APT network attack detection method and device based on gene map and machine learning

Abstract

The present invention belongs to the technical field of network security and machine learning, and discloses a method and device for detecting APT network attacks based on gene maps and machine learning, wherein the method software extracts genes; calculates the preliminary evaluation score of the gene fragment according to the word frequency of the word in the gene fragment, obtains the complexity factor based on the number of lines of code of the gene fragment, and weights the preliminary evaluation score using the complexity factor to obtain the final evaluation score; takes the gene fragment with a high final evaluation score as the characteristic gene; vectorizes the characteristic gene using the global word vector representation algorithm; clusters and reduces the dimension of all gene vectors to obtain multiple gene clusters; respectively sends the gene clusters into an attack detection model composed of a three-layer CNN-LSTM neural network, obtains the prediction result corresponding to each gene cluster output by the attack detection model, and aggregates all the prediction results to train and update the attack detection model. The present invention effectively improves the accuracy of APT attack detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and machine learning, and specifically relates to an APT network attack detection method and device based on gene mapping and machine learning. Background Art

[0002] APT attack, the full name of which is Advanced Persistent Threat, is a form of attack that targets specific targets with long-term and persistent network attacks. The purpose of APT attacks is usually to steal confidential information, destroy the functions of the target system, remotely control the target system, etc. Once an APT attack is successful, it will cause huge losses to the target organization, including the leakage of confidential information and the destruction of system functions. Therefore, efficient APT attack detection has become crucial.

[0003] With the emergence of deep learning algorithms and artificial neural networks, they can automatically generate features without human intervention. APT attack researchers began to rely on deep learning algorithms to develop APT network attack detection systems. However, most APT network attack detection systems developed with deep learning algorithms have problems such as poor accuracy, low detection rate, and high false alarm rate.

[0004] In response to the above problems, how to optimize deep learning algorithms and artificial neural networks to achieve more efficient APT network attack detection is an issue that needs to be solved urgently. Summary of the invention

[0005] The purpose of the present invention is to provide an APT network attack detection method and device based on gene mapping and machine learning to improve the accuracy of APT attack detection.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A first aspect: The present invention provides an APT network attack detection method based on gene mapping and machine learning, comprising:

[0008] Extracting software genes from software samples that contain or do not contain APT network attacks, wherein the software genes contain multiple gene fragments;

[0009] The preliminary evaluation score of the gene fragment is calculated according to the word frequency of the words in the gene fragment, and the complexity factor is obtained based on the number of code lines of the gene fragment. The complexity factor is used to weight the preliminary evaluation score to obtain the final evaluation score;

[0010] A preset number of gene fragments before the final evaluation score is taken as the characteristic genes of the software sample;

[0011] The feature gene is vectorized by using a global word vector representation algorithm to obtain a gene vector corresponding to the feature gene, wherein a weighting function is superimposed on the objective function of the global word vector representation algorithm, and the weighting function is calculated by the co-occurrence frequency of two words in the objective function;

[0012] Clustering and dimension reduction of all gene vectors to obtain multiple gene clusters;

[0013] The gene clusters are respectively sent to the attack detection model composed of a three-layer CNN-LSTM neural network to obtain the prediction results corresponding to each gene cluster output by the attack detection model. All prediction results are aggregated to train and update the attack detection model.

[0014] APT network attack detection is performed based on the attack detection model after training and updating, and the prediction result of whether the target software belongs to APT attack software or non-APT attack software is obtained.

[0015] Several optional methods are also provided below, but they are not intended to be additional limitations on the above-mentioned overall solution, but are merely further supplements or preferences. Under the premise that there are no technical or logical contradictions, each optional method can be combined with the above-mentioned overall solution separately, and multiple optional methods can also be combined.

[0016] Preferably, the step of calculating the preliminary evaluation score of the gene fragment according to the word frequency of the word in the gene fragment comprises:

[0017] ;

[0018] ;

[0019] In the formula, Represents software gene Medium gene fragment The initial assessment score, Indicates gene fragment The number of words contained in Indicates the number of software samples, Represents software gene Contains words The total number of gene fragments, Indicates gene fragment The words, represents the first positive parameter, Expressive words In software genes The word frequency in represents the second positive parameter, Expressive words In gene fragment The word frequency in is the intermediate parameter, represents the information level parameter, Represents software gene Length, Represents the average length of the software genes corresponding to all software samples.

