APT organization knowledge graph updating method and device, equipment and storage medium

Abstract

The invention discloses an APT organization knowledge graph updating method and device, equipment and a storage medium, and relates to the field of network security. The method comprises the following steps: constructing an APT organization knowledge graph; performing threat identification on the real-time network flow based on the APT organization knowledge graph to obtain a real-time threat identification result; under the condition that the real-time threat identification result indicates that the real-time network traffic has the threat, updating an APT organization knowledge graph based on the real-time network traffic; the historical network traffic is backtracked based on the updated APT organization knowledge graph, historical network attack traffic is obtained, and the historical network attack traffic is historical network traffic of which threats are not recognized; and updating the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic. According to the embodiment of the invention, the APT organization knowledge graph can be updated based on the real-time network traffic and the historical network traffic, and the success rate of finding APT organization threats is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a method, device, equipment and storage medium for updating an APT organization knowledge graph. Background Art

[0002] With the vigorous development of the digital economy, cyber attack technology has been constantly upgraded and developed in the direction of organization and specialization.

[0003] Traditional threat detection methods usually detect unknown threats based on sample knowledge, feature recognition and other means.

[0004] However, some APT (Advanced Persistent Threat) organizations continue to upgrade their attack tools, change their attack strategies, and use advanced technologies to launch network attacks, making it increasingly difficult to detect unknown threats. Summary of the invention

[0005] The embodiment of the present application provides a method, device, equipment and storage medium for updating the knowledge graph of an APT organization. The technical solution is as follows:

[0006] On the one hand, an embodiment of the present application provides a method for updating an APT organization knowledge graph, the method comprising:

[0007] Build the knowledge graph of APT organizations;

[0008] Based on the APT organization knowledge graph, threat identification is performed on real-time network traffic to obtain real-time threat identification results;

[0009] When the real-time threat identification result indicates that the real-time network traffic has a threat, updating the APT organization knowledge graph based on the real-time network traffic;

[0010] Based on the updated APT organization knowledge graph, historical network traffic is traced back to obtain historical network attack traffic, where the historical network attack traffic is historical network traffic for which no threat has been identified;

[0011] The APT organization knowledge graph is updated based on the historical network attack traffic and the associated traffic of the historical network attack traffic.

[0012] On the other hand, an embodiment of the present application provides a device for updating an APT organization knowledge graph, the device comprising:

[0013] Construction module, used to build the knowledge graph of APT organizations;

[0014] An identification module, used to identify threats to real-time network traffic based on the APT organization knowledge graph to obtain real-time threat identification results;

[0015] A first updating module, configured to update the APT organization knowledge graph based on the real-time network traffic when the real-time threat identification result indicates that the real-time network traffic has a threat;

[0016] A backtracking module, used to backtrack historical network traffic based on the updated APT organization knowledge graph to obtain historical network attack traffic, where the historical network attack traffic is historical network traffic for which no threat has been identified;

[0017] The second updating module is used to update the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic.

[0018] On the other hand, an embodiment of the present application provides a computer device, which includes a processor and a memory, wherein at least one program code is stored in the memory, and the at least one program code is loaded and executed by the processor to implement the method for updating the APT organization knowledge graph as described in the above aspects.

[0019] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the method for updating the APT organization knowledge graph as described in the above aspects.

[0020] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0021] In an embodiment of the present application, in order to discover APT organization threats, the computer device first constructs an APT organization knowledge graph, and then realizes threat identification of real-time network traffic by querying the APT organization knowledge graph, thereby obtaining real-time threat identification results. Subsequently, the computer device updates the knowledge graph based on the real-time network traffic according to the real-time threat identification results, when confirming that there is a threat in the real-time network traffic. Since the APT organization threat is a long-term infiltration process, there may be threats in the historical network traffic that have not been discovered in the real-time threat identification process. Therefore, after updating the knowledge graph, the computer device backtracks the historical network traffic to obtain the historical network attack traffic that has not been discovered in the real-time threat identification process. In addition, there may also be threats in the associated traffic of the historical network attack traffic. Therefore, the computer device updates the APT organization knowledge graph according to the threat identification results of the historical network attack traffic and the associated traffic, enriching the APT organization knowledge graph and improving the success rate of discovering APT organization threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A flowchart of a method for updating an APT organization knowledge graph provided by an exemplary embodiment of the present application is shown;

[0024] Figure 2 A flowchart showing a process of constructing an APT organization knowledge graph provided by an exemplary embodiment of the present application is shown;

[0025] Figure 3 It is a schematic diagram of key objects and relationships of ATT&CK provided by an exemplary embodiment of the present application;

[0026] Figure 4 A flowchart of a threat identification process for real-time network traffic provided by an exemplary embodiment of the present application is shown;

[0027] Figure 5 is a flowchart of a first threat identification process shown in an exemplary embodiment of the present application;

[0028] Figure 6 A schematic diagram of implementing a threat identification process for real-time network traffic provided by an exemplary embodiment of the present application is shown;

[0029] Figure 7 A flowchart of a process for acquiring historical network attack traffic provided by an exemplary embodiment of the present application is shown;

[0030] Figure 8 A flowchart of a threat identification process for associated traffic provided by an exemplary embodiment of the present application is shown;

[0031] Fig. 9 This is a schematic diagram of the attack mode of the APT34 organization provided by an exemplary embodiment of the present application;

[0032] Fig.10 is a flow chart of a key traffic acquisition process provided by an exemplary embodiment of the present application;

[0033] Fig.11 It is a schematic diagram of the implementation of the updating process of the APT organization knowledge graph provided by an exemplary embodiment of the present application;

[0034] Fig.12A structural block diagram of an APT organization knowledge graph updating device provided by an exemplary embodiment of the present application is shown;

[0035] Fig.13 A structural block diagram of a computer device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0036] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0037] Please refer to Figure 1 , which shows a flow chart of a method for updating an APT organization knowledge graph provided by an exemplary embodiment of the present application. The method comprises the following steps:

[0038] Step 101, constructing the APT organization knowledge graph.

[0039] The APT organization knowledge graph includes all relevant information needed to monitor APT organization threats, including basic information, attack patterns, vulnerability information, malicious samples, address information, etc.

