An attack trace detection method, device, equipment and readable storage medium

Abstract

The application discloses a kind of attack trace detection method, device, equipment and readable storage medium in network security technology field, the method includes: the network communication behavior of analysis traffic data is obtained exception subgraph database and exception edge;With exception edge, exception subgraph in exception subgraph database is fused;From the exception subgraph after fusion, multiple attack path is screened, and in combination with the multiple attack path screened and exception subgraph database, multiple attack data set is obtained;With the network security event set corresponding to traffic data is acquired;Multiple attack data set is used to screen and supplement network security event set, and multiple attack security event set is obtained;Multiple attack security event set is clustered, and multiple attack chain is obtained.The application is based on the multiple attack of communication characteristic and the multiple attack security event set obtained after security event association analysis of multiple attack is clustered, and more accurate multiple attack chain can be obtained.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an attack trace detection method and device, equipment and a readable storage medium. BACKGROUND

[0002] Attacks are long-term network attack activities implemented by advanced hacker organizations against specific targets, and their purpose is to steal valuable confidential data or conduct network espionage, and their attack activities mostly follow similar patterns: pre-investigation, contact with C&C servers, privilege escalation or lateral movement, and data transmission.

[0003] Unlike other attack patterns, APT (Advanced Persistent Threat) attacks have the characteristics of concealment, flexibility, long cycle, and tool sharing, and concealment is an important feature that distinguishes APT attacks from other attacks.

[0004] Currently, the trace detection of APT attacks has the problem of low accuracy, which cannot meet the needs of trace analysis.

[0005] To sum up, how to effectively improve the accuracy of APT attack trace detection and other problems are technical problems that need to be solved by technical personnel in the field at present. SUMMARY

[0006] The purpose of the present application is to provide an attack trace detection method, device, equipment and readable storage medium to improve the accuracy of APT attack trace detection.

[0007] To solve the above technical problems, the present application provides the following technical solutions:

[0008] An attack trace detection method, comprising:

[0009] analyzing the network communication behavior of the traffic data to obtain an abnormal subgraph database and an abnormal edge;

[0010] Fusing abnormal subgraphs in the abnormal subgraph database using the abnormal edge;

[0011] Filtering a multi-step attack path from the fused abnormal subgraph, and combining the filtered multi-step attack path with the abnormal subgraph database to obtain a multi-step attack dataset;

[0012] Obtaining a network security event set corresponding to the traffic data;

[0013] Filtering and supplementing the network security event set using the multi-step attack dataset to obtain a multi-step attack security event set;

[0014] The multi-step attack security event set is clustered to obtain a multi-step attack chain.

[0015] Preferably, network communication behaviors of the traffic data are analyzed to obtain an abnormal subgraph database, including:

[0016] IP information in the traffic data is used to form a directed graph of the traffic data.

[0017] Abnormal subgraphs and abnormal subgraph related information conforming to communication characteristics of attack behaviors are detected from the directed graph.

[0018] The abnormal subgraphs and the abnormal subgraph related information are stored in a database to obtain the abnormal subgraph database.

[0019] Preferably, abnormal edges are obtained by analyzing network communication behaviors of the traffic data, including:

[0020] The traffic data is input into an abnormal edge identification model to identify abnormal edges, to obtain the abnormal edges.

[0021] Preferably, abnormal subgraphs and abnormal subgraph related information conforming to communication characteristics of attack behaviors are detected from the directed graph, including:

[0022] Out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph are calculated.

[0023] It is determined that a difference between the in-degree centrality and the out-degree centrality of the node is greater than a standard deviation, and the degree centrality of the node is greater than a preset threshold.

[0024] If yes, a directed graph corresponding to the node is determined as an abnormal subgraph, and it is recorded in abnormal subgraph related information that a type of the abnormal subgraph is a denial of service attack type and a batch of the abnormal subgraph.

[0025] Preferably, abnormal subgraphs and abnormal subgraph related information conforming to communication characteristics of attack behaviors are detected from the directed graph, including:

[0026] Out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph are calculated.

[0027] It is determined that a difference between the out-degree centrality and the in-degree centrality of the node is greater than a standard deviation, and the degree centrality of the node is greater than a preset threshold.

[0028] If yes, a directed graph corresponding to the node is determined as an abnormal subgraph, and it is recorded in abnormal subgraph related information that a type of the abnormal subgraph is a scanning and probing type and a batch of the abnormal subgraph.

[0029] Preferably, abnormal subgraphs and abnormal subgraph related information conforming to communication characteristics of attack behaviors are detected from the directed graph, including:

[0030] finding a relevant path node with a specified value from the directed graph;

[0031] In the case of a path with multiple edges, filtering all path combinations with possible nodes and edges according to the chronological order of time;

[0032] Based on the filtered graph structure, if the out-degree of the main node is greater than the in-degree, an abnormal subgraph is determined, and the type of the abnormal subgraph is recorded in the abnormal subgraph related information as an internal network penetration type and the batch of the abnormal subgraph.

[0033] Preferably, the abnormal subgraph database is fused using the abnormal edge, including:

[0034] According to the start node of the abnormal edge, the end node in the abnormal subgraph database is queried, and the first batch of abnormal subgraphs is returned;

[0035] According to the end node of the abnormal edge, the start node in the abnormal subgraph database is queried, and the second batch of abnormal subgraphs is returned;

[0036] Using the first batch and the second batch, the batch to which the abnormal edge belongs is filtered out;

[0037] Based on the filtered batch, the abnormal subgraphs are fused to obtain the fused abnormal subgraphs.