[0020] Preferably, the complexity factor is obtained based on the number of lines of code of the gene fragment, and the initial evaluation score is weighted by the complexity factor to obtain the final evaluation score, including:

[0021] ;

[0022] ;

[0023] In the formula, Indicates gene fragment The complexity factor of Indicates gene fragment The number of lines of code, Represents software gene The average number of lines of code is the software gene Total lines of code and software genes The ratio of the number of gene fragments contained, Represents software gene Medium gene fragment The final evaluation score.

[0024] Preferably, the weighting function is calculated by the co-occurrence frequency of two words in the objective function, including:

[0025] ;

[0026] In the formula, is the weighting function, represents the co-occurrence frequency of two words in the target function, is the maximum co-occurrence frequency threshold.

[0027] Preferably, the clustering adopts a non-weighted group averaging method, and the dimension reduction adopts a unified manifold approximation and projection algorithm.

[0028] Preferably, the attack detection model includes three layers of CNN-LSTM neural networks connected in sequence, and a fully connected layer connected after the third layer of CNN-LSTM neural network, wherein the CNN-LSTM neural network includes a convolutional layer, a maximum pooling layer, a batch normalization layer and an LSTM layer.

[0029] Preferably, if there is a gene cluster whose prediction result is APT attack software, the prediction result of the target software is APT attack software; otherwise, the prediction result of the target software is non-APT attack software.

[0030] Second aspect: The present invention provides an APT network attack detection device based on genetic mapping and machine learning, comprising a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the APT network attack detection method based on genetic mapping and machine learning.

[0031] The present invention provides a method and device for detecting APT network attacks based on gene mapping and machine learning, which has the following beneficial effects compared with the prior art:

[0032] 1. Combining genetic technology with the improved global word vector representation algorithm (GloVe algorithm) reduces the impact of high-frequency co-occurring words such as system words, and effectively reduces the occurrence of false positives and negatives.

[0033] 2. In view of the characteristics of APT attacks, a code complexity factor is added to gene cleaning, which greatly reduces the concealment of APT code, can effectively detect unknown threats, and improve detection accuracy.

[0034] 3. Reduce the dimension of the data set so that it can better match the CNN-LSTM three-layer neural network, improve the automation level of genetic technology, and help discover and prevent APT attacks in the early stages. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart of an APT network attack detection method based on gene mapping and machine learning of the present invention;

[0036] Figure 2 It is a structural diagram of the attack detection model of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0039] like Figure 1 As shown, this embodiment provides an APT network attack detection method based on gene mapping and machine learning, comprising the following steps:

[0040] (1) Gene extraction and selection: Extract software genes from software samples that contain or do not contain APT network attacks, calculate the preliminary evaluation score of the gene fragment based on the word frequency of the words in the gene fragment, and obtain the complexity factor based on the number of code lines in the gene fragment. Use the complexity factor to weight the preliminary evaluation score to obtain the final evaluation score, and take the preset number of gene fragments before the final evaluation score as the characteristic genes of the software sample. Gene technology can deeply analyze the essential characteristics of APT software code and reduce false positives and false negatives.

[0041] (1-1) Gene extraction: A software gene refers to a binary sequence fragment that carries specific functions or information in the software code. It is composed of one or more basic code blocks. A basic code block is defined as a series of instructions executed in sequence. If the termination instruction of a basic code block is a library function call (excluding exit-like functions), the basic code block will be merged with the next basic code block at the physical address that follows it. When the merging process cannot continue, the formed code block is regarded as an independent software gene. Software samples containing or not containing APT network attacks are collected as training data. One software sample is extracted to obtain a software gene, and one software gene contains multiple gene fragments.

