Network attack tracing method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of network attack tracing, and discloses a network attack tracing method and device, computer equipment and a storage medium, and the method comprises the steps: carrying out the entity recognition of historical attack event data; constructing a network attack traceability knowledge graph by using the entities corresponding to the historical attack event data and the association relationship; carrying out community division on entities in the network attack traceability knowledge graph by utilizing a community discovery algorithm; obtaining current attack event data, performing multi-dimensional constraint on the current attack event data, and determining a target community where a current attack event is located; and extracting related information corresponding to the current attack event data, determining a connection relationship between the related information and the target community, carrying out constraint on the target community based on the connection relationship, and carrying out tracing to obtain a tracing result corresponding to the current attack event data. According to the invention, the accuracy and efficiency of attack event tracing are improved, the accuracy and effectiveness of the tracing result are ensured, and complex and changeable network attack scenes can be dealt with.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack tracing technology, and in particular to a network attack tracing method, device, computer equipment and storage medium. Background Art

[0002] With the development of Internet technology, network attacks are becoming increasingly complex, and traditional security protection mechanisms face challenges in dealing with advanced persistent threats (APT) and multi-stage attacks. Attackers use multi-step strategies to cover up attack traces, making tracing more difficult.

[0003] In related technologies, attack tracing assumes that there are undetected threats lurking inside the information system, and security analysts are required to identify the malicious behavior of attackers in the tracing data and reconstruct the attack scenario. Limited by the personal experience and ability of security analysts, the accuracy and efficiency of attack tracing cannot be guaranteed, and it is difficult to ensure the accuracy and effectiveness of tracing results in response to complex and changing network attack scenarios. Summary of the invention

[0004] In view of this, the present invention provides a network attack tracing method, apparatus, computer equipment and storage medium to solve the problem that it is difficult to ensure the accuracy and effectiveness of tracing results in dealing with complex and changeable network attack scenarios.

[0005] In a first aspect, the present invention provides a network attack source tracing method, the method comprising:

[0006] Obtain historical attack event data;

[0007] Perform entity recognition on historical attack event data to identify entities and association relationships corresponding to the historical attack event data;

[0008] Use the entities and relationships corresponding to historical attack event data to build a network attack tracing knowledge graph;

[0009] Using the community discovery algorithm, the entities in the network attack tracing knowledge graph are divided into communities to obtain several communities;

[0010] Obtain current attack event data, perform multi-dimensional constraints on the current attack event data, and determine the target community where the current attack event is located;

[0011] Extract relevant information corresponding to the current attack event data, use preset verification rules to determine the connection relationship between the relevant information and the target community, constrain the target community based on the connection relationship, and trace back to obtain the tracing results corresponding to the current attack event data.

[0012] In the present invention, by performing semantic analysis and relationship mining on attack event data, combined with accurate entity recognition and correlation of key entities in attack events; through community division, focusing on the core elements corresponding to attack events such as attack organizations, tool technologies, etc., the accuracy and efficiency of attack event tracing are further improved. Through multi-dimensional verification, the accuracy and effectiveness of the tracing results are ensured, and it can cope with complex and changeable network attack scenarios, significantly improving network security protection capabilities. The knowledge graph and community discovery algorithm are coordinated, breaking through the limitations of traditional rule-based tracing methods, and can more accurately identify attack groups and locate key nodes, greatly improving the accuracy, depth and accuracy of network attack tracing.

[0013] In an optional implementation, performing entity recognition on the historical attack event data to identify entities and association relationships corresponding to the historical attack event data includes:

[0014] Based on preset regular rules, historical attack event data is matched with entities to determine different types of entities corresponding to the historical attack event data;

[0015] Construct a mapping dictionary corresponding to each type of entity, perform entity recognition on the historical attack event data based on the mapping dictionary, and determine the entity corresponding to the historical attack event data;

[0016] The pre-trained entity recognition model is used to perform entity recognition on the historical attack event data, identify the entities corresponding to the historical attack event data, and establish the association relationship between the related entities in the historical attack event data.

[0017] In this approach, a comprehensive network attack tracing knowledge graph is constructed by using a large model to identify and structure the attack behaviors, entities and relationships from multi-source heterogeneous attack event data. This not only intuitively displays the attack path and its potential correlations, but also uses knowledge reasoning technology to explore hidden attack patterns and correlations, achieving a deeper understanding and tracing of network attacks.

[0018] In an optional implementation, a community discovery algorithm is used to divide entities in the network attack source tracing knowledge graph into communities to obtain several communities, including:

[0019] Take each entity in the network attack tracing knowledge graph as the initial community;

[0020] The modularity of each initial community is calculated, and the community discovery algorithm is used to merge the initial communities based on the modularity of each initial community until the modularity corresponding to all communities no longer changes, thereby obtaining several communities.

