown in Table 4. Each curly bracket in the matching rule is a triple, representing an edge information, including the corresponding subject type, relationship type, and object type. The attack technique number is the conventional attack technique number of the ATT&CK model, which is not described in detail in this embodiment.

[0096] Table 4 Attack technology matching rules

[0097]

[0098] In Table 4, MP1 and MP2 represent two different malicious processes MP in the same attack technique. For the sake of distinction, they are described as the first malicious process MP1 and the second malicious process MP2.

[0099] When identifying attack techniques in the initial intrusion subgraph, privilege escalation subgraph, sensitive behavior subgraph, and goal achievement subgraph according to the attack technique matching rules, the match is considered successful only when all triples in the matching rules are met at the same time, and one is randomly selected from the corresponding technique number as the identified attack technique.

[0100] (3-2) Instantiation: In order to assign a reasonable entity name to each entity in AAG, this embodiment constructs an instantiation library that can correspond to each technology in the ATT&CK technology matching rules. The instantiation library stores the entity names corresponding to all entity types related to each attack technology. Among them, the sources of entity names are mainly the following three ways: ① The text description and examples provided for each technology in the ATT&CK official website. ② The text description of each technology in the Capec official website. ③ The command line examples corresponding to each technology provided by the ANY.RUN website.

[0101] Using the technical matching rules defined in step (3-1), perform rule matching in the attack phase subgraph obtained in step (2), interpret the abstract attack graph structure, and obtain the entity name of the corresponding attack technology from the instantiation library based on the matching results. If the entity type under an attack technology has multiple entity names, randomly select one of the entity names. For the initial intrusion subgraph, privilege escalation subgraph, sensitive behavior subgraph, and goal achievement subgraph, only the entities with entity types are filled with corresponding entity names, so that the abstract attack graph structure that originally only has node and edge types has complete semantics. Finally, a logically reasonable, real and usable traceability graph-level advanced persistent threat sample is obtained.

[0102] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0103] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A method for automatically generating advanced persistent threat samples at the traceability graph level, characterized in that: The method for automatically generating advanced persistent threat samples at the traceability graph level includes: Defining entity types and relationship types in advanced persistent threat samples at the traceability graph level, and using a flow-based graph generation model to generate an abstract attack graph structure, wherein nodes and edges in the abstract attack graph structure have the defined entity types and relationship types, respectively; Using an attack phase division algorithm, determine the starting process node of each attack phase in the abstract attack graph structure, wherein the attack phase includes initial intrusion, privilege escalation, sensitive behavior, and goal achievement; Based on each starting process node, the abstract attack graph structure is divided into the initial intrusion subgraph, the privilege escalation subgraph, the sensitive behavior subgraph, and the goal achievement subgraph; Identify the attack techniques in the initial intrusion subgraph, the privilege escalation subgraph, the sensitive behavior subgraph, and the goal achievement subgraph according to the attack technique matching rules, and obtain entity names from an attack instantiation library based on the identified attack techniques, wherein the attack instantiation library stores entity names corresponding to all entity types related to each attack technique; Fill in the corresponding entity names for entities with only entity types in the initial intrusion subgraph, privilege escalation subgraph, sensitive behavior subgraph, and goal achievement subgraph, and obtain the automatically generated advanced persistent threat samples at the traceability graph level; The abstract attack graph structure is defined as ,in is the node matrix, is the edge matrix, is the maximum number of nodes in the abstract attack graph structure, is the number of entity types, is the number of relationship types, when Nodes and A node is indexed by a relationship type When the edges are connected, remember Otherwise, remember , , ; The process of generating an abstract attack graph structure using a flow-based graph generation model includes: The abstract attack graph structure generation process is iterated from an empty abstract attack graph structure Start, in In the round iteration, according to the existing abstract attack graph structure Predict a new node, and then predict the edges between the new node and all existing nodes. Continue iterating until the newly predicted node has no relationship with any existing node, or the maximum number of nodes in the abstract attack graph structure has been reached. Then stop iterating and output the abstract attack graph structure. The prediction process of nodes and edges in one iteration is as follows: For a given abstract attack graph structure , using dequantization techniques to add noise and abstract attack graph structures Represented as continuous data; Learning embedding vectors for continuous data using relational graph convolutional networks , and perform sum-pooling operation on the embedded vector to obtain the entire abstract attack graph structure The embedding vector ; Using two multi-layer perceptron models, for the embedding vector , respectively generate neural network parameters for predicting the mean of node distribution and neural network parameters for predicting the variance of node distribution, use the neural network that is respectively endowed with the neural network parameters for predicting the mean of node distribution and the neural network parameters for predicting the variance of node distribution, output the node distribution of this iteration for the node distribution obtained in the previous iteration, and select the entity type corresponding to the dimension with the highest median value of the node distribution as the node type of the newly predicted node in this iteration; Using two multi-layer perceptron models, for the embedding vector , embedding vector The The embedding of nodes and the embedding vector The The embedding of nodes generates the neural network parameters for predicting the mean of the edge distribution and the neural network parameters for predicting the variance of the edge distribution, respectively. is the sequence number of the newly predicted node in this iteration, is the serial number of any existing node; Using a neural network that is respectively endowed with neural network parameters for the predicted edge distribution mean and neural network parameters for the predicted edge distribution variance, the edge distribution of this iteration is output for the edge distribution obtained in the previous iteration, the newly predicted nodes in this iteration, and the edges predicted in this iteration. The relationship type corresponding to the dimension with the highest median value in the edge distribution is selected as the edge type of the newly predicted edge, and the edge type prediction is repeated until the prediction of the edge type between the newly predicted node in this iteration and any existing node is completed.