[0042] (1-2) Gene cleaning: In the set of extracted gene fragments, there are a large number of gene fragments that are not related to APT attack detection. In order to improve the detection efficiency, the Best Matching 25 algorithm (BM25 algorithm) is used to classify the gene fragments, aiming to remove the noise components in the software genes, so as to more accurately identify the gene fragments that can represent specific APT characteristics. As shown in formula (1) and formula (2), for the gene fragments in the software genes extracted from a software sample, (The first gene fragments), Represents software gene Medium gene fragment The initial assessment score, Indicates gene fragment The number of words contained in Indicates the number of software samples, Represents software gene Contains words The total number of gene fragments, Indicates gene fragment The words, Represents the first positive parameter, used to standardize the range of word frequency, Expressive words In software genes The word frequency in Represents the second positive parameter, used to correct the gene fragment The frequency range of the words in Expressive words In gene fragment The word frequency in is the intermediate parameter, The parameter representing the amount of information is used to indicate the amount of information. Represents software gene Length, Represents the average length of the software genes corresponding to all software samples.

[0043] (1)

[0044] (2)

[0045] In order to hide itself, APT attack software will confuse detection software through complex codes, such as the number of code lines and the number of nested layers, etc. Therefore, this embodiment introduces a complexity factor, as shown in formula (3) and formula (4). Indicates gene fragment The complexity factor of Indicates gene fragment The number of lines of code, Represents software gene The average number of lines of code is the software gene Total lines of code and software genes The ratio of the number of gene fragments contained, Represents software gene Medium gene fragment The final evaluation score.

[0046] (3)

[0047] (4)

[0048] (1-3) Gene selection: In this embodiment, after testing and training, the parameters The value is 1.3. The value is 1.5. When the value is 0.75, the test effect is better. The final evaluation score of all gene fragments in the software gene corresponding to each software sample is calculated. Sorting is performed, and the gene fragments in the top 300 (which can be adjusted according to actual conditions) are selected as the characteristic genes of the software sample.

[0049] (2) Gene clustering and dimensionality reduction: Use the global word vector representation algorithm to vectorize the feature genes and obtain the gene vectors corresponding to the feature genes. Cluster and reduce the dimension of all gene vectors to obtain multiple gene clusters, which form the input for subsequent machine learning.

[0050] (2-1) Vector construction: The GloVe algorithm is used to vectorize the gene fragment sequence to obtain a gene vector, and then the cosine similarity is used to calculate the similarity between gene vectors and measure the distance between gene vectors. In the vectorization process, since the gene fragment is composed of codes, it contains a large number of high-frequency co-occurring words, such as if and else, for and break, etc. In order to reduce the contribution of high-frequency co-occurring word pairs in the loss function and prevent them from dominating the training process, this embodiment adds a weighting function to the traditional GloVe algorithm and adds it to the objective function in the step of minimizing the objective function, as shown in formula (5). is the weighting function, represents the co-occurrence frequency of two words in the target function, is the maximum co-occurrence frequency threshold, and the weighting function resets the weight to 1 after the co-occurrence frequency exceeds the threshold. After the weighting function is superimposed on the objective function, the specific processing process of the GloVe algorithm refers to the conventional steps, which will not be described in detail in this embodiment.

[0051] (5)

[0052] (2-2) Gene clustering: Highly similar genes are usually considered to have basically the same functions and are therefore classified into the same category. This example uses the unweighted group average method (UPGMA clustering algorithm) to perform systematic clustering analysis on gene vectors. For any two gene clusters to be clustered and , the distance between them This is achieved by calculating the average distance between all gene points in two clusters. Represents gene cluster The gene vector in Indicates gene cluster The gene vector in Represents gene vector With gene vector The distance between Indicates gene cluster The model, Indicates gene cluster The modulus is shown in formula (6).

[0053] (6)

[0054] Each time a gene cluster is merged, a new gene cluster is formed, and the distance between the new cluster and other clusters needs to be updated, as shown in formula (7). Indicates new gene clusters Original gene cluster The distance between Indicates gene cluster Gene cluster The distance between them is calculated in the same way as formula (6). Indicates gene cluster Gene cluster The calculation principle is the same as formula (6).