[0021] In this way, the community discovery algorithm based on modularity optimization can accurately divide the community structure formed by core nodes such as attack organizations, tools, and technologies, thereby improving the global understanding and tracing capabilities of multi-step and multi-stage attacks. It can effectively identify groups of attack nodes with close internal connections and reveal the collaborative relationship between attackers, thereby improving the efficiency and accuracy of attack tracing, especially when dealing with complex advanced persistent threats.

[0022] In an optional implementation, multi-dimensional constraints are applied to the current attack event data to determine the target community where the current attack event is located, including:

[0023] Perform entity recognition on the current attack event data to identify the entities and relationships corresponding to the current attack event data, and add the entities and relationships corresponding to the current attack event data to the network attack tracing knowledge graph to obtain an updated network attack tracing knowledge graph;

[0024] The updated network attack tracing knowledge graph is divided into communities, and the target community corresponding to the current attack event is identified based on four dimensions: ATTCK organization, attack organization, attack technology, and affiliated company.

[0025] In this method, by introducing preset verification rules and multi-dimensional third-party application programming interface (API) verification, combined with community discovery results, the accuracy and reliability of the tracing results obtained from the tracing analysis of the current attack events are ensured. Especially in the case of indirect associations, the accuracy of locating the source of the attack is improved through multi-order connection mining, further enhancing the credibility of the tracing results.

[0026] In an optional implementation, extracting relevant information corresponding to the current attack event data includes:

[0027] Based on the entities and relationships corresponding to the current attack event data, filter the third-party application programming interface corresponding to the current attack event;

[0028] Utilize a third-party application programming interface to extract relevant information corresponding to the current attack event data.

[0029] In this way, by combining third-party application programming interfaces for multi-dimensional verification, the accuracy and effectiveness of the traceability results are further ensured, the ability to trace the source of network attacks in complex and changeable network attack scenarios is improved, and the network security protection capabilities are significantly improved.

[0030] In an optional implementation, determining the connection relationship between the relevant information and the target community includes:

[0031] Determine whether relevant information exists in the target community;

[0032] When the relevant information does not exist in the target community, query the order of the connection relationship between the relevant information and the target community, and determine whether the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold;

[0033] When the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold, it is determined that the current attack event has no connected target community.

[0034] In this way, combined with the community discovery results, the accuracy and reliability of the current attack event tracing analysis are ensured. In the case of indirect association, the accuracy of attack source positioning is improved through multi-order connection mining, further enhancing the credibility of the tracing results.

[0035] In a second aspect, the present invention provides a network attack source tracing device, the device comprising:

[0036] A data acquisition module is used to acquire historical attack event data;

[0037] An entity recognition module is used to perform entity recognition on historical attack event data, and identify entities and association relationships corresponding to the historical attack event data;

[0038] The knowledge graph construction module is used to construct a network attack tracing knowledge graph using the entities and associations corresponding to historical attack event data;

[0039] The community division module is used to divide the entities in the network attack tracing knowledge graph into communities using the community discovery algorithm to obtain several communities;

[0040] The multi-dimensional constraint module is used to obtain the current attack event data, perform multi-dimensional constraints on the current attack event data, and determine the target community where the current attack event is located;

[0041] The connection relationship tracing module is used to extract relevant information corresponding to the current attack event data, use preset verification rules to determine the connection relationship between the relevant information and the target community, constrain the target community based on the connection relationship, and trace the source to obtain the tracing results corresponding to the current attack event data.

[0042] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the network attack tracing method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the network attack tracing method of the first aspect or any corresponding embodiment thereof.

[0044] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the network attack tracing method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 It is a flowchart of a network attack source tracing method according to an embodiment of the present invention.

[0047] Figure 2 It is a schematic diagram of constructing a paradigm representation of a knowledge graph according to an embodiment of the present invention.

[0048] Figure 3 It is a flowchart of a network attack tracing method based on a knowledge graph and a community discovery algorithm according to an embodiment of the present invention.

[0049] Figure 4 The figure is a flowchart of another network attack source tracing method according to an embodiment of the present invention.

[0050] Figure 5 It is a flowchart of another network attack source tracing method according to an embodiment of the present invention.

[0051] Figure 6 4 is a structural block diagram of a network attack source tracing device according to an embodiment of the present invention.

[0052] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0054] In related technologies, attack tracing assumes that there are undetected threats lurking inside the information system, and security analysts are required to identify the malicious behavior of attackers in the tracing data and reconstruct the attack scenario. Limited by the personal experience and ability of security analysts, the accuracy and efficiency of attack tracing cannot be guaranteed, and it is difficult to ensure the accuracy and effectiveness of tracing results in response to complex and changing network attack scenarios.

[0055] As a semantic network technology, knowledge graph can associate and integrate structured and unstructured data to form a relationship graph between entities. This graph not only contains rich contextual semantics, but also can discover the correlation between hidden attackers through graph structure analysis, thus providing a solid foundation for tracing the source of network attacks.