[0040] Among them, the basic information includes the organization name, alias, country or region, historical activity time, historical attack events, attack country or region, etc. of the APT organization. The attack mode records the attack process of the APT organization. Each attack process includes corresponding attack links, and each attack link corresponds to the tactical purpose defined in the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework. Vulnerability information indicates security vulnerabilities within the threat monitoring protection object, and the APT organization may exploit the vulnerability to attack the attack object. Malicious samples include malicious communication content used by the APT organization to carry out network attacks, which may be APT attack tools used to carry out network attacks. Address information is the network address used by the APT organization when conducting network attacks, which may include historical access IP addresses and historical access domain names.

[0041] like Figure 2 As shown, the construction of the APT organization knowledge graph can include the following steps.

[0042] Step 101A, APT organization knowledge ontology construction. The computer device collects APT organization information and constructs the ontology of the knowledge graph based on the collected APT organization information. The ontology construction includes structuring the APT organization knowledge.

[0043] In a possible implementation, the computer device obtains APT organization information through crawler technology, and then builds an APT organization information framework, so as to describe the APT organization information using the APT organization information framework. For example, the basic information of the APT organization includes the earliest activity time, historical activity time, country or region, attack country or region, and attack industry of the APT organization. For another example, the attack mode of the APT organization includes multiple tactical objectives, and each tactical objective includes attack tools, attack methods, attack targets, and defense methods.

[0044] Step 101B, APT organizational knowledge extraction.

[0045] Extract entities, relationships and attributes from various APT organization information. An entity is an abstract individual with several attributes used to describe its characteristics, and a relationship is the connection between different entities. For example, "The earliest activity time of the APT34 organization is 2014", where the APT34 organization is an entity, the earliest activity time is the attribute of the APT34 organization, and 2014 is the attribute value. Another example is "The APT34 organization attacks Turkey", where the APT34 organization and Turkey are entities, and the two are in an attack relationship.

[0046] In a possible implementation, the computer device may extract entities, relationships, and attributes from the APT organization information by inputting the APT organization information into a large language model.

[0047] Step 101C, APT organization knowledge integration.

[0048] Since the APT organization information obtained by computer equipment includes various aspects, the computer equipment needs to fuse the descriptions of the same entity in different aspects in different information. The technologies used in the knowledge fusion process mainly include entity disambiguation, reference resolution, entity linking and other technologies.

[0049] In an embodiment of the present application, the computer device uses the ATT&CK framework to describe the tactical objectives and attack techniques of the APT organization. Therefore, during the knowledge fusion process, the computer device can correspond the tactical objectives and attack techniques used by the APT organization to the key objects defined in ATT&CK.

[0050] For example, Figure 3 As shown, the computer device can regard each key object defined in ATT&CK as an entity, and there is a certain relationship between the key objects defined in ATT&CK. Among them, the APT organization 301 uses attack technology 302 to achieve tactical goal 303. The APT organization 301 uses attack tools 304 to implement attack technology 302.

[0051] Step 101D, APT organizes knowledge storage.

[0052] Since APT organization information is rich in content and large in data volume, in order to be able to flexibly manage a large amount of APT organization information, the computer device first represents the APT organization information as an RDF (Resource Description Framework) triple structure that can be stored and described by the computer, where the RDF triple includes entities, relationships and attributes. Then, the computer device stores the RDF triples corresponding to the APT organization information in the graph database.

[0053] Step 101E, APT organizes knowledge representation.

[0054] Knowledge representation can refer to a computer device presenting a knowledge graph in a visual manner, or it can refer to a computer device representing APT organization information as RDF triples for easy storage in a graph database.

[0055] It should be noted that in the above steps, the knowledge graph is constructed in a top-down manner, and the APT organization knowledge graph can also be constructed in a bottom-up manner. The embodiment of the present application does not limit the construction method of the APT organization knowledge graph.

[0056] Step 102: Perform threat identification on real-time network traffic based on the APT organization knowledge graph to obtain real-time threat identification results.

[0057] Real-time network traffic is the network traffic monitored by the computer device in real time. In one possible implementation, the computer device obtains real-time network traffic by mirroring the network traffic at the core switch. Subsequently, the computer device extracts the information contained in the real-time network traffic and performs a matching query with the corresponding information in the APT organization knowledge graph.

[0058] The real-time threat identification result is the query result of the APT organization knowledge graph. If the information contained in the real-time network traffic is queried in the knowledge graph, it means that there is a threat in the real-time network traffic. If the information contained in the real-time network traffic cannot be queried in the knowledge graph, it means that there is no threat in the real-time network traffic.

[0059] Step 103: When the real-time threat identification result indicates that there is a threat in the real-time network traffic, the APT organization knowledge graph is updated based on the real-time network traffic.

[0060] In order to prevent being easily identified, APT organizations update their attack methods during the long-term infiltration process. Therefore, the APT organization knowledge graph used for threat identification needs to be updated according to the threat content in real-time network traffic to improve the ability of computer equipment to identify APT organizations.

[0061] In one possible implementation, when threat information recorded in the APT organization knowledge graph appears in real-time network traffic, the computer device can identify the presence of threats in the real-time network traffic based on the APT organization knowledge graph; when threat information not recorded in the APT organization knowledge graph appears in real-time network traffic, the computer device updates the knowledge graph with the threat information in the real-time network traffic.

[0062] Step 104, based on the updated APT organization knowledge graph, historical network traffic is traced back to obtain historical network attack traffic, where the historical network attack traffic is historical network traffic for which no threat has been identified.

[0063] Although computer devices can identify the updated threat information of ATP organizations after the APT organization knowledge graph is updated, there may be historical threats in the historical network traffic that the computer devices have not been able to detect in the past. Therefore, computer devices can trace back the historical network traffic based on the updated knowledge graph to find historical network attack traffic that failed to identify threats in the past.

[0064] Step 105: Update the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic.

[0065] Since ATP organizations usually have a complete set of attack processes during the long-term infiltration process, and the threat information contained in the historical network attack traffic may not contain the complete ATP organization attack process, computer equipment needs to mine other network traffic that may contain ATP organization threats.

[0066] Since there is a correlation between network attack traffic, in a possible implementation, the computer device can infer associated traffic that may be a threat based on the currently identified historical network attack traffic, and review the associated traffic to obtain other unidentified threats.

[0067] After confirming that there are threats in historical network attack traffic and related traffic that have not been identified through the knowledge graph, the computer device can use the threat information to update the APT organization knowledge graph.