[0038] Preferably, the network security event set is filtered and supplemented using the multi-step attack data set to obtain a multi-step attack security event set, including:

[0039] The network security event set is filtered using the multi-step attack data set to obtain a security event set corresponding to the multi-step attack;

[0040] Supplementing security events that appear in the multi-step attack data set but do not appear in the security event set to obtain the multi-step attack security event set.

[0041] An attack trace detection device, comprising:

[0042] A communication behavior analysis module for analyzing the network communication behavior of the traffic data to obtain an abnormal subgraph database and an abnormal edge;

[0043] An abnormal subgraph fusion module for fusing abnormal subgraphs in the abnormal subgraph database using the abnormal edge;

[0044] A multi-step attack data set acquisition module for filtering multi-step attack paths from the fused abnormal subgraphs, and combining the filtered multi-step attack paths and the abnormal subgraph database to obtain a multi-step attack data set;

[0045] a network security event set acquisition module, configured to acquire a network security event set corresponding to the traffic data;

[0046] a multi-step attack security event set acquisition module, configured to filter and supplement the network security event set by using the multi-step attack data set, to obtain a multi-step attack security event set;

[0047] a multi-step attack tracing detection module, configured to perform clustering processing on the multi-step attack security event set, to obtain a multi-step attack chain.

[0048] An electronic device comprises:

[0049] a memory, configured to store a computer program;

[0050] a processor, configured to implement the steps of the attack tracing detection method when the computer program is executed.

[0051] A readable storage medium, wherein the readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the attack tracing detection method.

[0052] By using the method provided in the embodiments of the present application, the network communication behavior of the traffic data is analyzed to obtain an abnormal subgraph database and abnormal edges; the abnormal edges are used to fuse the abnormal subgraphs in the abnormal subgraph database; multi-step attack paths are filtered from the fused abnormal subgraphs, and the multi-step attack data set is obtained in combination with the filtered multi-step attack paths and the abnormal subgraph database; a network security event set corresponding to the traffic data is acquired; the network security event set is filtered and supplemented by using the multi-step attack data set, to obtain a multi-step attack security event set; and the multi-step attack security event set is subjected to clustering processing, to obtain a multi-step attack chain.

[0053] In one aspect, the network communication behavior corresponding to the multi-step attack behavior inevitably leaves traces and has differences from normal communication behavior. Therefore, the application performs anomaly detection of multi-step attacks from the perspective of the graph structure of communication behavior, using the attack behavior characteristics, to obtain a multi-step attack dataset. On the other hand, since the events in the network security event set do not correspond to multi-step attack security events alone, and in actual applications, due to the defects of the retrieval scheme, some multi-step attack security events may also be missed. In the application, based on the fact that the network communication behavior corresponding to the multi-step attack behavior inevitably leaves traces that are specifically different from the registered communication behavior, by analyzing the network communication behavior of network traffic, abnormal subgraphs and abnormal edges can be found. After fusing the abnormal subgraphs based on the abnormal edges, path screening is performed on the fused abnormal subgraphs, and a multi-step attack path can be obtained. In combination with the multi-step attack path and the abnormal subgraph database, a multi-step attack dataset can be obtained. Based on the multi-step attack dataset, the network security event set is screened and supplemented, to obtain a multi-step attack security event set. Then, clustering processing is performed on the multi-step attack security event set, and the multi-step attack trace can be obtained, to obtain the corresponding multi-step attack chain.

[0054] The application can obtain a more accurate multi-step attack chain by analyzing communication behavior, based on the multi-step attack security event set obtained by analyzing the communication characteristics of multi-step attacks and security event association.

[0055] Correspondingly, the application also provides an attack trace detection method, device, and readable storage medium corresponding to the attack trace detection method, which have the above technical effects, and will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the application or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or the related art description. Obviously, the drawings in the following description only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0057] Figure 1 The implementation flowchart of an attack trace detection method in an embodiment of the application;

[0058] Figure 2 An abnormal subgraph of a denial of service attack type in an embodiment of the application;

[0059] Figure 3 An abnormal subgraph of a scanning and probing type in an embodiment of the application;

[0060] Figure 4 is an abnormal subgraph of an internal network penetration type in an embodiment of the present application;

[0061] Figure 5 is a structural schematic diagram of an attack trace detection device in an embodiment of the present application;

[0062] Figure 6 is a structural schematic diagram of an electronic device in an embodiment of the present application;

[0063] Figure 7 is a specific structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to enable persons skilled in the art to better understand the present application, the present application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor fall within the scope of protection of the present application.

[0065] Please refer to Figure 1 , Figure 1 is a flowchart of an attack trace detection method in an embodiment of the present application, and the method comprises the following steps:

[0066] S101, analyzing network communication behavior of traffic data to obtain an abnormal subgraph database and an abnormal edge.

[0067] The abnormal subgraph refers to data anomalies brought by an attacker in communication traffic, such as graph structures corresponding to denial-of-service attack type, scanning and detection type, and internal network penetration type.

[0068] The abnormal edge refers to data anomalies brought by an attacker in communication traffic, such as extracting target data and transmitting data to the outside through a stepping stone node (stepping stone host), so that network communication brings obvious burst change, which has an attack attribute.

[0069] The abnormal subgraph database can store abnormal subgraphs and related information of abnormal subgraphs, such as batch, detection time, attack type, etc.