[0056] The community detection algorithm aims to divide closely connected nodes into the same community by analyzing the relationship between nodes and edges in the knowledge graph. The community detection algorithm based on modularity optimization can identify nodes or groups that play a key role in network attacks and provide efficient clues for subsequent tracing analysis.

[0057] In order to solve the above problems, a network attack tracing method is provided in the embodiment of the present invention, which is used in a computer device. It should be noted that its execution subject can be a network attack tracing device, which can be implemented as part or all of the computer device through software, hardware or a combination of software and hardware. The computer device can be a terminal or a client or a server. The server can be a server or a server cluster composed of multiple servers. The terminal in the embodiment of the present application can be a smart phone, a personal computer, a tablet computer and other intelligent hardware devices. In the following method embodiments, the execution subject is a computer device as an example for explanation.

[0058] The computer device in this embodiment is suitable for mining potential patterns in network attacks and tracing the source of attackers. The present invention provides a network attack tracing method, which performs semantic analysis and relationship mining on attack event data, combines accurate entity identification and key entities in associated attack events; through community division, it focuses on the core elements corresponding to attack events such as attack organizations, tool technologies, etc., and further improves the accuracy and efficiency of attack event tracing. Through multi-dimensional verification, the accuracy and effectiveness of the tracing results are ensured, and it can cope with complex and changeable network attack scenarios, significantly improving network security protection capabilities. The knowledge graph and community discovery algorithm are coordinated, breaking through the limitations of traditional rule-based tracing methods, and can more accurately identify attack groups and locate key nodes, greatly improving the accuracy, depth and accuracy of network attack tracing.

[0059] According to an embodiment of the present invention, an embodiment of a network attack tracing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0060] In this embodiment, a network attack tracing method is provided, which can be used for the above-mentioned computer device. Figure 1 is a flow chart of a network attack source tracing method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0061] Step S101, obtaining historical attack event data.

[0062] In one example, obtaining historical attack event data may include: on the one hand, automatically crawling public intelligence data through crawlers such as Scrapy; secondly, collecting historical attack data including attackers, contact information, etc. through manual collection and verification; and obtaining historical attack tracing information through related APIs such as Weibo Community, ChinaZ, and Tianyancha, including information such as the assets contained in the attacking IP, the company to which it belongs, and the legal person.

[0063] Step S102: perform entity recognition on the historical attack event data to obtain entities and association relationships corresponding to the historical attack event data.

[0064] In one example, entity recognition is performed on historical attack event data based on specific rules; dictionary mapping is performed for some specific names, and similar mapping dictionaries are constructed for each type of entity to achieve entity recognition of historical attack event data; large open source models such as chatglm and Llama are used through Lora fine-tuning, and fine-tuned using Lora fine-tuning to achieve entity recognition of historical attack event data. Figure 2 is a schematic diagram of constructing a paradigm representation of a knowledge graph according to an embodiment of the present invention, in which related entities contained in the same text are directly constructed as follows: Figure 2 The relationship shown.

[0065] Step S103, using the entities and associations corresponding to the historical attack event data, construct a network attack tracing knowledge graph.

[0066] In one example, the above steps are used to identify entities and relationships in historical attack event data, and Neo4j is used as a storage carrier for the comprehensive knowledge graph of network attack events to facilitate the implementation of subsequent community discovery algorithms.

[0067] Step S104, using a community discovery algorithm, divide the entities in the network attack source tracing knowledge graph into communities to obtain a number of communities.

[0068] In one example, a modularity-based community discovery algorithm is used to divide similar entities such as attackers, attack organizations, and attack technologies in the network attack tracing knowledge graph into communities, providing reliable data support for subsequent tracing.

[0069] Step S105, obtaining current attack event data, performing multi-dimensional constraints on the current attack event data, and determining the target community where the current attack event is located.

[0070] In one example, current attack event data is obtained, entity recognition is performed on the current attack event data, entities and associated relationships corresponding to the current attack event data are obtained, the newly identified entities and relationships are incrementally added to the knowledge graph, and the above-mentioned community discovery algorithm is used to divide the new graph into communities. The community where the attack event is located is converged from four dimensions: ATTCK organization, attack organization, attack technology, and affiliated company, and the community where the current attack is located is obtained: ATTCK organization type community, attack organization type community, attack technology type community, and affiliated company type community.

[0071] Step S106, extract relevant information corresponding to the current attack event data, use preset verification rules to determine the connection relationship between the relevant information and the target community, constrain the target community based on the connection relationship, and trace back to obtain the tracing result corresponding to the current attack event data.

[0072] In one example, the above steps are used to obtain entity recognition results, and the entity recognition results are sent to third-party APIs such as ChinaZ, Weibu Online, and Tianyancha (it is necessary to select a suitable third-party API tool based on the entity recognition results, and different APIs have different required parameters) to extract relevant information about the current attack, including the attacker's IP ownership, formula name, company contact information, attacker's name, etc. This information is defined as information X.