[0068] In summary, in the embodiment of the present application, in order to discover the threat of APT organization, the computer device first constructs a knowledge graph that records the information of APT organization, and then realizes the threat identification of real-time network traffic by querying the knowledge graph of APT organization, thereby obtaining the real-time threat identification result, and then the computer device updates the knowledge graph based on the real-time network traffic according to the threat identification result, when confirming that there is a threat in the real-time network traffic. Since the threat of APT organization is a long-term infiltration process, there may be threats in the historical network traffic that have not been discovered in the real-time threat identification process. Therefore, after updating the knowledge graph, the computer device backtracks the historical network traffic to obtain the historical network attack traffic that has not been discovered in the real-time threat identification process. In addition, there may also be threats in the associated traffic of the historical network attack traffic. Therefore, the computer device updates the APT organization knowledge graph according to the threat identification results of the historical network attack traffic and the associated traffic, enriches the APT organization knowledge graph, and improves the success rate of discovering APT organization threats.

[0069] In the above embodiment, the threat identification of the computer device to the APT organization includes the threat identification of the real-time network traffic and the backtracking of the historical network traffic. In the process of real-time network traffic threat identification, the computer device performs threat identification on the real-time IP address, real-time domain name and real-time communication content in the real-time network traffic according to the knowledge graph, and obtains the real-time threat identification result.

[0070] Please refer to Figure 4 , which shows a flowchart of a threat identification process of real-time network traffic provided by an exemplary embodiment of the present application. The process includes the following steps:

[0071] Step 401, perform traffic analysis on the real-time network traffic to obtain the real-time IP address, real-time domain name and real-time communication content.

[0072] The real-time IP address may include a real-time source IP address and a real-time destination IP address. If a domain name exists in the real-time network traffic, the computer device may obtain the real-time IP address, the real-time domain name, and the real-time communication content through traffic resolution. If a domain name does not exist in the real-time network traffic, the computer device may obtain the real-time IP address and the real-time communication content through traffic resolution.

[0073] In a possible implementation, the computer device performs TCP / IP protocol analysis on the real-time network traffic to obtain the real-time IP address, real-time domain name, and real-time communication content.

[0074] Step 402, when at least one of a real-time IP address and a real-time domain name is queried in the APT organization knowledge graph, a first threat identification is performed on the real-time communication content to obtain a real-time threat identification result.

[0075] Since real-time network traffic may or may not include real-time domain names, the situation where at least one of the real-time IP address and the real-time domain name is queried in the APT organization knowledge graph can be divided into the following two situations.

[0076] 1. The real-time domain name does not exist in the real-time network traffic.

[0077] When there is no real-time domain name in the real-time network traffic, when the computer device queries the real-time IP address in the APT organization knowledge graph, it means that the real-time IP address is associated with the APT organization. Therefore, the real-time communication content corresponding to the real-time IP address may or may not be a threat.

[0078] 2. Real-time domain names exist in real-time network traffic.

[0079] When there is a real-time domain name in the real-time network traffic, when the computer device queries at least one of the real-time IP address and the real-time domain name in the APT organization knowledge graph, it means that the real-time IP address, or the real-time domain name, or the real-time IP address and the real-time domain name are associated with the APT organization, so the real-time communication content may or may not be a threat.

[0080] In order to verify the threat of the real-time communication content, the computer device needs to perform a first threat identification on the real-time communication content to obtain a real-time threat identification result, and then determine whether there is a threat to the real-time network traffic based on the real-time threat identification result.

[0081] Among them, Figure 5 As shown, the first threat identification may include the following steps.

[0082] Step 402A, when the APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, it is determined that there is a threat to the real-time network traffic.

[0083] Since the content of the APT organization knowledge graph includes APT attack tools, historical access IP addresses and historical access domain names of the APT organization, computer devices can determine whether there are threats in real-time network traffic by querying the knowledge graph.

[0084] Since the real-time IP address and real-time domain name can only prove that the real-time network traffic is related to the APT organization, but cannot determine whether the real-time network traffic poses a threat, it is only when it is confirmed that the real-time communication content is an APT attack tool that the real-time network traffic can be determined to pose a threat.

[0085] Step 402B, when no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, a manual review result of the real-time communication content is obtained.

[0086] Since APT organizations may update APT attack tools in order to evade threat detection, when APT organizations release new APT attack tools, computer devices cannot query the APT attack tools corresponding to the real-time communication content in the APT organization knowledge graph.

[0087] In order to enable the computer device to identify updated APT attack tools based on the APT organization knowledge graph, after manual review, the computer device obtains the manual review results of the real-time communication content.

[0088] Among them, the manual review is performed by security experts to detect threats to real-time communication content. In a possible implementation, during the review process, the security experts use sandbox technology to detect the real-time communication content, and then the computer device obtains the detection results.

[0089] Step 402C: when the manual review result indicates that the real-time communication content belongs to an APT attack tool, it is determined that there is a threat to the real-time network traffic.

[0090] Step 402D: When the threat review result indicates that the real-time communication content does not belong to an APT attack tool, it is determined that there is no threat to the real-time network traffic.

[0091] Step 403: When no real-time IP address and real-time domain name are found in the APT organization knowledge graph, a second threat identification is performed on the real-time communication content to obtain a real-time threat identification result.

[0092] Since real-time network traffic may or may not include real-time domain names, the situation where the real-time IP address and real-time domain name are not queried in the APT organization knowledge graph can be divided into the following two situations.

[0093] 1. The real-time network traffic does not include the real-time domain name.

[0094] In the case that the real-time network traffic does not contain the real-time domain name, and the computer device does not query the real-time IP address in the APT organization knowledge graph, the computer fails to identify whether there is an association between the real-time IP address and the APT organization. Since the APT organization may update the IP address and then use the new IP address to launch a network attack, the computer device needs to perform a second threat identification on the real-time communication content, and after obtaining the real-time threat identification results, confirm whether there is a threat in the real-time network traffic based on the real-time threat identification results.

[0095] 2. The real-time network traffic contains the real-time domain name.

[0096] In the case where the real-time network traffic contains the real-time domain name, and the computer device does not query the real-time IP address and real-time domain name in the APT organization knowledge graph, the computer cannot identify whether the real-time IP address is related to the APT organization, nor can it identify whether the real-time domain name is related to the APT organization. Since the APT organization may update the IP address and domain name at the same time, and then use the new IP address and domain name to launch a network attack, the computer device needs to perform a second threat identification on the real-time communication content, and after obtaining the real-time threat identification results, confirm whether there is a threat in the real-time network traffic based on the real-time threat identification results.

