Attack behavior detection method, device, equipment and medium

Abstract

The present application discloses an attack behavior detection method, device, equipment and medium. Among them, the method includes: using a target large model to identify alternative attack step entities in the log to be detected; then, querying the attack and defense knowledge graph to obtain similar attack step entity sets and corresponding other related entity sets, the attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to multiple historical attack behaviors, the historical other related entities corresponding to the historical attack step entities, and the relationship between each entity; finally, the log, the similar attack step entity set and the other related entity set are input into the target large model for attack behavior detection, and the detection result for indicating whether there is an attack behavior in the log to be detected is output. This method uses the target large model combined with the attack and defense knowledge graph to detect attack behaviors in logs, reducing the problems of missed reports and false reports of attack behaviors.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an attack behavior detection method, device, equipment and medium. Background Art

[0002] Currently, large and medium-sized enterprises rely heavily on security information and event management (SIEM) products to analyze security logs generated daily by the enterprise to discover threat activities that really need attention and take countermeasures. These security logs include logs of various security devices (such as firewalls, mail gateways, etc.) and logs of various systems (such as operating systems, system middleware, etc.).

[0003] With the escalation of attack and defense confrontation, detecting attack behaviors from a single point of security equipment is prone to false positives and missed reports. This requires SIEM products to comprehensively analyze logs from various sources, but the current technical means of SIEM products have some limitations, such as over-reliance on human experience and overly rigid rule-based detection methods, which cause missed reports and false positives. With the vigorous development of large language models, methods for security log analysis based on large language models have emerged one after another. However, due to the many challenges of large language models in terms of hallucinations and interpretability, the detection of attack behaviors is uncontrollable and it is also very easy to have missed reports and false positives. Summary of the invention

[0004] The embodiments of the present application provide an attack behavior detection method, device, equipment and medium. The method uses a large target model combined with an attack and defense knowledge graph to detect attack behaviors in logs, thereby reducing the problems of missed reports and false reports of attack behaviors.

[0005] In a first aspect, an embodiment of the present application provides an attack behavior detection method, comprising:

[0006] Get the log to be tested;

[0007] Input the above-mentioned log to be detected into the target large model to perform attack step entity recognition, and output candidate attack step entities;

[0008] According to the above-mentioned alternative attack step entities, query the attack and defense knowledge graph to obtain a similar attack step entity set and other related entity sets corresponding to the above-mentioned similar attack step entity set; the above-mentioned attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of the multiple historical attack behaviors, the historical other related entities corresponding to the above-mentioned historical attack step entities, and the relationship between the entities;

[0009] The above-mentioned log to be detected, the above-mentioned similar attack step entity set and the above-mentioned other related entity sets are input into the above-mentioned target large model to detect attack behavior, and the detection result corresponding to the above-mentioned log to be detected is output; the above-mentioned detection result is used to indicate whether there is attack behavior in the above-mentioned log to be detected.

[0010] In a possible implementation, the similar attack step entity set includes at least one similar attack step entity and the previous and next attack step entities corresponding to each of the similar attack step entities; the other related entity set includes at least one first other related entity corresponding to the similar attack step entity and at least one second other related entity corresponding to the previous and next attack step entities;

[0011] After inputting the log to be detected, the entity set of similar attack steps and the other related entity sets into the target large model to detect attack behaviors and outputting the detection results corresponding to the log to be detected, the method further includes:

[0012] If the detection result indicates that there is an attack behavior in the log to be detected, then based on the previous and next attack step entities and the second other related entity, a query is performed in other logs to obtain a query result; the query result is used to indicate whether the previous and next attack step entities exist in the other logs;

[0013] If the query result indicates that the preceding and following attack step entities exist in the other logs, then the attack behavior corresponding to the similar attack step entity in the log to be detected is determined to be a high-confidence attack behavior;

[0014] If the query result indicates that the previous and next attack step entities do not exist in the other logs, it is determined that the attack behavior corresponding to the similar attack step entity in the log to be detected is a general confidence attack behavior; the processing priority of the high confidence attack behavior is higher than that of the general confidence attack behavior.

[0015] In a possible implementation, based on the preceding and following attack step entities and the second other related entity, a query is performed in other logs to obtain a query result, including:

[0016] The aforementioned previous and subsequent attack step entities, the aforementioned second other related entities and other logs are input into the aforementioned target large model for query analysis, and the query results are output.

[0017] In a possible implementation, the attack and defense knowledge graph is queried based on the candidate attack step entities to obtain similar attack step entity sets and other related entity sets corresponding to the similar attack step entity sets, including:

[0018] Vectorize the above candidate attack step entities to obtain candidate attack step entity vectors;

[0019] Calculate the target similarity between the candidate attack step entity vector and the attack step entity vector corresponding to each attack step entity in the attack and defense knowledge graph;

[0020] According to the target similarity corresponding to each attack step entity in the attack and defense knowledge graph, a similar attack step entity set is determined; the similar attack step entity set is the attack step entity whose target similarity ranking is within the target value and / or the attack step entity whose target similarity exceeds the similarity threshold;

[0021] According to the above similar attack step entity set, the above attack and defense knowledge graph is queried to obtain other related entity sets corresponding to the above similar attack step entity set.

[0022] In a possible implementation, the log to be detected, the similar attack step entity and the other related entity set are input into the target large model to perform attack behavior detection, and the detection result corresponding to the log to be detected is output, including:

[0023] Input the log to be detected, the similar attack step entity and the other related entity set into the target big model, and determine whether the similar attack step entity belongs to the log to be detected based on the log to be detected and the other related entity set;

[0024] If the similar attack step entity belongs to the log to be detected, it is determined that there is an attack behavior in the log to be detected;

[0025] If the similar attack step entity does not belong to the log to be detected, it is determined that there is no attack behavior in the log to be detected.

[0026] In a possible implementation, before querying the attack and defense knowledge graph according to the candidate attack step entities to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set, the method further includes:

[0027] Obtaining a historical attack activity report; the historical attack activity report includes at least one historical attack behavior and description information corresponding to the historical attack behavior;

[0028] The above historical attack activity report is input into the detection model for attack step entity recognition to obtain the initial attack step entity corresponding to the above historical attack behavior; the above detection model is obtained by fine-tuning the pre-trained model based on the sample data of the historical attack activity report with known attack step entity recognition results;

[0029] Input the above historical attack activity report, the above initial attack step entity and the preset prompt information into the above target big model, and output the historical attack step entity, the historical attack activity entity, the historical other related entities corresponding to the above historical attack behavior in the above historical attack activity report, and the relationship between the entities; the above historical attack activity entity is an entity composed of multiple historical attack step entities in the order of attack;

[0030] According to the historical attack step entities, the historical attack activity entities, the other historical related entities, and the relationships between the entities corresponding to the historical attack behaviors, an attack and defense knowledge graph corresponding to the historical attack activity report is constructed.

[0031] In a possible implementation, the preset prompt information includes a correct attack step example; the other historical related entities include a historical log data source entity, a historical identification rule entity, and a historical log feature entity;

[0032] The above-mentioned historical attack activity report, the above-mentioned initial attack step entity and the preset prompt information are input into the above-mentioned target large model, and the historical attack step entity, the historical attack activity entity, the historical other related entities corresponding to the historical attack behavior in the above-mentioned historical attack activity report, and the relationship between each entity are output, including:

[0033] The above-mentioned historical attack activity report, the above-mentioned initial attack step entity and the above-mentioned correct attack step example are input into the target big model for attack step entity recognition, and the above-mentioned historical attack step entity, historical attack activity entity, and the usage relationship between the above-mentioned historical attack step entity and the above-mentioned historical attack activity entity are extracted based on the attack step entity recognition result, and other entity recognitions are performed on the above-mentioned historical attack activity report based on the above-mentioned attack step entity recognition result to obtain the above-mentioned historical log data source entity, historical identification rule entity, historical log feature entity, as well as the detection relationship between the above-mentioned historical attack step entity and the above-mentioned historical identification rule entity, the embodiment relationship between the above-mentioned historical attack step entity and the above-mentioned historical log feature entity, and the output relationship between the above-mentioned historical log data source entity and the above-mentioned historical log feature entity.