[0070] Obtaining the abnormal subgraph database and the abnormal edge are both based on network communication behavior analysis of traffic data, and the two can be executed in sequence or in parallel.

[0071] In a specific embodiment of the present application, analyzing network communication behavior of traffic data to obtain an abnormal subgraph database comprises:

[0072] Using IP information in traffic data to form a directed graph of traffic data;

[0073] detecting an abnormal subgraph and abnormal subgraph related information conforming to a communication feature of an attack behavior from the directed graph;

[0074] storing the abnormal subgraph and the abnormal subgraph related information into a database to obtain an abnormal subgraph database;

[0075] and / or, obtaining an abnormal edge by analyzing network communication behavior of the traffic data, including:

[0076] inputting the traffic data into an abnormal edge identification model to identify the abnormal edge, and obtaining the abnormal edge.

[0077] For ease of description, the above steps will be described in combination.

[0078] In actual application, when analyzing network communication behavior of the traffic data, the process of obtaining the abnormal subgraph database is as follows: based on IP information in the traffic data, a directed graph of the traffic data is formed. For example, taking source IP and destination IP of the traffic data as nodes, and taking the direction of the source IP pointing to the destination IP as an edge direction, a directed graph of the traffic data is formed. Then, an abnormal subgraph and abnormal subgraph related information conforming to an attack behavior feature are detected from the directed graph. The attack behavior feature can be summarized by analyzing communication of the attack behavior. The abnormal subgraph and the abnormal subgraph related information are stored into a database, so that the abnormal subgraph database can be obtained.

[0079] For identification of the abnormal edge, the abnormal edge identification model can be used for processing, so as to obtain the abnormal edge. Specifically, the UNSW-NB15 dataset can be used for training of the abnormal edge model. The dataset has nine types of attacks, i.e. Fuzzers (fuzzing attack), Analysis (analysis attack), Backdoors (backdoor attack), DoS (Denial of Service attack), Exploits (exploit attack), Generic (generic attack), Reconnaissance (reconnaissance attack), Shellcode (shellcode attack) and Worms (worm attack). The traffic features of the dataset are utilized in the embodiment, including byte flow per unit time, packet size per unit time, outflow / inflow byte flow per unit time, inflow / outflow packet size per unit time, unit packet size, unit packet inflow / outflow byte flow size. A decision tree model is used for training, and the training result F1-score is 97%. The result is used as an abnormal attack edge identification model, so that the identification of the abnormal edge has diversity, and the specific algorithm is as follows:

[0080] Step 1: Extract traffic features from the UNSW-NB15 dataset as follows: duration, out-bytes flow size, out-packet size, in-bytes flow size, in-packet size, byte flow per unit time, packet size per unit time, out-bytes flow per unit time, in-bytes flow per unit time, out-packet size per unit time, packet size per unit time, in-packet per unit time, out-bytes flow per unit time, out-packet size per unit time, a total of 14 features;

[0081] Step 2: Model training is performed using a decision tree model, and an abnormal edge identification model is output.

[0082] Step 3: Abnormal edge identification is performed on the traffic data using the abnormal edge identification model, and an abnormal edge result is output.

[0083] Of course, in actual application, the acquisition of the abnormal subgraph database and the acquisition of the abnormal edge can refer to the above two ways, or one of the two ways can be used for communication behavior analysis to obtain the abnormal subgraph database or the abnormal edge. For the other object that is not obtained, other ways can be used to obtain it. For example, the abnormal subgraph database can also be acquired based on the trained abnormal subgraph identification model.

[0084] In one specific embodiment of the present application, the abnormal subgraph and abnormal subgraph related information conforming to the communication characteristics of the attack behavior are detected from the directed graph, including:

[0085] Step 1: Calculate the out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph.

[0086] Step 2: Determine whether the difference between the in-degree centrality and the out-degree centrality of the node is greater than the standard deviation, and whether the degree centrality of the node is greater than a preset threshold.

[0087] Step 3: If yes, the directed graph corresponding to the node is determined as an abnormal subgraph, and the type of the abnormal subgraph is recorded as a denial-of-service attack class and the batch of the abnormal subgraph in the abnormal subgraph related information.

[0088] For ease of description, the above steps will be combined for description.

[0089] Denial-of-service attack class (in-star) attack: an attacker launches a connection to a single host through multiple IPs, thereby paralyzing the target node. The attack communication graph presents a convergence state, such as Figure 2 . From Figure 2The degree centrality can find that the graph structure is a many-to-one relationship, so the degree centrality is used to reflect the concentration of the central node of the many-to-one relationship, that is, the degree of the node accounts for the proportion of the number of the whole node; and the node has the characteristic that the in-degree is much larger than the out-degree, and the difference between the in-degree centrality and the out-degree centrality is greater than the standard deviation (0.5) and the degree centrality of the node is greater than the threshold value (0.8) through experimental design. The algorithm steps for extracting the abnormal subgraph of this type are as follows:

[0090] Step 1: Calculate the out-degree, in-degree of each node, and the out-degree centrality and in-degree centrality based on the out-degree and in-degree;

[0091] Step 2: The difference between the in-degree centrality and the out-degree centrality (ratio) is greater than the standard deviation (0.5) and the degree centrality of the node is greater than the threshold value (0.8), then it is determined that the detected type is the abnormal subgraph of the scanning detection type.

[0092] Step 3: Write the basic information such as the type of the abnormal subgraph and the batch of the detected abnormal subgraph into the abnormal subgraph database. The batch can determine the abnormal subgraph. That is, the batch can be similar to the number of the abnormal subgraph.