[0097] The second threat identification may include the following two situations.

[0098] In the first case, when the APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, it is determined that there is a threat to the real-time network traffic.

[0099] When the real-time IP address and real-time domain name are not found in the APT organization knowledge graph, and the APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, the real-time network traffic of the computer device is threatened, and the APT organization has updated the real-time IP address and real-time domain name, and the APT organization knowledge graph does not include the updated IP address and domain name of the APT organization.

[0100] In the second case, when no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, it is determined that there is no threat to the real-time network traffic.

[0101] Before the computer device performs the second threat identification, the computer device does not detect that the real-time IP address and real-time domain name in the real-time network traffic are related to the APT organization. Therefore, when the APT attack tool corresponding to the real-time communication content is not found in the APT organization knowledge graph, the computer device can determine that the real-time network traffic is not related to the APT organization and there is no threat.

[0102] It should be noted that the above-mentioned step 402 and step 403 can be executed simultaneously, and the embodiment of the present application does not limit the execution sequence of step 402 and step 403.

[0103] For example, Figure 6 As shown, in the threat identification process of real-time network traffic, the computer device first performs the following steps.

[0104] Step 601, parse the real-time network traffic to extract the real-time IP address, real-time domain name and real-time communication content.

[0105] Step 602, query the real-time IP address in the APT organization knowledge graph.

[0106] Step 603, determine whether the real-time IP address is a historical access IP address of the APT organization.

[0107] In the case where the real-time IP address is a historically accessed IP address of the APT organization, step 604 is executed to query the real-time communication content in the APT organization knowledge graph.

[0108] When the real-time IP address is not a historically accessed IP address of the APT organization, step 610 is executed to determine whether a real-time domain name exists in the real-time network traffic.

[0109] Step 604, query the real-time communication content in the APT organization knowledge graph.

[0110] Step 605: determine whether the real-time communication content is an APT attack tool.

[0111] In the case where the real-time communication content is an APT attack tool, step 606 is executed to confirm that there is an APT organization threat in the real-time network traffic.

[0112] When the real-time communication content is not an APT attack tool, since the real-time IP address or real-time domain name is a historically accessed IP address or historically accessed domain name of an APT organization, the real-time network traffic may be threatened, and step 607 is executed to manually review the real-time communication content.

[0113] Step 606, confirming that there is an APT organization threat in the real-time network traffic.

[0114] Step 607: manually review the real-time communication content.

[0115] Step 608: determine whether the real-time communication content is an APT attack tool.

[0116] When the real-time communication content is an APT attack tool, execute step 609 to update the knowledge graph.

[0117] When the real-time communication content is not an APT attack tool, it is determined that there is no APT organization threat in the real-time network traffic.

[0118] Step 609, update the knowledge graph.

[0119] In the case that there is no real-time communication content in the APT organization knowledge graph, the APT attack tools corresponding to the APT organization in the knowledge graph are updated.

[0120] If the real-time IP address does not exist in the APT organization knowledge graph, the real-time IP address is updated into the APT organization knowledge graph.

[0121] When the real-time domain name does not exist in the APT organization knowledge graph, the real-time domain name is updated into the APT organization knowledge graph.

[0122] Step 610, determining whether there is a real-time domain name in the real-time network traffic.

[0123] In the case where a real-time domain name exists, step 611 is executed to query the real-time domain name in the APT organization knowledge graph.

[0124] In the case where the real-time domain name does not exist, step 612 is executed to query the real-time communication content in the APT organization knowledge graph.

[0125] Step 611, query the real-time domain name in the APT organization knowledge graph.

[0126] Step 612, determine whether the real-time domain name is a domain name that has been historically accessed by the APT organization.

[0127] In the case where the real-time domain name is a historically visited domain name of the APT organization, step 604 is executed to query the real-time communication content in the APT organization knowledge graph.

[0128] In the case that the real-time domain name is not a historically visited domain name of the APT organization, step 613 is executed to query the real-time communication content in the APT organization knowledge graph.

[0129] Step 613, query the real-time communication content in the APT organization knowledge graph.

[0130] Step 614, determining whether the real-time communication content is an APT attack tool.

[0131] In the case where the real-time communication content is an APT attack tool, it is determined that there is a threat in the real-time network traffic.

[0132] When the real-time communication content is not an APT attack tool, it is determined that there is no APT organization threat in the real-time network traffic.

[0133] In an embodiment of the present application, the computer device first performs traffic analysis on the real-time network traffic to obtain the real-time IP address, real-time domain name and real-time communication content. Subsequently, the real-time IP address, real-time domain name and real-time communication content are queried in the knowledge graph, and whether there is a threat is determined based on the query result of the real-time communication content. In addition, if the knowledge graph fails to find out whether the real-time communication content is an APT attack tool, and at least one of the real-time IP address and the real-time domain name is related to the APT organization, it is confirmed by reviewing whether there is a threat in the real-time network traffic. If the threat is confirmed in the real-time network traffic, the IP address, domain name and APT attack tool of the corresponding APT organization in the knowledge graph are updated, enriching the knowledge graph and improving the success rate of subsequent discovery using the APT organization knowledge graph.

[0134] In the above embodiment, the computer device performs threat identification based on the real-time IP address, real-time domain name, and real-time communication content in the real-time network traffic. In the case where the real-time threat identification result indicates that there is a threat in the real-time network traffic, since the result that there is a threat in the real-time network traffic may be obtained through manual review, at least one of the real-time IP address, real-time domain name, and real-time communication content in the real-time network traffic may not exist in the knowledge graph. Therefore, the computer device can update the knowledge graph based on the real-time IP address, real-time domain name, and real-time communication content.

[0135] Optionally, after confirming that the real-time communication content is an APT attack tool, the computer device may update at least one of the corresponding real-time IP address and real-time domain name in the real-time network traffic into the knowledge graph.

[0136] Optionally, the computer device determines that at least one of the real-time IP address and the real-time domain name is related to the APT organization by querying the knowledge graph, and when the real-time communication content is unknown, the real-time communication content is manually reviewed, and when the review determines that the real-time communication content is an APT attack tool, the real-time communication content is updated into the knowledge graph.