[0034] In a second aspect, an embodiment of the present application provides an attack behavior detection device, including:

[0035] The first acquisition module is used to acquire the log to be detected;

[0036] An identification module is used to input the above-mentioned log to be detected into the target large model to perform attack step entity recognition and output candidate attack step entities;

[0037] The first query module is used to query the attack and defense knowledge graph according to the above-mentioned alternative attack step entities to obtain a similar attack step entity set and other related entity sets corresponding to the above-mentioned similar attack step entity set; the above-mentioned attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of the multiple historical attack behaviors, the historical other related entities corresponding to the above-mentioned historical attack step entities, and the relationship between the entities;

[0038] The detection module is used to input the above-mentioned log to be detected, the above-mentioned similar attack step entity set and the above-mentioned other related entity sets into the above-mentioned target large model to detect attack behavior, and output the detection result corresponding to the above-mentioned log to be detected; the above-mentioned detection result is used to indicate whether there is attack behavior in the above-mentioned log to be detected.

[0039] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory; wherein the memory stores executable program code, and the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method steps provided in the first aspect of the embodiment of the present application or any possible implementation method of the first aspect.

[0040] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores multiple instructions, and the instructions are suitable for being loaded by a processor and executing the method steps provided by the first aspect of the embodiment of the present application or any possible implementation of the first aspect.

[0041] The beneficial effects brought about by the technical solutions provided by some embodiments of the present application include at least:

[0042] In the embodiment of the present application, firstly, since the target large model has a strong generalization ability, the alternative attack step entities are obtained according to the target large model, which can reduce the omission problem caused by the failure to identify the attack step entities; then, similar attack step entity sets and other related entity sets corresponding to similar attack step entity sets are queried in the attack and defense knowledge graph. This method of obtaining similar attack step entity sets in combination with the attack and defense knowledge graph reduces the omissions and false positives caused by model hallucinations compared with the method of directly using the large language model; finally, the target large model is used to determine whether there is an attack behavior in the log to be detected based on the log to be detected, similar attack step entity sets and other related entity sets. This detection method using the target large model combined with the attack and defense knowledge graph can not only reduce the dependence of the attack behavior detection process on people and improve the efficiency of attack behavior detection, but also ensure that the attack steps in the log to be detected can be completely detected, thereby improving the accuracy of attack behavior detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A schematic diagram of the architecture of an attack behavior detection system provided by an exemplary embodiment of the present application;

[0045] Figure 2 A flowchart of an attack behavior detection method provided by an exemplary embodiment of the present application;

[0046] Figure 3 A flowchart of a method for constructing an attack and defense knowledge graph provided for an exemplary embodiment of the present application;

[0047] Figure 4 A schematic diagram of an attack activity detection rule report provided in an embodiment of the present application;

[0048] Figure 5 A schematic diagram of an attack means log provided in an embodiment of the present application;

[0049] Figure 6 A schematic diagram of an attack and defense knowledge graph provided for an exemplary embodiment of the present application;

[0050] Figure 7 A flowchart of another attack behavior detection method provided by an exemplary embodiment of the present application;

[0051] Figure 8 A schematic diagram of an implementation process of an attack behavior detection method provided by an exemplary embodiment of the present application;

[0052] Fig. 9 A schematic diagram of the implementation process of an attack and defense knowledge graph construction method provided for an exemplary embodiment of the present application;

[0053] Fig.10 A schematic diagram of the structure of an attack behavior detection device provided by an exemplary embodiment of the present application;

[0054] Fig.11 A schematic structural diagram of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0056] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0057] Please refer to the following Figure 1 , which is a schematic diagram of the architecture of an attack behavior detection system provided by an exemplary embodiment of this specification. Figure 1 As shown, the attack behavior detection system may include: a terminal 110 and a server 120. Among them:

[0058] The terminal 110 can interact with the server 120 through the network to receive messages from the server 120 or send messages to the server 120. The terminal 110 can be hardware or software. When the terminal 110 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 110 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0059] In the embodiment of the present specification, the terminal 110 may be a user terminal corresponding to a user who performs attack behavior detection. When a user wants to perform attack behavior detection on a log, the user may first obtain the log to be detected on the terminal 110, but is not limited to; then, the log to be detected is input into the target large model for attack step entity recognition, and the candidate attack step entity is output; then, according to the candidate attack step entity, the attack and defense knowledge graph is queried to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set; the similar attack step entity set includes at least one similar attack step entity corresponding to the candidate attack step entity; the other related entity set includes a first identification rule entity and a first log feature entity corresponding to the similar attack step entity; the attack and defense knowledge graph is constructed based on the historical attack step entity, the historical identification rule entity, the historical log feature entity corresponding to each of the multiple historical attack behaviors, and the relationship between the entities; finally, the log to be detected, the similar attack step entity, the first identification rule entity and the first log feature entity are input into the target large model for attack behavior detection, and the detection result corresponding to the log to be detected is output; the detection result is used to indicate whether there is an attack behavior in the log to be detected.

[0060] The server 120 may be a server that provides attack behavior detection functions. It should be noted that the server 120 may be hardware or software. When the server 120 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 120 is software, it may be implemented as multiple software or software modules (for example, used to provide distributed services), or it may be implemented as a single software or software module, which is not specifically limited here. The server 120 may be, but is not limited to, a hardware server, a virtual server, a cloud server, etc.

[0061] Optionally, after receiving the attack behavior detection instruction sent by the terminal 110 through the network, the server 120 may also perform attack behavior detection on the log to be detected carried by the attack behavior detection instruction through the attack behavior detection method provided in the embodiment of the present application.

[0062] It can be understood that the attack behavior detection method provided in the embodiment of the present application can be executed by the terminal 110 alone, by the server 120 alone, or by the terminal 110 and the server 120 together, and the embodiment of the present application is not limited to this.

[0063] The network may be a medium providing a communication link between the terminal 110 and the server 120, or may be the Internet including network devices and transmission media, but is not limited thereto. The transmission media may be a wired link, such as but not limited to coaxial cable, optical fiber, and digital subscriber line (DSL), or a wireless link, such as but not limited to wireless fidelity (WIFI), Hypertext Transfer Protocol (HTTP), Bluetooth, and mobile device network, etc.

[0064] Understandably, Figure 1 The number of terminals 110 and servers 120 in the attack behavior detection system shown is only an example. In a specific implementation, the attack behavior detection system may include any number of terminals 110 and servers 120.

[0065] Next, combine Figure 1 , taking the terminal 110 performing attack behavior detection as an example, an attack behavior detection method provided by an exemplary embodiment of the present application is introduced. For details, please refer to Figure 2 , which exemplarily shows a flow chart of an attack behavior detection method provided in an embodiment of the present application. Figure 2 As shown, the attack behavior detection method may include the following steps:

[0066] S201, obtaining the log to be detected.