[0073] In one implementation scenario, Figure 3 is a flow chart of a network attack source tracing method based on a knowledge graph and a community discovery algorithm according to an embodiment of the present invention. Figure 3 As shown, the network attack tracing method based on knowledge graph and community discovery algorithm may include: obtaining network attack data; performing entity recognition on network attack data to obtain entity recognition results, and the recognition methods include regular, dictionary and large model methods; combining knowledge graph, using multi-dimensional community discovery algorithm, tracing the network attack data from four dimensions of ATTCK organization, attack organization, company and attack technology, and obtaining tracing results; using third-party APIs such as ChinaZ, Weibu Online and Tianyancha to constrain the entity recognition results, and perform expert verification to constrain the above tracing results, and output the constrained tracing result information.

[0074] The network attack tracing method provided in this embodiment performs semantic analysis and relationship mining on the attack event data, combines accurate entity identification and associates key entities in the attack events; through community division, it focuses on the core elements corresponding to the attack events such as attack organizations, tool technologies, etc., and further improves the accuracy and efficiency of attack event tracing. Through multi-dimensional verification, the accuracy and effectiveness of the tracing results are ensured, and it can cope with complex and changeable network attack scenarios, significantly improving the network security protection capabilities. It realizes the collaboration of knowledge graph and community discovery algorithm, breaks through the limitations of traditional rule-based tracing methods, can more accurately identify attack groups and locate key nodes, and greatly improves the accuracy, depth and accuracy of network attack tracing.

[0075] In this embodiment, a network attack tracing method is provided, which can be used for the above-mentioned computer device. Figure 4 FIG. 4 is a flow chart of another network attack source tracing method according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0076] Step S401, obtain historical attack event data. For details, see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0077] Step S402: perform entity recognition on the historical attack event data to obtain entities and association relationships corresponding to the historical attack event data.

[0078] Specifically, the above step S402 includes:

[0079] Step S4021: perform entity matching on the historical attack event data based on preset regular rules to determine different types of entities corresponding to the historical attack event data.

[0080] Step S4022: construct a mapping dictionary corresponding to each type of entity, perform entity recognition on the historical attack event data based on the mapping dictionary, and determine the entity corresponding to the historical attack event data.

[0081] Step S4023, using the pre-trained entity recognition model, perform entity recognition on the historical attack event data, identify the entities corresponding to the historical attack event data, and establish association relationships between related entities in the historical attack event data.

[0082] In an example, there are several ways to identify entities and relationships:

[0083] 1) Entity identification based on specific rules: such as identification of attribute information related to the attacking organization. For example:

[0084] Mobile phone: ^(?:(?:\+|00)86-?)? 1[3-9]\d{9}$

[0085] ID number: ^[1-9]\d{5}(18|19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|

[12] \d|3

[01] )\d{3}(\d|X)$

[0086] Email: ^\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*$

[0087] On the other hand, similar formats such as APT28, CAPEC-11, and CWE-79 can also be directly matched to the corresponding ATTCK attackers, attack techniques, and vulnerability entities.

[0088] 2) Entity recognition based on dictionary matching: For example, for some specific names, a dictionary mapping is performed as follows:

[0089] "Entity Type 1": ["AA Company", "BB Company", "CC Company"]

[0090] "Entity Class 2": ["DD Company", "EE Company", "FF Company"]

[0091] "Entity Class 3": ["GG Company", "HH Company", "II Company"]

[0092] }

[0093] Manual construction is performed based on specific application scenarios. For example, for power grid systems, there are common network security attack event mapping methods as shown below:

[0094] {

[0095] "Attack event 1": ["Attack method A", "Attack method B", "Attack method C"]

[0096] "Attack Event 2": ["Attack Method D", "Attack Method E", "Attack Method F"]

[0097] "Attack Event 3": ["Attack Method G", "Attack Method H", "Attack Method I"]

[0098] }

[0099] By constructing a similar mapping dictionary for each type of entity, the accuracy of entity recognition can be greatly improved.

[0100] 3) Entity recognition is achieved based on fine-tuning of the large model: the following data set is artificially constructed, where the text field represents the input text, entities represents the obtained entity list, start_idx represents the start index of the entity, end_idx is the end index of the entity, entity_text is the name of the entity, and entity_names is the category name of the entity. The labeling process can be achieved with the help of tools such as Doccano and Prodigy.