[0137] Optionally, after obtaining the APT attack tool, the computer device can analyze the APT attack tool, basic information of the APT organization, vulnerability information, behavioral characteristics of the APT organization, and other information to obtain the corresponding tactical objectives of the APT attack tool in the ATT&CK framework, thereby updating the corresponding tactical objectives in the APT organization knowledge graph.

[0138] For example, when the APT attack tool is a phishing email, the computer device can determine that the phishing email corresponds to the spear phishing attack attachment technology in the ATT&CK framework, which constructs an attachment and exploits the corresponding vulnerability to attack in order to achieve the purpose of initial access. Then, if the attack mode corresponding to the APT organization in the APT organization knowledge graph does not include the initial access tactical purpose, the tactical purpose in the APT organization knowledge graph is updated.

[0139] After the computer device updates the knowledge graph, in order to detect threats that were not identified in the past, the computer device can record and analyze historical network traffic to obtain historical network attack traffic.

[0140] Please refer to Figure 7 , which shows a flowchart of a process for acquiring historical network attack traffic provided by an exemplary embodiment of the present application. The process includes the following steps.

[0141] Step 701, perform traffic analysis on historical network traffic to obtain historical IP addresses, historical domain names, and historical communication content.

[0142] Historical network traffic is the actual network traffic that has been parsed by the computer device in the past. In a possible implementation, the computer device stores the historical IP addresses, historical domain names, and historical communication contents in the historical network traffic in a database, and then when parsing the historical network traffic, the historical IP addresses, historical domain names, and historical communication contents can be obtained from the database.

[0143] In another possible implementation, the computer device stores the historical network traffic in a database, and then the computer device parses the historical network traffic to obtain the historical IP address, historical domain name, and historical communication content.

[0144] Step 702: When at least one of the historical IP address and the historical domain name is queried in the updated APT organization knowledge graph, threat identification is performed on the historical communication content to obtain a historical threat identification result; when the historical threat identification result indicates that there is a threat in the historical network traffic, the historical network traffic is determined as historical network attack traffic.

[0145] Since historical network traffic may contain historical IP addresses, historical domain names, and historical communication content that failed to detect threats in the past, after the computer device performs real-time network traffic analysis and updates the APT organization knowledge graph, the computer device can query the updated knowledge graph to find threats that failed to detect in historical network traffic.

[0146] In a possible implementation, when the computer device queries at least one of the historical IP address and the historical domain name in the updated APT organization knowledge graph, it performs threat identification on the historical communication content to obtain a threat identification result.

[0147] When an APT attack tool is found in the updated APT organization knowledge graph, the computer device determines that there is a threat in the historical network traffic. When an APT attack tool is not found in the updated APT organization knowledge graph, the historical communication content needs to be manually reviewed.

[0148] If the historical communication content is confirmed to be an APT attack tool, there is a threat in the historical network traffic, and the computer device updates the historical IP address, historical domain name and historical communication content in the historical network traffic into the APT organization knowledge graph; if the historical communication content is confirmed not to be an APT attack tool, there is no threat in the historical network traffic corresponding to the historical communication content.

[0149] In addition, when at least one of the historical IP address and the historical domain name is not found in the updated APT organization knowledge graph, threat identification is performed on the historical communication content to obtain a threat identification result.

[0150] Subsequently, when the APT attack tool is queried in the updated APT organization knowledge graph, the computer device determines that there is a threat in the historical network traffic, and then updates the historical IP address and historical domain name in the APT organization knowledge graph, wherein the historical domain name is updated when the historical domain name exists in the historical network traffic; when the APT attack tool cannot be queried in the updated APT organization knowledge graph, the computer device determines that there is no threat in the historical network traffic.

[0151] Indicatively, with Figure 6 Similar to the threat identification of real-time network traffic shown, historical network traffic is subjected to threat identification based on the updated knowledge graph, which is then updated.

[0152] Step 703, when the APT attack tool corresponding to the historical communication content is queried in the updated APT organization knowledge graph, the historical network traffic is determined as the historical network attack traffic.

[0153] When the APT attack tool corresponding to the historical communication content is queried in the updated APT organization knowledge graph, the computer device determines that there is an APT organization attack in the historical network traffic, and determines the historical network traffic with the APT organization attack as the historical network attack traffic.

[0154] In an embodiment of the present application, the computer device first analyzes historical network traffic to obtain historical IP addresses, historical domain names, and historical communication content, and then performs historical threat identification by querying an updated APT organization knowledge graph to obtain historical threat identification results. Subsequently, when the historical threat identification results indicate that there is a threat in the historical network traffic, the APT organization knowledge graph is updated to enrich the APT organization knowledge graph. Finally, the computer device determines that the threatening historical network traffic is historical network attack traffic.

[0155] Since ATP organizations usually have a complete set of attack processes during the long-term infiltration process, and historical network attack traffic may not contain the complete ATP organization attack process, computer equipment needs to analyze the associated traffic of historical attack traffic, so as to further update the knowledge graph when ATP organization attacks are detected in the associated traffic.

[0156] Please refer to Figure 8 , which shows a flowchart of a threat identification process of associated traffic provided by an exemplary embodiment of the present application. The process includes the following steps.

[0157] Step 801, determining the attack link corresponding to the historical network attack traffic in the attack process.

[0158] In the APT organization knowledge graph, the APT organization has its corresponding attack mode, which includes several tactical objectives described in the ATT&CK framework. In the attack process of the APT organization, each attack link has a corresponding tactical objective in the attack mode.

[0159] In one possible implementation, the computer device determines the tactical purpose corresponding to the historical network attack traffic based on the APT attack tools contained in the historical network attack traffic, and then determines the attack link corresponding to the historical network attack traffic in the attack process based on the tactical purpose.

[0160] For example, ATT&CK includes 12 tactical objectives, corresponding to the 12 columns in ATT&CK. The attack process of an APT organization is composed of a combination of several of the 12 tactical objectives. The computer device determines the tactical objective corresponding to the APT attack tool based on the attack behavior characteristics of the APT organization, and then obtains the attack link corresponding to the tactical objective.

[0161] Step 802: query the attack process corresponding to the APT organization from the APT organization knowledge graph.

[0162] The APT organization knowledge graph includes the attack mode of the APT organization, which corresponds to the attack process of the APT organization.