[0093] In a specific embodiment of the present application, the abnormal subgraph and abnormal subgraph related information conforming to the communication characteristics of the attack behavior are detected from the directed graph, including:

[0094] Step 1: Calculate the out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph;

[0095] Step 2: Determine whether the difference between the out-degree centrality and the in-degree centrality of the node is greater than the standard deviation, and whether the degree centrality of the node is greater than the preset threshold value;

[0096] Step 3: If yes, the directed graph corresponding to the node is determined as the abnormal subgraph, and the type of the abnormal subgraph is recorded as the scanning detection type and the batch of the abnormal subgraph in the abnormal subgraph related information.

[0097] For the convenience of description, the above three steps will be combined for description.

[0098] Scanning detection type (out-star) attack: the attacker launches connection to multiple hosts through a single host, so as to find weak host. The attack communication graph presents a divergent state, like Figure 3 From Figure 3 , it can be found that the graph structure is a one-to-many relationship, and the algorithm steps for extracting the abnormal subgraph of this type are as follows:

[0099] Step 1: Calculate the out-degree, in-degree and degree centrality of each node;

[0100] Step 2: the difference between the out-degree centrality and the in-degree centrality is greater than the standard deviation (0.5) and the degree centrality of the node is greater than the threshold (0.8);

[0101] Step 3: write the basic information of the abnormal subgraph such as the type of the abnormal subgraph and the batch of detecting the abnormal subgraph into the abnormal subgraph database.

[0102] In a specific embodiment of the present application, abnormal subgraphs and abnormal subgraph related information meeting the communication characteristics of attack behavior are detected from a directed graph, including:

[0103] Step 1: find the relevant path nodes with a specified number of paths from the directed graph;

[0104] Step 2: in the case of multiple edges in the path, filter out all possible node and edge combinations according to the chronological order;

[0105] Step 3: based on the filtered graph structure, if the out-degree of the main node is greater than the in-degree, determine the abnormal subgraph, and record the type of the abnormal subgraph as the internal network penetration type and the batch of the abnormal subgraph in the abnormal subgraph related information.

[0106] For ease of description, the above three steps will be described together.

[0107] Internal network penetration (k-path) attack: the attacker starts from the foothold host, step by step detects and migrates to the target host, so as to find the key target host. Its attack communication graph is in a continuous divergent state, like Figure 4 From Figure 4 , it can be found that its structure has a dependency relationship, which has a prerequisite for the implementation of another single-step attack. Since the path is too short to reflect the implementation characteristics of multi-step attack, the possibility of multi-step attack with too long path is low, therefore, in this embodiment, the abnormal path length is selected as 3 (of course, in actual application, the path length can also be selected as 4 or other path length with high possibility of multi-step attack), and the algorithm steps for extracting the abnormal subgraph of this type are as follows:

[0108] Step 1: use the source IP and destination IP in the traffic data as nodes to form a directed graph of traffic data;

[0109] Step 2: calculate the shortest path and select the relevant path nodes with a path of 3;

[0110] Step 3: for the case of multiple edges in the path, filter out all possible node and edge combinations according to the chronological order;

[0111] Step 4: Through the graph structure, the out-degree greater than the in-degree on the master node is calculated, and if all conditions are met, the k-path feature is met, and basic information such as the type of the abnormal subgraph and the batch of the detected abnormal subgraph is written into the abnormal subgraph database.

[0112] S102, using the abnormal edge, fusing the abnormal subgraph in the abnormal subgraph database.

[0113] APT attack is a multi-step abnormal attack, and the denial of service attack class and the scanning detection class in the abnormal subgraph found in the embodiment of the application are single steps, so it is necessary to fuse the abnormal subgraph, so as to facilitate the discovery of the communication path information of the multi-step attack.

[0114] Specifically, based on the abnormal edge, the related abnormal subgraph is fused. For example, a certain abnormal edge appears in the abnormal subgraph Figure 1 and the abnormal subgraph Figure 2 , and the time of the two abnormal subgraphs is close, so the two abnormal subgraphs can be connected into one abnormal subgraph by connecting the abnormal edge between the abnormal subgraph Figure 1 and the abnormal subgraph Figure 2 . In the process of connecting the abnormal subgraph, all abnormal subgraphs can be screened and fused based on the detected abnormal edge. Thus, the fused abnormal subgraph or the fused graph structure is obtained.

[0115] In a specific embodiment of the application, the abnormal subgraph in the abnormal subgraph database is fused by using the abnormal edge, including:

[0116] Step 1: According to the start node of the abnormal edge, the end node in the abnormal subgraph database is queried, and the first batch of abnormal subgraphs is returned;

[0117] Step 2: According to the end node of the abnormal edge, the start node in the abnormal subgraph database is queried, and the second batch of abnormal subgraphs is returned;

[0118] Step 3: Using the first batch and the second batch, the batch of the abnormal edge belonging to different abnormal subgraphs is screened out;

[0119] Step 4: Based on the screened batch, the abnormal subgraph is fused to obtain the fused abnormal subgraph.

[0120] For the convenience of description, the above four steps will be described in combination.