[0101] Specifically, the following is a sample of the construction of a fine-tuning dataset:

[0102] "text":"On August 10, 2023, the hacker group APT28 launched a phishing attack against a multinational company MegaTech. The attacker exploited the CVE-2022-12345 vulnerability and infiltrated MegaTech's server through the malicious domain malicious-domain.com, ultimately obtaining the company's sensitive data.",

[0103]

[0104] "entity_text":"malicious-domain.com",

[0105] "entity_names":["domain name"]

[0106] }

[0107] ],

[0108] }

[0109] After processing the labeled data, we can get fine-tuned data pairs of the large model similar to the following:

[0110] {"instruction":"On August 10, 2023, the hacker group APT28 launched a phishing attack against a multinational company MegaTech. The attacker exploited the CVE-2022-12345 vulnerability and infiltrated MegaTech's server through the malicious domain malicious-domain.com, and finally obtained the company's sensitive data.","system":"You are a technical expert in the field of network security and entity identification. You need to extract information such as: attack organization, affiliated company, attack event, device information, domain name information, service and component information, ATTCK attack technology, ATTCK organization, vulnerability entity (CVE, CWE, etc.), attack log, etc. from the given data, and output it in json format, such as {"entity_text":"Phishing attack","entity_label":"Attack event"},Note:1. Each line of output must be a correct json string.2. When no entity is found, the output is "No entity found","output":[{"entity_text":"APT28","entity_label":"Attack organization"},{"entity_text":"MegaTech","entity_label":"Company"},{"entity_text":"Phishing attack","entity_label":"Attack event"},{"entity_text":"CVE-2022-12345","entity_label":"Vulnerability"},{"entity_text":"malicious-domain.com","entity_label":"Domain name information"}]}

[0111] By fine-tuning Lora, we use chatglm, Llama and other open source models to achieve entity recognition tasks. For association relationships, we directly establish association relationships between related entities contained in the same text.

[0112] In this approach, a comprehensive network attack tracing knowledge graph is constructed by using a large model to identify and structure the attack behaviors, entities and relationships from multi-source heterogeneous attack event data. This not only intuitively displays the attack path and its potential correlations, but also uses knowledge reasoning technology to explore hidden attack patterns and correlations, achieving a deeper understanding and tracing of network attacks.

[0113] Step S403: Use the entities and relationships corresponding to the historical attack event data to construct a network attack tracing knowledge graph. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0114] Step S404: Use a community discovery algorithm to divide entities in the network attack source tracing knowledge graph into communities to obtain a number of communities.

[0115] Specifically, the above step S404 includes:

[0116] Step S4041, taking each entity in the network attack tracing knowledge graph as the initial community.

[0117] Step S4042, calculating the modularity of each initial community, and using a community discovery algorithm to merge the initial communities based on the modularity of each initial community until the modularity corresponding to all communities no longer changes, thereby obtaining a number of communities.

[0118] In one example, the community discovery algorithm based on modularity divides similar entities such as attackers, attack organizations, and attack technologies into communities to provide reliable data support for subsequent tracing. Using the community discovery algorithm, the attack events, attack organizations, etc. in the network attack tracing knowledge graph constructed in the above steps are divided into communities, and the nodes involved are divided into communities using modularity as an indicator. The value range is [-1 / 2, 1). The closer the value is to 1, the better the stability of the community structure divided by the network, that is, the better the quality. In this algorithm, it is assumed that the graph composed of nodes of various types is an undirected graph. The modularity is defined as follows:

[0119]

[0120] Among them, Q represents the modularity of community c, e c represents the ratio of the sum of the weights of all edges within community c to the total weight of the edges, a cIt represents the ratio of the weight of the edge connected to the node in community c to the total weight of the edge. Its main steps include: treating each node as a community; calculating the adjacent community with the largest increase in modularity after merging the connected community into the current community for each community; merging the adjacent community with the current community if ΔQ>0 after merging, otherwise the error remains unchanged; if all communities remain stable, update the weight of the nodes in the community to the ring weight of the community (i.e. the weight of the edge within the community), and the weight between communities to the weight of the edge between communities, and obtain a new community, repeat this process, and guide the community to stabilize, and the community modularity will no longer change. The attack organization, ATTCK organization, attack technology and other related entities in the network attack traceability knowledge graph constructed by the above steps are divided into communities.

[0121] In this way, the community discovery algorithm based on modularity optimization can accurately divide the community structure formed by core nodes such as attack organizations, tools, and technologies, thereby improving the global understanding and tracing capabilities of multi-step and multi-stage attacks. It can effectively identify groups of attack nodes with close internal connections and reveal the collaborative relationship between attackers, thereby improving the efficiency and accuracy of attack tracing, especially when dealing with complex advanced persistent threats.

[0122] Step S405, obtain the current attack event data, perform multi-dimensional constraints on the current attack event data, and determine the target community where the current attack event is located. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0123] Step S406: extract relevant information corresponding to the current attack event data, use the preset verification rules to determine the connection relationship between the relevant information and the target community, constrain the target community based on the connection relationship, and trace the source to obtain the tracing result corresponding to the current attack event data. Figure 1 Step S106 of the illustrated embodiment will not be described in detail here.