2. The method for automatically generating advanced persistent threat samples at the traceability graph level according to claim 1 is characterized in that: The entity types include malicious process, benign process, malicious file, system file, temporary file and socket, and the relationship types include fork, delete, inject, read, write, change mode, execute, send and receive.

3. The method for automatically generating advanced persistent threat samples at the traceability graph level according to claim 1 is characterized in that: The attack phase division algorithm is used to determine the starting process node of each attack phase in the abstract attack graph structure, including: Obtain a starting node set and an ending node set of a function flow from an abstract attack graph structure, and obtain a function flow set corresponding to each process node in the abstract attack graph structure according to the starting node set and the ending node set; Take the process nodes with non-0 out-degree in the abstract attack graph structure as candidate stage feature nodes, calculate the function flow similarity between any two candidate stage feature nodes, and delete the candidate stage feature nodes whose function flow similarity is greater than the similarity threshold and whose function flow set size is small; The function flow number and total degree of the nodes are counted, and the candidate stage feature nodes remaining after deletion are sorted in ascending order according to the function flow number and total degree, respectively, to obtain a function flow number list and a total degree list, and the score of each candidate stage feature node is calculated according to its index in the function flow number list and the total degree list; The first four candidate stage feature nodes with the highest scores are taken as the starting process nodes, and in the ascending chronological order of the starting process nodes, the four starting process nodes are respectively taken as the starting process nodes of initial intrusion, the starting process nodes of privilege escalation, the starting process nodes of sensitive behavior, and the starting process nodes of goal achievement.

4. The method for automatically generating advanced persistent threat samples at the traceability graph level according to claim 3 is characterized in that: The entity types included in the starting node of the functional flow are malicious processes, benign processes and sockets, and the node degree feature of the starting node of the functional flow is 0 in-degree, or there is an out-degree edge whose timestamp is smaller than the timestamps of all in-degree edges; The entity types contained in the termination node of the functional flow are malicious processes, benign processes, malicious files, system files, temporary files and sockets. The node degree feature of the functional flow is 0 out-degree, or there is an in-degree edge whose timestamp is greater than the timestamps of all out-degree edges.

5. The method for automatically generating advanced persistent threat samples at the traceability graph level according to claim 3 is characterized in that: The function flow similarity calculation process is as follows: ； In the formula, Represents the candidate stage feature node and candidate stage feature nodes The functional flow similarity between Represents the candidate stage feature node The corresponding function flow set, Represents the candidate stage feature node The corresponding function flow set, , They represent the serial numbers of the feature nodes in the candidate stage, Indicates the length of the collection. Indicates taking the maximum value.