[0121] The identified abnormal edge is used to fuse the In-star, out-star and k-path abnormal subgraphs, and the algorithm process includes:

[0122] Step 1: According to the start node of the abnormal edge, the end node in the abnormal subgraph database is queried, and the batch of the abnormal subgraph (i.e. the first batch) is returned;

[0123] Step 2: Query the start nodes in the abnormal subgraph database according to the end nodes of the abnormal edges, and return the batches of abnormal subgraphs (i.e., the second batch);

[0124] Step 3: Filter the batches that belong to different abnormal subgraphs according to the results of Step 1 and Step 2;

[0125] Step 4: Filter the abnormal subgraphs and edge information to be fused according to the filtering result of Step 3, and fuse to obtain the fused graph.

[0126] S103, filtering multi-step attack paths from the fused abnormal subgraph, and combining the filtered multi-step attack paths with the abnormal subgraph database to obtain a multi-step attack dataset.

[0127] Specifically, the fused abnormal subgraph can be filtered according to time, and a multi-step attack path such as a longest path (where the longest path can be set and adjusted according to actual conditions) can be obtained. Then, based on the multi-step attack path, the fused abnormal subgraph type, abnormal subgraph detection batch, and other information are updated to form a multi-step attack dataset, which is marked as suspicious APT attack data, which can be used as input for fuzzy clustering APT attack tracing in the future.

[0128] That is, the abnormal subgraphs that have been fused in the database can be deleted, and the newly formed abnormal subgraphs (suspicious APT attack data) can be written into the database.

[0129] S104, obtaining a network security event set corresponding to the traffic data.

[0130] The network security event set can be a collection of network security events generated during the maintenance of network cases by security devices. The network security events in the network security event set include but are not limited to APT attack events.

[0131] The network security event set can be obtained directly by reading or receiving. How to detect or obtain each network security event in the network security event set can refer to related network security supervision schemes, which will not be described here.

[0132] S105, filtering and supplementing the network security event set using the multi-step attack dataset to obtain a multi-step attack security event set.

[0133] Since the purpose of the present application is to trace APT, the events related to non-APT attacks in the network security event set will interfere with the APT tracing, and therefore, in the embodiment, the network security event set can be filtered based on the multi-step attack data set, so as to leave the events related to APT. It is also considered that in actual application, not all APT-related events can be detected, and therefore, the network security event set can also be supplemented based on the multi-step attack data set. After the filtering and supplementing are completed, the multi-step attack security event set is obtained.

[0134] In a specific embodiment of the present application, the network security event set is filtered and supplemented based on the multi-step attack data set to obtain the multi-step attack security event set, comprising:

[0135] Step one, filtering the network security event set based on the multi-step attack data set to obtain the security event set corresponding to the multi-step attack;

[0136] Step two, supplementing the security events that appear in the multi-step attack data set but do not appear in the security event set to obtain the multi-step attack security event set.

[0137] For ease of description, the above steps will be described in combination.

[0138] In order to make the APT attack tracing detection have relevance and fully utilize the richness of data, the network security event of network flow is used for APT attack tracing detection, the network security event is filtered through the APT attack data set, when the APT attack event data set exists and the security data set does not exist, the security event is supplemented. The whole process not only eliminates the noise data related to APT tracing detection, but also reduces the calculation amount of APT attack tracing, the universality of its graph feature, thereby improving the accuracy and generalization of APT attack tracing detection, and providing strong support for APT attack tracing detection.

[0139] S106, clustering the multi-step attack security event set to obtain the multi-step attack chain.

[0140] Specifically, in order to make the APT attack tracing detection have relevance, the kill chain model can be used in the embodiment, the APT attack is divided into 7 stages: reconnaissance target, delivery implant, vulnerability exploitation, installation resident, command control, action harvesting, and trace removal, which are divided into security events, and the correlation features between security events are defined, so as to perform fuzzy clustering, and therefore, the security event is used as a clustering index, so as to improve the correlation of alarms in an APT attack sequence.

[0141] Regarding the fuzzy clustering function: first, define the similarity function of the fuzzy clustering attribute, different attributes show different characteristics in the APT attack sequence, and define the similarity function according to the meaning of the attribute, wherein and respectively represent two security event data, and . The similarity characteristics mainly include the similarity of IP network segment association, time association, and event execution phase of the kill chain, and the correlation function is defined as follows:

[0142] 1. Time-induced event association: time reflects the before-and-after relationship between attack events, and the association between two attack events gradually weakens over time. The similarity measurement can be defined as:

[0143]

[0144] wherein, represents the time of occurrence of a piece of data, the time of event occurrence is greater than .

[0145] 2. Network segment association characteristics: generally, the IP address of the attacker is mostly launched from the same network segment, so the same attacker has similarity on the source IP or destination IP of the IDS alarm log. The similarity measurement can be defined as: wherein: , the H function is the number of bits from left to right that are the same in the binary representation of two IP addresses, sIP refers to the source IP address, and dIP refers to the destination IP address.

[0146] 3. Execution phase: from the characteristics of the kill chain, the attack method of the previous event may be a prerequisite for the attack method in the next event. The similarity measurement can be defined as:

[0147] .

[0148] Fuzzy clustering based on DBSCAN: without any prior information and expert knowledge, how to use clustering algorithms based on similarity measurement to effectively identify and mine potential information in unlabeled data is one of the difficulties, and the DBSCAN clustering algorithm model is selected for clustering, which has the advantages of not needing to know the number of classes and selecting a core object for clustering, and is efficient, so the distance function is defined as follows:

[0149]

[0150] wherein, .

[0151] The finally obtained clustering result is a multi-step attack chain, that is, after clustering is completed, the APT tracing is completed.