[0124] The network attack tracing method provided in this embodiment uses a large model to identify and structure the attack behaviors, entities and relationships from multi-source heterogeneous attack event data, and constructs a comprehensive network attack tracing knowledge graph. It can not only intuitively display the attack path and its potential correlation, but also use knowledge reasoning technology to mine hidden attack patterns and correlations, and achieve a deeper understanding and tracing of network attacks. Through the community discovery algorithm based on modularity optimization, the community structure formed by core nodes such as attack organizations, tools, and technologies can be accurately divided, thereby improving the global understanding and tracing capabilities of multi-step and multi-stage attacks. It can effectively identify groups of attack nodes with close internal connections and reveal the collaborative relationship between attackers, thereby improving the efficiency and accuracy of attack tracing, especially when dealing with complex advanced persistent threats.

[0125] In this embodiment, a network attack tracing method is provided, which can be used for the above-mentioned computer device. Figure 5 FIG. 4 is a flowchart of another network attack source tracing method according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps:

[0126] Step S501, obtain historical attack event data. For details, see Figure 4 Step S401 of the illustrated embodiment will not be described in detail here.

[0127] Step S502: Perform entity recognition on the historical attack event data to identify the entities and associations corresponding to the historical attack event data. Figure 4 Step S402 of the illustrated embodiment will not be described in detail here.

[0128] Step S503: Use the entities and relationships corresponding to the historical attack event data to construct a network attack source tracing knowledge graph. Figure 4 Step S403 of the illustrated embodiment will not be described in detail here.

[0129] Step S504: Use a community discovery algorithm to divide entities in the network attack source tracing knowledge graph into communities to obtain several communities. Figure 4 Step S404 of the illustrated embodiment will not be described in detail here.

[0130] Step S505, obtaining current attack event data, performing multi-dimensional constraints on the current attack event data, and determining the target community where the current attack event is located.

[0131] Specifically, the above step S505 includes:

[0132] Step S5051, perform entity recognition on the current attack event data, identify the entities and relationships corresponding to the current attack event data, and add the entities and relationships corresponding to the current attack event data to the network attack tracing knowledge graph to obtain an updated network attack tracing knowledge graph.

[0133] Step S5052, divide the updated network attack tracing knowledge graph into communities, and identify the target community corresponding to the current attack event based on four dimensions: ATTCK organization, attack organization, attack technology, and affiliated company.

[0134] In one example, current attack event data is obtained, entity recognition is performed on the current attack event data, entities and associated relationships corresponding to the current attack event data are obtained, the newly identified entities and relationships are incrementally added to the knowledge graph, and the above-mentioned community discovery algorithm is used to divide the new graph into communities. The community where the attack event is located is converged from four dimensions: ATTCK organization, attack organization, attack technology, and affiliated company, and the community where the current attack is located is obtained: ATTCK organization type community, attack organization type community, attack technology type community, and affiliated company type community.

[0135] In this method, by introducing preset verification rules and multi-dimensional third-party application programming interface (API) verification, combined with community discovery results, the accuracy and reliability of the tracing results obtained from the tracing analysis of the current attack events are ensured. Especially in the case of indirect associations, the accuracy of locating the source of the attack is improved through multi-order connection mining, further enhancing the credibility of the tracing results.

[0136] Step S506, extract relevant information corresponding to the current attack event data, use preset verification rules to determine the connection relationship between the relevant information and the target community, constrain the target community based on the connection relationship, and trace back to obtain the tracing result corresponding to the current attack event data.

[0137] Specifically, the above step S506 includes:

[0138] Step S5061: based on the entities and relationships corresponding to the current attack event data, filter the third-party application programming interface corresponding to the current attack event.

[0139] Step S5062: extract relevant information corresponding to the current attack event data using a third-party application programming interface.

[0140] In one example, the entity recognition result is obtained by using the above steps, and then it is sent to third-party APIs such as ChinaZ, Weibu Online, and Tianyancha (it is necessary to select the appropriate third-party API tool according to the entity recognition result, and the required parameters of different APIs are different), and the relevant information for the current attack is extracted, including the attacker's IP ownership, formula name, company contact information, attacker's name and other information. This information is defined as information X. For example, according to the tool data, the attacking IP is extracted, and ChinaZ is used to obtain the company to which the IP belongs, and the Tianyancha API is used to find the contact address and other information of the company's manager. Or the province and city where the attacker is located are extracted.

[0141] Step S5063, determining whether the relevant information exists in the target community.

[0142] Step S5064: when the relevant information does not exist in the target community, query the order of the connection relationship between the relevant information and the target community, and determine whether the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold.

[0143] Step S5065: When the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold, it is determined that the current attack event has no connected target community.

[0144] In one example, expert verification rules are used to verify whether the relevant information obtained in communities A, B, C, and D contains information X. This inclusion can be direct inclusion: for example, part of information X exists in the attributes of a node in community A.