[0067] Specifically, the above-mentioned log to be detected is a log file that records security-related activities, events, alarms and state changes. It can be a log file generated by various security devices (such as but not limited to firewalls, anti-virus software, mail gateways, etc.), or a log file generated by various systems (such as but not limited to operating systems, system middleware, etc.), and the present application embodiment does not limit this. Log files can be used for real-time monitoring of the security status of the system, helping the security team to promptly discover potential security threats and take measures to prevent them. At the same time, by analyzing the abnormal behavior, attack mode and other information in the log, the behavior and trend of external attackers can be understood, so as to formulate more effective security strategies.

[0068] S202, input the log to be detected into the target large model to perform attack step entity recognition, and output candidate attack step entities.

[0069] Specifically, after obtaining the log to be detected, the API interface of the target large model (such as but not limited to a large model based on a deep neural network, a large language model, etc.) can be called to input the log to be detected into the target large model for identification of the attack step entity. The target large model preprocesses the log to be detected, including but not limited to word segmentation, removal of stop words, stem extraction, etc., so as to convert the log into a format that the model can process. Then, the target large model extracts features from the preprocessed log to be detected, and identifies the alternative attack step entity through the above features and context information. The above features may include but are not limited to lexical features, syntactic features, semantic features, etc. For the log to be detected, attack step entity identification is to identify a specific attack action or means in the log to be detected, such as but not limited to uploading Godzilla webshell using the CVE-2019-2618 arbitrary file upload vulnerability of weblogic. Since the target large model usually adopts an efficient computing architecture and algorithm, it can process a large amount of security log data in a short time. At the same time, the target large model has a strong generalization ability, which can more comprehensively extract the attack step entity in the log to be detected, avoiding the problem of underreporting.

[0070] S203, querying the attack and defense knowledge graph according to the candidate attack step entities, obtaining a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set.

[0071] Specifically, since the target large model will have certain hallucinations when generating text replies, this needs to be corrected using professional domain knowledge. The above-mentioned hallucination phenomenon refers to the fact that when the target large model identifies the attack step entity, alternative attack step entities that do not exist or do not conform to the facts may be generated. These alternative attack step entities may seem reasonable and logical, but in fact they are not identified based on the log to be detected. Therefore, after obtaining the alternative attack step entity, in order to ensure the professionalism and accuracy of the alternative attack step entity, it is possible but not limited to querying the attack and defense knowledge graph using keywords or similarity calculations to obtain similar attack step entity sets and other related entity sets corresponding to the similar attack step entity sets. The above-mentioned attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of the multiple historical attack behaviors, the historical other related entities corresponding to the historical attack step entities, and the relationship between the entities. The above-mentioned similar attack step entity set includes at least one attack step entity in the attack and defense knowledge graph corresponding to the alternative attack step entity, that is, there can be one or more similar attack step entities corresponding to an alternative attack step entity, and the embodiment of the present application is not limited to this. The above-mentioned other related entity set includes at least one first other related entity corresponding to the above-mentioned similar attack step entity in the attack and defense knowledge graph. The above-mentioned first other related entity may include but is not limited to at least one of the following: a first identification rule entity, a first log feature entity, and a first log data source entity. The above-mentioned first identification rule entity is used to characterize the related detection rules for the similar attack step corresponding to the above-mentioned similar attack step entity to be identified, and the above-mentioned first log feature entity is used to characterize the characteristics reflected in the log to which the above-mentioned similar attack step belongs. The above-mentioned first log data source entity is used to characterize the source of the log to which the above-mentioned similar attack step belongs. Since the target large model is mainly trained based on a large amount of text data, they lack the ability to represent specific professional and specific structural knowledge, while the attack and defense knowledge graph is a professional and structured knowledge representation method. For the field of network attacks, the attack and defense knowledge graph can provide professional and rich attack and defense knowledge, which can make up for the shortcomings of the target large model. Compared with the method of directly using a large language model, this method of determining similar attack step entities in combination with the attack and defense knowledge graph can effectively reduce the problems of missed reports and false positives caused by hallucinations.

[0072] Optionally, after obtaining the alternative attack step entity, similarity calculation can be used to query in the attack and defense knowledge graph to obtain a similar attack step entity set and other related entity sets. Specifically, the entities and relationships in the attack and defense knowledge graph can be converted into vector form and saved in the vector database, and then the alternative attack step entity is vectorized to obtain the alternative attack step entity vector. Next, the target similarity between the alternative attack step entity vector and the attack step entity vector corresponding to each attack step entity in the attack and defense knowledge graph is calculated. Then, according to the target similarity corresponding to each attack step entity in the attack and defense knowledge graph, the similar attack step entity set is determined. Finally, based on the above-mentioned similar attack step entity set, the above-mentioned attack and defense knowledge graph is queried to obtain other related entity sets associated with the above-mentioned similar attack step entity set. The above-mentioned similar attack step entity set is an attack step entity whose target similarity ranking is within the target value and / or an attack step entity whose target similarity exceeds the similarity threshold. The above-mentioned target similarity can measure the similarity between two vectors. Generally, the greater the similarity, the higher the similarity, and the higher the correlation between the alternative attack step entity and the similar attack step entity. The similarity calculation method may include but is not limited to cosine similarity calculation, Jaccard similarity coefficient calculation, and the like.

[0073] After obtaining the target similarity corresponding to each of the attack step entity vectors corresponding to each attack step entity in the attack and defense knowledge graph, the attack step entities can be sorted according to the size of the target similarity. Then, the attack step entities whose target similarity ranks within the target value can be determined as similar attack step entities. For example, if the target value is set to 3, the attack step entities whose target similarity ranks in the top 3 can be determined as similar attack step entities. It is also possible to set a similarity threshold (for example, but not limited to 0.8) and determine the attack step entities whose target similarity exceeds the similarity threshold as similar attack step entities. By using similarity calculation to query similar attack step entities, similar attack step entities that are close or related to the semantic information of the alternative attack step entities can be screened out, providing professional domain knowledge support for the target large model to determine the attack step entities in the log to be detected.

[0074] Please continue to refer to Figure 2 ,like Figure 2 As shown, in the above S203, after querying the attack and defense knowledge graph according to the candidate attack step entity to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set, the attack behavior detection method may further include:

[0075] S204, input the log to be detected, similar attack step entity sets and other related entity sets into the target large model to detect attack behaviors, and output the detection results corresponding to the log to be detected.

[0076] Specifically, the above-mentioned similar attack step entity set includes at least one similar attack step entity. In order to determine whether there is an attack behavior in the log to be detected, the log to be detected, the similar attack step entity set and other related entity sets corresponding to the similar attack step entity set can be input into the target large model for attack behavior detection, and the detection result corresponding to the log to be detected is output. The above-mentioned detection result is used to indicate whether there is an attack behavior in the log to be detected. Compared with the alternative attack step entity, the corresponding similar attack step entity not only has the same / similar semantics as the alternative attack step entity, but also has a more professional domain knowledge expression. Therefore, inputting the similar attack step entity corresponding to the log to be detected and the alternative attack step entity into the target large model for attack behavior detection is conducive to the target large model to make an accurate judgment. At the same time, other related entity sets corresponding to the similar attack step entity are also input into the target large model, which can assist the target large model in making a judgment, thereby more accurately determining whether there is an attack behavior in the log to be detected.

[0077] Optionally, the log to be detected, similar attack step entity sets and other related entity sets can be input into the target large model. The target large model analyzes the context information of the log to be detected to understand the overall structure and complete semantics of the log to be detected. Then, other related entity sets corresponding to similar attack step entities can be used to search the log to be detected for related attack step entity information, and confirm whether the above attack step entity information is semantically consistent with the similar attack step entity, thereby realizing the process of determining whether the similar attack step entity belongs to the log to be detected. If the similar attack step entity belongs to the log to be detected, it is determined that the attack behavior corresponding to the above similar attack step entity exists in the log to be detected; if the similar attack step entity does not belong to the log to be detected, it can be determined that the attack behavior corresponding to the above similar attack step entity does not exist in the log to be detected.