[0152] In the multi-step attack detection process, in order to ensure that the formed multi-step attack has the properties of sequentiality, long-term, reachability and greediness, the embodiment identifies abnormal subgraphs and abnormal edges from the perspective of a graph, and fuses the subgraphs through related logical strategies, so as to form suspicious APT attack data.

[0153] In the APT attack tracing detection based on fuzzy clustering, the suspicious APT attack data formed by the multi-step attack detection is fully utilized to screen and supplement the security event data, the screening ensures the correlation of the APT attack chain, and the supplement is beneficial to identifying the hidden means of the APT attack. By defining a clustering fuzzy function and using the DBSCAN algorithm for clustering, the APT attack is identified.

[0154] By applying the method provided in the embodiment, the network communication behavior of the traffic data is analyzed to obtain an abnormal subgraph database and abnormal edges; the abnormal edges are used to fuse the abnormal subgraphs in the abnormal subgraph database; a multi-step attack path is screened from the fused abnormal subgraphs, and a multi-step attack dataset is obtained in combination with the screened multi-step attack path and the abnormal subgraph database; a network security event set corresponding to the traffic data is obtained; the network security event set is screened and supplemented by using the multi-step attack dataset, to obtain a multi-step attack security event set; and the multi-step attack security event set is subjected to clustering processing, to obtain a multi-step attack chain.

[0155] On the one hand, the network communication behavior corresponding to the multi-step attack behavior must leave traces and has difference from normal communication behavior. Therefore, the embodiment starts from the graph structure of the communication behavior, uses the attack behavior characteristics thereof, and performs abnormal detection of the multi-step attack, to obtain a multi-step attack dataset. On the other hand, the events in the network security event set do not correspond to only the multi-step attack security event, and in actual application, due to the defects of the retrieval scheme, some multi-step attack security events may also be missed. In the present application, based on the fact that the network communication behavior corresponding to the multi-step attack behavior must leave traces that are different from the normal communication behavior, by analyzing the network communication behavior of the network traffic, abnormal subgraphs and abnormal edges can be found, the abnormal subgraphs are fused based on the abnormal edges, and then the path screening is performed on the fused abnormal subgraphs, to obtain a multi-step attack path. In combination with the multi-step attack path and the abnormal subgraph database, a multi-step attack dataset can be obtained. Based on the multi-step attack dataset, the network security event set is screened and supplemented, to obtain a multi-step attack security event set. Then, the multi-step attack security event set is subjected to clustering processing, to complete the tracing of the multi-step attack, and obtain a corresponding multi-step attack chain.

[0156] The application can cluster the multi-step attack security event set obtained based on the communication characteristics of the multi-step attack and the correlation analysis of the security events, and can obtain a more accurate multi-step attack chain. That is, the application can realize accurate multi-step attack tracing processing.

[0157] Corresponding to the above method embodiments, the application embodiments also provide an attack tracing detection device. The attack tracing detection device described below can be mutually corresponding and referred to with the attack tracing detection method described above.

[0158] Referring to Figure 5 As shown in the figure, the device comprises the following modules:

[0159] The communication behavior analysis module 101 is configured to analyze the network communication behavior of the traffic data, and obtain an abnormal subgraph database and abnormal edges.

[0160] The abnormal subgraph fusion module 102 is configured to fuse the abnormal subgraphs in the abnormal subgraph database by using the abnormal edges.

[0161] The multi-step attack data set acquisition module 103 is configured to filter the multi-step attack paths from the fused abnormal subgraphs, and obtain a multi-step attack data set in combination with the filtered multi-step attack paths and the abnormal subgraph database.

[0162] The network security event set acquisition module 104 is configured to obtain a network security event set corresponding to the traffic data.

[0163] The multi-step attack security event set acquisition module 105 is configured to filter and supplement the network security event set by using the multi-step attack data set, and obtain a multi-step attack security event set.

[0164] The multi-step attack tracing detection module 106 is configured to perform clustering processing on the multi-step attack security event set, and obtain a multi-step attack chain.

[0165] By using the device provided by the application embodiments, the network communication behavior of the traffic data is analyzed, and an abnormal subgraph database and abnormal edges are obtained. The abnormal subgraphs in the abnormal subgraph database are fused by using the abnormal edges. The multi-step attack paths are filtered from the fused abnormal subgraphs, and a multi-step attack data set is obtained in combination with the filtered multi-step attack paths and the abnormal subgraph database. A network security event set corresponding to the traffic data is obtained. The network security event set is filtered and supplemented by using the multi-step attack data set, and a multi-step attack security event set is obtained. The multi-step attack security event set is subjected to clustering processing, and a multi-step attack chain is obtained.

[0166] In one aspect, the network communication behavior corresponding to the multi-step attack behavior inevitably leaves traces and has differences from normal communication behavior. Therefore, the present application performs anomaly detection of multi-step attacks from the perspective of the graph structure of communication behavior, using the attack behavior characteristics, so as to obtain a multi-step attack dataset. On the other hand, since the events in the network security event set do not correspond to multi-step attack security events alone, and in actual application, due to the defects of the retrieval scheme, some multi-step attack security events may also be missed. In the present application, based on the fact that the network communication behavior corresponding to the multi-step attack behavior inevitably leaves traces that are specifically different from the registered communication behavior, by analyzing the network communication behavior of network traffic, abnormal subgraphs and abnormal edges can be found, and based on the abnormal edges, the abnormal subgraphs are fused, and then the fused abnormal subgraphs are subjected to path screening, so as to obtain a multi-step attack path. In combination with the multi-step attack path and the abnormal subgraph database, a multi-step attack dataset can be obtained. Based on the multi-step attack dataset, the network security event set is screened and supplemented, so as to obtain a multi-step attack security event set. Then, the multi-step attack security event set is subjected to clustering processing, so as to complete the tracing of the multi-step attack and obtain the corresponding multi-step attack chain.