[0055] (7)

[0056] (2-3) Gene dimensionality reduction: The unified manifold approximation and projection algorithm (UMAP algorithm) is used for dimensionality reduction, so that the data set can be better matched with the CNN-LSTM three-layer neural network, which improves the automation level of genetic technology and helps to discover and prevent attacks in the early stages of APT attacks. In constructing the high-dimensional space fuzzy simple set, this embodiment uses the Gaussian kernel function, as shown in formula (8). is a data point in high-dimensional space and The similarity between represents the Euclidean distance, It is a hyperparameter and its value is 30 in this embodiment.

[0057] (8)

[0058] (3) Model building and testing: The gene clusters are respectively sent to the attack detection model composed of a three-layer CNN-LSTM neural network to obtain the prediction results corresponding to each gene cluster output by the attack detection model, and all prediction results are aggregated to train and update the attack detection model. The method of this embodiment does not rely on a known code feature library, but analyzes universal APT features through genetic technology, which can effectively detect unknown threats. In addition, combined with machine learning, the automation level of genetic technology is improved, which helps to discover and prevent attacks in the early stages of APT attacks and reduce the impact of attacks on the system.

[0059] like Figure 2As shown, the attack detection model of this embodiment includes three layers of CNN-LSTM neural networks connected in sequence, and a fully connected layer connected after the third layer of CNN-LSTM neural network, wherein the CNN-LSTM neural network is a deep learning model that combines convolutional neural network (CNN) and long short-term memory network (LSTM), including convolutional layer, maximum pooling layer, batch normalization layer and LSTM layer. The detailed description of each layer is as follows:

[0060] Convolutional layer: A convolutional neural network is used to process the input gene vector. After the convolutional layer operation, the main features are extracted through the maximum pooling layer, and batch normalization is implemented to stabilize the learning process.

[0061] LSTM (Long Short-Term Memory) layer: The feature vector is passed to the LSTM layer to capture the temporal dependencies in the sequence data. The combination of CNN and LSTM layers is repeated three times with different numbers of neurons and filters to enhance the feature extraction capability of the model.

[0062] Fully connected layer: The output of the third layer of CNN-LSTM neural network is sent to a fully connected layer, which uses the SoftMax activation function for classification. The function of the fully connected layer is to map the gene features into a vector of length 2, which represents the probability that the gene cluster belongs to APT attack software and non-APT attack software. If there is a gene cluster whose prediction result is APT attack software, the prediction result of the software sample is APT attack software; otherwise, the prediction result of the software sample is non-APT attack software.

[0063] After the prediction of the attack detection model is completed, APT network attack detection is performed based on the attack detection model after training and updating. Specifically:

[0064] Extract software genes from target software;

[0065] The preliminary evaluation score of the gene fragment is calculated based on the word frequency in the gene fragment. At this time, the parameters in formula (1) are taken The value of is 1, and the complexity factor is obtained based on the number of code lines of the gene fragment. The complexity factor is used to weight the preliminary evaluation score to obtain the final evaluation score;

[0066] A preset number of gene fragments before the final evaluation score is taken as the characteristic genes of the target software;

[0067] Use the global word vector representation algorithm to vectorize the characteristic genes and obtain the gene vector corresponding to the characteristic genes;

[0068] Clustering and dimension reduction of all gene vectors to obtain multiple gene clusters;

[0069] The gene clusters are respectively sent to the attack detection model composed of a three-layer CNN-LSTM neural network to obtain the prediction results corresponding to each gene cluster output by the attack detection model;

[0070] If there is a gene cluster whose prediction result is APT attack software, the prediction result of the target software is APT attack software; otherwise, the prediction result of the target software is non-APT attack software, and finally the prediction result of the target software is APT attack software or non-APT attack software.

[0071] In another embodiment, the present invention also provides an APT network attack detection device based on genetic mapping and machine learning, comprising a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the APT network attack detection method based on genetic mapping and machine learning.

[0072] For the specific limitations of the APT network attack detection device based on genetic mapping and machine learning, please refer to the limitations of the APT network attack detection method based on genetic mapping and machine learning above, which will not be repeated here.