[0163] For example, Fig. 9As shown in the figure, it is the attack mode corresponding to APT34, including the tactical objectives of initial access, privilege escalation, collection, command and control, and data exfiltration. Each tactical objective corresponds to an attack link.

[0164] Step 803: Determine the missing status of the attack process based on the attack process and the attack links corresponding to the historical network attack traffic.

[0165] In one possible implementation, after the computer device obtains the attack link corresponding to the historical network attack traffic, the computer device can query the attack process of the corresponding APT organization in the knowledge graph and compare the attack link corresponding to the historical network attack traffic to determine whether some attack links in the attack process are missing in the historical network attack traffic.

[0166] For example, historical network attack traffic includes attack link 1, attack link 2, and attack link 4. However, by querying the knowledge graph, it can be known that the attack process of the APT organization should include attack link 1, attack link 2, attack link 3, and attack link 4. Therefore, the computer device can determine that attack link 3 is missing in the historical network attack traffic.

[0167] Step 804: when there is a missing attack link in the attack process, the associated traffic of the historical network attack traffic is obtained from the historical network traffic.

[0168] Since the IP addresses of each attack link are correlated during the attack process of the APT organization, computer equipment can find the associated traffic of historical network attack traffic based on the association of IP addresses, thereby obtaining the missing attack links in the associated traffic.

[0169] like Fig.10 As shown, step 804 may include the following sub-steps.

[0170] Step 804A, obtaining historical IP addresses contained in historical network attack traffic.

[0171] The historical IP address includes the historical source IP address and the historical destination IP address, wherein the transmission direction of the historical communication content is from the historical source IP address to the historical destination IP address.

[0172] Step 804B, determining the missing IP address based on the historical IP address, the historical IP address and the missing IP address constitute a complete IP chain.

[0173] During the attack process of the APT organization, each IP address communicates with each other, so the attack process composed of each tactical link can form a complete IP chain. Among them, the IP chain is composed of the source IP address and destination IP address contained in the historical attack traffic corresponding to each tactical link.

[0174] In a possible implementation, the computer device obtains the missing IP address according to the IP chain corresponding to the attack process and the historical IP addresses existing in the historical attack traffic.

[0175] For example, when the attack process includes tactical link 1, tactical link 2, and tactical link 3, in tactical link 1, first, IP address 1 is used as the source IP address and IP address 2 is used as the destination IP address for communication, and then IP address 2 is used as the source IP address and IP address 3 is used as the destination IP address for communication. In tactical link 2, first, IP address 3 is used as the source IP address and IP address 4 is used as the destination IP address for communication, and then IP address 4 is used as the source IP address and IP address 5 is used as the destination IP address for communication. In tactical link 3, IP address 6 is used as the source IP address and IP address 6 is used as the destination IP address for communication. Among them, IP address 1, IP address 2, IP address 3, IP address 4, IP address 5, and IP address 6 constitute a complete IP chain. When attack link 1 and attack link 3 exist in the historical attack traffic, the computer device can determine that attack link 2 is missing. According to the association relationship from the source IP address to the destination IP address in attack link 1 and attack link 3, the computer device can infer that IP address 4 and IP address 5 are missing in the IP chain.

[0176] Step 804C: determine the network traffic corresponding to the missing IP address in the historical network traffic as the associated traffic.

[0177] It should be noted that not all network traffic corresponding to missing IP addresses can be determined as associated traffic. In order to save time in identifying associated traffic threats, in one possible implementation, the computer device records the time corresponding to historical network traffic, and calculates the associated traffic corresponding to the missing IP address based on the time sequence. When the historical network traffic corresponding to the missing IP address is within the time range corresponding to the IP chain, the computer device determines that the network traffic is associated traffic.

[0178] Step 805: Perform threat identification on the associated traffic to obtain an associated threat identification result.

[0179] Threat identification of associated traffic may include the following sub-steps.

[0180] 1. Perform traffic analysis on the associated traffic to obtain the associated IP address, associated domain name, and associated communication content.

[0181] 2. When at least one of the associated IP address and the associated domain name is found in the APT organization knowledge graph, a first threat identification is performed on the associated communication content to obtain an associated threat identification result.

[0182] The first threat identification includes the following steps.

[0183] Step 1: When the APT attack tool corresponding to the associated communication content is found in the APT organization knowledge graph, it is determined that there is a threat in the associated network traffic.

[0184] Step 2: If no APT attack tool corresponding to the associated communication content is found in the APT organization knowledge graph, a manual review result of the associated communication content is obtained.

[0185] Step 3: When the manual review result indicates that the associated communication content belongs to an APT attack tool, it is determined that there is a threat in the associated traffic.

[0186] Step 4: When the threat review result indicates that the associated communication content does not belong to an APT attack tool, determine that there is no threat in the associated traffic.

[0187] 3. If no associated IP address and associated domain name are found in the APT organization knowledge graph, a second threat identification is performed on the associated communication content to obtain an associated threat identification result.

[0188] Among them, the second threat identification includes the following two situations.

[0189] The first one is that when the APT attack tool corresponding to the associated communication content is queried in the APT organization knowledge graph, it is determined that the associated traffic is a threat.

[0190] The second is that when no APT attack tool corresponding to the associated communication content is found in the APT organization knowledge graph, it is determined that there is no threat in the associated traffic.

[0191] Step 806: When the associated threat identification result indicates that the associated traffic has a threat, the associated traffic is determined as associated attack traffic.

[0192] Step 807, based on the historical network attack traffic and the historical IP addresses, historical domain names, and historical communication content in the associated attack traffic, update the APT organization knowledge graph.

[0193] When threats are identified from historical network attack traffic, the computer device updates the IP addresses, domain names, and APT attack tools in the APT organization’s knowledge graph.

[0194] Similar to how computer devices update their knowledge graph after real-time network traffic threat identification, when threats are identified through review in associated attack traffic, computer devices update historical IP addresses, historical domain names, and historical communication content into the APT organization knowledge graph.

[0195] Among them, the update of knowledge graph can be divided into two cases.

[0196] The first one is that the APT organization uses the APT attack tools recorded in the knowledge graph and uses at least one of the IP addresses and domain names not recorded in the knowledge graph to carry out network attacks.

[0197] After the computer device identifies the historical communication content as an APT attack tool by querying the knowledge graph, it adds at least one of the currently discovered historical IP addresses and historical domain names to the knowledge graph.