[0167] Technical effects of the present application: The present application can obtain a more accurate multi-step attack chain by analyzing communication behavior, based on the multi-step attack security event set obtained by analyzing the communication characteristics of multi-step attacks and the correlation of security events. That is, the present application can realize accurate multi-step attack tracing processing.

[0168] In one specific embodiment of the present application, the communication behavior analysis module comprises:

[0169] The abnormal subgraph database acquisition submodule is configured to form a directed graph of the traffic data using the IP information in the traffic data.

[0170] The abnormal subgraph and abnormal subgraph related information are detected from the directed graph.

[0171] The abnormal subgraph and abnormal subgraph related information are stored in the database to obtain an abnormal subgraph database.

[0172] And / or, the abnormal edge acquisition submodule is configured to input the traffic data into an abnormal edge identification model to identify abnormal edges, so as to obtain abnormal edges.

[0173] In one specific embodiment of the present application, the abnormal subgraph database acquisition submodule comprises:

[0174] The denial-of-service attack type detection unit is configured to calculate the out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph.

[0175] the difference between the out-degree centrality and the in-degree centrality of the node is greater than a standard deviation, and the degree centrality of the node is greater than a preset threshold value;

[0176] If yes, the directed graph corresponding to the node is determined as an abnormal subgraph, and the type of the abnormal subgraph is recorded as a denial-of-service attack type and the batch of the abnormal subgraph in abnormal subgraph related information.

[0177] In an embodiment of the present application, the abnormal subgraph database acquisition submodule comprises:

[0178] The out-degree centrality, the in-degree centrality and the degree centrality of each node in the directed graph are calculated.

[0179] the difference between the out-degree centrality and the in-degree centrality of the node is greater than a standard deviation, and the degree centrality of the node is greater than a preset threshold value;

[0180] If yes, the directed graph corresponding to the node is determined as an abnormal subgraph, and the type of the abnormal subgraph is recorded as a denial-of-service attack type and the batch of the abnormal subgraph in abnormal subgraph related information.

[0181] In an embodiment of the present application, the abnormal subgraph database acquisition submodule comprises:

[0182] The internal network penetration type detection unit is configured to find out the related path nodes with a specified number of paths from the directed graph.

[0183] In the case of multiple edges in the path, all path combinations with possible nodes and edges are filtered according to the chronological order.

[0184] Based on the filtered graph structure, if the out-degree of the main node is greater than the in-degree, an abnormal subgraph is determined, and the type of the abnormal subgraph is recorded as an internal network penetration type and the batch of the abnormal subgraph in abnormal subgraph related information.

[0185] In an embodiment of the present application, the abnormal subgraph fusion module is specifically configured to query the end node in the abnormal subgraph database according to the start node of the abnormal edge, and return the first batch of abnormal subgraphs.

[0186] According to the end node of the abnormal edge, the start node in the abnormal subgraph database is queried, and the second batch of abnormal subgraphs is returned.

[0187] The first batch and the second batch are used to filter the batch to which the abnormal edge belongs and different abnormal subgraphs.

[0188] Based on the filtered batch, the abnormal subgraphs are fused to obtain fused abnormal subgraphs.

[0189] In an embodiment of the present application, the multi-step attack security event set acquisition module is specifically configured to filter the network security event set by using the multi-step attack data set to obtain a security event set corresponding to the multi-step attack.

[0190] The security event appearing in the multi-step attack data set but not appearing in the security event set is supplemented to obtain the multi-step attack security event set.

[0191] Corresponding to the above method embodiments, the embodiments of the present application also provide an electronic device. The electronic device described below can be correspondingly referred to the attack trace detection method described above.

[0192] Referring to Figure 6 The electronic device includes:

[0193] The memory 332 is configured to store a computer program.

[0194] The processor 322 is configured to execute the computer program to implement the steps of the attack trace detection method in the above method embodiments.

[0195] Specifically, refer to Figure 7 , Figure 7 A specific structural diagram of an electronic device provided by the embodiment is shown in the figure. The electronic device can have great differences due to different configurations or performances, and can include one or more processors (central processing units, CPU) (for example, one or more processors) and a memory 332 storing one or more computer programs 342 or data 344. The memory 332 can be temporary storage or persistent storage. The program stored in the memory 332 can include one or more modules (not shown in the figure), and each module can include a series of instruction operations in the data processing device. Further, the processor 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301.

[0196] The electronic device 301 can also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341.

[0197] The steps in the attack trace detection method described above can be implemented by the structure of the electronic device.

[0198] Corresponding to the above method embodiments, the embodiments of the present application also provide a readable storage medium. The readable storage medium described below can be correspondingly referred to the attack trace detection method described above.

[0199] A readable storage medium, a computer program is stored on the readable storage medium, and the computer program is executed by a processor to implement the steps of the attack trace detection method of the method embodiment.

[0200] The readable storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various readable storage media that can store program codes.

[0201] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0202] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present text can be realized in electronic hardware, computer software or combination of both. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0203] The steps of the method or algorithm described in combination with the embodiments disclosed in the present text can be directly implemented by hardware, software module executed by a processor, or combination of both. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable magnetic disk, a CD-ROM, or any other form of storage medium known in the art.