[0078] In the embodiment of the present application, firstly, since the target large model has a strong generalization ability, the alternative attack step entities are obtained according to the target large model, which can reduce the omission problem caused by the failure to identify the attack step entities; then, similar attack step entity sets and other related entity sets corresponding to similar attack step entity sets are queried in the attack and defense knowledge graph. This method of obtaining similar attack step entity sets in combination with the attack and defense knowledge graph reduces the omissions and false positives caused by model hallucinations compared with the method of directly using the large language model; finally, the target large model is used to determine whether there is an attack behavior in the log to be detected based on the log to be detected, similar attack step entity sets and other related entity sets. This detection method using the target large model combined with the attack and defense knowledge graph can reduce the dependence of the attack behavior detection process on people and improve the efficiency of attack behavior detection. It can ensure that the attack steps in the log to be detected can be completely detected, thereby improving the accuracy of attack behavior detection.

[0079] Please refer to the following Figure 3 , which exemplarily shows a schematic diagram of the implementation process of a method for constructing an attack and defense knowledge graph provided in an embodiment of the present application. Figure 3 As shown, the attack and defense knowledge graph construction method may include the following steps:

[0080] S301, obtaining a historical attack activity report.

[0081] Specifically, it is possible but not limited to collect open source or closed source historical attack activity reports from the network, or collect historical attack activity reports generated by local device software or systems. The above historical attack activity report includes at least one historical attack behavior and the description information corresponding to the above historical attack behavior. The above historical attack activity report may include but is not limited to attack activity analysis report, attack activity detection rule report, attack means log, etc. The above attack activity analysis report may include but is not limited to advanced persistent threat (Advanced Persistent Threat, APT) analysis report, penetration test report, malware analysis report, etc. The content of the above attack activity analysis report includes a detailed description of the implementation process of each attack step in the attack activity, and may also include log features, detection rules, or detection intrusion indicators, etc. The content of the above attack means log is generally a description of the attack steps and the corresponding log feature description, or a specific log example. The above log features are features reflected by the attack steps, such as but not limited to the request type being the POST type, the target path containing / console, / ws, etc., and JSON data appearing in the request. The content of the above attack activity detection rule report is generally a description of the attack steps and the corresponding detection rules. The above detection rules can be expressed as regular expressions. For example, the detection rule corresponding to the CVE-2019-2618 attack behavior is "POST\s+\ / (?:console|ws|vulnerable).*HTTP\ / 1\.1". CVE-2019-2618 is an arbitrary file upload vulnerability in Oracle WebLogic server. It allows attackers to upload malicious files to any location on the server by sending carefully constructed HTTP requests, thereby executing remote code.

[0082] For example, Figure 4 The following is a schematic diagram of an attack activity detection rule report provided by an embodiment of the present application. Figure 4In the example, the data source of the attack activity detection rule report comes from the web page of the weblogic server. Among them, the detection rule of a certain attack step is the POST request method, and the Uniform Resource Locator (URL) of the request usually includes strings such as " / console" or " / ws" or " / vulnerable". The above POST request method is an HTTP request method used to submit data to a specified resource and request the server to process it (for example, submit a form or upload a file). The above URL is an address used to identify a resource on the Internet, that is, a web page address or website address. Figure 5 The following is a schematic diagram of an attack method log provided by an embodiment of the present application. Figure 5 , describes the content or feature description that may be contained in the web log when an attacker exploits the CVE-2019-2618 vulnerability to attack. Figure 5 (a) shows the log feature description. When a POST request appears in the log and strings such as " / console" or " / ws" appear in the URL, or JSON data or other attack payloads appear in the request and remote code execution is attempted, it indicates that CVE-2019-2618 attack behavior may exist in the log. Figure 5 (b) shows a specific example of log content. When the log content contains the string "POST / ws HTTP / 1.1" or the string "POST / console HTTP / 1.1", it indicates that CVE-2019-2618 attack behavior exists in the log.

[0083] S302: Input the historical attack activity report into the detection model to perform attack step entity recognition, and obtain the initial attack step entity corresponding to the historical attack behavior.

[0084] Specifically, after obtaining the historical attack activity report, in order to make full use of the information with special significance therein, it can be input into the detection model for attack step entity recognition to obtain the initial attack step entity corresponding to the historical attack behavior. The above-mentioned detection model can be obtained by fine-tuning the pre-trained model based on the sample data of historical attack activity reports with known attack step entity recognition results, or it can be a deep learning entity recognition model trained with sample data of historical attack activity reports with known attack step entity recognition results, which is not limited to the embodiments of the present application. The above-mentioned pre-trained model can be, but is not limited to, BERT, ROBERTa, etc. with a parameter scale of less than 1B. The initial attack step entity extracted by the above-mentioned detection model in conjunction with the original report can reduce the illusion of a large target model in the subsequent process.

[0085] S303, inputting the historical attack activity report, the initial attack step entity and the preset prompt information into the target large model, and outputting the historical attack step entity, the historical attack activity entity, the historical other related entities corresponding to the historical attack behavior in the historical attack activity report, and the relationship between each entity.

[0086] Specifically, after obtaining the initial attack step entity, the historical attack step entity, historical attack activity entity, other historical related entities, and the relationship between each entity can be extracted from the historical attack activity report according to the initial attack step entity and the preset prompt information using the target large model. The above-mentioned historical attack activity entity is an entity composed of multiple historical attack step entities in the order of attack, that is, the historical attack activity entity contains the sequence information between multiple historical attack step entities. The above-mentioned preset prompt information can be an example of the correct historical attack step sequence, or it can be a prompt of task instructions and entity categories, which is not limited in the embodiments of the present application.

[0087] Optionally, the above-mentioned other historical related entities may include but are not limited to at least one of the following: a historical log data source entity, a historical identification rule entity, and a historical log feature entity. The above-mentioned historical identification rule entity is used to characterize the related detection rules identified by the above-mentioned historical attack step entity, and the above-mentioned historical log feature entity is used to characterize the characteristics reflected in the log to which the above-mentioned historical attack step belongs. The above-mentioned historical log data source entity is used to characterize the log source of the above-mentioned historical attack step. When the above-mentioned preset prompt information is a correct attack step example, it is beneficial for the target large model to correctly sort the historical attack step entity, thereby obtaining an accurate historical attack activity entity. Compared with the target large model, the text understanding ability and semantic feature extraction ability of the above-mentioned detection model are relatively insufficient, so the above-mentioned initial attack step entity extracted by the detection model may have certain errors and omissions, so the target large model can be used to correct and supplement the initial attack step entity. First, the historical attack activity report, the initial attack step entity and the above-mentioned correct attack step example are input into the target large model for attack step entity recognition, and the attack step entity recognition result is obtained. The attack step entity recognition result is the historical attack step entity determined after the target large model supplements and corrects the omission. Then, based on the above historical attack step entities and the correct attack step examples, the historical attack activity entities in the historical attack activity report and the usage relationship between the historical attack step entities and the historical attack activity entities are extracted. Then, based on the above historical attack step entities, other entity recognition is performed on the above historical attack activity report to obtain the above historical log data source entity, historical identification rule entity, historical log feature entity, as well as the detection relationship between the above historical attack step entity and the above historical identification rule entity, the embodiment relationship between the above historical attack step entity and the above historical log feature entity, and the output relationship between the above historical log data source entity and the above historical log feature entity.