6. The method for automatically generating advanced persistent threat samples at the traceability graph level according to claim 3 is characterized in that: The score is calculated as follows: ； In the formula, Represents the candidate stage feature node The score, Represents the candidate stage feature node In the function flow number list The index in Indicates the function flow number list Length, Represents the candidate stage feature node In the total degree list The index in Represents a list of total degrees Length, is the weight constant.

7. The method for automatically generating advanced persistent threat samples at the traceability graph level according to claim 1 is characterized in that: The attack technology matching rules include: In the initial intrusion attack phase, if the triples [socket, receive, benign process], [benign process, read, system file], and [benign process, send, socket] are satisfied in order, the identification attack technique is numbered T1590 or T1592; In the initial intrusion attack phase, if the triples [socket, receive, benign process], [benign process, execute, malicious file], and [benign process, read, system file] are satisfied in order, the identification attack technique number is T1586; In the initial intrusion attack phase, if the triples [malicious process, write, malicious file] and [malicious process, execute, malicious file] are satisfied in order, the identification attack technology is numbered as T1091; In the initial intrusion attack phase, if the triples [malicious process, fork, benign process] and [benign process, execution, malicious file] are satisfied in order, the identification attack technology number is T1053; In the initial intrusion attack phase, if the triples [malicious process, read, system file] and [malicious process, write, temporary file] are satisfied in order, the identification attack technology number is T1217; In the privilege escalation attack phase, if the triples [malicious process, injection, benign process] and [benign process, execution, malicious file] are satisfied in order, the identification attack technique is numbered T1204; In the privilege escalation attack phase, if the triples [malicious process, read, system file] and [malicious process, write, temporary file] are satisfied in order, the identification attack technique is numbered T1555 or T1539; In the privilege escalation attack phase, if the triples [malicious process, read, system file] and [malicious process, write, system file] are satisfied in order, the identification attack technique is numbered T1078; In the privilege escalation attack phase, if the triples [malicious process, fork, benign process] and [benign process, write, system file] are satisfied in order, the identification attack technique is numbered T1136; In the privilege escalation attack phase, if the triples [malicious process, delete, system file] and [malicious process, write, system file] are satisfied in order, the identification attack technique is numbered T1036; In the privilege escalation attack phase, if the triples [malicious process, fork, benign process] and [benign process, read, system file] are satisfied in order, the identification attack technique is numbered T1087; In the privilege escalation attack phase, if the triple [malicious process, injection, benign process] is satisfied, the identification attack technique is numbered T1563; In the sensitive behavior attack phase, if the triples [first malicious process, fork, benign process] and [benign process, fork, second malicious process] are satisfied in order, the identification attack technology is numbered T1569; In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process] and [benign process, deletion, system file] are satisfied in order, the identification attack technology is numbered T1070; In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process], [benign process, read, system file], and [benign process, write, temporary file] are satisfied in order, the identification attack technology is numbered as T1201, T1518, or T1614; In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process] and [benign process, write, temporary file] are satisfied in order, the identification attack technology is numbered as T1056, T1074, or T1125; In the sensitive behavior attack phase, if the triples [malicious process, fork, benign process] and [benign process, send, socket] are satisfied in order, the identification attack technology is numbered T1568, T1571, or T1572; In the target achievement attack phase, if the triples [first malicious process, fork, second malicious process] and [second malicious process, write, system file] are satisfied in order, the identification attack technique is numbered T1037 or T1525; In the target achievement attack phase, if the triples [malicious process, fork, benign process] and [benign process, change mode, malicious file] are satisfied in order, the identification attack technology number is T1548; In the target achievement attack phase, if the triples [malicious process, fork, benign process], [benign process, write, temporary file], and [benign process, send, socket] are satisfied in order, the identification attack technique is numbered T1567; In the target achievement attack phase, if the triples [malicious process, fork, benign process] and [benign process, deletion, system file] are satisfied in order, the identification attack technique is numbered T1485, T1531, or T1561.

Images