[0198] For example, Fig.11 As shown in the figure, the historical access IP addresses, historical access domain names, and historical attack tools of the APT34 organization in the APT knowledge graph are IP address 1, domain name 1, and phishing emails, respectively. In the case where the APT34 organization uses IP address 2, domain name 2, and phishing emails to conduct network attacks in the historical attack traffic, the computer device detects the phishing email as an attack tool, so the IP address 2 and domain name 2 can be determined as the historical access IP address and historical access domain name of the APT34 organization, and then the computer device adds IP address 2 and domain name 2 to the knowledge graph.

[0199] The second type is that the APT organization uses at least one of the IP addresses and domain names recorded in the knowledge graph and uses APT attack tools that are not recorded in the knowledge graph to carry out network attacks.

[0200] After the computer device determines that at least one of the historical IP address and the historical domain name is related to the APT organization by querying the knowledge graph, the historical communication content is manually reviewed.

[0201] When it is determined through review that the historical communication content is an APT attack tool, at least one of the historical access IP addresses and historical access domain names of the corresponding APT organization in the knowledge graph is updated.

[0202] For example, Fig.11 As shown, when the APT34 organization uses IP address 2, domain name 2 and web script Trojan WebShell to carry out network attacks, the computer device detects that IP address 2 and domain name 2 are the historically visited IP address and historically visited domain name of the APT organization by querying the knowledge graph. Subsequently, when manual review determines that WebShell is an APT attack tool, the computer device updates WebShell to the historical attack tool of the APT34 organization in the knowledge graph.

[0203] Optionally, the computer device can also determine the tactical purpose of the APT organization based on the attack tool, and then update the tactical purpose in the knowledge graph. The updating method of updating the tactical purpose after threat identification of historical network traffic and its associated traffic is the same as the updating method of updating the tactical purpose after threat identification of real-time network traffic.

[0204] In addition, after analysis by security experts, computer equipment can also update the attack methods, attack targets, defense methods, and other content corresponding to each tactical purpose under the APT organization's attack mode in the knowledge graph.

[0205] In the embodiment of the present application, the computer device first determines the attack link corresponding to the historical network attack traffic, and then queries the attack process corresponding to the APT organization knowledge graph to determine whether there is a missing attack link. Subsequently, in the case of a missing attack link, the computer device determines the missing IP address in the historical attack traffic through the association relationship between the source IP address and the destination IP address, thereby obtaining the associated traffic. Finally, the associated IP address, associated domain name, and associated communication content in the associated traffic are extracted for threat identification, thereby updating the APT organization knowledge graph.

[0206] Its reference Fig.12 , which shows a structural block diagram of an APT organization knowledge graph update device provided by an exemplary embodiment of the present application, the device includes:

[0207] Construction module 1201, used to construct the APT organization knowledge graph;

[0208] An identification module 1202 is used to perform threat identification on real-time network traffic based on the APT organization knowledge graph to obtain real-time threat identification results;

[0209] A first updating module 1203 is configured to update the APT organization knowledge graph based on the real-time network traffic when the real-time threat identification result indicates that the real-time network traffic has a threat;

[0210] A backtracking module 1204 is used to backtrack historical network traffic based on the updated APT organization knowledge graph to obtain historical network attack traffic, where the historical network attack traffic is historical network traffic for which no threat has been identified;

[0211] The second updating module 1205 is used to update the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic.

[0212] Optionally, the identification module 1202 is further used to:

[0213] Performing traffic analysis on the real-time network traffic to obtain the real-time IP address, real-time domain name and real-time communication content;

[0214] When at least one of the real-time IP address and the real-time domain name is found in the APT organization knowledge graph, a first threat identification is performed on the real-time communication content to obtain the real-time threat identification result;

[0215] When the real-time IP address and the real-time domain name are not found in the APT organization knowledge graph, a second threat identification is performed on the real-time communication content to obtain the real-time threat identification result.

[0216] Optionally, the identification module 1202 is further used to:

[0217] In the case where an APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, determining that the real-time network traffic is threatened;

[0218] If no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, obtaining a manual review result of the real-time communication content;

[0219] In the case where the manual review result indicates that the real-time communication content belongs to an APT attack tool, determining that there is a threat to the real-time network traffic;

[0220] When the threat review result indicates that the real-time communication content does not belong to an APT attack tool, it is determined that there is no threat to the real-time network traffic.

[0221] Optionally, the identification module 1202 is further used to:

[0222] In the case where an APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, determining that the real-time network traffic is threatened;

[0223] When no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, it is determined that there is no threat to the real-time network traffic.

[0224] Optionally, the first updating module 1203 is further used to:

[0225] In the case where an APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, determining that the real-time network traffic is threatened;

[0226] When no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, it is determined that there is no threat to the real-time network traffic.

[0227] Optionally, the first updating module 1203 is further used to:

[0228] The APT organization knowledge graph is updated based on the real-time IP address, the real-time domain name, and the real-time communication content contained in the real-time network traffic.

[0229] Optionally, the backtracking module 1204 is further configured to:

[0230] Performing traffic analysis on the historical network traffic to obtain historical IP addresses, historical domain names, and historical communication content;

[0231] When at least one of the historical IP address and the historical domain name is queried in the updated APT organization knowledge graph, threat identification is performed on the historical communication content to obtain a historical threat identification result; when the historical threat identification result indicates that the historical network traffic has a threat, the historical network traffic is determined as the historical network attack traffic;

[0232] When the APT attack tool corresponding to the historical communication content is queried in the updated APT organization knowledge graph, the historical network traffic is determined as the historical network attack traffic.

[0233] Optionally, the second updating module 1205 is further used to:

[0234] Determine the attack link corresponding to the historical network attack traffic in the attack process;

[0235] In the case where an attack link is missing in the attack process, the associated traffic of the historical network attack traffic is obtained from the historical network traffic.

[0236] Optionally, the second updating module 1205 is further used to:

[0237] Query the attack process corresponding to the APT organization from the APT organization knowledge graph;

[0238] Based on the attack process and the attack links corresponding to the historical network attack traffic, the missing status of the attack process is determined.

[0239] Optionally, the second updating module 1205 is further used to:

[0240] Obtaining historical IP addresses contained in the historical network attack traffic;

[0241] Determine a missing IP address based on the historical IP address, wherein the historical IP address and the missing IP address constitute a complete IP chain;

[0242] The network traffic corresponding to the missing IP address in the historical network traffic is determined as the associated traffic.