[0088] S304, constructing an attack and defense knowledge graph corresponding to the historical attack activity report according to the historical attack step entities, historical attack activity entities, other historical related entities, and the relationship between the entities corresponding to the historical attack behaviors.

[0089] Specifically, the attack and defense knowledge graph corresponding to the historical attack activity report can be constructed using a knowledge graph construction tool (such as but not limited to Neo4j, NetworkX) or a graph processing framework (such as but not limited to Apache Jena) based on the historical attack step entities, historical attack activity entities, other historical related entities corresponding to the historical attack behaviors, and the relationships between the entities.

[0090] For example, Figure 6 The following is a schematic diagram of an attack and defense knowledge graph provided by an exemplary embodiment of the present application. Figure 6As shown, the attack and defense knowledge graph corresponding to the historical attack activity report is composed of the historical attack step entity, historical attack activity entity, historical log data source entity, historical identification rule entity, historical log feature entity and the relationship between each entity corresponding to the historical attack activity report; the relationship between the above entities may include but is not limited to the use relationship between the historical attack step entity and the historical attack activity entity, the detection relationship between the historical attack step entity and the historical identification rule entity, the embodiment relationship between the historical attack step entity and the historical log feature entity, and the output relationship between the historical log data source entity and the historical log feature entity.

[0091] In a possible implementation, after obtaining a new historical attack activity report, the above S301-S303 can be executed again to obtain all entities and entity relationships in the new historical attack activity report. Then, entity disambiguation technology can be used to identify and distinguish multiple entities with the same name or expression in different historical attack activity reports, which can avoid duplication and omission of entities. Then, all entities and relationships in the new historical attack activity report can be integrated into the original attack and defense knowledge graph through entity alignment technology to resolve conflicts and inconsistencies between data, and build a more complete, accurate, dynamic and scalable attack and defense knowledge graph to provide a solid domain knowledge foundation for attack behavior detection.

[0092] In an embodiment of the present application, all entities in historical attack activity reports are identified and the relationships between entities are extracted by combining a target large model with a detection model, and then an attack and defense knowledge graph is constructed. This is beneficial to reducing the illusion of the target large model, improving the accuracy of entity recognition and relationship extraction, and establishing a more complete and accurate attack and defense knowledge graph.

[0093] Please refer to the following Figure 7 , which exemplarily shows a flow chart of another attack behavior detection method provided in an embodiment of the present application. Figure 7 As shown, the attack behavior detection method may include the following steps:

[0094] S701, obtain the log to be detected.

[0095] Specifically, S701 is consistent with S201 and will not be repeated here.

[0096] S702, input the log to be detected into the target large model to perform attack step entity recognition, and output candidate attack step entities.

[0097] Specifically, S702 is consistent with S202 and will not be repeated here.

[0098] S703, query the attack and defense knowledge graph according to the alternative attack step entities, obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set, the similar attack step entity set includes at least one similar attack step entity and the previous and next attack step entities corresponding to the similar attack step entity, and the other related entity sets include at least one first other related entity corresponding to the similar attack step entity and at least one second other related entity corresponding to the previous and next attack step entities.

[0099] Specifically, the above-mentioned attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of the multiple historical attack behaviors, the historical other related entities corresponding to the historical attack step entities, and the relationship between the entities. The above-mentioned second other related entities include at least one of the following: a second identification rule entity, a second log feature entity. The above-mentioned second identification rule entity is used to characterize the related detection rules for the identified previous and next attack steps corresponding to the above-mentioned previous and next attack step entities, and the above-mentioned second log feature entity is used to characterize the characteristics reflected in the logs to which the above-mentioned previous and next attack steps belong. The above-mentioned second log data source entity is used to characterize the source of the log to which the above-mentioned previous and next attack steps belong. The description of other parts is consistent with S203 and will not be repeated here.

[0100] S704, input the log to be detected, similar attack step entity sets and other related entity sets into the target large model to perform attack behavior detection, and output the detection result corresponding to the log to be detected.

[0101] Specifically, S704 is consistent with S204 and will not be described in detail here.

[0102] S705: If the detection result indicates that there is no attack behavior in the log to be detected, the log to be detected is determined to be a normal log.

[0103] Specifically, if the detection result is that the log to be detected does not have the above similar attack step entity, it means that the log to be detected does not have the attack behavior corresponding to the above similar attack step entity, and it is determined that the log to be detected is a normal log.

[0104] S706, if the detection result indicates that there is an attack behavior in the log to be detected, based on the previous and next attack step entities and the second other related entity, a query is performed in other logs to obtain a query result, and the query result is used to indicate whether there is a previous and next attack step entity in other logs.

[0105] Specifically, when an attack activity occurs, the attacker will perform a series of behaviors or operations, and these operations will be recorded by the log system in chronological order. Therefore, different attack steps corresponding to the same attack activity may appear in different logs, and they can be sorted in the order of attack. The log generation frequency usually depends on multiple factors, including but not limited to the security requirements of the system, the importance of the log, the availability of system resources, and the convenience of log storage and management. The log generation frequency can be one hour, one day, or one week or longer, depending on the complexity and security requirements of the system or device generating the log, which is not limited in the embodiment of the present application. If the detection result is that the log to be detected has the above-mentioned similar attack step entity, it means that the attack behavior corresponding to the above-mentioned similar attack step entity exists in the log to be detected. In order to further verify the existence of the attack behavior, and determine its severity and attack scope, it can be based on the previous and next attack step entities corresponding to the similar attack step entity, and the second other related entity corresponding to the previous and next attack step entity. In other logs, it is queried whether there is a previous and next attack step entity. The above-mentioned other logs include all other logs except the log to be detected generated by the log data source corresponding to the log to be detected within a specific time period. The above-mentioned log to be detected and other logs are all logs generated by a certain device firewall within a certain time period. The above data source may be, but is not limited to, a device, software or system that can generate a security log.

[0106] Optionally, when the query method is to use the target large model for query, the previous and next attack step entities, the second other related entities and other logs can be input into the target large model for query analysis. Since the target large model has a strong semantic understanding ability and can more accurately capture the key information in the text, using the target large model for query can reduce misjudgment and misidentification to a certain extent. At the same time, inputting the second other related entities into the target large model can assist the target large model in searching, thereby determining the query results faster and more accurately.

[0107] S707: If the query result indicates that there are previous and subsequent attack step entities in other logs, then the attack behavior corresponding to the similar attack step entity in the log to be detected is determined to be a high-confidence attack behavior.

[0108] Specifically, after obtaining the above query results, if the query results indicate that there are previous and next attack step entities in other logs, it means that in addition to the similar attack step entities in the current log to be detected, there are also previous and next attack step entities corresponding to the similar attack step entities in other logs with the same source as the log to be detected, and they form a continuous attack behavior. Therefore, it can be determined that the attack behavior corresponding to the similar attack step entity in the log to be detected is a high-confidence attack behavior, and the operation and maintenance personnel can give priority to high-confidence attack behaviors to prevent greater impact or losses.

[0109] S708: If the query result indicates that the previous and next attack step entities do not exist in other logs, it is determined that the attack behavior corresponding to the similar attack step entity in the log to be detected is a generally trusted attack behavior.