[0204] Finally, it should be noted that in this text, relationships such as first and second are only used to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the term includes, contains or any other variant is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device.

[0205] The principles and implementations of the present application are described in the specific examples, and the above examples are only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation and application range will be changed, and the above description should not be understood as a limitation of the present application.

Claims

1. A method of attack attribution detection, the method comprising: The method comprises the following steps: analyzing network communication behavior of traffic data to obtain an abnormal subgraph database and abnormal edges; fusing abnormal subgraphs in the abnormal subgraph database by using the abnormal edges; screening multi-step attack paths from the fused abnormal subgraphs, and obtaining a multi-step attack dataset by combining the screened multi-step attack paths and the abnormal subgraph database; obtaining a network security event set corresponding to the traffic data; screening and supplementing the network security event set by using the multi-step attack dataset to obtain a multi-step attack security event set; performing clustering processing on the multi-step attack security event set to obtain a multi-step attack chain. The method comprises the following steps: querying end nodes in the abnormal subgraph database according to start nodes of the abnormal edges, and returning a first batch of abnormal subgraphs; querying start nodes in the abnormal subgraph database according to end nodes of the abnormal edges, and returning a second batch of abnormal subgraphs; screening batches in which the abnormal edges belong to different abnormal subgraphs by using the first batch and the second batch; fusing abnormal subgraphs based on the screened batches to obtain fused abnormal subgraphs.

2. The method of claim 1, wherein, The method comprises the following steps: forming a directed graph of the traffic data by using IP information in the traffic data; detecting abnormal subgraphs and abnormal subgraph related information that meet communication characteristics of attack behaviors from the directed graph; storing the abnormal subgraphs and the abnormal subgraph related information in a database to obtain the abnormal subgraph database; and / or, obtaining abnormal edges by analyzing network communication behavior of traffic data, which comprises the following steps: inputting the traffic data into an abnormal edge identification model to identify abnormal edges, and obtaining the abnormal edges.

3. The method of claim 2, wherein, The method comprises the following steps: calculating out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph; judging whether the difference between the in-degree centrality and the out-degree centrality of the node is greater than a standard deviation, and whether the degree centrality of the node is greater than a preset threshold; if yes, determining the directed graph corresponding to the node as an abnormal subgraph, and recording the type of the abnormal subgraph as a denial-of-service attack type and the batch of the abnormal subgraph in the abnormal subgraph related information.

4. The method of claim 2, wherein, The method comprises the following steps: calculating out-degree centrality, in-degree centrality and degree centrality of each node in the directed graph; judging whether the difference between the out-degree centrality and the in-degree centrality of the node is greater than a standard deviation, and whether the degree centrality of the node is greater than a preset threshold; if yes, determining the directed graph corresponding to the node as an abnormal subgraph, and recording the type of the abnormal subgraph as a scanning and probing type and the batch of the abnormal subgraph in the abnormal subgraph related information.

5. The method of claim 2, wherein, The method comprises the following steps: finding related path nodes with a specified number of paths from the directed graph; in the case that there are multiple edges in the path, screening all path combinations with possible nodes and edges according to the chronological order of time; Based on the screened graph structure, if the out-degree on the master node is greater than the in-degree, an abnormal subgraph is determined, and the type of the abnormal subgraph is recorded in the abnormal subgraph related information as an internal network penetration type and the batch of the abnormal subgraph.

6. The method according to any one of claims 1 to 5, characterized in that, The network security event set is screened and supplemented by using the multi-step attack data set to obtain a multi-step attack security event set, including: The network security event set is screened by using the multi-step attack data set to obtain a security event set corresponding to the multi-step attack; Security events that appear in the multi-step attack data set but do not appear in the security event set are supplemented to obtain the multi-step attack security event set.

7. An attack attribution detection apparatus characterized by comprising: Including: The communication behavior analysis module is configured to analyze the network communication behavior of the traffic data to obtain an abnormal subgraph database and an abnormal edge; The abnormal subgraph fusion module is configured to fuse abnormal subgraphs in the abnormal subgraph database by using the abnormal edge; The multi-step attack data set acquisition module is configured to screen multi-step attack paths from the fused abnormal subgraphs, and obtain a multi-step attack data set by combining the screened multi-step attack paths and the abnormal subgraph database; The network security event set acquisition module is configured to obtain a network security event set corresponding to the traffic data; The multi-step attack security event set acquisition module is configured to screen and supplement the network security event set by using the multi-step attack data set to obtain a multi-step attack security event set; The multi-step attack tracing detection module is configured to perform clustering processing on the multi-step attack security event set to obtain a multi-step attack chain. The abnormal subgraph fusion module is specifically configured to query the end node in the abnormal subgraph database according to the start node of the abnormal edge, and return the first batch of abnormal subgraphs; query the start node in the abnormal subgraph database according to the end node of the abnormal edge, and return the second batch of abnormal subgraphs; filter out the batches to which the abnormal edge belongs by using the first batch and the second batch; and fuse abnormal subgraphs based on the filtered batches to obtain fused abnormal subgraphs.

8. An electronic device, comprising: Including: The memory is configured to store a computer program; The processor is configured to execute the computer program to implement the steps of the attack tracing detection method according to any one of claims 1 to 6.

9. A readable storage medium, characterized by, The computer program is stored on the readable storage medium, and the computer program is executed by the processor to implement the steps of the attack tracing detection method according to any one of claims 1 to 6.

Images