[0073] The memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The memory stores a computer program that can be run on the processor, and the processor implements the method of the present invention by running the computer program stored in the memory.

[0074] The memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory is used to store a program, and the processor executes the program after receiving an execution instruction.

[0075] The processor may be an integrated circuit chip with data processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0076] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0077] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A method for detecting APT network attacks based on gene mapping and machine learning, characterized in that: The APT network attack detection method based on gene mapping and machine learning includes: Extracting software genes from software samples that contain or do not contain APT network attacks, wherein the software genes contain multiple gene fragments; The preliminary evaluation score of the gene fragment is calculated according to the word frequency of the words in the gene fragment, and the complexity factor is obtained based on the number of code lines of the gene fragment. The complexity factor is used to weight the preliminary evaluation score to obtain the final evaluation score; A preset number of gene fragments before the final evaluation score is taken as the characteristic genes of the software sample; Vectorizing the characteristic gene by using a global word vector representation algorithm to obtain a gene vector corresponding to the characteristic gene, wherein a weighting function is superimposed on the objective function of the global word vector representation algorithm, and the weighting function is calculated by the co-occurrence frequency of two words in the objective function; Clustering and dimension reduction of all gene vectors to obtain multiple gene clusters; The gene clusters are respectively sent to the attack detection model composed of a three-layer CNN-LSTM neural network to obtain the prediction results corresponding to each gene cluster output by the attack detection model. All prediction results are aggregated to train and update the attack detection model. Perform APT network attack detection based on the attack detection model after training and updating, and obtain the prediction result of whether the target software belongs to APT attack software or non-APT attack software; The step of calculating the preliminary evaluation score of the gene fragment according to the word frequency of the word in the gene fragment includes: ； ； In the formula, Represents software gene Medium gene fragment The initial assessment score, Indicates gene fragment The number of words contained in Indicates the number of software samples, Represents software gene Contains words The total number of gene fragments, Indicates gene fragment The words, represents the first positive parameter, Expressive words In software genes The word frequency in represents the second positive parameter, Expressive words In gene fragment The word frequency in is the intermediate parameter, represents the information level parameter, Represents software gene Length, Represents the average length of the software genes corresponding to all software samples.

2. The APT network attack detection method based on gene mapping and machine learning according to claim 1 is characterized in that: The complexity factor is obtained based on the number of lines of code of the gene fragment, and the initial evaluation score is weighted by the complexity factor to obtain the final evaluation score, including: ； ； In the formula, Indicates gene fragment The complexity factor of Indicates gene fragment The number of lines of code, Represents software gene The average number of lines of code is the software gene Total lines of code and software genes The ratio of the number of gene fragments contained, Represents software gene Medium gene fragment The final evaluation score.

3. The APT network attack detection method based on gene mapping and machine learning according to claim 1 is characterized in that: The weighting function is calculated by the co-occurrence frequency of two words in the target function, including: ； In the formula, is the weighting function, represents the co-occurrence frequency of two words in the target function, is the maximum co-occurrence frequency threshold.

4. The APT network attack detection method based on gene mapping and machine learning according to claim 1 is characterized in that: The clustering adopts the non-weighted group average method, and the dimension reduction adopts the unified manifold approximation and projection algorithm.

5. The APT network attack detection method based on gene mapping and machine learning according to claim 1 is characterized in that: The attack detection model includes three layers of CNN-LSTM neural networks connected in sequence, and a fully connected layer connected after the third layer of CNN-LSTM neural network, wherein the CNN-LSTM neural network includes a convolution layer, a maximum pooling layer, a batch normalization layer and an LSTM layer.

6. The APT network attack detection method based on gene mapping and machine learning according to claim 1 is characterized in that: If there is a gene cluster whose prediction result is APT attack software, then the prediction result of the target software is APT attack software; otherwise, the prediction result of the target software is non-APT attack software.

7. An APT network attack detection device based on gene mapping and machine learning, comprising a processor and a memory storing a plurality of computer instructions, characterized in that: When the computer instructions are executed by the processor, the steps of the APT network attack detection method based on genetic mapping and machine learning as described in any one of claims 1 to 6 are implemented.

Images