[0110] Specifically, if the query result indicates that there are no previous and next attack step entities in other logs, it only means that there are similar attack step entities only in the current log to be detected, and there are no previous and next attack step entities, so that a complete attack activity has not been formed. Therefore, it can be determined that the attack behavior corresponding to the similar attack step entity in the log to be detected is a general confidence attack behavior. The processing priority of the above-mentioned general confidence attack behavior is lower than that of the high confidence attack behavior, and the operation and maintenance personnel will determine the processing order according to the confidence priority. By querying in other logs whether there are previous and next attack step entities corresponding to the current similar attack step entity, the confidence of the attack behavior corresponding to the current similar attack step entity in the log to be detected can be determined. This method can discover attack behaviors from the overall attack activity (including multiple attack means and steps), does not rely entirely on a single log, and also reduces false alarms to a certain extent.

[0111] Please refer to the following Figure 8 , which exemplarily shows a schematic diagram of the implementation process of an attack behavior detection method provided in an embodiment of the present application. Figure 8As shown, after obtaining the log to be detected, the target large model is first used to identify the alternative attack step entities in the log to be detected. Then, according to the alternative attack entity, the attack and defense knowledge graph is queried to obtain a similar attack step set and other related entity sets. The above-mentioned similar attack step set includes the similar attack step entity corresponding to the alternative attack alternative attack entity entity and the previous and next attack step entities corresponding to the similar attack step entity. The above-mentioned other related entity sets include the first identification rule entity and the first log feature entity corresponding to the similar attack step entity, and the second identification rule entity and the second log feature entity corresponding to the previous and next attack step entities. Then, the target large model is used to determine whether the above-mentioned similar attack step entity exists in the log to be detected. If not, it is determined that no attack behavior is found in the log to be detected; if so, it is queried in other logs whether there are previous and next attack step entities corresponding to the similar attack step entity. If not, it is determined that a general confidence attack behavior is found in the log to be detected; if so, it is determined that a high confidence attack behavior is found in the log to be detected.

[0112] Please refer to the following Fig. 9 , which exemplarily shows a schematic diagram of the implementation process of a method for constructing an attack and defense knowledge graph provided in an embodiment of the present application. Fig. 9 As shown, first collect historical attack activity reports, then use the detection model to identify the attack step entities of the historical attack activity reports to obtain the initial attack step entities. Then, based on the initial attack step entities, use the target large model to identify and extract the attack activity entities (historical attack activity entities), attack step entities (historical attack step entities), and the relationships (usage relationships) in the historical attack activity reports. Next, based on the historical attack activity reports and the attack step entities (historical attack step entities), use the target large model to extract other entities (historical log data source entities, historical identification rule entities, historical log feature entities) and other entity relationships in the historical attack activity reports, and finally output all entities (historical attack step entities, historical attack activity entities, historical log data source entities, historical identification rule entities, historical log feature entities) and all relationships in the historical attack activity reports. Finally, construct the attack and defense knowledge graph corresponding to the historical attack activity reports based on all the entities and entity relationships obtained.

[0113] Please refer to the following Fig.10 , which exemplarily shows a structural diagram of an attack behavior detection device provided in an embodiment of the present application. Fig.10 As shown, the attack behavior detection device 1000 may include:

[0114] The first acquisition module 1010 is used to acquire the log to be detected;

[0115] Identification module 1020, used for inputting the above-mentioned log to be detected into the target large model to perform attack step entity identification, and outputting candidate attack step entities;

[0116] The first query module 1030 is used to query the attack and defense knowledge graph according to the above-mentioned alternative attack step entity to obtain a similar attack step entity set and other related entity sets corresponding to the above-mentioned similar attack step entity set; the above-mentioned attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of the multiple historical attack behaviors, the historical other related entities corresponding to the above-mentioned historical attack step entities, and the relationship between the entities;

[0117] The detection module 1040 is used to input the above-mentioned log to be detected, the above-mentioned similar attack step entity set and the above-mentioned other related entity sets into the above-mentioned target large model to detect attack behavior, and output the detection result corresponding to the above-mentioned log to be detected; the above-mentioned detection result is used to indicate whether there is attack behavior in the above-mentioned log to be detected.

[0118] In some possible embodiments, the attack behavior detection device 1000 further includes:

[0119] A second query module is used for querying other logs based on the previous and next attack step entities and the second other related entity to obtain a query result if the detection result indicates that there is an attack behavior in the log to be detected; the query result is used to indicate whether the previous and next attack step entities exist in the other logs;

[0120] A first determination module is used to determine that the attack behavior corresponding to the similar attack step entity in the log to be detected is a high-confidence attack behavior if the query result indicates that the previous and next attack step entities exist in the other logs;

[0121] The second determination module is used to determine that the attack behavior corresponding to the similar attack step entity in the above-mentioned log to be detected is a general confidence attack behavior if the above-mentioned query result indicates that the above-mentioned previous and next attack step entities do not exist in the above-mentioned other logs; the processing priority of the above-mentioned high confidence attack behavior is higher than the above-mentioned general confidence attack behavior.

[0122] In some possible embodiments, the second query module is specifically used to: input the previous and next attack step entities, the second other related entities and other logs into the target big model for query analysis, and output the query results.

[0123] In some possible embodiments, the first query module 1030 is specifically used to: vectorize the candidate attack step entities to obtain candidate attack step entity vectors; calculate the target similarity between the candidate attack step entity vectors and the attack step entity vectors corresponding to each attack step entity in the attack and defense knowledge graph; determine a similar attack step entity set based on the target similarity corresponding to each attack step entity in the attack and defense knowledge graph; the similar attack step entity set includes attack step entities whose target similarity ranking is within a target value and / or attack step entities whose target similarity exceeds a similarity threshold; based on the similar attack step entity set, query the attack and defense knowledge graph to obtain other related entity sets corresponding to the similar attack step entity set.

[0124] In some possible embodiments, the detection module 1040 is specifically used to: input the log to be detected, the similar attack step entity and the other related entity set into the target big model, and determine whether the similar attack step entity belongs to the log to be detected based on the log to be detected and the other related entity set; if the similar attack step entity belongs to the log to be detected, it is determined that there is an attack behavior in the log to be detected; if the similar attack step entity does not belong to the log to be detected, it is determined that there is no attack behavior in the log to be detected.

[0125] In some possible embodiments, the attack behavior detection device 1000 further includes:

[0126] A second acquisition module is used to acquire a historical attack activity report; the historical attack activity report includes at least one historical attack behavior and description information corresponding to the historical attack behavior;

[0127] The recognition module is used to input the above historical attack activity report into the detection model to perform attack step entity recognition, and obtain the initial attack step entity corresponding to the above historical attack behavior; the above detection model is obtained by fine-tuning the pre-trained model based on the sample data of the historical attack activity report with known attack step entity recognition results;

[0128] An extraction module is used to input the above historical attack activity report, the above initial attack step entity and the preset prompt information into the above target large model, and output the historical attack step entity, the historical attack activity entity, the historical other related entities corresponding to the above historical attack behavior in the above historical attack activity report, and the relationship between the entities; the above historical attack activity entity is an entity composed of multiple historical attack step entities in the order of attack;

[0129] A construction module is used to construct an attack and defense knowledge graph corresponding to the above-mentioned historical attack activity report based on the above-mentioned historical attack step entities, the above-mentioned historical attack activity entities, the above-mentioned other historical related entities corresponding to the above-mentioned historical attack behaviors, and the relationship between the above-mentioned entities.

[0130] In some possible embodiments, the extraction module is specifically used to: input the historical attack activity report, the initial attack step entity and the correct attack step example into the target big model for attack step entity recognition, extract the historical attack step entity, the historical attack activity entity, and the usage relationship between the historical attack step entity and the historical attack activity entity based on the attack step entity recognition result, and perform other entity recognition on the historical attack activity report based on the attack step entity recognition result to obtain the historical log data source entity, the historical identification rule entity, the historical log feature entity, and the detection relationship between the historical attack step entity and the historical identification rule entity, the embodiment relationship between the historical attack step entity and the historical log feature entity, and the output relationship between the historical log data source entity and the historical log feature entity.