[0243] Optionally, the second updating module 1205 is further used to:

[0244] Performing threat identification on the associated traffic to obtain an associated threat identification result;

[0245] If the associated threat identification result indicates that the associated traffic has a threat, determining the associated traffic as associated attack traffic;

[0246] The APT organization knowledge graph is updated based on the historical network attack traffic and the historical IP addresses, historical domain names, and historical communication content in the associated attack traffic.

[0247] It should be noted that: the device provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0248] Please refer to Fig.13 , which shows a block diagram of a computer device provided by an exemplary embodiment of the present application. The computer device may include one or more of the following components: a processor 1301 and a memory 1302 .

[0249] Optionally, the processor 1301 utilizes various interfaces and lines to connect various parts within the entire computer device, and performs various functions of the computer device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 1302, and calling data stored in the memory 1302.

[0250] The memory 1302 may include a random access memory (RAM) or a read-only memory (ROM). The memory 1302 may be used to store instructions, programs, codes, code sets or instruction sets.

[0251] An embodiment of the present application also provides a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the method for updating the APT organization knowledge graph described in the above embodiment.

[0252] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0253] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for updating the knowledge graph of an APT organization, characterized in that: The method comprises: Build the knowledge graph of APT organizations; Based on the APT organization knowledge graph, threat identification is performed on real-time network traffic to obtain real-time threat identification results; When the real-time threat identification result indicates that the real-time network traffic has a threat, updating the APT organization knowledge graph based on the real-time network traffic; Based on the updated APT organization knowledge graph, historical network traffic is traced back to obtain historical network attack traffic, where the historical network attack traffic is historical network traffic for which no threat has been identified; The APT organization knowledge graph is updated based on the historical network attack traffic and the associated traffic of the historical network attack traffic.

2. The method according to claim 1, characterized in that The threat identification of real-time network traffic based on the APT organization knowledge graph is performed to obtain real-time threat identification results, including: Performing traffic analysis on the real-time network traffic to obtain the real-time IP address, real-time domain name and real-time communication content; When at least one of the real-time IP address and the real-time domain name is found in the APT organization knowledge graph, a first threat identification is performed on the real-time communication content to obtain the real-time threat identification result; When the real-time IP address and the real-time domain name are not found in the APT organization knowledge graph, a second threat identification is performed on the real-time communication content to obtain the real-time threat identification result.

3. The method according to claim 2, characterized in that The performing a first threat identification on the real-time traffic sample to obtain the real-time threat identification result includes: In the case where an APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, determining that the real-time network traffic is threatened; If no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, obtaining a manual review result of the real-time communication content; In the case where the manual review result indicates that the real-time communication content belongs to an APT attack tool, determining that there is a threat to the real-time network traffic; When the threat review result indicates that the real-time communication content does not belong to an APT attack tool, it is determined that there is no threat to the real-time network traffic.

4. The method according to claim 2, characterized in that: The performing a second threat identification on the real-time communication content to obtain the real-time threat identification result includes: In the case where an APT attack tool corresponding to the real-time communication content is queried in the APT organization knowledge graph, determining that the real-time network traffic is threatened; When no APT attack tool corresponding to the real-time communication content is found in the APT organization knowledge graph, it is determined that there is no threat to the real-time network traffic.

5. The method according to claim 2, characterized in that: The updating of the APT organization knowledge graph based on the real-time network traffic includes: The APT organization knowledge graph is updated based on the real-time IP address, the real-time domain name, and the real-time communication content contained in the real-time network traffic.

6. The method according to claim 1, characterized in that The historical network traffic is traced back based on the updated APT organization knowledge graph to obtain the historical network attack traffic, including: Performing traffic analysis on the historical network traffic to obtain historical IP addresses, historical domain names, and historical communication content; When at least one of the historical IP address and the historical domain name is queried in the updated APT organization knowledge graph, threat identification is performed on the historical communication content to obtain a historical threat identification result; when the historical threat identification result indicates that the historical network traffic has a threat, the historical network traffic is determined as the historical network attack traffic; When the APT attack tool corresponding to the historical communication content is queried in the updated APT organization knowledge graph, the historical network traffic is determined as the historical network attack traffic.

7. The method according to claim 1, characterized in that Before updating the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic, the method further includes: Determine the attack link corresponding to the historical network attack traffic in the attack process; In the case where an attack link is missing in the attack process, the associated traffic of the historical network attack traffic is obtained from the historical network traffic.

8. The method according to claim 7, characterized in that The method further comprises: Query the attack process corresponding to the APT organization from the APT organization knowledge graph; Based on the attack process and the attack links corresponding to the historical network attack traffic, the missing status of the attack process is determined.

9. The method according to claim 7, characterized in that: The obtaining the associated traffic of the historical network attack traffic from the historical network traffic includes: Obtaining historical IP addresses contained in the historical network attack traffic; Determine a missing IP address based on the historical IP address, wherein the historical IP address and the missing IP address constitute a complete IP chain; The network traffic corresponding to the missing IP address in the historical network traffic is determined as the associated traffic.

10. The method according to claim 1, characterized in that The updating of the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic includes: Performing threat identification on the associated traffic to obtain an associated threat identification result; If the associated threat identification result indicates that the associated traffic has a threat, determining the associated traffic as associated attack traffic; The APT organization knowledge graph is updated based on the historical network attack traffic and the historical IP addresses, historical domain names, and historical communication content in the associated attack traffic.

11. A device for updating an APT organization knowledge graph, characterized in that: The device comprises: Construction module, used to build the knowledge graph of APT organizations; An identification module, used to identify threats to real-time network traffic based on the APT organization knowledge graph to obtain real-time threat identification results; A first updating module, configured to update the APT organization knowledge graph based on the real-time network traffic when the real-time threat identification result indicates that the real-time network traffic has a threat; A backtracking module, used to backtrack historical network traffic based on the updated APT organization knowledge graph to obtain historical network attack traffic, where the historical network attack traffic is historical network traffic for which no threat has been identified; The second updating module is used to update the APT organization knowledge graph based on the historical network attack traffic and the associated traffic of the historical network attack traffic.

12. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the method for updating the APT organization knowledge graph as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the method for updating the APT organization knowledge graph as described in any one of claims 1 to 10.

Images