[0145] It can also be an indirect inclusion of diversity: for example, information X does not exist in the nodes in communities A, B, C, and D, but through first-order, second-order, and third-order connections, the relevant nodes can be obtained with no more than 5-order connections, and the verification can be considered passed. Here, node a connected to node b indicates that there is a first-order connection between the two, and a connected to b and b connected to c indicate that there is a second-order connection between a and c. Too many orders indicate that the relationship between the two is more distant and the correlation is lower. By setting a 5-order connection relationship, the attacker information can be traced back more stably. In the present invention, the order of the connection relationship is not limited.

[0146] If the above two conditions are not met, it indicates that the current attack has no attacker information connected to it.

[0147] In this way, by combining third-party application programming interface API for multi-dimensional verification, the accuracy and effectiveness of the traceability results are further ensured, and the ability to trace the source of network attacks in complex and changing network attack scenarios is improved, thereby significantly improving network security protection capabilities. Combined with community discovery results, the accuracy and reliability of the current attack event traceability analysis are ensured. In the case of indirect association, the accuracy of attack source positioning is improved through multi-order connection mining, further enhancing the credibility of the traceability results.

[0148] The network attack tracing method provided in this embodiment, by introducing preset verification rules and multi-dimensional third-party application programming interface API verification, combined with community discovery results, ensures the accuracy and reliability of the tracing results obtained by tracing the current attack event. In particular, in the case of indirect association, the accuracy of attack source location is improved through multi-order connection mining, and the credibility of the tracing results is further enhanced. By combining the third-party application programming interface API for multi-dimensional verification, the accuracy and effectiveness of the tracing results are further ensured, and the ability to trace the source of network attacks in complex and changeable network attack scenarios is improved, thereby significantly improving network security protection capabilities. Combined with community discovery results, the accuracy and reliability of the current attack event tracing analysis are ensured. In the case of indirect association, the accuracy of attack source location is improved through multi-order connection mining, and the credibility of the tracing results is further enhanced.

[0149] In this embodiment, a network attack source tracing device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0150] This embodiment provides a network attack source tracing device, such as Figure 6 As shown, including:

[0151] The data acquisition module 601 is used to acquire historical attack event data. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0152] The entity recognition module 602 is used to perform entity recognition on the historical attack event data, and identify the entities and associations corresponding to the historical attack event data. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0153] The knowledge graph construction module 603 is used to construct a network attack source tracing knowledge graph using the entities and associations corresponding to the historical attack event data. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0154] The community division module 604 is used to divide the entities in the network attack source tracing knowledge graph into communities using a community discovery algorithm to obtain a number of communities. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0155] The multi-dimensional constraint module 605 is used to obtain the current attack event data, perform multi-dimensional constraints on the current attack event data, and determine the target community where the current attack event is located. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0156] The connection relationship tracing module 606 is used to extract the relevant information corresponding to the current attack event data, determine the connection relationship between the relevant information and the target community using the preset verification rules, constrain the target community based on the connection relationship, and trace the source to obtain the tracing result corresponding to the current attack event data. Figure 1 Step S106 of the illustrated embodiment will not be described in detail here.

[0157] In some optional implementations, the entity identification module 602 includes:

[0158] The regular matching unit is used to perform entity matching on the historical attack event data based on preset regular rules to determine different types of entities corresponding to the historical attack event data.

[0159] The mapping dictionary recognition unit is used to construct a mapping dictionary corresponding to each type of entity, perform entity recognition on the historical attack event data based on the mapping dictionary, and determine the entity corresponding to the historical attack event data.

[0160] The entity model recognition unit is used to use a pre-trained entity recognition model to perform entity recognition on the historical attack event data, identify the entities corresponding to the historical attack event data, and establish association relationships between related entities in the historical attack event data.

[0161] In some optional implementations, the community division module 604 includes:

[0162] The initial community division unit is used to take each entity in the network attack tracing knowledge graph as the initial community.

[0163] The modularity calculation unit is used to calculate the modularity of each initial community, and use the community discovery algorithm to merge the initial communities based on the modularity of each initial community until the modularity corresponding to all communities no longer changes, thereby obtaining a number of communities.

[0164] In some optional implementations, the multi-dimensional constraint module 605 includes:

[0165] The knowledge graph updating unit is used to perform entity recognition on the current attack event data, identify the entities and relationships corresponding to the current attack event data, and add the entities and relationships corresponding to the current attack event data to the network attack tracing knowledge graph to obtain an updated network attack tracing knowledge graph.

[0166] The multi-dimensional constraint unit is used to divide the updated network attack tracing knowledge graph into communities, and to identify the target communities corresponding to the current attack events based on the four dimensions of ATTCK organization, attack organization, attack technology, and affiliated company.