[0131] The division of the modules in the above-mentioned attack behavior detection device is only for illustration. In other embodiments, the attack behavior detection device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned attack behavior detection device. The implementation of each module in the attack behavior detection device provided in the embodiment of this specification can be in the form of a computer program. The computer program can be run on a terminal or a terminal or a server. The program modules constituted by the computer program can be stored in the memory of the terminal or the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the attack behavior detection method described in the embodiment of this specification are implemented.

[0132] See next Fig.11 , which is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of this specification. Fig.11 As shown, the electronic device 1100 may include: at least one processor 1110 , at least one communication bus 1120 , a user interface 1130 , at least one network interface 1140 , and a memory 1150 .

[0133] The communication bus 1120 may be used to realize the connection and communication among the above-mentioned components.

[0134] The user interface 1130 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0135] The network interface 1140 may optionally include a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0136] Among them, the processor 1110 may include one or more processing cores. The processor 1110 uses various interfaces and lines to connect the various parts of the entire electronic device 1100, and executes various functions and processes data of the electronic device 1100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1150, and calling data stored in the memory 1150. Optionally, the processor 1110 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 1110 can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to handle wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 1110, but may be implemented separately through a chip.

[0137] The memory 1150 may include a RAM or a ROM. Optionally, the memory 1150 includes a non-transitory computer-readable medium. The memory 1150 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 1150 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as obtaining a log to be detected, identifying an attack step entity, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1150 may optionally be at least one storage device located away from the aforementioned processor 1110. As Fig.11 As shown, the memory 1150 as a computer storage medium may include an operating system, a network communication module, a user interface module, and program instructions.

[0138] In some possible embodiments, the electronic device 1100 may be the aforementioned Fig.10In the attack behavior detection device 1000 shown, the processor 1110 can be used to call the program instructions stored in the memory 1150, and specifically perform the following operations: obtain the log to be detected; input the above-mentioned log to be detected into the target large model to perform attack step entity recognition, and output the alternative attack step entity; according to the above-mentioned alternative attack step entity, query the attack and defense knowledge graph to obtain a similar attack step entity set and other related entity sets corresponding to the above-mentioned similar attack step entity set; the above-mentioned attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of multiple historical attack behaviors, the historical other related entities corresponding to the above-mentioned historical attack step entities, and the relationship between each entity; input the above-mentioned log to be detected, the above-mentioned similar attack step entity set and the above-mentioned other related entity set into the above-mentioned target large model to perform attack behavior detection, and output the detection result corresponding to the above-mentioned log to be detected; the above-mentioned detection result is used to indicate whether there is an attack behavior in the above-mentioned log to be detected.

[0139] In some possible embodiments, the above-mentioned similar attack step entity set includes at least one similar attack step entity and the previous and next attack step entities corresponding to each of the above-mentioned similar attack step entities; the above-mentioned other related entity set includes at least one first other related entity corresponding to the above-mentioned similar attack step entity and at least one second other related entity corresponding to the above-mentioned previous and next attack step entities; the above-mentioned processor 1110 executes the above-mentioned input of the above-mentioned log to be detected, the above-mentioned similar attack step entity set and the above-mentioned other related entity set into the above-mentioned target large model for attack behavior detection, and outputs the detection result corresponding to the above-mentioned log to be detected, and is also used to execute: if the above-mentioned detection result indicates that there is an attack behavior in the above-mentioned log to be detected, then based on The above-mentioned front and back attack step entities and the above-mentioned second other related entities are queried in other logs to obtain query results; the above-mentioned query results are used to indicate whether the above-mentioned front and back attack step entities exist in the above-mentioned other logs; if the above-mentioned query results indicate that the above-mentioned front and back attack step entities exist in the above-mentioned other logs, it is determined that the attack behavior corresponding to the above-mentioned similar attack step entities in the above-mentioned log to be detected is a high-confidence attack behavior; if the above-mentioned query results indicate that the above-mentioned front and back attack step entities do not exist in the above-mentioned other logs, it is determined that the attack behavior corresponding to the above-mentioned similar attack step entities in the above-mentioned log to be detected is a general-confidence attack behavior; the processing priority of the above-mentioned high-confidence attack behavior is higher than the above-mentioned general-confidence attack behavior.

[0140] In some possible embodiments, the processor 1110 executes the query in other logs based on the previous and next attack step entities and the second other related entity, and when the query result is obtained, it is specifically used to execute: input the previous and next attack step entities, the second other related entity and other logs into the target big model for query analysis, and output the query result.

[0141] In some possible embodiments, when the processor 1110 executes the query of the attack and defense knowledge graph according to the alternative attack step entities to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set, it is specifically used to execute: vectorizing the alternative attack step entities to obtain alternative attack step entity vectors; calculating the target similarity between the alternative attack step entity vectors and the attack step entity vectors corresponding to each attack step entity in the attack and defense knowledge graph; determining a similar attack step entity set according to the target similarity corresponding to each attack step entity in the attack and defense knowledge graph; the similar attack step entity set is the attack step entities whose target similarity ranking is within the target value and / or the attack step entities whose target similarity exceeds the similarity threshold; querying the attack and defense knowledge graph according to the similar attack step entity set to obtain other related entity sets corresponding to the similar attack step entity set.

[0142] In some possible embodiments, when the processor 1110 executes the above-mentioned inputting of the log to be detected, the similar attack step entity and the other related entity set into the target big model for attack behavior detection and outputs the detection result corresponding to the log to be detected, it is specifically used to execute: inputting the log to be detected, the similar attack step entity and the other related entity set into the target big model, and judging whether the similar attack step entity belongs to the log to be detected based on the log to be detected and the other related entity set; if the similar attack step entity belongs to the log to be detected, it is determined that there is an attack behavior in the log to be detected; if the similar attack step entity does not belong to the log to be detected, it is determined that there is no attack behavior in the log to be detected.

[0143] In some possible embodiments, before the processor 1110 executes the query of the attack and defense knowledge graph according to the alternative attack step entity to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set, it is also used to execute: obtaining a historical attack activity report; the historical attack activity report includes at least one historical attack behavior and description information corresponding to the historical attack behavior; inputting the historical attack activity report into the detection model to perform attack step entity recognition to obtain an initial attack step entity corresponding to the historical attack behavior; the detection model is obtained by fine-tuning the pre-trained model based on the sample data of the historical attack activity report based on the known attack step entity recognition result; inputting the historical attack activity report, the initial attack step entity and the preset prompt information into the target large model, and outputting the historical attack step entity, the historical attack activity entity, the historical other related entities, and the relationship between the entities corresponding to the historical attack behavior in the historical attack activity report; the historical attack activity entity is an entity composed of multiple historical attack step entities in the order of attack; and constructing the attack and defense knowledge graph corresponding to the historical attack activity report according to the historical attack step entity, the historical attack activity entity, the historical other related entities, and the relationship between the entities corresponding to the historical attack behavior.

[0144] In some possible embodiments, the preset prompt information includes a correct attack step example; the other historical related entities include a historical log data source entity, a historical identification rule entity, and a historical log feature entity; when the processor 1110 executes the above-mentioned inputting the above-mentioned historical attack activity report, the above-mentioned initial attack step entity and the preset prompt information into the above-mentioned target big model, and outputting the historical attack step entity, the historical attack activity entity, the historical other related entities corresponding to the historical attack behavior in the above-mentioned historical attack activity report, and the relationship between the entities, it is specifically used to execute: inputting the above-mentioned historical attack activity report, the above-mentioned initial attack step entity and the above-mentioned correct attack step example into the target big model Perform attack step entity recognition, extract the above-mentioned historical attack step entity, historical attack activity entity, and the usage relationship between the above-mentioned historical attack step entity and the above-mentioned historical attack activity entity based on the attack step entity recognition result, and perform other entity recognition on the above-mentioned historical attack activity report based on the above-mentioned attack step entity recognition result to obtain the above-mentioned historical log data source entity, historical identification rule entity, historical log feature entity, as well as the detection relationship between the above-mentioned historical attack step entity and the above-mentioned historical identification rule entity, the embodiment relationship between the above-mentioned historical attack step entity and the above-mentioned historical log feature entity, and the output relationship between the above-mentioned historical log data source entity and the above-mentioned historical log feature entity.

[0145] The embodiment of the present application also provides a computer storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in any of the above methods. If the components of the above attack behavior detection device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above storage medium.

[0146] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of the present application is generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted by the above computer-readable storage medium. The above computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The above available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)), etc.

[0147] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0148] The above-mentioned embodiments are merely preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should fall within the protection scope determined by the claims of the present application.

Claims

1. A method for detecting attack behavior, characterized in that: include: Get the log to be tested; Input the log to be detected into the target large model to perform attack step entity recognition, and output candidate attack step entities; According to the candidate attack step entity, query the attack and defense knowledge graph to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set; the attack and defense knowledge graph is constructed based on the historical attack step entities corresponding to each of the multiple historical attack behaviors, the historical other related entities corresponding to the historical attack step entities, and the relationship between the entities; The log to be detected, the similar attack step entity set and the other related entity sets are input into the target large model to detect attack behavior, and the detection result corresponding to the log to be detected is output; the detection result is used to indicate whether there is attack behavior in the log to be detected.

2. The method according to claim 1, characterized in that The similar attack step entity set includes at least one similar attack step entity and the previous and next attack step entities corresponding to each of the similar attack step entities; the other related entity set includes at least one first other related entity corresponding to the similar attack step entity and at least one second other related entity corresponding to the previous and next attack step entities; After inputting the log to be detected, the similar attack step entity set and the other related entity sets into the target large model to detect attack behaviors and outputting the detection result corresponding to the log to be detected, the method further includes: If the detection result indicates that there is an attack behavior in the log to be detected, then based on the previous and next attack step entities and the second other related entity, a query is performed in other logs to obtain a query result; the query result is used to indicate whether the previous and next attack step entities exist in the other logs; If the query result indicates that the previous and next attack step entities exist in the other logs, determining that the attack behavior corresponding to the similar attack step entity in the log to be detected is a high-confidence attack behavior; If the query result indicates that the previous and next attack step entities do not exist in the other logs, it is determined that the attack behavior corresponding to the similar attack step entity in the log to be detected is a general confidence attack behavior; the processing priority of the high confidence attack behavior is higher than the general confidence attack behavior.

3. The method according to claim 2, characterized in that The querying in other logs based on the previous and next attack step entities and the second other related entity to obtain the query result includes: The preceding and following attack step entities, the second other related entities and other logs are input into the target big model for query analysis, and the query results are output.

4. The method according to claim 1, characterized in that The method of querying the attack and defense knowledge graph according to the candidate attack step entity to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set includes: Vectorizing the candidate attack step entity to obtain a candidate attack step entity vector; Calculating the target similarity between the candidate attack step entity vector and the attack step entity vector corresponding to each attack step entity in the attack and defense knowledge graph; Determine a similar attack step entity set according to the target similarity corresponding to each attack step entity in the attack and defense knowledge graph; the similar attack step entity set is the attack step entity whose target similarity ranking is within the target value and / or the attack step entity whose target similarity exceeds a similarity threshold; According to the similar attack step entity set, the attack and defense knowledge graph is queried to obtain other related entity sets corresponding to the similar attack step entity set.

5. The method according to claim 1, characterized in that The step of inputting the log to be detected, the similar attack step entity and the other related entity set into the target large model to perform attack behavior detection, and outputting the detection result corresponding to the log to be detected includes: Inputting the log to be detected, the similar attack step entity and the other related entity set into the target big model, and judging whether the similar attack step entity belongs to the log to be detected based on the log to be detected and the other related entity set; If the similar attack step entity belongs to the log to be detected, it is determined that there is an attack behavior in the log to be detected; If the similar attack step entity does not belong to the log to be detected, it is determined that there is no attack behavior in the log to be detected.

6. The method according to claim 1, characterized in that Before querying the attack and defense knowledge graph according to the candidate attack step entity to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set, the method further includes: Obtaining a historical attack activity report; the historical attack activity report includes at least one historical attack behavior and description information corresponding to the historical attack behavior; The historical attack activity report is input into the detection model for attack step entity recognition to obtain the initial attack step entity corresponding to the historical attack behavior; the detection model is obtained by fine-tuning the pre-trained model based on the historical attack activity report sample data with known attack step entity recognition results; Input the historical attack activity report, the initial attack step entity and the preset prompt information into the target big model, and output the historical attack step entity, the historical attack activity entity, other historical related entities corresponding to the historical attack behavior in the historical attack activity report, and the relationship between the entities; the historical attack activity entity is an entity composed of multiple historical attack step entities in the order of attack; According to the historical attack step entities, the historical attack activity entities, the other historical related entities corresponding to the historical attack behaviors, and the relationships between the entities, an attack and defense knowledge graph corresponding to the historical attack activity report is constructed.

7. The method according to claim 6, characterized in that The preset prompt information includes examples of correct attack steps; the other historical related entities include historical log data source entities, historical identification rule entities, and historical log feature entities; The historical attack activity report, the initial attack step entity and the preset prompt information are input into the target big model, and the historical attack step entity, the historical attack activity entity, the historical other related entities corresponding to the historical attack behavior in the historical attack activity report, and the relationship between the entities are output, including: The historical attack activity report, the initial attack step entity and the correct attack step example are input into the target big model for attack step entity recognition. Based on the attack step entity recognition result, the historical attack step entity, the historical attack activity entity and the usage relationship between the historical attack step entity and the historical attack activity entity are extracted. Based on the attack step entity recognition result, other entity recognitions are performed on the historical attack activity report to obtain the historical log data source entity, the historical identification rule entity, the historical log feature entity, the detection relationship between the historical attack step entity and the historical identification rule entity, the embodiment relationship between the historical attack step entity and the historical log feature entity, and the output relationship between the historical log data source entity and the historical log feature entity.

8. An attack behavior detection device, characterized in that: include: The first acquisition module is used to acquire the log to be detected; An identification module, used for inputting the log to be detected into the target large model to perform attack step entity identification and output candidate attack step entities; A first query module is used to query the attack and defense knowledge graph according to the candidate attack step entity to obtain a similar attack step entity set and other related entity sets corresponding to the similar attack step entity set; the attack and defense knowledge graph is constructed based on historical attack step entities corresponding to each of a plurality of historical attack behaviors, other historical related entities corresponding to the historical attack step entities, and the relationship between the entities; The detection module is used to input the log to be detected, the similar attack step entity set and the other related entity sets into the target large model to detect attack behavior, and output the detection result corresponding to the log to be detected; the detection result is used to indicate whether there is attack behavior in the log to be detected.

9. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores an executable program code, and the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1-7.

Images