[0167] In some optional implementations, the connection relationship tracing module 606 includes:

[0168] The third-party interface screening unit is used to screen the third-party application programming interface corresponding to the current attack event based on the entities and relationships corresponding to the current attack event data.

[0169] The relevant information extraction unit is used to extract relevant information corresponding to the current attack event data using a third-party application programming interface.

[0170] In some optional implementations, the connection relationship tracing module 606 further includes:

[0171] The target community judgment unit is used to judge whether the relevant information exists in the target community.

[0172] The connection relationship judgment unit is used to query the order of the connection relationship between the relevant information and the target community when the relevant information does not exist in the target community, and judge whether the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold.

[0173] The no-connection relationship determining unit is used to determine that the current attack event has no connected target community when the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold.

[0174] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0175] The network attack tracing device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0176] The embodiment of the present invention also provides a computer device having the above Figure 6 The network attack tracing device shown.

[0177] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0178] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0179] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0180] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0181] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0182] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0183] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0184] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0185] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0186] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network attack source tracing method, characterized in that: The method comprises: Obtain historical attack event data; Performing entity recognition on the historical attack event data to identify entities and association relationships corresponding to the historical attack event data; Using the entities and associations corresponding to the historical attack event data, a network attack tracing knowledge graph is constructed; Using a community discovery algorithm, entities in the network attack source tracing knowledge graph are divided into communities to obtain a number of communities; Obtain current attack event data, perform multi-dimensional constraints on the current attack event data, and determine the target community where the current attack event is located; Extract relevant information corresponding to the current attack event data, use preset verification rules to determine the connection relationship between the relevant information and the target community, constrain the target community based on the connection relationship, and trace back to obtain the tracing result corresponding to the current attack event data.

2. The method according to claim 1, characterized in that The performing entity recognition on the historical attack event data to obtain entities and association relationships corresponding to the historical attack event data includes: Based on preset regular rules, entity matching is performed on the historical attack event data to determine different types of entities corresponding to the historical attack event data; Constructing a mapping dictionary corresponding to each type of entity, performing entity recognition on the historical attack event data based on the mapping dictionary, and determining the entity corresponding to the historical attack event data; The historical attack event data is subjected to entity recognition using a pre-trained entity recognition model to identify entities corresponding to the historical attack event data, and to establish association relationships between related entities in the historical attack event data.

3. The method according to claim 1, characterized in that The community discovery algorithm is used to divide the entities in the network attack source tracing knowledge graph into communities, and several communities are obtained, including: Taking each entity in the network attack tracing knowledge graph as an initial community; The modularity of each of the initial communities is calculated, and the initial communities are merged based on the modularity of each of the initial communities using a community discovery algorithm until the modularity corresponding to all communities no longer changes, thereby obtaining a plurality of the communities.

4. The method according to claim 1, characterized in that The multi-dimensional constraints on the current attack event data are used to determine the target community where the current attack event is located, including: Perform entity recognition on the current attack event data to identify entities and relationships corresponding to the current attack event data, and add the entities and relationships corresponding to the current attack event data to the network attack source tracing knowledge graph to obtain an updated network attack source tracing knowledge graph; The updated network attack tracing knowledge graph is divided into communities, and the target community corresponding to the current attack event is determined based on four dimensions: ATTCK organization, attack organization, attack technology, and affiliated company.

5. The method according to claim 4, characterized in that The extracting of relevant information corresponding to the current attack event data includes: Based on the entities and relationships corresponding to the current attack event data, filter the third-party application programming interface corresponding to the current attack event; The third-party application programming interface is used to extract relevant information corresponding to the current attack event data.

6. The method according to claim 4, characterized in that The determining of the connection relationship between the relevant information and the target community includes: Determining whether the relevant information exists in the target community; When the relevant information does not exist in the target community, querying the order of the connection relationship between the relevant information and the target community, and determining whether the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold; When the order of the connection relationship between the relevant information and the target community is greater than a preset order threshold, it is determined that the current attack event has no connected target community.

7. A network attack source tracing device, characterized in that: The device comprises: A data acquisition module is used to acquire historical attack event data; An entity recognition module, used to perform entity recognition on the historical attack event data, and identify entities and association relationships corresponding to the historical attack event data; A knowledge graph construction module, used to construct a network attack tracing knowledge graph using entities and associations corresponding to the historical attack event data; A community division module, used to divide entities in the network attack source tracing knowledge graph into communities using a community discovery algorithm to obtain a number of communities; The multi-dimensional constraint module is used to obtain the current attack event data, perform multi-dimensional constraints on the current attack event data, and determine the target community where the current attack event is located; The connection relationship tracing module is used to extract relevant information corresponding to the current attack event data, determine the connection relationship between the relevant information and the target community using preset verification rules, constrain the target community based on the connection relationship, and trace back to obtain the tracing result corresponding to the current attack event data.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network attack tracing method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the network attack tracing method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the network attack tracing method according to any one of claims 1 to 6.

Images